Use MyOS¶
For anyone with an account who just wants to use the services. No admin knowledge needed.
Names below use ${domain} — personalize it once and these become your real
links.
Signing in¶
Everything uses single sign-on. Go to https://auth.${domain}, log in once, and you'll
see your "My applications" dashboard with a tile for each app you can reach. Most apps also
accept the same login directly.
Your account — username, password, group membership — comes from the central directory. One identity works everywhere, including SSH and your network home directory. A few apps can't use the SSO redirect (native mobile/TV clients), so they ask for your login directly; it's the same username and password — most notably Jellyfin.
What's available, and where¶
| Service | Address | What it's for | Reachable from |
|---|---|---|---|
| Files / Nextcloud | cloud.${domain} |
files, calendar, contacts, photos | anywhere |
| Git / Forgejo | git.${domain_alt} |
git hosting + container registry | anywhere |
| Search / SearXNG | search.${domain} |
private metasearch | anywhere (login) |
| Find My Device | fmd.${domain} |
locate / ring / wipe your phone | anywhere |
| Meetings / Jitsi | meet.${domain} |
video calls, screen share (end-to-end encrypted) | anywhere |
| Notifications / ntfy | ntfy.${domain} |
push notifications | anywhere |
| Media / Jellyfin | jellyfin.${domain} |
movies, TV, recordings | home or VPN |
| Video / Invidious | invidious.${domain} |
private YouTube frontend | home or VPN |
| Home / Home Assistant | ha.${domain} |
smart-home control | home or VPN |
The green padlock works on all of them — even the private ones use real, publicly-trusted certificates.
Public vs. private — when you need the VPN¶
- Public / login apps (files, git, search…) work from anywhere with just your account.
- Private apps (media, smart-home, video) are not exposed to the internet by design. You reach them only on the home network or over the VPN. That's deliberate: the most sensitive things can't be attacked from outside because they aren't reachable from outside.
Change your password¶
Your password is your central directory password — changing it updates every app, SSH, and your home directory at once.
- From a browser: sign in at
https://auth.${domain}, open your user settings, and change it there. - From an enrolled workstation (Linux), in a terminal — this is plain so the command copies cleanly with your values:
kinit # confirm your current credentials
ipa user-mod $USER --password # prompts for the new password
Pick a long passphrase — this one password is the single switch behind every app, so it's worth getting right.
Set up an SSH key¶
SSH on the fleet trusts certificates issued by the lab, not loose public keys, so you don't hand a raw key to each server. Ask an administrator to sign your key (or enroll your device); you keep the private key, they return a short-lived certificate.
To generate a key to hand over:
ssh-keygen -t ed25519 -C "you@${domain}"
# give the administrator the .pub file; keep the private key safe
Once your certificate is issued, you log in normally — the certificate is presented automatically and expires on its own, so a lost laptop can't grant forever-access.
Connecting the VPN¶
Private services use WireGuard. On a device with the WireGuard app and your peer config:
- Turn the tunnel on, then open a private address (e.g.
https://jellyfin.${domain}). - Laptops and phones are typically set always-on, so private apps "just work" the same at home and away — nothing to toggle as you move between networks.
- No peer config yet? Ask an administrator to enroll your device.
Your files on a workstation¶
On an enrolled workstation you log in with your central account and your home directory is your own (local, fast). Shared data is available on demand under your share folder — put things you want backed up there. (See an administrator if a share isn't appearing.)
Notifications¶
Apps and alerts can push to ntfy (ntfy.${domain}). Install the ntfy app, subscribe to your
topic, and you'll get backup results, alerts, and device-locate pushes.