Remote access in the browser

With remote access, the Build Station runs on one Mac, such as a Mac mini in the office, and you use it from a browser on another computer. You see the same interface as on the Mac: projects, Build tab, queue, history, uploads. Nothing is streamed. The browser loads the interface as a web app and talks to the Station through a protected interface.

Requirements

• a valid license. Remote access is one of the features it unlocks. Without a license, the Station shows the Lizenz anfragen (request license) link, and the switch stays disabled.
• a password with at least ten characters
• a Mac running the Build Station. If you quit the app, remote access is gone too.

Turning it on

Everything you need is under Einstellungen › Fernzugriff (Settings › remote access).

1. Enter a password under Passwort (password) and click Passwort setzen (set password).
2. Switch on Fernzugriff im Browser erlauben (allow remote access in the browser).
3. The section then shows Erreichbar unter … (reachable at …) with the addresses where the Station can be found on the network.

You can change the Port; the default is 8787. Speichern (Save) applies port and certificate.

In the browser, open one of the addresses shown, e.g. http://<Adresse des Macs>:8787, enter the password and click Anmelden (sign in).

HTTPS

Without a certificate, remote access runs over unencrypted HTTP. That’s only acceptable on your own network or behind a reverse proxy with HTTPS.

For direct HTTPS, enter two paths on the Station’s Mac:

• TLS-Zertifikat (PEM, optional) (TLS certificate)
• Privater Schlüssel (PEM, optional) (private key)

Never expose the Station directly to the internet without HTTPS. Password and session would then travel across the network in plain text.

What’s different in the browser

The interface is the same, but a few things naturally work differently in the browser:

• Files and folders are chosen on the Station’s Mac, not on your device. The picker shows that Mac’s file system.
• Vom Gerät hochladen … (upload from device) in the same picker transfers a file from your device, such as a store key. It lands in the Station’s data folder, readable only by your macOS user.
• Herunterladen (download) replaces dragging things out and Im Finder (in Finder). Folders such as a web build come as a ZIP. A download link only works once and only for two minutes. Allowed are the runs’ artifacts and everything in the collection folder.
• Transporter downloads the IPA. You then open Transporter on your own Mac and drag it in.

Builds, uploads and everything else run on the Station’s Mac, just like when you use it on site.

Sign-in and sessions

• After signing in, a browser stays signed in for 30 days from its last use.
• Diesen Browser abmelden (sign out this browser) ends your own session, Alle Browser abmelden (sign out all browsers) ends all of them.
• A new password signs out all browsers and drops their open connections.
• In the browser, the password can only be changed with the bisherigen Passwort (current password). On the Mac itself it works without, in case it was forgotten.
• After ten failed attempts in ten minutes, the Station throttles the address in question.

If you switch off remote access in the browser, that browser loses the connection immediately. Switching it back on is then only possible on the Station’s Mac.

Security

• The Station stores the password only as a hash and the sessions only as a checksum. Both are kept in remote_access.json in the Station’s data folder.
• Secrets such as store keys never leave the Station in plain text. The interface only sees their status, such as “hinterlegt” (stored).
• Anyone who knows the password can do everything you can do on the Mac: start builds, run custom scripts, upload apps. Choose it accordingly and don’t share it.
• If the license expires, remote access closes immediately.

More on data storage and the keychain in Settings and security.