Reference
The facts, in tables: what each Console page is for, what each role may do, every setting the Console manages, and what each status means.
Console pages
The sidebar lists them. Members and Templates appear when your organization's plan has team features; the Overview shows whether it does.
| Page | What it's for |
|---|---|
| Overview | The organization's address, your role and its plan. Owners are asked to turn on two-factor authentication here until they do. |
| License keys | One key per person: who it is for, its profile, status and computers. Issue, reveal, suspend, revoke, and move a key to another profile. |
| Profiles | The configurations computers receive, which version of each is live, and whether it has reached your fleet. |
| Templates | Baselines several profiles share. |
| Instances | Every computer that reports with your keys, and your organization's own nodes. |
| Members | Who runs the Console with you, their roles, and open invitations. |
| Audit log | Every change, reveal, connection and departure, with filters and a CSV export. |
| Organization | The name and support contacts managed computers show. |
| Security | Two-factor authentication for your own account. |
Roles
A member's role decides what they can change. Controls a role can't use are not shown.
| Can | Owner | Admin | Member |
|---|---|---|---|
| See every page | Yes | Yes | Yes |
| Change the organization's name and support contacts | Yes | — | — |
| Make someone an owner | Yes | — | — |
| Invite, change and remove members | Yes | Yes | — |
| Issue, suspend, revoke and move license keys | Yes | Yes | — |
| Reveal a full license key | Yes | Yes | — |
| Change profiles and templates | Yes | Yes | — |
| Publish a profile | Yes | Yes | — |
Settings the Console manages
Every setting a profile or template can set. A setting set there is locked on every install; one left alone stays each person's own, at the app's default until they change it. Security settings can only be tightened; Policy settings are honoured by the app, not enforced.
| Setting | Values | App default | Kind |
|---|---|---|---|
Relay (network.relayMode) | Off — direct connections only, Automatic — when a direct connection fails, Always — hide addresses from peers | Off | Policy |
Relay key (network.relayKey) | The relay's public key: 52 z-base-32 or 64 hex characters | None | Policy |
Record local activity (audit.enabled) | Required. Can be required, never turned off; the person always sees that it is on. | On | Security |
Keep activity for (audit.retentionDays) | 30, 90 or 365 days | 90 days | Policy |
Send activity to this Console (audit.forwardingEnabled) | Shown, but can't be set yet: it waits for the Mirall release that forwards activity. | Off | Security |
Backup folder — Windows (backup.folder.windows) | A folder path with {install} | None | Policy |
Backup folder — macOS (backup.folder.macos) | The same, as the share is mounted on macOS, e.g. /Volumes/… | None | Policy |
Backup folder — Linux (backup.folder.linux) | The same, as the share is mounted on Linux, e.g. /mnt/… | None | Policy |
Require a backup (backup.required) | Required. Each computer must keep a backup; the person still chooses their own passphrase. | Off | Security |
Backup folder paths
A backup folder is written once for every computer, with placeholders each computer fills in.
{install}is required, once: it gives each computer its own folder.{user}and{host}are optional: the person's user name and the computer's name.- On Windows, start with a share (
\\server\share\…) or a drive (D:\…) and use\. On macOS and Linux, start with/and use/. - Write the server and share out in full, and name at least one folder before the first placeholder.
- Keep the path to 400 characters and each folder name to 255, counting
{user}and{host}as 64 and{install}as 12. - The part before the first placeholder must exist. Mirall creates each computer's folders below it.
License key statuses
| Status | Means |
|---|---|
| Active | In use. Computers can connect with it and receive its profile. |
| Suspended | Paused. Resume key makes it active again. |
| Revoked | Ended for good. It stopped receiving configuration, freed its seat and retired its computers. It can't be changed again. |
Profile delivery
The Delivery column on Profiles and the line at the top of a profile.
| Status | Means |
|---|---|
| Not published | Nothing has been sent to your fleet yet. |
| Unpublished changes | Saved changes have not been published. On the profile's own page this reads Not delivered. |
| Publishing | A version is on its way to your fleet. |
| Live | The version reached your fleet, on the date shown. |
| Failed | The version could not be delivered. Retry sends it again. |
Computer statuses
What the columns on Instances and a computer's details say.
| Column | Value | Means |
|---|---|---|
| Status | Active | Reported in the last 14 days. |
| Status | Dormant | No report for 14 days. Its next report makes it active again. |
| Status | Retired | It left the organization, or its key was revoked. Hidden until you click Show retired. |
| Configuration | Up to date | It applied its profile's live version. |
| Configuration | Behind by <n> | It applied an older version of its profile. |
| Configuration | Other profile | It applied a version of another profile, such as before its key was moved. |
| Configuration | Nothing applied | It hasn't applied any of your configuration yet. |
| Backup | Protected · At risk · Stopped | How its backup is doing, as the app judges it. |
| Backup | Not set up | It has no backup. |
| Computer | New on this key | It joined the key in the last 14 days while another computer still used the key. |
| Details | Not applied | Settings it received but did not apply. |
| Details | Not locked, ignored | Settings it received without a lock, which it ignores. |
Audit log actions
The Action filter's groups and what each records.
| Group | Actions |
|---|---|
| License keys | Key issued · Key revealed · Key suspended · Key resumed · Key revoked · Key moved to another profile |
| Configuration | Profile created, details changed, saved, published, republished or deleted · Profile version saved · Version note changed · Version hidden · Version shown again · Delivery failed · Template created, details changed, version saved or deleted |
| Computers | Computer connected · Computer left the organization · Computers retired (key revoked) |
| Members | Member invited · Invitation revoked · Invitation accepted · Role changed · Member removed |
| Organization | Organization created · Organization details changed |
On a managed computer
What Mirall shows on a computer connected to your organization.
| Where | What it shows |
|---|---|
| Profile → About Mirall → Organization | Appears only on a computer an organization manages, reading Managed by <organization>. Opens its page: the settings it manages, its support links, and Leave…. |
| Command palette | Open organization opens the same page. |
| Settings | Each setting the organization manages reads Set by <organization> and can't be changed. A folder it sets is shown read-only, with a Copy button. |
| Activity Log | While the organization keeps recording on, Delete the log is unavailable; Export as JSON still works. |