🛋️Working remotely (terminal + VNC)

Your machine is reachable from anywhere thanks to Tailscale. What’s left is to settle in comfortably from your everyday machine, Mac or Windows. Good news: there are two ways to work remotely, and one of them covers 95% of cases.

• The terminal, via SSH. Light, fast, this is where you’ll spend most of your time. You type commands (or you chat with your agent), the machine responds. A few kilobytes over the network, it works even on a struggling 4G connection.
• The graphical desktop, via VNC. For the rare moments when you really need an interface: opening a browser on the machine, working a graphical tool. Heavier, to be kept for cases where the terminal isn’t enough.

We’ll set up both. But keep the ratio in mind: you’ll live in the terminal, you’ll visit the graphical desktop.

The terminal: your control station

SSH is built in everywhere, but a good terminal app makes daily life noticeably more pleasant, tabs, search, clean copy-paste, connection profiles.

On macOS

Apple’s Terminal is enough to get started. For comfort, two solid free picks: iTerm2 (the classic, fully loaded) or Tabby (modern, cross-platform). Either way, the connection command is the same:

ssh ulrich@mini   # 'mini' = your machine's MagicDNS name

On Windows

Install Windows Terminal from the Microsoft Store (free, it’s become the standard). The OpenSSH client is built into Windows, so there’s nothing else to install to connect:

ssh ulrich@mini

If you prefer, Tabby works great on Windows too.

On phone and tablet

To drive your machine from an iPhone, an iPad or an Android, look at Termius: cross-platform (Mac, Windows, iOS, Android), a polished interface, with connections and keys synced across your devices. It’s the most comfortable option when you don’t have a physical keyboard on hand.

The graphical desktop: VNC, and only when you need it

Sometimes the terminal isn’t enough: you want a real browser on the machine, or a tool that only exists as a graphical version. That’s VNC’s job, it sends the machine’s screen back to your machine.

On the mini-PC side: setting up the VNC server

Several servers exist (wayvnc for Wayland, x11vnc for the simplest). The most turnkey remains TigerVNC, which creates a dedicated virtual desktop, no need for a screen plugged into the machine:

# Install TigerVNC
sudo apt install -y tigervnc-standalone-server tigervnc-common
# Launch a virtual desktop, accessible ONLY locally
vncserver :1 -localhost

The -localhost is the detail that matters. It tells the server: only accept connections from the machine itself, never directly from the network. We’ll reach it through the Tailscale/SSH tunnel, which shuts the door on prying eyes. On first launch, TigerVNC asks you for a session password, pick a strong one.

On your machine’s side: tunnel, never expose

Absolutely no opening of the VNC port (5900/5901) directly. We route it through the SSH tunnel, which itself travels over your private Tailscale network:

# Create a tunnel: local port 5901 points to the machine's 5901
ssh -L 5901:localhost:5901 ulrich@mini

As long as this command is running, your machine has a local door (localhost:5901) that opens, encrypted, onto the machine’s VNC desktop.

On your machine’s side: the VNC viewer

• macOS has a built-in client. In the Finder, press Cmd + K and enter vnc://localhost:5901. Otherwise, RealVNC Viewer (free, cross-platform) does the job nicely.
• Windows: RealVNC Viewer or TightVNC Viewer. You point the viewer at localhost:5901, that’s your end of the tunnel.

In reality, you’ll rarely open the desktop

A small honest reframe to finish. Once your coding agent is installed, the overwhelming majority of remote work is: SSH + your agent (Claude Code or OpenCode) running in the terminal. You describe what you want, it reads, writes, runs, fixes. No mouse, no windows, no graphical latency.

VNC stays there for the exceptions, a browser to drive visually, an interface debug. But don’t be surprised to go weeks without opening it. The terminal is 95% of the time, and that’s for the best: it’s faster, lighter, and it works even when the network is coughing.