# Connectivity

Your alp app connects to the daemon running on your computer or server. alp Desktop and the CLI can tunnel through SSH. Mobile clients can connect through the alp relay or directly with Tailscale.

This is client-to-daemon transport. If you are looking for the service that starts agents from GitHub, Slack, and Discord events, that is [Hub](/docs/hub).

- [SSH](#ssh)
- [alp relay](#alp-relay)
- [Tailscale](#tailscale)

## SSH

SSH transport connects to an existing daemon through your local OpenSSH client. It does not install, start, or configure alp on the remote host.

Before connecting:

1. Start the alp daemon on the remote host.
2. Confirm `ssh user@host` works with a key or SSH agent. alp uses non-interactive SSH and follows your OpenSSH config.

The CLI accepts an SSH URI as its host:

```bash
alp --host ssh://user@host ls -a
```

The daemon is expected at `127.0.0.1:6767` on the remote host. The port in the SSH URL is the SSH server port:

```bash
alp --host ssh://user@host:2222 ls -a
```

Set a different remote daemon port with `daemonPort`:

```bash
alp --host 'ssh://user@host?daemonPort=7777' ls -a
```

Put `--host` before the command. `alp daemon status` observes the default local home; use `alp --host ssh://user@host daemon status` to query a remote daemon. `alp --host ssh://user@host run --cwd /path/on/remote ...` requires a working directory that exists on the remote host.

In alp Desktop, open **Settings → Add host → Remote SSH** and enter the same `ssh://` destination.

## alp relay

The relay works without Tailscale, port forwarding, or network configuration. Traffic is end-to-end encrypted.

Relay is disabled until you enable it.

### Enable relay from alp Desktop

1. Open **Settings → your host → Pair a device**.
2. Select **Enable relay**.
3. Scan the QR code with alp on your phone, or copy the pairing link and paste it into the phone app.

### Enable relay from the CLI

Run:

```bash
alp daemon pair
```

Confirm when prompted. alp prints a QR code and pairing link. Scan the QR code with alp on your phone, or choose **Paste pairing link** in the phone app.

## Tailscale

Install [Tailscale](https://tailscale.com/download) on the daemon machine and your phone. Sign in to the same tailnet on both devices.

### 1. Find the daemon machine's Tailscale IP

Run this on the daemon machine:

```bash
tailscale ip -4
```

Copy the address it prints. The example below uses `100.101.102.103`.

### 2. Configure the daemon

Open `$PASEO_HOME/config.json` (`~/.alp/config.json` by default) and set `daemon.listen` to the Tailscale IP:

```json
{
  "$schema": "https://alp.anhlp.com/schemas/paseo.config.v1.json",
  "version": 1,
  "daemon": {
    "listen": "100.101.102.103:6767"
  }
}
```

Keep the other settings already in the file. If it has a `daemon` object, add `listen` inside that object.

To restrict access with a password, see [Password authentication](/docs/configuration#password-authentication).

Restart the daemon:

```bash
alp daemon restart
```

If alp Desktop manages the daemon, use **Settings → your host → Overview → Restart daemon**.

### 3. Connect the phone app

1. Connect Tailscale on your phone.
2. Open alp and go to **Settings → Add host → Direct connection**.
3. Enter the Tailscale IP in **Host**.
4. Enter `6767` in **Port**.
5. Leave **Use SSL** off and select **Connect**.

If the host was already paired through the relay, alp adds the direct connection to the same host.

## Troubleshooting

- **SSH authentication failed:** Run `ssh user@host` in a terminal and fix the key, agent, host key, or `~/.ssh/config` entry there. alp does not prompt for SSH passwords.
- **SSH connects but alp is refused:** Run `alp daemon status` on the remote host. SSH transport does not start the daemon.
- **Connection timed out:** Check that Tailscale is connected on both devices and that you used the daemon machine's Tailscale IP.
- **Connection refused:** Run `alp daemon status` and confirm the daemon is running on the configured IP and port.
- **Config change has no effect:** Run `alp reload`. `daemon.listen` is a startup setting, so restart when the command reports it.