Check that ssh <host> works from this Mac without asking for a password: a key in ~/.ssh and an entry in ~/.ssh/config. Vantage also checks this for you and lists what it found, with a fix under each line that failed.
Check whether sudo there wants a password: ssh <host> sudo -n true prints nothing when it does not. If it asks, type the password in Sudo password. It goes to sudo once over SSH and is never stored.
Enter the SSH host, a label for the dashboard, and the address the agent should listen on. Use the machine's tailnet IP with port 9736 (for example 100.64.0.9:9736). Use 127.0.0.1:9736 only for this Mac.
Choose Server or Laptop, and a site if you have sites. Both can be changed later.
Press Install. Vantage detects Linux or macOS by itself, copies the agent over, starts it as a service, pairs with it and pins its certificate. This takes up to a minute.
Something not working?
The SSH key is not set up: the failed check line above says the exact command to run, with your host in it. Run it on this Mac, then check again.
If sudo wants a password, type it in Sudo password. The password goes to sudo once and is never stored.
The Mac has not given Vantage permission to reach the local network: open System Settings > Privacy & Security > Local Network, switch Vantage on, then check again. Vantage shows in that list only after it has tried once.
A firewall on the machine blocks the address: open TCP port 9736 from this Mac, or from your tailnet.
The machine got a new address (DHCP): type its new address in the host field, or give it a fixed address in your router.
