Install on macOS

Nardeboon for macOS is one package, for Apple silicon and Intel Macs alike, that sets up three things: the nardeboond service, which keeps the Mac on its network from the moment it starts; the Nardeboon app, in the menu bar; and the nardeboon CLI, on PATH. It supports macOS 11 Big Sur and later.

Install

Download the package from the download page and open it. The installer asks for an administrator's password, as it does for anything that sets up a service.

The package isn't signed with an Apple Developer ID yet, so the first time macOS may say it can't check it for malicious software. Open System Settings → Privacy & Security and choose Open Anyway beside Nardeboon's package. On macOS 14 and earlier you can also Control-click the package and choose Open. Nardeboon itself installs only updates that Nardeboon signed.

Join your network

Once it's installed, Nardeboon opens in the menu bar. Choose Sign in: your browser opens, you sign in with your account, and the Mac joins your network.

To join with an auth key, choose Use an auth key instead in the app, or run this in Terminal:

nardeboon up --auth-key "<key>"

The CLI needs no sudo: anyone who uses the Mac can use Nardeboon, from the app or Terminal. nardeboon status shows the connection, nardeboon down disconnects, and nardeboon logout signs the Mac out of its network.

What it sets up

• The service, nardeboond, runs as root. launchd starts it when the Mac starts and again after a failure. Its log is /Library/Logs/Nardeboon/nardeboond.log, which the Mac's administrators can read, in Console too. nardeboon bugreport saves what's needed to look into a problem, with no keys or secrets in it.

• The app opens in the menu bar at login, for everyone who uses the Mac. Each person can turn that off in its settings. macOS lists Nardeboon's service and app in System Settings → General → Login Items.

• Names. macOS asks Nardeboon for your network's names, so ping laptop reaches a device by its name. Other names resolve as before. Nardeboon puts a file for each of your network's domains in /etc/resolver, and takes them away when you disconnect. See DNS and device names.

• An exit node, when you use one. Everything the Mac sends to the internet goes through it, and nothing gets out around it while the exit node is offline. Two things differ from Windows and Linux for now:

  • the networks the Mac is on stay reachable directly;
  • if Nardeboon stops unexpectedly, the Mac reaches the internet directly until it's back.

  See Exit nodes.

Updates

Nardeboon updates itself, as on Linux and Windows. It installs only a release that Nardeboon signed, with macOS's own installer, and the app opens again on the new version. nardeboon update check shows what's installed and what's next.

Remove

macOS doesn't remove an installed package by itself, so run this in Terminal:

sudo launchctl bootout system/io.nardeboon.nardeboond
pkill -x Nardeboon
sudo rm -rf /Applications/Nardeboon.app /usr/local/sbin/nardeboond /usr/local/bin/nardeboon \
  /Library/LaunchDaemons/io.nardeboon.nardeboond.plist /Library/LaunchAgents/io.nardeboon.app.plist \
  /Library/Logs/Nardeboon
sudo pkgutil --forget io.nardeboon.pkg

The device's identity stays in /Library/Application Support/Nardeboon, so installing it again brings the same device back. Delete that folder to forget it, and remove the device in the dashboard.