Andy Dixon
76bd664ed1
- sync: timestamps and tombstones in the shared file are clipped to the local clock, and an edit wins a tie with a deletion, so a forged future-dated record can no longer override every later local change (or keep deleting a re-created profile) for as long as the forged date. - write_private: the temp file is created O_EXCL under a random name, so a symlink pre-placed in a shared folder can't be followed or overwritten. - Vault/keychain reads return Zeroizing<String>; has_sync_password is cached for a few seconds instead of fetching the real value every frame. - generate_ssh_key creates a missing ~/.ssh as 0700. - Honest wording: encrypted exports and the sync file carry login-script values; the audit entry, the Settings hint and the docs now say so.
125 lines
7.0 KiB
TeX
125 lines
7.0 KiB
TeX
\guidepart{pink}{Make it yours}{Make it yours}
|
|
{Settings, backups, and keeping several computers in step.}
|
|
{\partitem{\iGear}{Settings}
|
|
\partitem{\iUpload}{Import and export}
|
|
\partitem{\iPlane}{Moving house}}
|
|
|
|
% =========================================================================================
|
|
\chapter{Settings}\label{ch:settings}
|
|
\chapmeta{3 minutes}{You'll know where every setting lives}
|
|
|
|
\keys{\mod+,} opens settings (also the \iGear{} in the sidebar footer and \menu{File\then Settings}). Change things,
|
|
then click \ui{Save}.
|
|
|
|
\begin{center}\begin{minipage}[t]{0.49\linewidth}\crop{settings-general.png}{581}{253}{576}{285}{\linewidth}{General}\end{minipage}\hfill\begin{minipage}[t]{0.49\linewidth}\crop{settings-terminal.png}{581}{253}{576}{285}{\linewidth}{Terminal}\end{minipage}\end{center}
|
|
|
|
\begin{description}
|
|
\item[General] App theme (Pro, Midnight, Light), default protocol for new profiles, \ui{Restore tabs at launch}
|
|
(saved connections reconnect, local shells reopen in the folder they were in), whether to ask before closing or
|
|
disconnecting, whether remote programs may write to your clipboard, a confirmation before pasting several lines,
|
|
the update check, status bar, sidebar width, and the local shell (empty for the system default, or
|
|
\ui{Browse…}).
|
|
\item[Terminal] Colour scheme, font, size, scrollback and cursor style. These are the defaults for new profiles;
|
|
each profile can override them.
|
|
\item[Security] Keychain and vault status; set up, unlock or lock the vault; change the master password; your
|
|
stored credentials; profile sync.
|
|
\item[Known Hosts] Saved server fingerprints, with first-seen and last-seen times; import and export
|
|
\code{known\_hosts}; trusted SSH certificate authorities.
|
|
\item[Diagnostics] Version, platform, where your data and log live, and the state of the keychain, vault and sync.
|
|
\ui{Copy Diagnostics} for bug reports (never includes credentials).
|
|
\item[Help] Built-in help: connection types, shortcuts and troubleshooting, when this guide isn't to hand.
|
|
\item[About] Version, \ui{Check for Updates} and \ui{Import \textasciitilde/.ssh/config}.
|
|
\end{description}
|
|
|
|
\crop{settings-diagnostics.png}{604}{600}{604}{20}{0.8\linewidth}{Diagnostics: everything a bug report needs, nothing secret.}
|
|
|
|
\section{Updates}
|
|
|
|
Nexus Terminal checks once at launch. If there's a newer version the status bar says \ui{Update available}; click it to
|
|
see the release notes and a \ui{View release} button. Nothing downloads or installs behind your back.
|
|
|
|
% =========================================================================================
|
|
\chapter{Import and export}\label{ch:transfer}
|
|
\chapmeta{3 minutes}{You'll back up your profiles, or copy them to another computer}
|
|
|
|
\begin{tldr}
|
|
\menu{File\then Export profiles…} makes a password-protected \code{.nexus} file. \menu{File\then Import profiles…}
|
|
reads it back. Already have an \code{\textasciitilde/.ssh/config}? Import that too.
|
|
\end{tldr}
|
|
|
|
\begin{description}
|
|
\item[Encrypted export] Choose the profiles, set a password, save a \code{.nexus} file. Saved passwords aren't
|
|
included, so the file is safe to email to yourself.
|
|
\item[Encrypted import] Pick a \code{.nexus} file, enter its password and decide what happens to
|
|
profiles that already exist: \ui{Skip existing}, \ui{Overwrite existing} or \ui{Create duplicates}.
|
|
\item[JSON] \ui{Export Profiles (JSON)} and \ui{Import Profiles (JSON)} are in the palette. Tick
|
|
\ui{Include secrets} to keep passwords typed by login scripts, which are otherwise blanked. Proxy passwords and
|
|
TOTP secrets live in the keychain or vault, so no export carries them.
|
|
\item[OpenSSH config] \menu{File\then Import \textasciitilde/.ssh/config} turns your \code{Host} blocks into profiles,
|
|
with host names, users, ports, identity files and jump hosts.
|
|
\end{description}
|
|
|
|
\crop{export.png}{906}{388}{904}{390}{0.55\linewidth}{Exporting profiles. Everything's ticked to start with; untick what you don't want.}
|
|
|
|
\begin{danger}[JSON with secrets is not encrypted]
|
|
A JSON export with \ui{Include secrets} ticked has those login-script passwords in plain text. Use the encrypted \code{.nexus} export to
|
|
move things between machines.
|
|
\end{danger}
|
|
|
|
% =========================================================================================
|
|
\chapter{Moving house}\label{ch:move}
|
|
\chapmeta{3 minutes}{Your connections will follow you from laptop to desktop to work machine}
|
|
|
|
\begin{tldr}
|
|
Pick a folder every machine can see, set the same sync password on each, done. Profiles stay in step; passwords
|
|
stay put on each machine.
|
|
\end{tldr}
|
|
|
|
\section{Profile sync}
|
|
|
|
\menu{Settings\then Security\then Profile sync}. \ui{Choose…} a folder your machines share (Dropbox, iCloud Drive,
|
|
OneDrive, Nextcloud, a network share, or a git checkout you commit) and set the same \ui{Sync password} everywhere.
|
|
Nexus Terminal keeps one encrypted file there, \code{nexus-profiles.nexus}, and merges it at launch, a few seconds
|
|
after you change a profile, every ten minutes and whenever you click \ui{Sync Now}.
|
|
|
|
\begin{checklist}
|
|
\item[\color{green}\iCheck] Edited on two machines? The newer change wins, profile by profile.
|
|
\item[\color{green}\iCheck] Deleted on one machine? It goes from the others too (unless someone edited it afterwards).
|
|
\item[\color{rose}\ph{E4F6}] Saved passwords, keys and tokens never sync. Each machine keeps its own in its keychain or vault.
|
|
(Anything a login script \emph{sends} is part of the profile, so that does travel.)
|
|
\end{checklist}
|
|
|
|
\crop{settings-security.png}{581}{253}{576}{285}{0.8\linewidth}{Profile sync lives on the Security page, under your stored credentials.}
|
|
|
|
\begin{headsup}
|
|
Lose the sync password and the sync file can't be read, just like an encrypted export. Your local profiles are
|
|
fine.
|
|
\end{headsup}
|
|
|
|
\section{One-off moves}
|
|
|
|
Not worth setting up sync? \menu{File\then Export profiles…} on the old machine, \menu{File\then Import profiles…}
|
|
on the new one (see \hyperref[ch:transfer]{Import and export}). Known hosts travel the same way through
|
|
\ui{Export…} and \ui{Import} on the Known Hosts page.
|
|
|
|
\section{Where everything lives}
|
|
|
|
\renewcommand\arraystretch{1.45}
|
|
\begin{tabularx}{\linewidth}{@{}>{\leavevmode\heavy\color{ink}}p{20mm}X@{}}
|
|
\toprule
|
|
macOS & \code{\textasciitilde/Library/Application Support/NexusTerminal}\\
|
|
Windows & \code{\%APPDATA\%\textbackslash NexusTerminal}\\
|
|
Linux & \code{\$XDG\_CONFIG\_HOME/NexusTerminal}, usually \code{\textasciitilde/.config/NexusTerminal}\\
|
|
\bottomrule
|
|
\end{tabularx}
|
|
|
|
Inside: \code{nexus.db} (profiles, known hosts, preferences, snippets, IRC state and the audit log),
|
|
\code{vault/vault.json}, \code{recordings/}, \code{triggers.json}, \code{sftp-bookmarks.json} and \code{nexus.log}, the
|
|
diagnostic log. Keychain entries are
|
|
stored under the service name \code{NexusTerminal}.
|
|
|
|
\begin{protip}[Try things without touching your real data]
|
|
Start Nexus Terminal with \code{--data-dir /some/other/folder} and it uses that folder instead. Brilliant for
|
|
experiments, demos and a portable install on a USB stick.
|
|
\end{protip}
|