.TH TRUSTMUXD 1 "2026-05-28" "trustmux" "User Commands"
.SH NAME
trustmuxd \- Trustmux daemon (mobile companion for tmux/Byobu sessions)
.SH SYNOPSIS
.B trustmuxd
[\fB\-\-host\fP \fIADDR\fP]
[\fB\-\-port\fP \fIPORT\fP]
[\fB\-\-name\fP \fINAME\fP]
[\fB\-\-https\fP]
[\fB\-\-self\-signed\fP]
[\fB\-\-advertise\fP \fISOURCE\fP]
[\fB\-\-no\-advertise\fP]
[\fB\-\-version\fP]
.SH DESCRIPTION
.B trustmuxd
is a lightweight daemon that serves a mobile-optimised web interface for
monitoring and interacting with tmux and Byobu sessions over your Tailscale
private network.
.PP
The daemon serves a Progressive Web App (PWA) over HTTPS.  In the default
mode it binds to the Tailscale interface and relies on
.BR "tailscale serve"
for TLS termination.  In direct mode (\fB\-\-self\-signed\fP) it generates
a self-signed ECDSA certificate and binds directly on the network interface.
.PP
Authentication uses 6-digit one-time pairing codes (generated with
.BR trustmux\-pair (1))
and permanent per-device session tokens stored per instance (see
.BR FILES ).
.PP
In normal use, the daemon is managed via
.BR trustmux (1)
rather than being invoked directly.
.SH OPTIONS
.TP
.BI \-\-host " ADDR"
Bind address (default: Tailscale IP, or 127.0.0.1 with \fB\-\-https\fP).
.TP
.BI \-\-port " PORT"
TCP port to listen on (default: 7432).
.TP
.B \-\-https
HTTPS mode: trust proxy headers and set Secure cookie flag.
Use with \fBtailscale serve\fP.
.TP
.B \-\-self\-signed
Generate a self-signed ECDSA P-256 TLS certificate for direct
HTTPS access without Tailscale.
.TP
.BI \-\-name " NAME"
Which instance's state and runtime files to use (default:
.BR default ).
Each instance has its own tokens, TLS keypair, log, admin socket and pid file,
so several daemons can run side by side.
.B trustmux (1)
passes this through when it starts a daemon.
.TP
.BI \-\-advertise " SOURCE"
Address to publish and to name in the TLS certificate, for when it is not the
one this host can see.
Repeatable.
.I SOURCE
is a literal
.IR HOST ,
.IR HOST:PORT ,
a full URL, or
.BI cmd: PROGRAM
to run
.I PROGRAM
and read one address per line of its standard output.
.IP
Sources are resolved once, at startup, before the certificate is generated and
before the admin socket is bound.
Any failure to resolve one — a non-zero exit, no output, a blank line, a value
that is not an address, or more than 5 seconds across all sources — stops the
daemon, in the same way an unavailable TLS implementation does: an unreachable
URL, or a certificate for the wrong host, is not something a warning would fix.
.IP
The resolved addresses are reported over the admin socket, which is how
.B "trustmux pair"
and
.B "trustmux status"
come to print exactly what the certificate attests.
.IP
When no
.B \-\-advertise
or
.B \-\-no\-advertise
is given, the daemon reads
.B TRUSTMUX_ADVERTISE
and then the instance's configuration file itself.
.B trustmux (1)
always passes one or the other, so a daemon it starts uses only the sources
.I it
resolved.
See
.BR trustmux (1)
for the source syntax in full.
.TP
.B \-\-no\-advertise
Advertise nothing, ignoring
.B TRUSTMUX_ADVERTISE
and the instance's configuration file.
.TP
.B \-\-version
Print version and exit.
.SH FILES
Paths follow the XDG base directories, one subdirectory per instance;
.I INSTANCE
below is the
.B \-\-name
name.
.B trustmux (1)
documents the full layout, the fallbacks and the
.B TRUSTMUX_*_DIR
overrides.
.TP
.I $XDG_CONFIG_HOME/trustmux/instances/INSTANCE.json
Optional, hand-written: advertise sources for this instance, read when neither
.B \-\-advertise
nor
.B \-\-no\-advertise
was given.
Refused if writable by group or other, since a source can name a program to run.
.TP
.I $XDG_STATE_HOME/trustmux/instances/INSTANCE/tokens.json
Persistent session tokens (mode 0600).
.TP
.I $XDG_STATE_HOME/trustmux/instances/INSTANCE/cert.pem
Self-signed TLS certificate (mode 0644), created on first
\fB\-\-self\-signed\fP start.
.TP
.I $XDG_STATE_HOME/trustmux/instances/INSTANCE/key.pem
TLS private key (mode 0600).
.TP
.I $XDG_STATE_HOME/trustmux/instances/INSTANCE/trustmux.sock
Admin Unix socket (mode 0600) used by
.BR trustmux\-pair (1)
and
.BR trustmux\-unpair (1).
.SH SEE ALSO
.BR trustmux (1),
.BR trustmux\-pair (1),
.BR trustmux\-unpair (1),
.BR trustmux\-enable (1),
.BR trustmux\-disable (1),
.BR byobu (1),
.BR tmux (1)
.SH AUTHOR
Dustin Kirkland <kirkland@ubuntu.com>