Staying Connected

After you pair, the phone never asks you to type an address. It knows the routes captured when you scanned the QR code and can rediscover that same Mac nearby if its LAN address changes. It quietly tries the available paths until one answers. This chapter explains that process, why away-from-home access sometimes needs a little help, and how to read the connection status at a glance.

The Mac-backed connection is anchored to its control server. If that server is switched off, or the Mac is asleep or off the network, there is no live Mac endpoint for the app to reach; the bounded offline features are covered in Using the App. For pairing itself, see Chapter 2; for the desktop side of the control server, see the desktop manual.

4.1The three paths home

When you paired, the QR code carried more than a token: it carried a small list of addresses at which your Mac can be found — its address on your home or office network, its Tailscale address, and the address of any Cloudflare tunnel the Mac has enabled. The app keeps that list and, every time it needs to talk to the Mac, walks it in a fixed order:

1. Your home or office network first. If the phone and the Mac are on the same Wi-Fi (or wired LAN), the app connects directly — the fastest, lowest-latency path, with nothing in between.
2. Tailscale next. If a direct connection doesn't answer, the app tries the Mac's Tailscale address. This works wherever you are, as long as your phone and Mac are members of the same tailnet.
3. A Cloudflare tunnel last. If neither of those works, the app falls back to a Cloudflare tunnel — but only if the Mac has one enabled. This reaches your Mac from anywhere without any network of your own.

The app remembers which path last worked and tries that one first next time, so reconnecting on a familiar network is near-instant. You never choose the path by hand; you simply open the app and it lands on whichever route is live.

If the saved LAN address no longer answers, the phone also browses for FrontierStack over Bonjour. A discovered address is only a hint: the phone accepts it only after the Mac presents the exact certificate fingerprint saved during pairing, then remembers the fresh address. Two FrontierStack Macs on the same LAN cannot be confused because each phone matches the full fingerprint, not the Mac's display name.

4.2When you're on the same Wi-Fi

At home or in the office — phone and Mac on the same network — the app takes the direct path. This is the best case: everything is reachable and fast. Service status, start and stop, alerts, the AI, device web UIs and LAN shares all behave as if the phone were sitting next to the Mac, because in network terms it is.

The Mac advertises its pinned HTTPS control service over Bonjour. If DHCP, a Wi-Fi move or a network change gives it a new address, the phone can find it again without re-pairing. The app verifies the Mac's identity using the certificate fingerprint it captured at pairing, so even a self-signed certificate can't be impersonated on your own network.

Several phones can use the same Mac on one LAN at the same time. Each phone has its own signing key, permission level and request session, so one does not replace another. Several FrontierStack Macs can also advertise at once: the phone filters Bonjour results by the full fingerprint from its own pairing and verifies the pinned certificate again before sending a signed request.

4.3When you're away from home

The moment you leave your network, the direct path stops answering and the app moves on to the other two. Away access comes down to a simple question: can your phone reach your Mac at all right now?

• Tailscale answers yes whenever your phone and Mac share a tailnet. It is the most reliable away path: it works on cellular, on hotel and café Wi-Fi, behind almost any router, with no ports to open.
• A Cloudflare tunnel answers yes whenever the Mac has one running. It needs nothing on the phone and reaches from anywhere, but it depends entirely on the Mac keeping that tunnel up.

If neither is available — no shared tailnet, no tunnel — the app simply can't see your Mac from outside, and the status dot goes to offline. That is expected behaviour, not a fault: a Mac on a private home network is, by design, not reachable from the open internet.

4.4Device web UIs and LAN shares

Reaching your Mac is only half the story. The Web UIs page (under More) opens the web interfaces of other things on your network — routers, NAS boxes, printers, dashboards — and Shared (under More) can open LAN shares your Mac has temporarily exposed. These live on the network itself, not on your Mac, so the app reaching your Mac does not guarantee it can reach them.

A device web UI or a LAN share is reachable only when your phone can actually get onto that network:

• On the same Wi-Fi — everything on the LAN is directly reachable.
• Over Tailscale — reachable if your tailnet routes to that network, for example through a subnet router advertising the LAN's range. Without that, Tailscale gets you to the Mac but not to the printer beside it.

This is the practical reason the TIP above recommends a subnet router or a Tailscale-connected router: it turns "I can reach my Mac" into "I can reach my whole network," which is what makes the Web UIs and Shared screens useful from the road.

4.5Connection status

The coloured dot at the top of Operations is the app's honest summary of whether it can talk to your Mac right now. Fleet shows a separate offline banner whenever it is displaying the last signed inventory. The connection has three states:

To force a fresh attempt, pull down to refresh on Fleet or Operations. The state returns to connecting while the app re-walks the path list, then settles on connected or offline. For route-by-route evidence, open More → Settings → Connection and tap Check all routes; it shows LAN, Tailscale and other saved routes, their result and latency. The compact Phone & Fleet row on Fleet opens the site view without consuming the rest of the screen.

4.6What has to be true

None of the three paths can conjure a connection that isn't there. For the app to reach your Mac, all of the following must hold:

• The Mac's control server is enabled. This is the service the phone talks to. If it's switched off on the Mac, every path fails and the dot stays offline.
• The Mac is online and reachable. It must be awake, on a network, and reachable from where your phone is — same Wi-Fi, shared tailnet, or via its Cloudflare tunnel. A sleeping Mac answers nothing; consider keeping it from sleeping if you rely on remote access.
• You have a working away path, if you're away. Off your home network, that means Tailscale on both ends, or a tunnel the Mac keeps running.

Push notifications follow the same logic from the other direction: the Mac (or its push relay) must be online to send an alert. If alerts go quiet, the cause is usually the same as a missing connection — the Mac is asleep, off, or unreachable. The summary below ties the three locations together.