Joining the MMD network is the first step for everything else. Our servers are not reachable from the open internet — you must be on this network before you can sign in to any of them.
You need a personal enrolment key from MMD IT. It looks like
hskey-auth-…, works once, and expires. If you do not have one,
reply to the email that sent you here and ask for it.
| Your machine | Use |
|---|---|
| Windows (most of us) | PowerShell, as administrator — see below |
| Windows + WSL | Run the Windows steps. WSL uses Windows' connection automatically. |
| Linux | The shell installer |
| macOS | The shell installer |
Press Start, type PowerShell, right-click it and choose Run as administrator. Then paste this in one line, with your own key:
iex "& { $(irm https://get.baobab-ts.com/mmd-setup.ps1) } -PreauthKey '<your-key>'"
To join the network only, without the developer tooling:
iex "& { $(irm https://get.baobab-ts.com/mmd-setup.ps1) } -PreauthKey '<your-key>' -SkipClaudeCode"
Installs Tailscale joined to vpn.baobab-ts.com, and unless skipped,
Node.js LTS and Claude Code. Other flags: -InstallVSCode,
-SkipTailscale.
If it says winget is missing, update App Installer from the Microsoft Store, then run it again.
Source: /mmd-setup.ps1
Do the Windows steps above, in PowerShell — not inside WSL. Windows owns the network connection and WSL rides on it automatically. Running the installer inside WSL will tell you the same thing and stop.
In a terminal, with your own key:
curl -fsSL https://get.baobab-ts.com/mmd-setup.sh | bash -s -- --preauth-key '<your-key>'
On Linux this installs Tailscale from the official installer. On macOS it uses
Homebrew. Both then join vpn.baobab-ts.com and check the connection
really works before finishing.
Source: /mmd-setup.sh
The installer prints your address on the MMD network — it begins
100.64.. To check at any time:
tailscale status
Then sign in to the MMD Group IT sandbox with the username and temporary password IT sent you:
ssh <your-username>@176.9.38.89
Once you are on the MMD network the same machine also answers at
100.64.0.21 — use that if your internet provider blocks outgoing SSH.
You will be asked to set a new password on first sign-in. The sandbox accepts
sign-in from the internet as well as from the MMD network; every other MMD server
takes passwords only from inside the network. What the sandbox gives you is
described at sandbox.baobab-ts.com
and in ~/README.md on the machine itself.
PDF reader and editor for Windows, built in-house and signed by MMD. Download and details
PowerPoint, Word, Excel and PDF templates for every group company, and how to teach your AI assistant to use them: /office-templates.html
Download for macOS Apple Silicon
Versioned 3.3.1 links also remain available from /cowork/.
Claude Code gateway credentials are managed by MMD device policy. This page does not publish static AI credentials.