How-to guides

Sign in to the Console

The Console signs you in with a link by email. There is no password to set or forget.

1. 1Open console.mirall.app and enter your Work email.
2. 2Click Email me a sign-in link.
3. 3Open the link from the email in the same browser. It works once and expires in an hour.

If the link has expired or was already used, the sign-in page says so: request a new one there. Sign out is at the bottom of the sidebar.

Change your organization's name and support contacts

What managed computers show: your name beside each setting you lock, and where people can ask for help. Only an owner can change it.

1. 1Open Organization in the sidebar.
2. 2Change the Name (up to 80 characters), the Support page (https only) or the Support email.
3. 3Click Save.

Computers receive the new details with the next delivery, within a few minutes.

Turn on two-factor authentication

Adds a code from an authenticator app to your Console account. It is recommended for everyone who manages license keys, and the Overview asks every owner until it is on.

1. 1Open Security in the sidebar and click Set up two-factor authentication.
2. 2Scan the code with your authenticator app, or enter the key shown below it.
3. 3Type the 6-digit code your app shows right now and click Turn on two-factor authentication.

Two-factor authentication is on confirms it. If the code didn't match, wait for the next one: codes change every 30 seconds.

Invite a member

Members share the work of running the Console. You invite them with a link that works for one address.

1. 1Open Members and click Invite member.
2. 2Enter their Email and choose a Role. Only an owner can invite another owner.
3. 3Click Create invitation link, copy the link and send it to them.

The link is shown only once. It works for that address only and expires after seven days. They open it, click Accept and sign in, and join with the sign-in link the Console emails them.

Until then the invitation is listed under Open invitations. New link replaces a lost or expired link, and the old one stops working; Revoke withdraws the invitation.

Change a member's role, or remove them

Owners and admins manage the members list. You can't change your own row, and only an owner can change an owner's.

1. 1Open Members.
2. 2To change a role, choose it in the member's row and click Save.
3. 3To remove someone, click Remove, then Remove member.

A removed member loses access to the Console at once. Their license keys stay as they are: revoke those separately if they should stop working too.

Issue a license key

Each person who uses Mirall gets a key. The key decides which profile their computers receive, and one key covers all of that person's computers.

1. 1Open License keys and click Issue key.
2. 2Enter the Email of the person, and optionally their Name.
3. 3Choose the Configuration profile their computers receive, and optionally a Label such as Edit suite.
4. 4Click Issue key, then copy the key or the activation link.
5. 5Click I've stored the key.

The dialog is the only place the full key is shown without a record. After that, the list shows only the key's first characters, and seeing the whole key again is a recorded reveal.

The line under the heading counts the seats in use. Going over your plan is shown, never blocked.

Send someone their activation link

The activation link is what connects a person's Mirall to your organization. It carries their key, so it is shown only beside the full key.

1. 1Open License keys and click Details on the person's key.
2. 2Click Reveal. The full key appears, with the activation link buttons below it.
3. 3Click Copy activation link and send it to the person.

Each reveal is recorded in the audit log with your name, and the key hides itself again after 30 seconds. Copy app link copies the same link in the form a script can open with open, start or xdg-open, for connecting computers you set up yourself.

Move a key to another profile

Changes which configuration a person's computers receive, without a new key.

1. 1Open License keys and click Details on the key.
2. 2Choose the new Configuration profile and click Change.

Their computers receive the other profile's live version. Until they have applied it, Instances shows them as Other profile.

Suspend or revoke a key

Suspending is reversible. Revoking is permanent: when a person leaves, revoke their key.

1. 1Open License keys and click Details on the key.
2. 2Click Suspend key. Resume key makes it active again.
3. 3Or click Revoke key, read what it does, and click Revoke key again.

A revoked key stops receiving configuration, frees its seat, and retires its computers in Instances. No computer can connect with it again. To give the person access again, issue a new key.

Change a setting for everyone

A profile is the set of settings its computers receive. Changing one is two steps: save the profile, then publish it.

1. 1Open Profiles and click Open on the profile.
2. 2Find the setting. Tick Set here and choose its value. Untick Set here to leave the setting to each computer again.
3. 3Click Save. The bar at the bottom reads All changes saved.
4. 4Click Publish in the delivery line at the top.

Publishing creates the profile's next version and sends it to every computer whose key uses the profile, within minutes. The delivery line reads Publishing, then Live with the version and when it reached your fleet.

A setting you set is locked on every install: the person sees Set by <your organization> and can't change it. Settings marked Security · can only be tightened can only be required, never relaxed.

Create a profile for a group of people

Use a separate profile when some computers need different settings, such as field laptops that always go through your relay.

1. 1Open Profiles and click New profile.
2. 2Enter a Name and optionally a Description. If your organization has templates, choose one under Based on template.
3. 3Click Create profile. The new profile opens: set its settings, save and publish it.
4. 4Move the keys of the people it is for onto it.

To delete a profile, open it and choose Delete profile from the ⋯ menu. That works only when no key uses it.

Share a baseline between profiles

A template holds settings several profiles share. A profile based on it inherits them and can't unlock what it locks.

1. 1Open Templates and click New template.
2. 2Name it, for example Company baseline, and click Create template.
3. 3Set its settings and click Save.
4. 4Open each profile that should build on it, choose it under Based on template, then save and publish the profile.

In a profile, a setting the template sets reads From template and Locked by template. Profiles pick up a changed template the next time they are published.

Deleting a template (Delete template on its page) leaves its profiles in place; they stop inheriting from it.

Go back to an earlier version

Each publish is kept as a version. Restoring one sends its settings again, as a new version.

1. 1Open the profile and choose the Versions tab.
2. 2Click Restore on the version. Its settings load into the Configuration tab.
3. 3Check them, click Save, then Publish.

Add note records why a version exists; the note stays in the Console and never reaches a computer. Hide takes an old version out of the list, and Show hidden brings it back. The live version can't be hidden.

Require backups and choose where they go

Each computer keeps its encrypted backup in its own folder on a share you provide. People still choose their own passphrase, and nobody else ever holds it.

1. 1Open the profile. Under Backup, tick Set here beside Backup folder for each platform your studio uses.
2. 2Enter the folder as the share is reached on that platform, with {install} in it, for example \\server\share\{user}\{host}-{install} on Windows or /Volumes/share/{user}/{host}-{install} on macOS.
3. 3To make a backup mandatory, tick Set here beside Require a backup.
4. 4Save and publish the profile.

Below the field, the Console shows what the path becomes on an example computer, or why it would be refused. The share itself must exist; Mirall creates each computer's folders below it.

Point every install at your relay

Your studio's relay carries the connections a firewall would otherwise stop. We set it up with you as part of the rollout; this is how the Console hands it to every computer.

1. 1Open the profile. Under Network, tick Set here beside Relay key and paste your relay's public key.
2. 2Tick Set here beside Relay and choose when to use it: Automatic — when a direct connection fails, or Always — hide addresses from peers.
3. 3Save and publish the profile.

The relay key is not a secret: anyone who has it can use the relay, and it can't read what it carries. Each computer shows both settings as set by your organization.

Connect Mirall to your organization

For the person at the computer. Your organization can manage some of Mirall's settings on the computers it looks after, and your administrator sends you an activation link to connect this one.

1. 1Open the activation link on the computer where Mirall is installed. It opens in your browser, which hands it to Mirall.
2. 2Mirall checks with your organization, then asks Connect Mirall to <organization>? and says what connecting means.
3. 3Click Connect. Connected to <organization> confirms it.

An organization can set your relay, whether the Activity Log records and how long it keeps events, and your backup: it can require automatic backups and choose the folder they go to, in which Mirall makes this computer's own folder. A setting it manages reads Set by <organization> and can't be changed while you're connected. While it keeps recording on, Delete the log is unavailable; Export as JSON still works.

To see what it manages, open Profile → About Mirall → Organization, or Open organization in the command palette. The page lists the managed settings by settings page, with your organization's support links.

To leave, click Leave… on that page, then Leave. The settings it managed go back to yours. Backups already on its share stay there, encrypted with your passphrase.

Check a computer's configuration and backup

Instances lists every computer that reports with one of your keys, grouped by person, and your organization's own nodes below them.

1. 1Open Instances.
2. 2Read the computer's row: its Mirall version, whether its Configuration is up to date, and its Status.
3. 3Click Details for its last report: when it connected and was last seen, when it applied its configuration, any settings it did not apply, and its backup.

A computer is Dormant after 14 days without a report, and active again with its next one. Computers that left or whose key was revoked are Retired; Show retired lists them.

From a key's details, Show in Instances lists only that key's computers. New on this key marks a computer that joined a key in the last 14 days while another computer still used it.

Find out who changed what

The audit log records every change in the Console, every revealed key, and every computer that connected or left.

1. 1Open Audit log.
2. 2Narrow it by Action, Person and Period, then click Apply.
3. 3Click Older entries at the bottom to go further back.

Who names the member, or Mirall app for a computer that connected or left, or System. Export CSV downloads the entries that match the filters.