diff --git a/CHANGELOG.md b/CHANGELOG.md
index 041e97a..ed4e81c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,24 @@
 - New `/etc/systemd/journald@terraria.conf` for the servers' journal size and retention (default: up to 256 MB).
 - New internal `terractl journal-access`, run as root before each server start: creates the servers' journal folder (never `/var/log/journal` itself) and gives the `terraria` group read access, repairing existing journal files too.
 - The note shown by `attach` and `cmd` when output can't be read now distinguishes "not in the `terraria` group" from "in it, but the journal isn't set up yet".
+- New polkit rule (`/usr/share/polkit-1/rules.d/50-terractl.rules`): members of the `terraria` group can `systemctl start`, `stop` and `restart` `terraria@<name>` without `sudo`. `enable`, `disable` and all other units still need root. Needs `polkitd` 0.106 or newer, now a recommended package; Ubuntu 22.04's polkit can't run the rule.
+- New `enable` and `disable` commands: `terractl enable <name> [--now]` makes a server start at boot (`--now` also starts it), `terractl disable <name> [--now]` stops that (`--now` also stops it, saving the world). They need root, like `systemctl enable`. `enable` refuses names without an instance, so a typo can't create a new instance at boot. `new` and `import` now suggest `terractl enable <name> --now`.
+- `list` has a new `BOOT` column showing whether each server starts at boot (`enabled`, `disabled`, or e.g. `masked`).
+- Manage other hosts, like LXD/Incus remotes:
+  - `sudo terractl daemon enable` starts `terractld.service`, a daemon other hosts connect to (HTTPS, TCP port 7776; `TERRACTL_LISTEN` in `/etc/default/terractl` changes it). It's off until enabled. `daemon disable` and `daemon status` turn it off and show its state.
+  - `sudo terractl daemon trust add <name>` creates a one-time token for a computer, valid for 24 hours; `daemon trust list` and `daemon trust remove <name>` show and revoke access. On that computer, `terractl remote add <remote> <token>` adds the host; `remote list` and `remote remove` manage remotes, which are stored per user.
+  - `terractl --host <remote> <command>` runs any command on a remote, including `attach`, `watch` and `export`/`import`/`mods add` with files from your computer. The daemon runs it as root there, with messages adjusted to `terractl --host <remote> ...`.
+  - `terractl copy` and `terractl move` copy, move or rename instances, on one host or between hosts (`[<remote>:]<name>`). Paths and ports follow the destination's settings, and a missing server zip is copied along. `move` stops the source first, starts it again if the transfer fails, and starts the moved instance where it was running before.
+  - Security: the token carries the daemon's certificate fingerprint, which the client checks on every connection; each computer gets its own key, and the daemon stores only hashes. The daemon runs as root with systemd sandboxing.
+  - Written in Python (standard library only), in `/usr/lib/terraria-server-manager/terractl-remote`. The package now depends on `python3` and `openssl`.
+- New `start`, `stop` and `restart` commands, the same as `systemctl start|stop|restart terraria@<name>`, for this host and for `--host`. `start` refuses names that have no instance. The service's own stop step is now `terractl service-stop`; units that still call `terractl stop <name> <pid>` keep working.
+- New `rename` command: `terractl rename <name> <new name>` renames the folder, updates `serverconfig.txt`, and carries over the service (stopped and started again if it was running, and still starting at boot). The port and unpacked server are kept. `move` within one host uses it.
+- New `info` command: this host's folders, zips and instances, or an instance's type, port, server zip and state, as `key=value` lines.
+- `import` replaces a `ZIP=` pin that's an absolute path not present on this host with the zip of the same name in this host's `dist/`.
+- Messages that suggest a command now suggest `terractl` commands (`terractl stop <name>` rather than `systemctl stop terraria@<name>`), with `sudo` only when it's needed: not in a root shell, and not for `terraria` group members starting, stopping or restarting a server.
+- New `watch` command: `terractl watch <name> [-n <lines>] [-q]` follows the server's output like `attach`, but never sends input, so it's safe to leave open. Works for the `terraria` group without `sudo`, and while the server is stopped. `-q` leaves out the lines about what it's doing.
+- Bash completion for the new commands, remote names after `--host`, and `<remote>:<name>` for `copy` and `move`.
+- Clearer messages when `run` or `prepare` is typed without `sudo` (the old one, "must run as root or 'terraria'", read as if the `terraria` group were enough), and when `stop` is typed by hand.
 - Upgrading: running servers keep logging to the system journal until restarted; the package lists the ones to restart.
 
 ## 0.0.10 - 2026-09-30
diff --git a/Makefile b/Makefile
index d266b3c..9ac0ca7 100644
--- a/Makefile
+++ b/Makefile
@@ -17,10 +17,18 @@ SYSUSERSDIR := $(PREFIX)/lib/sysusers.d
 TMPFILESDIR := $(PREFIX)/lib/tmpfiles.d
 DOCDIR      := $(PREFIX)/share/doc/$(NAME)
 DATADIR     := $(PREFIX)/share/$(NAME)
+PKGLIBDIR   := $(PREFIX)/lib/$(NAME)
 COMPLETIONDIR := $(PREFIX)/share/bash-completion/completions
+# polkit only reads /usr/share/polkit-1/rules.d and /etc/polkit-1/rules.d
+ifeq ($(PREFIX),/usr)
+POLKITDIR   ?= /usr/share/polkit-1/rules.d
+else
+POLKITDIR   ?= $(SYSCONFDIR)/polkit-1/rules.d
+endif
 
 # Fill in version and install paths
-SUBST = sed -e 's|@VERSION@|$(VERSION)|g' -e 's|@BINDIR@|$(BINDIR)|g' -e 's|@DOCDIR@|$(DOCDIR)|g'
+SUBST = sed -e 's|@VERSION@|$(VERSION)|g' -e 's|@BINDIR@|$(BINDIR)|g' -e 's|@DOCDIR@|$(DOCDIR)|g' \
+	-e 's|@PKGLIBDIR@|$(PKGLIBDIR)|g'
 
 MAINT_SCRIPTS := packaging/deb/postinst packaging/deb/prerm packaging/deb/postrm
 STAGE         := build/deb-root
@@ -34,22 +42,33 @@ check:
 	bash -n bin/terractl
 	bash -n completions/bash/terractl
 	for f in $(MAINT_SCRIPTS); do sh -n $$f; done
+	python3 -c 'import ast, sys; ast.parse(open(sys.argv[1]).read(), sys.argv[1])' lib/terractl-remote
 	@if command -v shellcheck >/dev/null; then \
 		shellcheck bin/terractl completions/bash/terractl $(MAINT_SCRIPTS); \
 	else \
 		echo "shellcheck not installed; skipped (apt install shellcheck)"; \
 	fi
+	@if python3 -m pyflakes --version >/dev/null 2>&1; then \
+		python3 -m pyflakes lib/terractl-remote; \
+	else \
+		echo "pyflakes not installed; skipped (apt install python3-pyflakes)"; \
+	fi
 
 install:
 	install -d $(DESTDIR)$(BINDIR) $(DESTDIR)$(UNITDIR) $(DESTDIR)$(SYSUSERSDIR) \
-		$(DESTDIR)$(TMPFILESDIR) $(DESTDIR)$(DOCDIR) $(DESTDIR)$(DATADIR) \
-		$(DESTDIR)$(COMPLETIONDIR) $(DESTDIR)$(SYSCONFDIR)/default $(DESTDIR)$(SYSCONFDIR)/systemd
+		$(DESTDIR)$(TMPFILESDIR) $(DESTDIR)$(DOCDIR) $(DESTDIR)$(DATADIR) $(DESTDIR)$(PKGLIBDIR) \
+		$(DESTDIR)$(COMPLETIONDIR) $(DESTDIR)$(SYSCONFDIR)/default $(DESTDIR)$(SYSCONFDIR)/systemd \
+		$(DESTDIR)$(POLKITDIR)
 	$(SUBST) bin/terractl > $(DESTDIR)$(BINDIR)/terractl
 	chmod 755 $(DESTDIR)$(BINDIR)/terractl
+	install -m 755 lib/terractl-remote $(DESTDIR)$(PKGLIBDIR)/terractl-remote
 	$(SUBST) systemd/terraria@.service > $(DESTDIR)$(UNITDIR)/terraria@.service
+	$(SUBST) systemd/terractld.service > $(DESTDIR)$(UNITDIR)/terractld.service
+	chmod 644 $(DESTDIR)$(UNITDIR)/terraria@.service $(DESTDIR)$(UNITDIR)/terractld.service
 	install -m 644 systemd/terraria@.socket $(DESTDIR)$(UNITDIR)/
 	install -m 644 config/sysusers.d/terractl.conf $(DESTDIR)$(SYSUSERSDIR)/
 	install -m 644 config/tmpfiles.d/terractl.conf $(DESTDIR)$(TMPFILESDIR)/
+	install -m 644 config/polkit/terractl.rules $(DESTDIR)$(POLKITDIR)/50-terractl.rules
 	install -m 644 docs/guide.md $(DESTDIR)$(DOCDIR)/README.md
 	install -m 644 tools/windows/export-tmod-mods.ps1 $(DESTDIR)$(DATADIR)/
 	install -m 644 completions/bash/terractl $(DESTDIR)$(COMPLETIONDIR)/terractl
@@ -68,20 +87,27 @@ install:
 	@if [ -z "$(DESTDIR)" ]; then \
 		systemd-sysusers terractl.conf && \
 		systemd-tmpfiles --create terractl.conf && \
-		if [ -d /run/systemd/system ]; then systemctl daemon-reload; fi && \
+		if [ -d /run/systemd/system ]; then \
+			systemctl daemon-reload && systemctl try-restart terractld.service; \
+		fi && \
 		$(BINDIR)/terractl journal-access && \
 		echo "Installed terractl $(VERSION). See $(DOCDIR)/README.md"; \
 	fi
 
 uninstall:
+	@if [ -z "$(DESTDIR)" ] && [ -d /run/systemd/system ]; then \
+		systemctl disable --now terractld.service 2>/dev/null || true; \
+	fi
 	rm -f $(DESTDIR)$(BINDIR)/terractl \
 		$(DESTDIR)$(UNITDIR)/terraria@.service $(DESTDIR)$(UNITDIR)/terraria@.socket \
+		$(DESTDIR)$(UNITDIR)/terractld.service \
 		$(DESTDIR)$(SYSUSERSDIR)/terractl.conf $(DESTDIR)$(TMPFILESDIR)/terractl.conf \
-		$(DESTDIR)$(COMPLETIONDIR)/terractl
-	rm -rf $(DESTDIR)$(DOCDIR) $(DESTDIR)$(DATADIR)
+		$(DESTDIR)$(COMPLETIONDIR)/terractl $(DESTDIR)$(POLKITDIR)/50-terractl.rules
+	rm -rf $(DESTDIR)$(DOCDIR) $(DESTDIR)$(DATADIR) $(DESTDIR)$(PKGLIBDIR)
 	@if [ -z "$(DESTDIR)" ] && [ -d /run/systemd/system ]; then systemctl daemon-reload; fi
 	@echo "Removed. Kept: $(SYSCONFDIR)/default/terractl, $(SYSCONFDIR)/systemd/journald@terraria.conf,"
-	@echo "/var/lib/terraria, the servers' journal and the terraria user."
+	@echo "/var/lib/terraria, /var/lib/terractl (the daemon's certificate and trusted"
+	@echo "computers), the servers' journal and the terraria user."
 
 deb: check
 	rm -rf $(STAGE)
diff --git a/README.md b/README.md
index 8dffeaf..9e1ff73 100644
--- a/README.md
+++ b/README.md
@@ -5,7 +5,7 @@ Run any number of vanilla **Terraria** and **tModLoader** dedicated servers on o
 ```bash
 sudo terractl new calamity tmodloader
 sudo terractl mods calamity add ~/tmod-export
-sudo systemctl enable --now terraria@calamity
+sudo terractl enable calamity --now
 sudo terractl attach calamity
 ```
 
@@ -15,18 +15,20 @@ sudo terractl attach calamity
 - **Vanilla and tModLoader side by side**, chosen per instance.
 - **No manual installs.** Drop the official server zips into `/var/lib/terraria/dist`; they're unpacked on demand, and each instance can be pinned to a specific version.
 - **Safe shutdowns.** Stopping a server saves the world first.
-- **A live console.** `terractl attach` shows the server's output and lets you type commands into it.
+- **A live console.** `terractl attach` shows the server's output and lets you type commands into it; `terractl watch` just shows the output.
 - **Mod management.** `terractl mods` installs, enables and removes mods, with correct file ownership.
 - **Tab completion** for commands, instance names, mods and console commands.
 - **Export and import.** Pack an instance into one `.tar.gz` for backups or moving to another machine, and import it anywhere, with paths, ports and ownership adjusted.
+- **Manage other hosts.** Run any command on another host with `terractl --host nas ...`, and copy or move instances between hosts with `terractl copy` and `terractl move`, like LXD/Incus remotes. Hosts opt in by running the `terractld` daemon; access is per computer, over pinned TLS.
 - **Hardened.** Servers run as an unprivileged `terraria` user and can only write to their own data.
-- **Access for moderators.** Members of the `terraria` group can use the console and read the servers' own logs, without `sudo` and without seeing the rest of the system's logs.
+- **Access for moderators.** Members of the `terraria` group can start, stop and restart servers, use the console and read the servers' own logs, without `sudo` and without seeing the rest of the system's logs.
 - **Helper for Windows.** A PowerShell script exports your enabled tModLoader mods for the server.
 
 ## Requirements
 
 - Debian 12+ or Ubuntu 22.04+ (other systemd-based distributions should work with `make install`)
 - `unzip`, `systemd`; for tModLoader, also `curl` and ICU (`libicu`)
+- `python3` and `openssl`, for managing other hosts
 
 ## Install
 
diff --git a/bin/terractl b/bin/terractl
index d775c2c..62c7582 100755
--- a/bin/terractl
+++ b/bin/terractl
@@ -10,6 +10,9 @@
 #       serverconfig.txt                      normal Terraria server config (port, world, ...)
 #       server/                               unpacked server binaries (replaceable)
 #       data/                                 worlds, mods, player data (kept across reinstalls)
+#
+# Managing other hosts (--host, remote, daemon, copy, move) is done by
+# terractl-remote, in Python; see run_remote_helper.
 set -euo pipefail
 
 # Work from / so nothing depends on the caller's directory (which the 'terraria'
@@ -33,10 +36,32 @@ SVC_USER="${TERRARIA_USER:-terraria}"
 STOP_TIMEOUT="${TERRARIA_STOP_TIMEOUT:-80}"   # keep below TimeoutStopSec
 JOURNAL_NS=terraria                           # LogNamespace= in terraria@.service
 TERRACTL_VERSION="@VERSION@"                  # filled in by 'make install' / 'make deb'
+REMOTE_HELPER="@PKGLIBDIR@/terractl-remote"   # likewise
 
 die() { echo "terractl: $*" >&2; exit 1; }
 log() { echo "terractl: $*" >&2; }
 
+# Is <user> (default: whoever runs this) in the terraria group?
+in_group() {
+  [[ " $(id -nG "${1:-$(id -un)}" 2>/dev/null) " == *" $SVC_USER "* ]]
+}
+
+# A terractl command to suggest: hint root|group <command> [args...]. 'root'
+# commands need sudo; 'group' ones only for people outside the terraria group
+# (start/stop/restart are allowed to the group by the polkit rule). Under sudo,
+# it advises the person who ran sudo. When terractld runs a command for another
+# host, TERRACTL_VIA says how that host reaches this one (e.g. "--host nas").
+hint() {
+  local need=$1 who=${SUDO_USER:-$(id -un)}; shift
+  if [[ -n ${TERRACTL_VIA:-} ]]; then
+    echo "terractl $TERRACTL_VIA $*"
+  elif [[ $who == root ]] || { [[ $need == group ]] && in_group "$who"; }; then
+    echo "terractl $*"
+  else
+    echo "sudo terractl $*"
+  fi
+}
+
 usage() {
   cat <<EOF
 Usage: terractl <command> <instance> [args]
@@ -44,8 +69,13 @@ Usage: terractl <command> <instance> [args]
 
 Admin commands:
   new <name> [vanilla|tmodloader] [port]   create an instance (run as root)
-  list                                     show instances, type, port, state
+  list                                     show instances, type, port, boot, state
+  info [<name>]                            paths and zips of this host, or details of an instance
+  start|stop|restart <name>                start, stop (saves the world) or restart a server
+  enable <name> [--now]                    start at boot (--now: also start it now)
+  disable <name> [--now]                   don't start at boot (--now: also stop it now)
   attach <name>                            interactive console (Ctrl-D to detach)
+  watch <name> [-n <lines>] [-q]           follow the server's output, read-only (Ctrl-C to quit)
   cmd <name> <console command...>          send a console command (e.g. save, say hi)
   reinstall <name> [--clean]               re-unpack server on next start
                                            (--clean also re-downloads tModLoader's .NET)
@@ -54,17 +84,32 @@ Admin commands:
   mods <name> enable|disable <mod>...      change which installed mods load
   mods <name> remove <mod>...              uninstall mods
   delete <name> [-y] [--no-backup]         stop, disable and remove an instance
+  rename <name> <new name>                 rename an instance (restarted if it was running)
   export <name> [file.tar.gz] [--with-server]
                                            archive an instance (configs, worlds, mods)
   import <name> <file.tar.gz>              create instance <name> from an archive
                                            (worlds/configs archived to $BASE_DIR/.deleted/)
 
+Other hosts:
+  --host <remote> <command> [args]         run a command on another host (e.g. --host nas list)
+  copy [<remote>:]<name> [<remote>:][<new name>] [--with-server]
+                                           copy an instance, on this host or between hosts
+  move [<remote>:]<name> [<remote>:][<new name>] [--with-server]
+                                           move (or rename) an instance; stops it while moving
+  remote add <name> <token>                add a host to manage (token from 'daemon trust add')
+  remote add <name> <address> [<token>]    ... when the token's addresses don't work from here
+  remote list | remote remove <name>       show or forget remotes
+  daemon enable|disable|status             let other hosts manage this one (terractld.service)
+  daemon trust add <client>                create a one-time token for a computer to join
+  daemon trust list | trust remove <client>
+                                           show or revoke computers that may manage this host
+
 Used by terraria@.service:
   journal-access                           let the terraria group read the servers' journal
   prepare <name>                           create dirs/configs, unpack server if needed
   run <name>                               exec the server
-  stop <name> <mainpid>                    graceful shutdown via console "exit" (service only;
-                                           to stop a server use: systemctl stop terraria@<name>)
+  service-stop <name> <mainpid>            graceful shutdown via console "exit" (service only;
+                                           to stop a server use: terractl stop <name>)
 EOF
   exit "${1:-1}"
 }
@@ -239,7 +284,7 @@ take_lock() {
     state=$(systemctl show -p ActiveState --value "terraria@$name" 2>/dev/null || true)
     case $state in
       active|activating|deactivating|reloading)
-        die "terraria@$name is $state; stop it first: systemctl stop terraria@$name" ;;
+        die "terraria@$name is $state; stop it first: $(hint group stop "$name")" ;;
       *)
         die "instance '$name' is already running outside systemd (e.g. 'terractl run' in another terminal); stop that first" ;;
     esac
@@ -293,11 +338,12 @@ cmd_run() {
   esac
 }
 
-cmd_stop() {
+# ExecStop of terraria@.service
+cmd_service_stop() {
   local name=$1 pid=${2:-} fifo="$RUN_DIR/$1.stdin" i
   # systemd sets INVOCATION_ID for every process it runs for a service
   if [[ -z ${INVOCATION_ID:-} ]]; then
-    die "'stop' is only for terraria@.service. To stop the server: systemctl stop terraria@$name"
+    die "'service-stop' is only called by terraria@.service. To stop the server: $(hint group stop "$name")"
   fi
   if [[ -n $pid && ! $pid =~ ^[0-9]+$ ]]; then die "invalid process ID '$pid'"; fi
   if [[ -z $pid ]] || ! kill -0 "$pid" 2>/dev/null; then exit 0; fi
@@ -314,6 +360,42 @@ cmd_stop() {
   log "server did not exit within ${STOP_TIMEOUT}s; leaving it to systemd"
 }
 
+# start/stop/restart through systemd: root, or the terraria group through the
+# polkit rule (50-terractl.rules)
+cmd_svc() {
+  local action=$1 name=$2 unit="terraria@$2" state; shift 2
+  [[ $# -eq 0 ]] || die "usage: terractl $action <name>"
+  # Only checkable with read access to the instances (root or the group)
+  if [[ -x $BASE_DIR && ! -f $(inst_dir "$name")/instance.conf ]]; then
+    die "no instance '$name' (create it with: $(hint root new "$name"))"
+  fi
+  if [[ $EUID -ne 0 ]] && ! in_group; then
+    die "'$action' needs root or the '$SVC_USER' group: sudo terractl $action $name"
+  fi
+  state=$(systemctl is-active "$unit" 2>/dev/null || true)
+  case $action in
+    start)
+      if [[ $state == active ]]; then echo "$unit is already running"; return 0; fi
+      systemctl start "$unit"
+      echo "$unit started" ;;
+    stop)
+      if [[ $state == inactive || $state == failed ]]; then
+        if instance_running "$name"; then
+          die "'$name' is running outside systemd (e.g. 'terractl run' in another terminal); type 'exit' in its console"
+        fi
+        echo "$unit isn't running"
+        return 0
+      fi
+      echo "stopping $unit (saves the world first)..."
+      systemctl stop "$unit"
+      echo "$unit stopped" ;;
+    restart)
+      echo "restarting $unit (saves the world first)..."
+      systemctl restart "$unit"
+      echo "$unit restarted" ;;
+  esac
+}
+
 # The servers log to their own journal (LogNamespace=terraria), which the
 # 'terraria' group can read; see cmd_journal_access. It lives in
 # <machine-id>.terraria under /var/log/journal (or /run/log/journal).
@@ -341,7 +423,7 @@ can_read_journal() {
 
 journal_hint() {
   {
-    echo "Note: commands are sent, but you can't see the server's output."
+    echo "$1"
     if [[ " $(id -Gn) " == *" $SVC_USER "* ]]; then
       echo "You're in the '$SVC_USER' group, but the servers' journal isn't set up for it"
       echo "yet. That happens automatically when a server (re)starts, or run once:"
@@ -385,7 +467,7 @@ cmd_cmd() {
   if ! can_read_journal; then
     printf '%s\n' "$*" > "$fifo"
     echo "sent."
-    journal_hint
+    journal_hint "Note: commands are sent, but you can't see the server's output."
     return 0
   fi
 
@@ -412,7 +494,7 @@ cmd_cmd() {
     printf '%s\n' "$out"
   else
     echo "sent; no output from the server within 5s (it may be busy or still starting)."
-    echo "Watch it with: terractl attach $name"
+    echo "Watch it with: $(hint group attach "$name")"
   fi
 }
 
@@ -427,7 +509,7 @@ cmd_attach() {
     journalctl --namespace="$JOURNAL_NS" -u "terraria@$name" -f -n 30 -o cat &
     ATTACH_PID=$!    # killed by cleanup() however attach ends
   else
-    journal_hint
+    journal_hint "Note: commands are sent, but you can't see the server's output."
   fi
   trap 'echo; exit 0' INT
 
@@ -436,7 +518,7 @@ cmd_attach() {
     [[ -z $line ]] && continue
     if [[ $line == exit ]]; then
       echo "(not sent: 'exit' would shut the server down. Use Ctrl-D to detach," \
-           "or 'systemctl stop terraria@$name' to stop it.)"
+           "or '$(hint group stop "$name")' to stop it.)"
       continue
     fi
     printf '%s\n' "$line" > "$fifo"
@@ -444,6 +526,37 @@ cmd_attach() {
   echo
 }
 
+# Like attach, but only shows output: nothing typed is sent to the server, so
+# it's safe to leave running. Works whether or not the server is running.
+cmd_watch() {
+  local name=$1 lines=30 quiet=0; shift
+  while [[ $# -gt 0 ]]; do
+    case $1 in
+      -n|--lines)
+        [[ ${2:-} =~ ^[0-9]+$ ]] || die "$1 needs a number of lines"
+        lines=$2; shift ;;
+      -q|--quiet) quiet=1 ;;
+      *) die "unknown option '$1'" ;;
+    esac
+    shift
+  done
+  # Only checkable with read access to the instances (root or the group)
+  if [[ -x $BASE_DIR && ! -f $(inst_dir "$name")/instance.conf ]]; then
+    die "no instance '$name'"
+  fi
+  if ! can_read_journal; then
+    journal_hint "Can't show the server's output: no read access to the servers' journal."
+    exit 1
+  fi
+  if [[ $quiet -eq 0 ]]; then
+    if ! systemctl is-active --quiet "terraria@$name" 2>/dev/null; then
+      echo "terraria@$name isn't running; output will appear here once it starts."
+    fi
+    echo "Watching terraria@$name (read-only). Ctrl-C quits; the server keeps running."
+  fi
+  exec journalctl --namespace="$JOURNAL_NS" -u "terraria@$name" -f -n "$lines" -o cat
+}
+
 cmd_delete() {
   local name=$1; shift
   local assume_yes=0 backup=1 dir archive answer
@@ -497,6 +610,39 @@ cmd_delete() {
   echo "deleted instance '$name'"
 }
 
+# Gives an instance a new name: its folder, the paths in serverconfig.txt, and
+# its service (stopped and started again, and still starting at boot if it did).
+cmd_rename() {
+  local name=$1 new=${2:-} dir newdir state enabled
+  [[ $# -eq 2 ]] || die "usage: terractl rename <name> <new name>"
+  valid_name "$new"
+  [[ $EUID -eq 0 ]] || die "rename must be run as root: sudo terractl rename $name $new"
+  dir=$(inst_dir "$name"); newdir=$(inst_dir "$new")
+  [[ -f $dir/instance.conf ]] || die "no instance '$name'"
+  [[ ! -e $newdir ]] || die "instance '$new' already exists"
+  state=$(systemctl is-active "terraria@$name" 2>/dev/null || true)
+  enabled=$(systemctl is-enabled "terraria@$name" 2>/dev/null || true)
+  if [[ $state == inactive || $state == failed ]] && instance_running "$name"; then
+    die "'$name' is running outside systemd (e.g. 'terractl run' in another terminal); stop it first"
+  fi
+  if [[ $state == active || $state == activating || $state == reloading ]]; then
+    echo "stopping terraria@$name (saves the world first)..."
+    systemctl stop "terraria@$name"
+  fi
+  if [[ $enabled == enabled ]]; then systemctl disable -q "terraria@$name"; fi
+  systemctl reset-failed "terraria@$name.service" "terraria@$name.socket" 2>/dev/null || true
+  mv "$dir" "$newdir"
+  if [[ -f $newdir/serverconfig.txt ]]; then
+    sed -i -E "s#^(world|worldpath|banlist)=.*/data/#\1=$newdir/data/#" "$newdir/serverconfig.txt"
+  fi
+  echo "renamed '$name' to '$new'"
+  if [[ $enabled == enabled ]]; then systemctl enable -q "terraria@$new"; echo "terraria@$new starts at boot"; fi
+  if [[ $state == active || $state == activating || $state == reloading ]]; then
+    systemctl start "terraria@$new"
+    echo "terraria@$new started"
+  fi
+}
+
 # ------------------------------------------------------- export/import ----
 # Archive layout:  terractl-export.txt   (info about the export; optional)
 #                  <instance>/...        (instance.conf, serverconfig.txt, data/, [server/])
@@ -653,6 +799,13 @@ cmd_import() {
 
   # Keep the server version the world was exported with, unless one is pinned already
   load_conf "$name"
+  # A pin to an absolute path from another host usually doesn't exist here: use
+  # the zip of that name in this host's dist folder instead
+  if [[ $ZIP == /* && ! -r $ZIP && $(basename "$ZIP") =~ ^[A-Za-z0-9._+-]+\.zip$ ]]; then
+    log "ZIP=$ZIP isn't on this host; now ZIP=$(basename "$ZIP") (from $DIST_DIR)"
+    ZIP=$(basename "$ZIP")
+    sed -i "s/^ZIP=.*/ZIP=$ZIP/" "$dir/instance.conf"
+  fi
   if [[ -z $ZIP && $meta_zip =~ ^[A-Za-z0-9._+-]+\.zip$ ]]; then
     sed -i "s/^ZIP=.*/ZIP=$meta_zip/" "$dir/instance.conf"
     ZIP=$meta_zip
@@ -671,7 +824,7 @@ cmd_import() {
   else
     echo "imported '$name' into $dir"
   fi
-  echo "Review $dir/serverconfig.txt, then: systemctl enable --now terraria@$name"
+  echo "Review $dir/serverconfig.txt, then: $(hint root enable "$name" --now)"
 }
 
 # ---------------------------------------------------------------- mods ----
@@ -699,7 +852,7 @@ write_enabled() {   # write_enabled <mods dir> <name>...
 
 mods_restart_hint() {
   if systemctl is-active --quiet "terraria@$name" 2>/dev/null; then
-    echo "Restart to apply: sudo systemctl restart terraria@$name"
+    echo "Restart to apply: $(hint group restart "$name")"
   fi
 }
 
@@ -712,7 +865,7 @@ mods_list() {
   done
   if [[ ${#files[@]} -eq 0 ]]; then
     echo "No mods installed in $mdir"
-    echo "Add some with: terractl mods $name add <folder or .tmod files>"
+    echo "Add some with: $(hint root mods "$name" add "<folder or .tmod files>")"
     return 0
   fi
   printf '%-32s %s\n' MOD STATE
@@ -820,7 +973,7 @@ cmd_mods() {
   if [[ $# -gt 0 ]]; then shift; fi
   local dir mdir
   dir=$(inst_dir "$name")
-  [[ -f $dir/instance.conf ]] || die "no instance '$name' (create it with: terractl new $name tmodloader)"
+  [[ -f $dir/instance.conf ]] || die "no instance '$name' (create it with: $(hint root new "$name" tmodloader))"
   load_conf "$name"
   [[ $TYPE == tmodloader ]] || die "'$name' is a $TYPE instance; mods need TYPE=tmodloader"
   mdir="$dir/data/Mods"
@@ -850,26 +1003,67 @@ Created $type instance '$name' in $dir
 Review $dir/serverconfig.txt, then:
 EOF
   if [[ $type == tmodloader ]]; then
-    echo "  terractl mods $name add <folder or .tmod files>   (before first start)"
+    echo "  $(hint root mods "$name" add "<folder or .tmod files>")   (before first start)"
   fi
   cat <<EOF
-  systemctl enable --now terraria@$name
-  terractl attach $name
+  $(hint root enable "$name" --now)
+  $(hint group attach "$name")
 EOF
 }
 
+# Whether the server starts at boot. Needs root: systemd doesn't let polkit
+# rules limit enabling to our units, so the terraria group can't be allowed it.
+cmd_enable() {
+  local action=$1 name=$2 now=0 unit="terraria@$2"; shift 2
+  while [[ $# -gt 0 ]]; do
+    case $1 in
+      --now) now=1 ;;
+      *) die "unknown option '$1'" ;;
+    esac
+    shift
+  done
+  [[ $EUID -eq 0 ]] || die "'$action' needs root: sudo terractl $action $name$(if [[ $now -eq 1 ]]; then echo " --now"; fi)"
+  if [[ $action == enable ]]; then
+    # Enabling a name without an instance would create a default one at boot
+    [[ -f $(inst_dir "$name")/instance.conf ]] ||
+      die "no instance '$name' (create it with: $(hint root new "$name"))"
+    systemctl enable -q "$unit"
+    if [[ $now -eq 1 ]]; then
+      systemctl start "$unit"
+      echo "$unit started and will start at boot"
+    elif systemctl is-active --quiet "$unit"; then
+      echo "$unit will start at boot"
+    else
+      echo "$unit will start at boot. To start it now: $(hint group start "$name")"
+    fi
+  else
+    systemctl disable -q "$unit"
+    if [[ $now -eq 1 ]]; then
+      echo "stopping $unit (saves the world first)..."
+      systemctl stop "$unit"
+      echo "$unit stopped and won't start at boot"
+    elif systemctl is-active --quiet "$unit"; then
+      echo "$unit won't start at boot; it is still running. To stop it: $(hint group stop "$name")"
+    else
+      echo "$unit won't start at boot"
+    fi
+  fi
+}
+
 cmd_list() {
-  local d n port state
-  printf '%-20s %-11s %-6s %s\n' INSTANCE TYPE PORT STATE
+  local d n port boot state
+  printf '%-20s %-11s %-6s %-9s %s\n' INSTANCE TYPE PORT BOOT STATE
   for d in "$BASE_DIR"/*/; do
     [[ -f $d/instance.conf ]] || continue
     n=$(basename "$d")
     (
       load_conf "$n"
       port=$(sed -n 's/^port=\([0-9][0-9]*\).*/\1/p' "$d/serverconfig.txt" 2>/dev/null | tail -n1)
+      # enabled, disabled, or e.g. masked
+      boot=$(systemctl is-enabled "terraria@$n" 2>/dev/null || true)
       state=$(systemctl is-active "terraria@$n" 2>/dev/null || true)
       if [[ $state != active ]] && instance_running "$n"; then state="running (outside systemd)"; fi
-      printf '%-20s %-11s %-6s %s\n' "$n" "$TYPE" "${port:--}" "$state"
+      printf '%-20s %-11s %-6s %-9s %s\n' "$n" "$TYPE" "${port:--}" "${boot:--}" "$state"
     ) 2>/dev/null || printf '%-20s %s\n' "$n" "(cannot read config - try sudo)"
   done
 }
@@ -884,17 +1078,69 @@ cmd_reinstall() {
   esac
   [[ -f $dir/instance.conf ]] || die "no instance '$name'"
   if [[ $clean -eq 1 ]] && instance_running "$name"; then
-    die "'$name' is running; --clean would delete .NET under it. Stop it first: systemctl stop terraria@$name"
+    die "'$name' is running; --clean would delete .NET under it. Stop it first: $(hint group stop "$name")"
   fi
   rm -f "$dir/server/.installed"
   if [[ $clean -eq 1 ]]; then
     rm -rf "$dir/server/dotnet" "$dir/server/tModLoader-Logs"
     echo "removed the downloaded .NET runtime and logs; .NET will be downloaded again"
   fi
-  echo "server/ will be re-unpacked on next start: systemctl restart terraria@$name"
+  echo "server/ will be re-unpacked on next start: $(hint group restart "$name")"
+}
+
+# key=value facts, one per line, for people and for terractl-remote (copy, move,
+# tab completion). Without a name: this host. Repeated keys are lists.
+cmd_info() {
+  local name=${1:-} dir f ver installed="" port
+  if [[ -z $name ]]; then
+    ver=$TERRACTL_VERSION; if [[ $ver == *@* ]]; then ver=development; fi
+    echo "version=$ver"
+    echo "host=$(hostname 2>/dev/null || echo unknown)"
+    echo "base_dir=$BASE_DIR"
+    echo "dist_dir=$DIST_DIR"
+    echo "run_dir=$RUN_DIR"
+    for f in "$DIST_DIR"/*.zip; do
+      if [[ -f $f ]]; then echo "dist_zip=$(basename "$f")"; fi
+    done
+    for f in "$BASE_DIR"/*/instance.conf; do
+      if [[ -f $f ]]; then echo "instance=$(basename "$(dirname "$f")")"; fi
+    done
+    return 0
+  fi
+  dir=$(inst_dir "$name")
+  echo "instance=$name"
+  if [[ ! -f $dir/instance.conf ]]; then echo "exists=no"; return 0; fi
+  load_conf "$name"
+  if [[ -r $dir/server/.installed ]]; then read -r _ installed < "$dir/server/.installed" || true; fi
+  port=$(sed -n 's/^port=\([0-9][0-9]*\).*/\1/p' "$dir/serverconfig.txt" 2>/dev/null | tail -n1) || true
+  echo "exists=yes"
+  echo "dir=$dir"
+  echo "type=$TYPE"
+  echo "port=$port"
+  echo "pinned_zip=$ZIP"
+  echo "installed_zip=$installed"
+  echo "state=$(systemctl is-active "terraria@$name" 2>/dev/null || true)"
+  echo "boot=$(systemctl is-enabled "terraria@$name" 2>/dev/null || true)"
+  echo "running=$(if instance_running "$name"; then echo yes; else echo no; fi)"
+}
+
+# Other hosts are handled by terractl-remote (Python). It runs this script for
+# anything it does on this host, and passes on where it was called from.
+run_remote_helper() {
+  local helper=$REMOTE_HELPER ver=$TERRACTL_VERSION self
+  self=$(readlink -f "$0")
+  # A development copy uses the helper from its source tree
+  if [[ $helper == *@* ]]; then helper="$(dirname "$self")/../lib/terractl-remote"; fi
+  if [[ $ver == *@* ]]; then ver=development; fi
+  command -v python3 >/dev/null || die "this needs python3 (sudo apt install python3)"
+  TERRACTL_BIN=$self TERRACTL_VERSION=$ver TERRACTL_CALLER_PWD=$CALLER_PWD \
+    TERRACTL_LISTEN=${TERRACTL_LISTEN:-} exec python3 "$helper" "$@"
 }
 
 [[ $# -ge 1 ]] || usage
+case $1 in
+  --host|--host=*|-H|remote|daemon|copy|move) run_remote_helper "$@" ;;
+esac
 command=$1; shift
 case $command in
   -h|--help|help) usage 0 ;;
@@ -904,6 +1150,7 @@ case $command in
     else echo "terractl $TERRACTL_VERSION"; fi
     exit 0 ;;
   list) cmd_list; exit ;;
+  info) if [[ $# -eq 0 ]]; then cmd_info; exit; fi ;;
   journal-access) cmd_journal_access; exit ;;
 esac
 [[ $# -ge 1 ]] || usage
@@ -917,20 +1164,30 @@ if [[ $command == prepare || $command == run ]]; then
     exec runuser -u "$SVC_USER" -- env HOME="$(inst_dir "$1")" \
       "$(readlink -f "$0")" "$command" "$@"
   elif [[ $(id -un) != "$SVC_USER" ]]; then
-    die "$command must run as root or '$SVC_USER'"
+    # Being in the group isn't enough: files would end up owned by the caller
+    die "'$command' needs root (it switches to the '$SVC_USER' user by itself): sudo terractl $command $1"
   fi
 fi
 
 case $command in
   prepare)   cmd_prepare "$1" ;;
   run)       cmd_run "$1" ;;
-  stop)      cmd_stop "$@" ;;
+  service-stop) cmd_service_stop "$@" ;;
+  stop)
+    # Before 0.0.11 the service stopped servers with 'terractl stop <name> <pid>';
+    # a unit loaded before an upgrade may still do that
+    if [[ -n ${INVOCATION_ID:-} && $# -eq 2 ]]; then cmd_service_stop "$@"; else cmd_svc stop "$@"; fi ;;
+  start|restart) cmd_svc "$command" "$@" ;;
+  info)      cmd_info "$1" ;;
   cmd)       cmd_cmd "$@" ;;
   attach)    cmd_attach "$1" ;;
+  watch)     cmd_watch "$@" ;;
+  enable|disable) cmd_enable "$command" "$@" ;;
   mods)      cmd_mods "$@" ;;
   new)       cmd_new "$@" ;;
   reinstall) cmd_reinstall "$@" ;;
   delete)    cmd_delete "$@" ;;
+  rename)    cmd_rename "$@" ;;
   export)    cmd_export "$@" ;;
   import)    cmd_import "$@" ;;
   *)         usage ;;
diff --git a/completions/bash/terractl b/completions/bash/terractl
index d7e5392..02fcfbf 100644
--- a/completions/bash/terractl
+++ b/completions/bash/terractl
@@ -32,6 +32,33 @@ _terractl_instances() {
     fi
 }
 
+# Remotes this user added with 'terractl remote add'
+_terractl_remotes() {
+    local f=${TERRACTL_CONFIG_DIR:-${XDG_CONFIG_HOME:-$HOME/.config}/terractl}/remotes.json
+    [[ -r $f ]] || return 0
+    python3 -c 'import json, sys; print("\n".join(json.load(open(sys.argv[1]))["remotes"]))' "$f" 2>/dev/null
+}
+
+# Instance names on a remote. This asks its daemon, so it can take a moment.
+_terractl_remote_instances() {
+    timeout 5 terractl --host "$1" info 2>/dev/null </dev/null | sed -n 's/^instance=//p'
+}
+
+# [<remote>:]<name> for copy and move
+_terractl_places() {
+    if [[ $cur == -* ]]; then
+        _terractl_reply "--with-server"
+    elif [[ $cur == *:* ]]; then
+        mapfile -t COMPREPLY < <(compgen -P "${cur%:*}:" -W "$(_terractl_remote_instances "${cur%:*}")" -- "${cur##*:}")
+    else
+        mapfile -t COMPREPLY < <(compgen -W "$(_terractl_instances) $(_terractl_remotes | sed 's/$/:/')" -- "$cur")
+        # After "<remote>:" comes an instance name, not a space
+        if [[ ${#COMPREPLY[@]} -eq 1 && ${COMPREPLY[0]} == *: ]]; then compopt -o nospace 2>/dev/null; fi
+    fi
+    # Readline sees only the part after the last ':'
+    if declare -F __ltrim_colon_completions >/dev/null 2>&1; then __ltrim_colon_completions "$cur"; fi
+}
+
 # Mods installed in an instance (*.tmod files), or enabled ones (enabled.json)
 _terractl_mods() {
     local mdir f
@@ -70,16 +97,33 @@ _terractl() {
     if declare -F _init_completion >/dev/null 2>&1; then
         # shellcheck disable=SC2034  # prev is set by _init_completion but not needed here
         local prev
-        _init_completion || return
+        # -n : keeps "<remote>:<name>" (copy, move) in one word
+        _init_completion -n : || return
     else
         cur=${COMP_WORDS[COMP_CWORD]}
         words=("${COMP_WORDS[@]}")
         cword=$COMP_CWORD
     fi
 
-    local commands="new list attach cmd mods reinstall delete export import prepare run --help --version"
+    local commands="new list info start stop restart enable disable attach watch cmd mods reinstall delete rename export import"
     local console="save say playing kick ban motd password time dawn noon dusk midnight settle seed version maxplayers port clear help"
 
+    # terractl --host <remote> <command> ...: the same as on this host, except
+    # that instance names come from the remote and mod names aren't offered
+    local host=""
+    if [[ ${words[1]:-} == --host || ${words[1]:-} == -H ]]; then
+        if (( cword == 2 )); then
+            _terractl_reply "$(_terractl_remotes)"
+            return
+        fi
+        host=${words[2]}
+        words=("${words[0]}" "${words[@]:3}")
+        cword=$((cword - 2))
+        commands+=" --help --version"
+    else
+        commands+=" copy move remote daemon prepare run --host --help --version"
+    fi
+
     if (( cword == 1 )); then
         _terractl_reply "$commands"
         return
@@ -97,10 +141,31 @@ _terractl() {
             # import <new name> <file.tar.gz>: the name is new, so nothing to offer
             if (( cword == 3 )); then _terractl_files tar.gz; fi
             return ;;
+        copy|move)
+            _terractl_places
+            return ;;
+        remote)
+            if (( cword == 2 )); then
+                _terractl_reply "add list remove"
+            elif (( cword == 3 )) && [[ ${words[2]} == remove ]]; then
+                _terractl_reply "$(_terractl_remotes)"
+            fi
+            return ;;
+        daemon)
+            if (( cword == 2 )); then
+                _terractl_reply "enable disable status trust"
+            elif (( cword == 3 )) && [[ ${words[2]} == trust ]]; then
+                _terractl_reply "add list remove"
+            fi
+            return ;;
     esac
 
     if (( cword == 2 )); then
-        _terractl_reply "$(_terractl_instances)"
+        if [[ -n $host ]]; then
+            _terractl_reply "$(_terractl_remote_instances "$host")"
+        else
+            _terractl_reply "$(_terractl_instances)"
+        fi
         return
     fi
 
@@ -110,6 +175,11 @@ _terractl() {
             if (( cword == 3 )); then _terractl_reply "$console"; fi ;;
         reinstall)
             if (( cword == 3 )); then _terractl_reply "--clean"; fi ;;
+        enable|disable)
+            if (( cword == 3 )); then _terractl_reply "--now"; fi ;;
+        watch)
+            # the number after -n is free-form
+            if [[ $cur == -* ]]; then _terractl_reply "-n -q"; fi ;;
         delete)
             _terractl_reply "-y --yes --no-backup" ;;
         export)
@@ -124,9 +194,9 @@ _terractl() {
                     # .tmod files and folders (e.g. the Windows export folder)
                     _terractl_files tmod ;;
                 enable|remove)
-                    _terractl_reply "$(_terractl_mods "$instance" installed)" ;;
+                    if [[ -z $host ]]; then _terractl_reply "$(_terractl_mods "$instance" installed)"; fi ;;
                 disable)
-                    _terractl_reply "$(_terractl_mods "$instance" enabled)" ;;
+                    if [[ -z $host ]]; then _terractl_reply "$(_terractl_mods "$instance" enabled)"; fi ;;
             esac ;;
     esac
 }
diff --git a/config/default/terractl b/config/default/terractl
index a6041e4..ebcd0f5 100644
--- a/config/default/terractl
+++ b/config/default/terractl
@@ -12,3 +12,8 @@
 
 # Seconds to wait for a server to save and exit on stop (keep below 90)
 #TERRARIA_STOP_TIMEOUT=80
+
+# Where terractld (terractl daemon) listens for other hosts: an address and/or
+# port. Default: all addresses, port 7776. After changing it:
+#   sudo systemctl restart terractld
+#TERRACTL_LISTEN=10.0.10.77:7776
diff --git a/config/polkit/terractl.rules b/config/polkit/terractl.rules
new file mode 100644
index 0000000..dbcf62b
--- /dev/null
+++ b/config/polkit/terractl.rules
@@ -0,0 +1,23 @@
+// Members of the 'terraria' group may start, stop and restart Terraria servers
+// (terraria@<name>.service) without sudo. Nothing else: enable/disable and all
+// other units still need root.
+//
+// Starting a name that has no instance yet creates a vanilla instance with
+// default settings, as it does for root.
+//
+// Needs polkit 0.106 or newer (JavaScript rules); Ubuntu 22.04's 0.105 ignores it.
+polkit.addRule(function(action, subject) {
+    if (action.id != "org.freedesktop.systemd1.manage-units" ||
+        !subject.isInGroup("terraria")) {
+        return polkit.Result.NOT_HANDLED;
+    }
+    // Same names terractl accepts (valid_name)
+    var unit = action.lookup("unit") || "";
+    var verb = action.lookup("verb") || "";
+    var verbs = ["start", "stop", "restart", "try-restart", "reset-failed"];
+    if (/^terraria@[A-Za-z0-9_][A-Za-z0-9_.-]*\.service$/.test(unit) &&
+        verbs.indexOf(verb) >= 0) {
+        return polkit.Result.YES;
+    }
+    return polkit.Result.NOT_HANDLED;
+});
diff --git a/docs/guide.md b/docs/guide.md
index 9a896fc..1ccab34 100644
--- a/docs/guide.md
+++ b/docs/guide.md
@@ -16,14 +16,15 @@ Run any number of vanilla Terraria and tModLoader dedicated servers on one Linux
 10. [Configuration](#configuration)
 11. [Mods (tModLoader)](#mods-tmodloader)
 12. [Versions and upgrades](#versions-and-upgrades)
-13. [Deleting and restoring](#deleting-and-restoring)
+13. [Deleting, renaming and restoring](#deleting-renaming-and-restoring)
 14. [Exporting and importing](#exporting-and-importing)
-15. [Backups](#backups)
-16. [Permissions](#permissions)
-17. [Running by hand for debugging](#running-by-hand-for-debugging)
-18. [Troubleshooting](#troubleshooting)
-19. [Tab completion](#tab-completion)
-20. [Command reference](#command-reference)
+15. [Managing other hosts](#managing-other-hosts)
+16. [Backups](#backups)
+17. [Permissions](#permissions)
+18. [Running by hand for debugging](#running-by-hand-for-debugging)
+19. [Troubleshooting](#troubleshooting)
+20. [Tab completion](#tab-completion)
+21. [Command reference](#command-reference)
 
 ---
 
@@ -49,10 +50,13 @@ Everything is installed by the `terraria-server-manager` package:
 | `/usr/lib/systemd/system/terraria@.service` | Template service. One copy runs per instance. |
 | `/usr/lib/systemd/system/terraria@.socket` | Creates the console pipe the server reads commands from. |
 | `/usr/bin/terractl` | Helper script. The service calls it to set up, run and stop servers; you use it for everyday management. |
-| `/etc/default/terractl` | Optional overrides (locations, stop timeout). |
+| `/usr/lib/terraria-server-manager/terractl-remote` | The part of `terractl` that manages other hosts (`--host`, `remote`, `daemon`, `copy`, `move`), in Python. |
+| `/usr/lib/systemd/system/terractld.service` | The daemon that lets other hosts manage this one. Off until you turn it on (see [Managing other hosts](#managing-other-hosts)). |
+| `/etc/default/terractl` | Optional overrides (locations, stop timeout, the daemon's address). |
 | `/etc/systemd/journald@terraria.conf` | Size and retention of the servers' own journal (see [Logs](#logs)). |
 | `/usr/lib/sysusers.d/terractl.conf` | Defines the `terraria` system user. |
 | `/usr/lib/tmpfiles.d/terractl.conf` | Creates `/var/lib/terraria` and its subdirectories. |
+| `/usr/share/polkit-1/rules.d/50-terractl.rules` | Lets members of the `terraria` group start, stop and restart servers without `sudo`. |
 | `/usr/share/terraria-server-manager/export-tmod-mods.ps1` | Optional. Copy to your Windows PC to collect your enabled tModLoader mods. |
 
 What happens when an instance starts:
@@ -61,7 +65,7 @@ What happens when an instance starts:
 2. `terractl prepare <name>` creates the instance directory and default configs if they're missing, and unpacks the server zip if it hasn't been unpacked yet.
 3. `terractl run <name>` starts the vanilla or tModLoader server, reading commands from the pipe and logging to the servers' own journal (see [Logs](#logs)).
 
-On stop, `terractl stop` sends `exit` through the pipe so the world is saved before the server shuts down.
+On stop, `terractl service-stop` sends `exit` through the pipe so the world is saved before the server shuts down.
 
 ---
 
@@ -86,6 +90,8 @@ On stop, `terractl stop` sends `exit` through the pipe so the world is saved bef
     └── .deleted/                     Backups made by 'terractl delete'
 
 /run/terraria/<name>.stdin            Console pipe (exists only while running)
+
+/var/lib/terractl/                    The daemon's certificate and trusted computers (root only)
 ```
 
 The server can write only inside `instances/`. It reads `dist/` but can never change it.
@@ -100,15 +106,15 @@ The package works on Debian 12 or newer and Ubuntu 22.04 or newer.
 sudo apt install ./terraria-server-manager_0.0.9_all.deb
 ```
 
-Using `apt install ./file.deb` (rather than `dpkg -i`) installs the dependencies automatically. `unzip` is required. `curl` and the ICU library are "recommended", which apt installs by default; they're only needed for tModLoader instances, which crash with `Aborted` without ICU.
+Using `apt install ./file.deb` (rather than `dpkg -i`) installs the dependencies automatically. `unzip` is required. `curl` and the ICU library are "recommended", which apt installs by default; they're only needed for tModLoader instances, which crash with `Aborted` without ICU. `polkitd` is also recommended: it lets members of the `terraria` group start and stop servers without `sudo` (see [Permissions](#permissions)).
 
 Installing the package:
 
 - creates the `terraria` system user and group;
 - creates `/var/lib/terraria/`, `/var/lib/terraria/instances/` and `/var/lib/terraria/dist/`;
-- installs the units and helper script.
+- installs the units, the helper script and the polkit rule.
 
-It doesn't start or enable anything.
+It doesn't start or enable anything, including the daemon for managing the host from elsewhere.
 
 If you use a firewall, open each instance's port for **TCP**. Terraria uses TCP only.
 
@@ -173,6 +179,8 @@ sudo make install          # or install directly without a package (PREFIX=/usr/
 sudo make uninstall        # removes a 'make install' (keeps settings and data)
 ```
 
+`make install` with a prefix other than `/usr` puts the polkit rule in `/etc/polkit-1/rules.d/`, because polkit doesn't read `/usr/local`.
+
 The version comes from the `VERSION` file. Set `Maintainer:` in `packaging/deb/control` to yourself before publishing packages.
 
 ### Changing locations
@@ -281,7 +289,7 @@ Instance names may contain letters, digits, `_`, `-` and `.`, and must not start
 sudo terractl new calamity tmodloader
 sudo terractl mods calamity add ~/tmod-export     # your mods, before the first start
 sudo nano /var/lib/terraria/instances/calamity/serverconfig.txt                     # optional: world size, difficulty
-sudo systemctl enable --now terraria@calamity
+sudo terractl enable calamity --now
 sudo terractl attach calamity                       # watch it load and generate the world
 ```
 
@@ -291,24 +299,41 @@ You can also skip `new` and just run `sudo systemctl start terraria@<name>`. Tha
 
 ## Starting, stopping and boot
 
-Instances are ordinary systemd services:
+Instances are ordinary systemd services, which `terractl` starts and stops for you:
 
 ```bash
-sudo systemctl start terraria@calamity
-sudo systemctl stop terraria@calamity        # saves the world, then exits
-sudo systemctl restart terraria@calamity
-sudo systemctl enable terraria@calamity      # start at boot
-sudo systemctl disable terraria@calamity     # don't start at boot
-sudo systemctl enable --now terraria@calamity  # both at once
-systemctl status terraria@calamity
+sudo terractl start calamity
+sudo terractl stop calamity          # saves the world, then exits
+sudo terractl restart calamity
 ```
 
-To see all instances with their type, port and state:
+These are the same as `systemctl start|stop|restart terraria@<name>`, which work too; `systemctl status terraria@<name>` shows the details. `terractl start` refuses names that have no instance, whereas `systemctl start` creates one.
+
+Whether a server starts at boot is set with `terractl`:
+
+```bash
+sudo terractl enable calamity             # start at boot
+sudo terractl enable calamity --now       # start at boot, and start it now
+sudo terractl disable calamity            # don't start at boot (a running server keeps running)
+sudo terractl disable calamity --now      # don't start at boot, and stop it now (saves the world)
+```
+
+These do the same as `systemctl enable`/`disable terraria@<name>`, which also still work. `terractl enable` refuses names that have no instance, so a typo can't create a new instance at the next boot.
+
+Members of the `terraria` group can `start`, `stop` and `restart` servers without `sudo` (see [Permissions](#permissions)). `enable` and `disable` always need `sudo`.
+
+To see all instances with their type, port, whether they start at boot, and state:
 
 ```bash
 sudo terractl list
 ```
 
+```
+INSTANCE             TYPE        PORT   BOOT      STATE
+calamity             tmodloader  7778   enabled   active
+survival             vanilla     7777   disabled  inactive
+```
+
 Behaviour to be aware of:
 
 - **Crashes restart automatically** after 10 seconds.
@@ -330,10 +355,20 @@ sudo terractl attach calamity
 
 This shows the last 30 lines of output and then follows it live. Anything you type is sent to the server, with arrow-key editing and history. **Ctrl-D** or **Ctrl-C** detaches, and the server keeps running.
 
-`attach` will not send `exit`, since that would stop the server. Use `systemctl stop` to stop it.
+`attach` will not send `exit`, since that would stop the server. Use `terractl stop` to stop it.
 
 The one visible difference from a real terminal: the server's `:` prompt only appears once a newline follows it.
 
+### Read-only: `watch`
+
+```bash
+terractl watch calamity             # last 30 lines, then follow
+terractl watch calamity -n 200      # start with the last 200 lines
+terractl watch calamity -q          # without the lines about what it's doing
+```
+
+`watch` shows the server's output like `attach` does, but never sends anything to the server. That makes it safe to leave open, for instance on a second screen, with no risk of typing into the console. **Ctrl-C** quits and the server keeps running. It also works while the server is stopped: it shows the last output and picks up again when the server starts.
+
 ### One-off commands: `cmd`
 
 ```bash
@@ -343,7 +378,7 @@ sudo terractl cmd calamity say Restarting in 5 minutes
 
 `cmd` prints the server's reply, then returns once the server has been quiet for a second (at most 5 seconds). For example, `terractl cmd calamity playing` lists who's online. That makes it handy in scripts and cron jobs too. If the server doesn't answer within 5 seconds (for instance while it's still loading), `cmd` says so; the command has still been sent.
 
-Members of the `terraria` group can use `attach` and `cmd` fully, output included, without `sudo`. See [Logs](#logs) for how that's arranged.
+Members of the `terraria` group can use `attach`, `watch` and `cmd` fully, output included, without `sudo`. See [Logs](#logs) for how that's arranged.
 
 ### Logs
 
@@ -543,7 +578,7 @@ sudo systemctl restart terraria@calamity
 
 ---
 
-## Deleting and restoring
+## Deleting, renaming and restoring
 
 ```bash
 sudo terractl delete calamity                  # asks you to type the name
@@ -557,11 +592,17 @@ To restore an instance, import its backup. You can give it back its old name, or
 
 ```bash
 sudo terractl import calamity /var/lib/terraria/instances/.deleted/calamity-20260928-134422.tar.gz
-sudo systemctl enable --now terraria@calamity           # server/ is unpacked again on start
+sudo terractl enable calamity --now                     # server/ is unpacked again on start
 ```
 
 `.deleted/` is never cleaned up automatically. Remove old archives yourself.
 
+To give an instance another name, use `rename`. It stops the server if it's running, renames the folder, updates the paths in `serverconfig.txt`, and starts it again under the new name. The port, world, mods and unpacked server stay as they are, and if it started at boot, it still does:
+
+```bash
+sudo terractl rename calamity calamity-old
+```
+
 ---
 
 ## Exporting and importing
@@ -599,11 +640,13 @@ After extracting, it adjusts the instance for its new home:
 
 `import` also accepts:
 
-- the backups that `delete` makes (see [Deleting and restoring](#deleting-and-restoring));
+- the backups that `delete` makes (see [Deleting, renaming and restoring](#deleting-renaming-and-restoring));
 - a plain archive of an instance folder, including one from the old `/opt/terraria` manual setup, e.g. `tar -czf old.tar.gz -C /opt/terraria calamity`.
 
 ### Moving a server to another machine
 
+If the new machine runs the daemon, `sudo terractl move calamity newhost:` does all of this in one step; see [Managing other hosts](#managing-other-hosts). By hand:
+
 ```bash
 # old machine
 sudo terractl export calamity /tmp/calamity.tar.gz
@@ -611,11 +654,116 @@ scp /tmp/calamity.tar.gz newhost:/tmp/
 
 # new machine (with terraria-server-manager installed, and the same zip in dist/)
 sudo terractl import calamity /tmp/calamity.tar.gz
-sudo systemctl enable --now terraria@calamity
+sudo terractl enable calamity --now
 ```
 
 ---
 
+## Managing other hosts
+
+One computer can manage the Terraria servers of several hosts. A host that should be managed runs **the daemon**, `terractld`. The computers that manage it add it as a **remote**, as with LXD or Incus remotes. Then any command can be run there with `--host`, and instances can be copied and moved between hosts:
+
+```bash
+terractl --host nas list
+terractl --host nas attach calamity
+sudo terractl move calamity nas:             # this host → nas
+terractl copy nas:calamity pi:test           # nas → pi, as 'test'
+```
+
+### Turning on the daemon
+
+On the host to be managed:
+
+```bash
+sudo terractl daemon enable
+```
+
+This starts `terractld.service` and makes it start at boot. It listens on **TCP port 7776**, on all addresses. If a firewall is active, allow that port (for example `sudo ufw allow 7776/tcp`), ideally only from the computers that will manage the host. To listen on one address or on another port, set `TERRACTL_LISTEN` in `/etc/default/terractl` (e.g. `TERRACTL_LISTEN=10.0.10.77:7776`) and run `sudo systemctl restart terractld`.
+
+`sudo terractl daemon disable` turns it off again. `terractl daemon status` shows whether it's running, where it listens and its certificate's fingerprint, and with `sudo`, which computers it trusts.
+
+The daemon is an ordinary systemd service: systemd starts it at boot, restarts it if it crashes, and keeps its log. `journalctl -u terractld` lists every command it ran and for which computer.
+
+### Adding a remote
+
+Each computer that should manage the host needs a one-time token. On the host with the daemon:
+
+```bash
+sudo terractl daemon trust add laptop
+```
+
+`laptop` is a name for the computer, used in the host's log and to revoke it later. The command prints what to run on that computer:
+
+```bash
+terractl remote add nas tctl1_eyJ2IjoxLCJmcCI6...
+```
+
+`nas` is the name you'll use for the host there; choose any. The token contains the host's addresses, so usually nothing else is needed. If none of them works from the computer (behind NAT, for example), add the address: `terractl remote add nas 203.0.113.5 tctl1_...`, or `nas.example.com:7800` for another port.
+
+A token works **once**, **within 24 hours**. Remotes are kept per user in `~/.config/terractl/remotes.json`, readable only by you. Under `sudo`, the remotes of the person who ran sudo are used.
+
+```bash
+terractl remote list                # your remotes
+terractl remote remove nas          # forget one
+```
+
+### Running commands on a remote: `--host`
+
+Put `--host <remote>` in front of any command:
+
+```bash
+terractl --host nas list
+terractl --host nas new calamity tmodloader
+terractl --host nas mods calamity add ~/tmod-export         # sends the files
+terractl --host nas enable calamity --now
+terractl --host nas attach calamity
+terractl --host nas export calamity                         # fetches ./calamity-<date>-<time>.tar.gz
+terractl --host nas import calamity2 calamity.tar.gz        # sends the archive
+```
+
+`<remote>` is a remote's name, or the address it was added with (`--host 10.0.10.77`). No `sudo` is needed on either side: the daemon runs each command as root on its host, as if it had been typed there with `sudo`. File arguments (`mods add`, `import`, `export`) are files on *your* computer; they're sent to the host or fetched from it. Messages that suggest a command show it as `terractl --host nas ...`.
+
+Not available with `--host`:
+
+- `remote`, `daemon`, `copy` and `move` run on your computer (copy and move take `<remote>:<name>` instead).
+- The service's own commands (`prepare`, `run`, `service-stop`, `journal-access`).
+- Editing `serverconfig.txt` still needs a shell on that host.
+
+### Copying and moving instances
+
+```bash
+terractl copy calamity nas:                   # to nas, same name
+sudo terractl copy nas:calamity cal-test      # from nas to this host, as cal-test
+terractl copy nas:calamity pi:                # between two remotes
+sudo terractl move calamity nas:              # to nas; removed here
+terractl move nas:calamity pi:                # between two remotes
+sudo terractl move calamity survival2         # rename, on this host (same as rename)
+```
+
+Each side is `[<remote>:]<name>`, and without a remote it's this host. Leave out the destination name (`nas:`) to keep the name.
+
+A copy is an [export](#exporting-and-importing) on the source, a transfer, and an import on the destination, so everything import does applies. Paths are set to the **destination's** folders, whatever its `TERRARIA_BASE` is: they're asked from the destination, never assumed. A port that's taken there is replaced with a free one, and the server version is pinned.
+
+- **The server zip comes along if needed.** If the destination's `dist/` doesn't have the zip the instance runs, it's copied from the source's `dist/`. If the source doesn't have it either, nothing is changed and you're told so; put the zip on the destination first, or use `--with-server` to take the unpacked server along.
+- **Copy leaves the source running.** A running server is asked to save first, so the copy has the world as of that save. Anything that happens in the game after it isn't included. The copy isn't started.
+- **Move within one host is a rename** (`sudo terractl move calamity calamity-old`, or `nas:a nas:b`): nothing is copied, and the port and unpacked server stay the same. See [Deleting, renaming and restoring](#deleting-renaming-and-restoring).
+- **Move stops the source first**, which saves the world, and removes it from the source only after the import worked. `delete`'s usual backup is kept in the source's `.deleted/`. If the source was running, the moved instance is started on the destination, and if it started at boot, it does there too. If something fails before the import has worked, the source is started again and nothing else changes.
+- **Transfers go through the computer you run the command on.** Between two remotes, the archive streams from one to the other through your computer without being stored on it.
+
+On this host, copying *from* it works for members of the `terraria` group. Copying *to* it, and moving away from it, needs `sudo`, like `import` and `delete` do.
+
+### Security
+
+- **Encrypted and pinned.** Traffic is HTTPS (TLS 1.2 or newer). The daemon's certificate is self-signed, the token carries its fingerprint, and every connection checks it, so nothing in between can pose as the daemon. If the fingerprint ever changes, `terractl` refuses to connect and says so.
+- **Keys, not passwords.** Joining trades the token for a random key for that computer. The daemon keeps only hashes of keys and tokens, in `/var/lib/terractl/trust.json` (root only).
+- **A trusted computer is an admin of the host's servers.** It can do what `sudo terractl` can: create, delete, import, start and stop instances, and install mods or server files, which run as the `terraria` user. It can't change the daemon or run anything other than `terractl`. Give tokens only to computers you'd trust with `sudo terractl`.
+- **Revoking.** `sudo terractl daemon trust list` shows the trusted computers, and `sudo terractl daemon trust remove laptop` takes one's access away immediately.
+- **Firewall.** The daemon doesn't need to be reachable from the internet. Limit port 7776 to your LAN or VPN, or set `TERRACTL_LISTEN` to a LAN or VPN address.
+
+The daemon runs as root, because it creates and removes instances and starts services, but with systemd's protections it can't write to `/usr`, `/boot`, `/etc` or home folders. Its certificate, key and trust list are in `/var/lib/terractl/`. Files in transit are kept in `/var/lib/terractl/transfers/`, and removed once used, after 6 hours unused, or when the daemon restarts.
+
+---
+
 ## Backups
 
 Everything worth keeping is in `data/`, `instance.conf` and `serverconfig.txt`, which is exactly what `export` saves. A nightly backup kept for 14 days, as a root cron job (`sudo crontab -e`):
@@ -635,19 +783,27 @@ The servers always run as the `terraria` user. Administration is simplest with `
 | Command | Who can run it | Notes |
 |---|---|---|
 | `new` | root (or `terraria`) | Run as root, it sets ownership of the new instance to `terraria` itself. |
-| `list` | root, or members of the `terraria` group | `/var/lib/terraria` is not readable by other users. |
+| `list`, `info` | root, or members of the `terraria` group | `/var/lib/terraria` is not readable by other users. |
+| `start`, `stop`, `restart` | root, or members of the `terraria` group | Through systemd, where the polkit rule allows the group (see `systemctl start/stop/restart` below). |
+| `enable`, `disable` | root only | Checked by the script. systemd can't restrict these to Terraria servers, so the group can't be allowed them. |
 | Adding zips to `dist/` | root, or members of the `terraria` group | |
 | `attach` | root, or members of the `terraria` group | Writes to the console pipe and reads the servers' journal. |
 | `cmd` | root, or members of the `terraria` group | Same as `attach`. |
+| `watch` | root, or members of the `terraria` group | Reads the servers' journal only. |
 | `reinstall` | root (or `terraria`) | |
 | `mods <name>` (list) | root, or members of the `terraria` group | |
 | `mods add/enable/disable/remove` | root (or `terraria`) | Run as root, it sets ownership of the files it installs to `terraria`. |
-| `delete` | root only | Checked by the script. |
+| `delete`, `rename` | root only | Checked by the script. |
 | `export` | root, or members of the `terraria` group | Reads the instance, and asks a running server to save. |
 | `import` | root (or `terraria`) | Run as root, it gives the new instance to `terraria`. |
 | `prepare`, `run` | Normally only the service | Run as root, they automatically switch to the `terraria` user, so no files end up owned by root. Any other user is refused. |
-| `stop` | Only the service | Needs the server's process ID from systemd. |
-| `systemctl start/stop/enable` | root | |
+| `service-stop` | Only the service | Needs the server's process ID from systemd. |
+| `daemon enable`, `daemon disable`, `daemon trust ...` | root only | |
+| `daemon status` | anyone | Shows the trusted computers only with `sudo`. |
+| `remote ...`, `--host ...` | anyone | Uses your own remotes. On the remote, the daemon runs the command as root. |
+| `copy`, `move` | depends on this host's part | Copying from this host: the group is enough. Copying to it, or moving away from it: root. |
+| `systemctl start/stop/restart terraria@...` | root, or members of the `terraria` group | Allowed by the polkit rule `50-terractl.rules`. Needs `polkitd` 0.106 or newer, so not on Ubuntu 22.04, where it needs `sudo`. Starting a name that has no instance creates a vanilla one with default settings. |
+| `systemctl enable/disable terraria@...` | root | Same as `terractl enable`/`disable`. |
 | `journalctl --namespace=terraria ...` | root, or members of the `terraria` group | The servers' output only; see [Logs](#logs). |
 | `journalctl -u terraria@...` (system journal) | root, or members of `systemd-journal` or `adm` | systemd's start/stop messages. |
 
@@ -682,14 +838,14 @@ Editing an existing file with `sudo nano` keeps its owner, so it's fine.
 Stop the service first. `terractl` won't let two copies of the same server run at once: if the service is running, `run` refuses and tells you to stop it.
 
 ```bash
-sudo systemctl stop terraria@calamity
+sudo terractl stop calamity
 sudo terractl run calamity      # automatically runs as 'terraria'
 ```
 
 The server runs in your terminal and you can type commands into it directly. Type `exit` to stop it, then start the service again:
 
 ```bash
-sudo systemctl start terraria@calamity
+sudo terractl start calamity
 ```
 
 ### How running servers are protected
@@ -702,7 +858,7 @@ While a server runs, whether systemd started it or you did, it holds a lock on t
 - **`delete` stops the service**, but refuses to go on if a copy started by hand is still running.
 - **`list` shows a copy started by hand** as `running (outside systemd)`.
 
-`terractl stop` is only for the service's own use. Typed by hand, it tells you to use `systemctl stop terraria@<name>` instead.
+`terractl stop` only stops the service. A copy started by hand is stopped by typing `exit` in its terminal.
 
 ---
 
@@ -741,7 +897,7 @@ Run `terractl mods <name>` to check for mods that are enabled but missing. Then
 Two instances share a port. Check the ports with `sudo terractl list`. A second copy of the *same* instance can't be the cause, because `terractl` prevents it.
 
 **"already running outside systemd" or "is active; stop it first".**
-The instance's server is already running, so the command was refused to protect it. Stop the server first. If it was started with `terractl run` in another terminal, type `exit` there; otherwise use `sudo systemctl stop terraria@<name>`.
+The instance's server is already running, so the command was refused to protect it. Stop the server first. If it was started with `terractl run` in another terminal, type `exit` there; otherwise use `terractl stop <name>`.
 
 **The service starts but you can't connect.**
 Check the port in `serverconfig.txt`, your firewall (TCP), and router port forwarding.
@@ -750,11 +906,20 @@ Check the port in `serverconfig.txt`, your firewall (TCP), and router port forwa
 Both commands print a note explaining why. If you were just added to the `terraria` group, log out and back in. If you're already in it, the servers' journal hasn't been set up for the group yet; that happens automatically when a server starts, or run `sudo terractl journal-access`. Servers that were running before upgrading to 0.0.11 keep logging to the system journal until they're restarted.
 
 **The server isn't restarting after it stopped.**
-It exited cleanly, probably via `exit` in the console, so systemd leaves it stopped. Start it again with `systemctl start`.
+It exited cleanly, probably via `exit` in the console, so systemd leaves it stopped. Start it again with `terractl start`.
 
 **The world was created without mod content.**
 It was generated before the mods were added. Delete the world files in `data/Worlds/` (or point `world=` at a new name) and restart to generate a new one.
 
+**`can't reach nas at 10.0.10.77:7776`.**
+The daemon isn't running on that host (check with `terractl daemon status` there), a firewall blocks the port, or the host's address changed. After an address change, remove the remote and add it again with a new token.
+
+**`isn't the one 'nas' was added with: its certificate changed`.**
+The daemon has a different certificate than when you added it. That's expected if `/var/lib/terractl` was deleted there, or the package was purged and installed again; remove the remote and add it again. If nothing like that happened, don't work around it: something may be intercepting the connection.
+
+**`doesn't trust this computer (any more)`.**
+Its access was revoked with `daemon trust remove`, or that computer was added again under the same name elsewhere. Get a new token.
+
 ---
 
 ## Tab completion
@@ -765,7 +930,8 @@ It was generated before the mods were added. Delete the world files in `data/Wor
 - instance names;
 - `vanilla`/`tmodloader` for `new`;
 - common server console commands for `cmd` (`save`, `say`, `playing`, `kick`...);
-- the options of `reinstall`, `delete` and `export`;
+- the options of `enable`, `disable`, `watch`, `reinstall`, `delete`, `export`, `copy` and `move`;
+- remote names after `--host`, and `<remote>:<name>` for `copy` and `move`. Instance names on a remote are asked from its daemon, so they can take a moment;
 - `.tar.gz` files for `export` and `import`;
 - `mods` actions. For `mods add` it completes `.tmod` files and folders; for `mods enable` and `mods remove`, the installed mods; for `mods disable`, the enabled ones.
 
@@ -779,8 +945,13 @@ Completion runs as *you*, even when you type `sudo`. Instance and mod names ther
 
 ```
 terractl new <name> [vanilla|tmodloader] [port]   Create an instance (not started)
-terractl list                                     Show instances, type, port, state
+terractl list                                     Show instances, type, port, boot, state
+terractl info [<name>]                            This host's paths and zips, or an instance's details
+terractl start|stop|restart <name>                Start, stop (saves the world) or restart
+terractl enable <name> [--now]                    Start at boot (--now: and start now)
+terractl disable <name> [--now]                   Don't start at boot (--now: and stop now)
 terractl attach <name>                            Interactive console (Ctrl-D detaches)
+terractl watch <name> [-n <lines>] [-q]           Follow the output, read-only (Ctrl-C quits)
 terractl cmd <name> <command...>                  Send one console command
 terractl reinstall <name> [--clean]               Re-unpack server/ on next start
                                                   (--clean also re-downloads .NET)
@@ -789,15 +960,30 @@ terractl mods <name> add <folder|file.tmod>...    Install and enable mods (and M
 terractl mods <name> enable|disable <Mod>...      Change which mods load
 terractl mods <name> remove <Mod>...              Uninstall mods
 terractl delete <name> [-y] [--no-backup]         Stop, disable, back up and remove
+terractl rename <name> <new name>                 Rename (restarted if it was running)
 terractl export <name> [file.tar.gz] [--with-server]
                                                   Archive an instance (configs, worlds, mods)
 terractl import <name> <file.tar.gz>              Create an instance from an archive
 terractl --version                                Show the installed version
 
+Other hosts:
+terractl --host <remote> <command> [args]         Run a command on a remote
+terractl copy [<remote>:]<name> [<remote>:][<new name>] [--with-server]
+                                                  Copy an instance, here or between hosts
+terractl move [<remote>:]<name> [<remote>:][<new name>] [--with-server]
+                                                  Move or rename an instance
+terractl remote add <name> <token>                Add a remote (token from 'daemon trust add')
+terractl remote add <name> <address> [<token>]    ... at an address the token doesn't list
+terractl remote list | remove <name>              Show or forget remotes
+terractl daemon enable|disable|status             Let other hosts manage this one
+terractl daemon trust add|remove <name>           Create a token for a computer, or revoke one
+terractl daemon trust list                        Show trusted computers and unused tokens
+
 Used by the service:
 terractl prepare <name>                           Create dirs/configs, unpack zip if needed
 terractl run <name>                               Run the server
-terractl stop <name> <pid>                        Save and shut down via the console (service only)
+terractl service-stop <name> <pid>                Save and shut down via the console (service only)
+terractl daemon serve                             Run the daemon (terractld.service)
 ```
 
 ```
diff --git a/lib/__pycache__/terractl-remotecpython-314.pyc b/lib/__pycache__/terractl-remotecpython-314.pyc
new file mode 100644
index 0000000..f777ff8
Binary files /dev/null and b/lib/__pycache__/terractl-remotecpython-314.pyc differ
diff --git a/lib/terractl-remote b/lib/terractl-remote
new file mode 100755
index 0000000..7b1b6e5
--- /dev/null
+++ b/lib/terractl-remote
@@ -0,0 +1,1949 @@
+#!/usr/bin/python3
+# terractl-remote - manage Terraria servers on other hosts (terraria-server-manager)
+#
+# Run by terractl (never directly) for:
+#   terractl daemon ...             the daemon other hosts connect to (terractld.service)
+#   terractl remote ...             the hosts this user manages ("remotes")
+#   terractl --host <remote> ...    any terractl command, run on a remote
+#   terractl copy|move ...          instances between hosts, or within one
+#
+# How it fits together: the daemon is a small HTTPS server that does everything
+# by running terractl on its own host, so paths, checks and file ownership are
+# exactly as if someone had run terractl there. Copy and move are 'export' on
+# the source, a file transfer, and 'import' on the destination; import adapts
+# the instance to the destination's folders and free ports.
+#
+# Security: the daemon's certificate is self-signed. A computer joins with a
+# one-time token from 'terractl daemon trust add', which holds the certificate's
+# fingerprint and a secret. The client checks that fingerprint on every
+# connection, so nothing in between can pose as the daemon, and trades the
+# secret for a random key of its own, sent with each request. The daemon stores
+# only SHA-256 hashes of keys and secrets. A trusted computer can do what
+# 'sudo terractl' can do on that host, except change the daemon itself.
+#
+# Python standard library only (3.9 or newer).
+
+import base64
+import codecs
+import errno
+import fcntl
+import getpass
+import hashlib
+import hmac
+import http.client
+import http.server
+import json
+import os
+import pwd
+import re
+import secrets
+import select
+import shlex
+import shutil
+import signal
+import socket
+import socketserver
+import ssl
+import stat
+import subprocess
+import sys
+import tarfile
+import tempfile
+import threading
+import time
+import traceback
+import urllib.parse
+from pathlib import PurePosixPath
+
+API = 1                          # changes only if old and new versions can't talk
+DEFAULT_PORT = 7776              # one below the first game port terractl hands out
+DAEMON_UNIT = "terractld.service"
+TOKEN_PREFIX = "tctl1_"
+TOKEN_HOURS = 24
+TRANSFER_HOURS = 6               # files sent to the daemon but never used are removed after this
+CHUNK = 1024 * 1024
+PING_SECONDS = 20                # a quiet stream sends a ping this often...
+STREAM_TIMEOUT = 90              # ...so hearing nothing for this long means the connection is gone
+IO_TIMEOUT = 120
+MAX_CONNECTIONS = 64
+
+TERRACTL = os.environ.get("TERRACTL_BIN") or "terractl"
+VERSION = os.environ.get("TERRACTL_VERSION") or "development"
+STATE_DIR = os.environ.get("TERRACTL_STATE_DIR") or "/var/lib/terractl"
+CERT, KEY, TRUST = "server.crt", "server.key", "trust.json"
+
+NAME_RE = re.compile(r"[A-Za-z0-9_][A-Za-z0-9_.-]*")         # instances and remotes (valid_name)
+CLIENT_RE = re.compile(r"[A-Za-z0-9_][A-Za-z0-9_.@-]{0,63}")
+ZIP_RE = re.compile(r"[A-Za-z0-9_][A-Za-z0-9._+-]*\.zip")
+OUTPUT_RE = re.compile(r"[A-Za-z0-9_][A-Za-z0-9_.-]*\.(tar\.gz|tgz)")
+VIA_RE = re.compile(r"--host [A-Za-z0-9_.:\[\]%-]{1,200}")
+
+
+class Fail(Exception):
+    """Shown to the user as 'terractl: <message>'; exit status 1."""
+
+
+class Unreachable(Fail):
+    """Couldn't connect to a daemon, or it wasn't the expected one."""
+
+
+def die(message):
+    raise Fail(message)
+
+
+def log(message):
+    print(f"terractl: {message}", file=sys.stderr, flush=True)
+
+
+def human_size(n):
+    if n < 1000:
+        return f"{n} bytes"
+    for unit in ("KB", "MB", "GB", "TB"):
+        n /= 1000
+        if n < 1000 or unit == "TB":
+            return f"{n:.1f} {unit}"
+
+
+def sha256(text):
+    return hashlib.sha256(text.encode()).hexdigest()
+
+
+def split_hostport(text, default_port=DEFAULT_PORT):
+    """'host', 'host:port', '[v6addr]:port', 'v6addr' or 'port' -> (host, port).
+    An empty host means all addresses."""
+    text = text.strip()
+    host, port = text, ""
+    if text.startswith("["):
+        host, sep, rest = text[1:].partition("]")
+        if not sep or (rest and not rest.startswith(":")):
+            die(f"invalid address '{text}'")
+        port = rest[1:]
+    elif text.isdigit():
+        host, port = "", text
+    elif text.count(":") == 1:
+        host, port = text.split(":")
+    if port == "":
+        return host, default_port
+    if not port.isdigit() or not 0 < int(port) < 65536:
+        die(f"invalid port in '{text}'")
+    return host, int(port)
+
+
+def join_hostport(host, port):
+    return f"[{host}]:{port}" if ":" in host else f"{host}:{port}"
+
+
+def describe_listen(host, port):
+    if host in ("", "::"):
+        return f"all addresses, port {port}"
+    if host == "0.0.0.0":
+        return f"all IPv4 addresses, port {port}"
+    return join_hostport(host, port)
+
+
+def listen_setting():
+    """Where the daemon listens: TERRACTL_LISTEN from /etc/default/terractl."""
+    return split_hostport(os.environ.get("TERRACTL_LISTEN", ""))
+
+
+def parse_info(text):
+    """'terractl info' output -> {key: [values]} (some keys repeat)."""
+    info = {}
+    for line in text.splitlines():
+        key, sep, value = line.partition("=")
+        if sep:
+            info.setdefault(key, []).append(value)
+    return info
+
+
+def one(info, key, default=""):
+    values = info.get(key)
+    return values[-1] if values else default
+
+
+def terractl(args, capture=False, show_stdout=True):
+    """Runs terractl on this host. Its messages go straight to the terminal."""
+    if capture:
+        stdout = subprocess.PIPE
+    else:
+        stdout = None if show_stdout else subprocess.DEVNULL
+    try:
+        return subprocess.run([TERRACTL, *args], stdout=stdout, text=True)
+    except OSError as e:
+        die(f"can't run {TERRACTL}: {e.strerror}")
+
+
+def systemctl(*args):
+    try:
+        return subprocess.run(["systemctl", *args], stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
+    except OSError:
+        return subprocess.CompletedProcess(args, 1, "", "systemctl not found")
+
+
+def big_tempdir():
+    """A private folder for archives, on disk rather than in memory (/tmp may be tmpfs)."""
+    try:
+        return tempfile.mkdtemp(prefix="terractl-", dir="/var/tmp")
+    except OSError:
+        return tempfile.mkdtemp(prefix="terractl-")
+
+
+# ---------------------------------------------------------- daemon state ----
+# <STATE_DIR>/server.crt, server.key  the daemon's certificate
+#            /trust.json              trusted computers and waiting tokens (hashed)
+#            /transfers/              files in transit (cleared when the daemon starts)
+
+def state_path(*parts):
+    return os.path.join(STATE_DIR, *parts)
+
+
+def need_root(cmdline):
+    if os.geteuid() != 0:
+        die(f"this needs root: sudo terractl {cmdline}")
+
+
+def open_state(cmdline):
+    try:
+        os.makedirs(STATE_DIR, mode=0o755, exist_ok=True)
+    except PermissionError:
+        die(f"this needs root: sudo terractl {cmdline}")
+    if not os.access(STATE_DIR, os.W_OK):
+        die(f"this needs root: sudo terractl {cmdline}")
+
+
+class StateLock:
+    """Serialises changes to trust.json between the daemon and 'terractl daemon trust'."""
+
+    def __enter__(self):
+        self.fd = os.open(state_path(".lock"), os.O_RDWR | os.O_CREAT, 0o600)
+        fcntl.flock(self.fd, fcntl.LOCK_EX)
+
+    def __exit__(self, *exc):
+        os.close(self.fd)
+
+
+def ensure_cert():
+    crt, key = state_path(CERT), state_path(KEY)
+    if os.path.exists(crt) and os.path.exists(key):
+        return
+    with StateLock():
+        if os.path.exists(crt) and os.path.exists(key):
+            return
+        host = socket.gethostname() or "localhost"
+        new_crt, new_key = crt + ".new", key + ".new"
+        old_umask = os.umask(0o077)
+        try:
+            proc = subprocess.run(
+                ["openssl", "req", "-x509", "-newkey", "ec", "-pkeyopt", "ec_paramgen_curve:prime256v1",
+                 "-sha256", "-nodes", "-days", "3650", "-subj", f"/CN=terractld@{host}",
+                 "-keyout", new_key, "-out", new_crt],
+                stdout=subprocess.DEVNULL, stderr=subprocess.PIPE, text=True)
+        except OSError:
+            die("openssl is not installed (sudo apt install openssl)")
+        finally:
+            os.umask(old_umask)
+        if proc.returncode != 0:
+            die(f"creating the daemon's certificate failed: {proc.stderr.strip()}")
+        os.chmod(new_crt, 0o644)
+        os.replace(new_key, key)
+        os.replace(new_crt, crt)
+
+
+def cert_fingerprint():
+    with open(state_path(CERT)) as f:
+        return hashlib.sha256(ssl.PEM_cert_to_DER_cert(f.read())).hexdigest()
+
+
+def load_trust():
+    try:
+        with open(state_path(TRUST)) as f:
+            trust = json.load(f)
+    except FileNotFoundError:
+        trust = {}
+    except ValueError as e:
+        die(f"{state_path(TRUST)} is damaged ({e})")
+    trust.setdefault("clients", [])
+    trust.setdefault("tokens", [])
+    return trust
+
+
+def save_trust(trust):
+    tmp = state_path(TRUST + ".new")
+    fd = os.open(tmp, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+    with os.fdopen(fd, "w") as f:
+        json.dump(trust, f, indent=2)
+        f.write("\n")
+    os.replace(tmp, state_path(TRUST))
+
+
+def make_token(fields):
+    raw = json.dumps(fields, separators=(",", ":")).encode()
+    return TOKEN_PREFIX + base64.urlsafe_b64encode(raw).decode().rstrip("=")
+
+
+def read_token(text):
+    text = text.strip()
+    if not text.startswith(TOKEN_PREFIX):
+        die(f"that isn't a terractl token (they start with {TOKEN_PREFIX})")
+    body = text[len(TOKEN_PREFIX):]
+    try:
+        fields = json.loads(base64.urlsafe_b64decode(body + "=" * (-len(body) % 4)))
+    except ValueError:
+        fields = None
+    if (not isinstance(fields, dict) or not isinstance(fields.get("s"), str)
+            or not re.fullmatch(r"[0-9a-f]{64}", str(fields.get("fp", "")))):
+        die("the token is damaged; copy it again (it's one long line)")
+    return fields
+
+
+def host_addresses(listen_host, port):
+    """Addresses to put in a token, likeliest to be reachable first."""
+    if listen_host not in ("", "::", "0.0.0.0"):
+        return [join_hostport(listen_host, port)]
+    found = []
+    try:
+        # The address of the default route; nothing is actually sent
+        with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as s:
+            s.connect(("192.0.2.1", 9))
+            found.append(s.getsockname()[0])
+    except OSError:
+        pass
+    try:
+        found += subprocess.run(["hostname", "-I"], stdout=subprocess.PIPE, stderr=subprocess.DEVNULL,
+                                text=True, timeout=5).stdout.split()
+    except (OSError, subprocess.SubprocessError):
+        pass
+    result = []
+    for addr in found:
+        if addr.startswith(("127.", "fe80:")) or addr == "::1" or addr in result:
+            continue
+        if listen_host == "0.0.0.0" and ":" in addr:
+            continue
+        result.append(addr)
+    return [join_hostport(a, port) for a in result]
+
+
+# --------------------------------------------------------------- daemon ----
+
+EXEC_COMMANDS = {"list", "info", "new", "start", "stop", "restart", "enable", "disable", "cmd", "watch",
+                 "mods", "reinstall", "delete", "rename", "export", "import",
+                 "-V", "--version", "version", "-h", "--help", "help"}
+
+
+class HttpError(Exception):
+    def __init__(self, status, message):
+        super().__init__(message)
+        self.status = status
+
+
+def dlog(message):
+    """The daemon's log (the journal, under systemd)."""
+    print(message, file=sys.stderr, flush=True)
+
+
+def child_env(via=""):
+    """Environment for terractl run by the daemon. Minimal, and in particular
+    without systemd's INVOCATION_ID, which 'terractl stop' would take to mean
+    it's being run as terraria@.service's ExecStop."""
+    env = {"PATH": "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+           "LANG": "C.UTF-8", "HOME": os.environ.get("HOME", "/root"), "TERM": "dumb",
+           "SYSTEMD_COLORS": "0", "SYSTEMD_PAGER": "", "PAGER": "cat"}
+    env.update((k, v) for k, v in os.environ.items() if k.startswith("TERRARIA_"))
+    if via:
+        env["TERRACTL_VIA"] = via
+    return env
+
+
+def local_host_info(env=None):
+    proc = subprocess.run([TERRACTL, "info"], stdout=subprocess.PIPE, stderr=subprocess.PIPE,
+                          text=True, cwd="/", env=env)
+    if proc.returncode != 0:
+        raise RuntimeError(f"terractl info failed: {proc.stderr.strip()}")
+    return parse_info(proc.stdout)
+
+
+class Transfers:
+    """Files sent to the daemon, and exports waiting to be fetched. Each lives in
+    its own folder under <state>/transfers and is used once."""
+
+    def __init__(self, root):
+        self.root = root
+        self.lock = threading.Lock()
+        self.items = {}
+        shutil.rmtree(root, ignore_errors=True)      # left over from before a restart
+        os.makedirs(root, mode=0o700)
+
+    def new_dir(self):
+        return tempfile.mkdtemp(dir=self.root)
+
+    def add(self, path):
+        tid = secrets.token_hex(16)
+        with self.lock:
+            self.items[tid] = {"path": path, "dir": os.path.dirname(path), "time": time.time()}
+        return tid
+
+    def take(self, tid):
+        with self.lock:
+            item = self.items.pop(tid, None) if isinstance(tid, str) else None
+        if item is None:
+            raise HttpError(404, f"that file is gone (unused files are removed after {TRANSFER_HOURS} hours)")
+        return item
+
+    @staticmethod
+    def remove(item):
+        shutil.rmtree(item["dir"], ignore_errors=True)
+
+    def expire(self):
+        cutoff = time.time() - TRANSFER_HOURS * 3600
+        with self.lock:
+            old = [tid for tid, item in self.items.items() if item["time"] < cutoff]
+            gone = [self.items.pop(tid) for tid in old]
+        for item in gone:
+            self.remove(item)
+
+
+def extract_upload(tar_path, dest):
+    """Unpacks the files and folders sent for 'mods add'. Only plain files and
+    folders are accepted, and nothing may land outside dest."""
+    try:
+        with tarfile.open(tar_path) as tar:
+            for member in tar:
+                parts = PurePosixPath(member.name).parts
+                if not parts:
+                    continue
+                if parts[0] == "/" or ".." in parts:
+                    raise HttpError(400, f"unsafe path in the files sent: {member.name}")
+                target = os.path.join(dest, *parts)
+                if member.isdir():
+                    os.makedirs(target, mode=0o755, exist_ok=True)
+                elif member.isfile():
+                    os.makedirs(os.path.dirname(target), mode=0o755, exist_ok=True)
+                    with tar.extractfile(member) as src, open(target, "xb") as out:
+                        shutil.copyfileobj(src, out, CHUNK)
+                    os.chmod(target, 0o644)
+                else:
+                    raise HttpError(400, f"the files sent include a link or special file: {member.name}")
+    except (tarfile.TarError, FileExistsError) as e:
+        raise HttpError(400, f"the files sent aren't a valid archive ({e})")
+
+
+class Handler(http.server.BaseHTTPRequestHandler):
+    protocol_version = "HTTP/1.1"
+    server_version = "terractld"
+    sys_version = ""
+    timeout = IO_TIMEOUT
+
+    def log_message(self, format, *args):
+        pass       # requests are logged by what they do
+
+    def do_GET(self):
+        self.dispatch()
+
+    do_POST = do_PUT = do_DELETE = do_GET
+
+    def dispatch(self):
+        self.who = None
+        self.started = self.streaming = self.body_read = False
+        try:
+            if "Transfer-Encoding" in self.headers:
+                raise HttpError(411, "send a Content-Length")
+            path = urllib.parse.urlsplit(self.path).path
+            parts = [urllib.parse.unquote(p) for p in path.strip("/").split("/")]
+            if parts[0] != "1.0":
+                raise HttpError(404, "not found")
+            self.route(self.command, parts[1:])
+        except HttpError as e:
+            self.fail(e.status, str(e))
+        except (ConnectionError, TimeoutError, ssl.SSLError):
+            self.close_connection = True
+        except OSError as e:
+            self.fail(500, e.strerror or str(e))
+        except Exception:
+            dlog(f"{self.who or self.client_address[0]}: {self.command} {self.path} failed:\n"
+                 f"{traceback.format_exc()}")
+            self.fail(500, "internal error; see the daemon's log: journalctl -u terractld")
+
+    def route(self, method, p):
+        if method == "POST" and p == ["trust", "join"]:
+            return self.join()
+        self.who = self.authenticate()
+        if method == "GET" and p == []:
+            return self.send_json(200, self.server.host_info())
+        if method == "POST" and p == ["exec"]:
+            return self.run_command()
+        if method == "PUT" and p == ["files"]:
+            return self.put_file()
+        if len(p) == 2 and p[0] == "files" and method in ("GET", "DELETE"):
+            item = self.server.transfers.take(p[1])
+            try:
+                if method == "GET":
+                    self.send_file(item["path"])
+                else:
+                    self.send_json(200, {})
+            finally:
+                self.server.transfers.remove(item)
+            return
+        if len(p) == 2 and p[0] == "console" and method == "POST":
+            return self.console(p[1])
+        if len(p) == 2 and p[0] == "dist" and method in ("GET", "PUT"):
+            return self.get_zip(p[1]) if method == "GET" else self.put_zip(p[1])
+        raise HttpError(404, "not found")
+
+    # ---- plumbing
+
+    def authenticate(self):
+        auth = self.headers.get("Authorization", "")
+        if auth.startswith("Bearer "):
+            digest = sha256(auth[7:].strip())
+            for client in load_trust()["clients"]:
+                if hmac.compare_digest(client.get("key_sha256", ""), digest):
+                    return client["name"]
+        dlog(f"{self.client_address[0]}: refused (not a trusted key)")
+        raise HttpError(401, "not a trusted key")
+
+    def fail(self, status, message):
+        self.close_connection = True
+        try:
+            if self.streaming:
+                self.frame({"error": message})
+            elif not self.started:
+                # Closing with unread data would reset the connection before the
+                # client reads the error; small bodies are read first (big ones
+                # are uploads, which clients only start once they know they're in)
+                length = self.content_length() if not self.body_read else 0
+                if length <= 1 << 20:
+                    self.rfile.read(length)
+                self.send_json(status, {"error": message}, close=True)
+        except (OSError, HttpError):
+            pass
+
+    def send_json(self, status, obj, close=False):
+        body = (json.dumps(obj) + "\n").encode()
+        self.send_response(status)
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(body)))
+        if close:
+            self.send_header("Connection", "close")
+            self.close_connection = True
+        self.end_headers()
+        self.started = True
+        self.wfile.write(body)
+
+    def content_length(self):
+        try:
+            length = int(self.headers.get("Content-Length", "0"))
+        except ValueError:
+            length = -1
+        if length < 0:
+            raise HttpError(400, "bad Content-Length")
+        return length
+
+    def read_json(self):
+        length = self.content_length()
+        if length > 1 << 20:
+            raise HttpError(413, "request too large")
+        self.body_read = True
+        try:
+            data = json.loads(self.rfile.read(length) or b"{}")
+        except ValueError:
+            data = None
+        if not isinstance(data, dict):
+            raise HttpError(400, "bad request")
+        return data
+
+    def receive(self, path, length):
+        """Saves the request body to a new file."""
+        self.body_read = True
+        with open(path, "xb") as f:
+            left = length
+            while left:
+                data = self.rfile.read(min(CHUNK, left))
+                if not data:
+                    raise HttpError(400, "the upload was cut off")
+                f.write(data)
+                left -= len(data)
+
+    def send_file(self, path):
+        with open(path, "rb") as f:
+            size = os.fstat(f.fileno()).st_size
+            self.send_response(200)
+            self.send_header("Content-Type", "application/octet-stream")
+            self.send_header("Content-Length", str(size))
+            self.end_headers()
+            self.started = True
+            shutil.copyfileobj(f, self.wfile, CHUNK)
+
+    def frame(self, obj):
+        self.wfile.write((json.dumps(obj) + "\n").encode())
+
+    # ---- endpoints
+
+    def join(self):
+        secret = self.read_json().get("secret")
+        if not isinstance(secret, str):
+            raise HttpError(400, "bad request")
+        digest = sha256(secret)
+        with StateLock():
+            trust = load_trust()
+            now = time.time()
+            trust["tokens"] = [t for t in trust["tokens"] if t.get("expires", 0) > now]
+            token = next((t for t in trust["tokens"]
+                          if hmac.compare_digest(t.get("secret_sha256", ""), digest)), None)
+            if token is None:
+                save_trust(trust)
+                dlog(f"{self.client_address[0]}: refused a join (unknown, used or expired token)")
+                raise HttpError(403, "this token is not valid (it may have been used already, or "
+                                     "expired); create a new one there: sudo terractl daemon trust add <name>")
+            trust["tokens"].remove(token)
+            key = secrets.token_urlsafe(32)
+            name = token["name"]
+            trust["clients"] = [c for c in trust["clients"] if c.get("name") != name]
+            trust["clients"].append({"name": name, "key_sha256": sha256(key),
+                                     "added": time.strftime("%Y-%m-%d %H:%M"),
+                                     "from": self.client_address[0]})
+            save_trust(trust)
+        dlog(f"{self.client_address[0]}: joined as '{name}'")
+        self.send_json(200, {"name": name, "key": key})
+
+    def resolve(self, args, cleanup):
+        """The command line to run from a client's arguments. Where terractl takes
+        file paths, only files sent to the daemon are accepted, never paths on
+        this host: import <name> <file>, export <name> [file], mods <name> add
+        <files or folders>."""
+        if not isinstance(args, list) or not args or not all(isinstance(a, (str, dict)) for a in args):
+            raise HttpError(400, "bad request")
+        command = args[0]
+        if not isinstance(command, str) or command not in EXEC_COMMANDS:
+            raise HttpError(400, f"'{command}' can't be run from another host")
+        mods_add = command == "mods" and len(args) > 2 and args[2] == "add"
+        argv, shown, output = [command], [command], None
+        for i, arg in enumerate(args[1:], start=1):
+            if isinstance(arg, str):
+                takes_path = ((command == "import" and i == 2)
+                              or (command == "export" and i >= 2 and arg != "--with-server")
+                              or (mods_add and i >= 3))
+                if takes_path or "\0" in arg:
+                    raise HttpError(400, f"'{command}' takes files sent along with the request, "
+                                         "not paths on the daemon's host")
+                argv.append(arg)
+                shown.append(arg)
+            elif command == "import" and i == 2 and set(arg) == {"file"}:
+                item = self.server.transfers.take(arg["file"])
+                cleanup.append(item["dir"])
+                argv.append(item["path"])
+                shown.append("<file>")
+            elif mods_add and i >= 3 and set(arg) == {"dir"}:
+                item = self.server.transfers.take(arg["dir"])
+                cleanup.append(item["dir"])
+                dest = self.server.transfers.new_dir()
+                cleanup.append(dest)
+                extract_upload(item["path"], dest)
+                entries = sorted(os.listdir(dest))
+                if not entries:
+                    raise HttpError(400, "no files were sent")
+                argv += [os.path.join(dest, e) for e in entries]
+                shown += entries
+            elif command == "export" and i >= 2 and set(arg) == {"output"} and output is None:
+                if not isinstance(arg["output"], str) or not OUTPUT_RE.fullmatch(arg["output"]):
+                    raise HttpError(400, "bad output file name")
+                dest = self.server.transfers.new_dir()
+                cleanup.append(dest)
+                output = os.path.join(dest, arg["output"])
+                argv.append(output)
+                shown.append("<file>")
+            else:
+                raise HttpError(400, "bad request")
+        return argv, shown, output
+
+    def run_command(self):
+        """POST /1.0/exec: runs terractl and streams its output as JSON lines:
+        {"o": stdout text}, {"e": stderr text}, {"p": 1} (keepalive), and last
+        {"x": exit status, "file": {...}} (an export to fetch, if any)."""
+        req = self.read_json()
+        via = req.get("via") or ""
+        if not isinstance(via, str) or (via and not VIA_RE.fullmatch(via)):
+            raise HttpError(400, "bad request")
+        cleanup = []
+        try:
+            argv, shown, output = self.resolve(req.get("args"), cleanup)
+            proc = subprocess.Popen([TERRACTL, *argv], stdin=subprocess.DEVNULL, stdout=subprocess.PIPE,
+                                    stderr=subprocess.PIPE, cwd="/", env=child_env(via),
+                                    start_new_session=True)
+            self.server.track(proc)
+            dlog(f"{self.who}: terractl {shlex.join(shown)}")
+            try:
+                self.send_response(200)
+                self.send_header("Content-Type", "application/x-ndjson")
+                self.send_header("Connection", "close")
+                self.end_headers()
+                self.close_connection = True
+                self.started = self.streaming = True
+                if not self.pump(proc):
+                    dlog(f"{self.who}: went away; stopped terractl {shown[0]}")
+                    return
+                final = {"x": proc.wait()}
+                if output and final["x"] == 0 and os.path.isfile(output):
+                    cleanup.remove(os.path.dirname(output))
+                    final["file"] = {"id": self.server.transfers.add(output),
+                                     "name": os.path.basename(output), "size": os.path.getsize(output)}
+                self.frame(final)
+            finally:
+                self.server.untrack(proc)
+        finally:
+            for path in cleanup:
+                shutil.rmtree(path, ignore_errors=True)
+
+    def pump(self, proc):
+        """Sends a process's output as it comes. False if the client went away."""
+        streams = {proc.stdout.fileno(): ["o", codecs.getincrementaldecoder("utf-8")("replace")],
+                   proc.stderr.fileno(): ["e", codecs.getincrementaldecoder("utf-8")("replace")]}
+        sock = self.connection
+        quiet_since = time.monotonic()
+        while streams:
+            ready, _, _ = select.select([*streams, sock], [], [], PING_SECONDS)
+            if sock in ready and self.client_left():
+                return False
+            for fd in ready:
+                if fd is sock:
+                    continue
+                key, decoder = streams[fd]
+                data = os.read(fd, 65536)
+                text = decoder.decode(data, final=not data)
+                if text:
+                    self.frame({key: text})
+                    quiet_since = time.monotonic()
+                if not data:
+                    del streams[fd]
+            if time.monotonic() - quiet_since >= PING_SECONDS:
+                self.frame({"p": 1})
+                quiet_since = time.monotonic()
+        return True
+
+    def client_left(self):
+        sock = self.connection
+        sock.settimeout(0)
+        try:
+            return sock.recv(4096) == b""
+        except (ssl.SSLWantReadError, BlockingIOError):
+            return False
+        except OSError:
+            return True
+        finally:
+            sock.settimeout(IO_TIMEOUT)
+
+    def put_file(self):
+        length = self.content_length()
+        dest = self.server.transfers.new_dir()
+        path = os.path.join(dest, "upload")
+        try:
+            self.receive(path, length)
+        except BaseException:
+            shutil.rmtree(dest, ignore_errors=True)
+            raise
+        self.send_json(200, {"id": self.server.transfers.add(path)})
+
+    def console(self, name):
+        """A line for a server's console (attach), or {"check": true} to ask
+        whether the console is there."""
+        if not NAME_RE.fullmatch(name):
+            raise HttpError(400, f"invalid instance name '{name}'")
+        req = self.read_json()
+        fifo = os.path.join(self.server.run_dir, f"{name}.stdin")
+        try:
+            is_fifo = stat.S_ISFIFO(os.stat(fifo).st_mode)
+        except FileNotFoundError:
+            is_fifo = False
+        if not is_fifo:
+            raise HttpError(409, f"{fifo} not found - is terraria@{name} running?")
+        if req.get("check"):
+            return self.send_json(200, {})
+        line = req.get("line")
+        if not isinstance(line, str) or "\n" in line or "\r" in line or len(line) > 4096:
+            raise HttpError(400, "bad console line")
+        try:
+            fd = os.open(fifo, os.O_WRONLY | os.O_NONBLOCK)
+        except OSError as e:
+            if e.errno == errno.ENXIO:
+                raise HttpError(409, f"nothing reads {fifo}; is terraria@{name} running?")
+            raise
+        try:
+            os.write(fd, (line + "\n").encode())
+        finally:
+            os.close(fd)
+        self.send_json(200, {})
+
+    def zip_path(self, name):
+        if not ZIP_RE.fullmatch(name):
+            raise HttpError(400, f"invalid zip name '{name}'")
+        dist = one(self.server.info(), "dist_dir")
+        return dist, os.path.join(dist, name)
+
+    def get_zip(self, name):
+        dist, path = self.zip_path(name)
+        if not os.path.isfile(path):
+            raise HttpError(404, f"no {name} in {dist}")
+        self.send_file(path)
+
+    def put_zip(self, name):
+        dist, path = self.zip_path(name)
+        if os.path.exists(path):
+            raise HttpError(409, f"{name} is already in {dist}")
+        length = self.content_length()
+        part = os.path.join(dist, f".{name}.{secrets.token_hex(4)}.part")
+        try:
+            self.receive(part, length)
+            os.chmod(part, 0o644)
+            try:
+                os.link(part, path)          # never replaces an existing zip
+            except FileExistsError:
+                raise HttpError(409, f"{name} is already in {dist}")
+        finally:
+            try:
+                os.unlink(part)
+            except FileNotFoundError:
+                pass
+        dlog(f"{self.who}: added {path}")
+        self.send_json(200, {})
+
+
+class Daemon(socketserver.ThreadingMixIn, http.server.HTTPServer):
+    daemon_threads = True
+
+    def __init__(self, sock, context):
+        super().__init__(sock.getsockname()[:2], Handler, bind_and_activate=False)
+        self.socket.close()
+        self.socket = sock
+        self.context = context
+        self.slots = threading.BoundedSemaphore(MAX_CONNECTIONS)
+        self.transfers = Transfers(state_path("transfers"))
+        self.children = set()
+        self.children_lock = threading.Lock()
+        try:
+            self.run_dir = one(self.info(), "run_dir") or "/run/terraria"
+        except RuntimeError as e:
+            die(str(e))
+
+    def info(self):
+        return local_host_info(child_env())
+
+    def host_info(self):
+        info = self.info()
+        return {"api": API, "version": one(info, "version"), "hostname": one(info, "host"),
+                "base_dir": one(info, "base_dir"), "dist_dir": one(info, "dist_dir"),
+                "dist_zips": info.get("dist_zip", []), "instances": info.get("instance", [])}
+
+    def process_request(self, request, client_address):
+        if not self.slots.acquire(blocking=False):
+            self.shutdown_request(request)
+            return
+        try:
+            super().process_request(request, client_address)
+        except BaseException:
+            self.slots.release()
+            raise
+
+    def process_request_thread(self, request, client_address):
+        try:
+            super().process_request_thread(request, client_address)
+        finally:
+            self.slots.release()
+
+    def finish_request(self, request, client_address):
+        # TLS is set up here, in the connection's own thread, so a slow or
+        # silent client can't hold up everyone else
+        request.settimeout(30)
+        request.setsockopt(socket.SOL_SOCKET, socket.SO_KEEPALIVE, 1)
+        for option, value in (("TCP_KEEPIDLE", 60), ("TCP_KEEPINTVL", 15), ("TCP_KEEPCNT", 4)):
+            if hasattr(socket, option):
+                request.setsockopt(socket.IPPROTO_TCP, getattr(socket, option), value)
+        try:
+            conn = self.context.wrap_socket(request, server_side=True)
+        except (OSError, ValueError):
+            return
+        try:
+            self.RequestHandlerClass(conn, client_address, self)
+        except (ConnectionError, TimeoutError, ssl.SSLError):
+            pass       # the client hung up
+        finally:
+            conn.close()
+
+    def handle_error(self, request, client_address):
+        dlog(f"{client_address[0]}: {sys.exc_info()[1]!r}")
+
+    def track(self, proc):
+        with self.children_lock:
+            self.children.add(proc)
+
+    def untrack(self, proc):
+        """Stops a command whose client went away, with everything it started."""
+        if proc.poll() is None:
+            for sig, wait in ((signal.SIGTERM, 10), (signal.SIGKILL, 5)):
+                try:
+                    os.killpg(proc.pid, sig)
+                    proc.wait(wait)
+                    break
+                except ProcessLookupError:
+                    break
+                except subprocess.TimeoutExpired:
+                    continue
+        for pipe in (proc.stdout, proc.stderr):
+            pipe.close()
+        with self.children_lock:
+            self.children.discard(proc)
+
+    def stop_children(self):
+        with self.children_lock:
+            children = list(self.children)
+        for proc in children:
+            self.untrack(proc)
+
+
+def listen_socket(host, port):
+    if host in ("", "::"):
+        if socket.has_dualstack_ipv6():
+            try:
+                return socket.create_server(("", port), family=socket.AF_INET6, dualstack_ipv6=True, backlog=64)
+            except OSError as e:
+                if e.errno not in (errno.EAFNOSUPPORT, errno.EADDRNOTAVAIL):
+                    raise
+        return socket.create_server(("", port), backlog=64)
+    family, _, _, _, addr = socket.getaddrinfo(host, port, 0, socket.SOCK_STREAM)[0]
+    return socket.create_server(addr[:2], family=family, backlog=64)
+
+
+def daemon_serve():
+    open_state("daemon serve")
+    ensure_cert()
+    host, port = listen_setting()
+    try:
+        sock = listen_socket(host, port)
+    except OSError as e:
+        hint = ""
+        if e.errno == errno.EADDRINUSE:
+            hint = "; another program uses it (set TERRACTL_LISTEN in /etc/default/terractl to change the port)"
+        die(f"can't listen on {describe_listen(host, port)}: {e.strerror}{hint}")
+    context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
+    context.minimum_version = ssl.TLSVersion.TLSv1_2
+    context.load_cert_chain(state_path(CERT), state_path(KEY))
+    server = Daemon(sock, context)
+    signal.signal(signal.SIGTERM, lambda *_: sys.exit(0))
+
+    def expire():
+        while True:
+            time.sleep(600)
+            server.transfers.expire()
+
+    threading.Thread(target=expire, daemon=True).start()
+    dlog(f"terractld {VERSION} listening on {describe_listen(host, port)}; "
+         f"certificate SHA-256 {cert_fingerprint()}")
+    try:
+        server.serve_forever()
+    except KeyboardInterrupt:
+        pass
+    finally:
+        server.server_close()
+        server.stop_children()
+    return 0
+
+
+def wait_listening(host, port, seconds):
+    target = {"": "127.0.0.1", "0.0.0.0": "127.0.0.1", "::": "::1"}.get(host, host)
+    deadline = time.monotonic() + seconds
+    while time.monotonic() < deadline:
+        try:
+            socket.create_connection((target, port), 1).close()
+            return True
+        except OSError:
+            time.sleep(0.3)
+    return False
+
+
+def daemon_enable():
+    need_root("daemon enable")
+    open_state("daemon enable")
+    ensure_cert()
+    proc = systemctl("enable", "--now", DAEMON_UNIT)
+    if proc.returncode != 0:
+        die(f"starting terractld failed: {proc.stderr.strip()} (details: journalctl -u terractld)")
+    host, port = listen_setting()
+    if not wait_listening(host, port, 10):
+        die(f"terractld isn't listening on {describe_listen(host, port)}; see: journalctl -u terractld")
+    print(f"terractld is running and starts at boot, listening on {describe_listen(host, port)}.")
+    print(f"Certificate fingerprint (SHA-256): {cert_fingerprint()}")
+    print()
+    print("To let a computer manage this host, create a token for it:")
+    print("  sudo terractl daemon trust add <name for that computer>")
+    print(f"If a firewall is active, allow TCP port {port} (e.g. sudo ufw allow {port}/tcp).")
+    return 0
+
+
+def daemon_disable():
+    need_root("daemon disable")
+    proc = systemctl("disable", "--now", DAEMON_UNIT)
+    if proc.returncode != 0:
+        die(f"stopping terractld failed: {proc.stderr.strip()}")
+    print("terractld is stopped and won't start at boot, so other hosts can't manage this one.")
+    print("The computers it trusts are kept for next time (terractl daemon trust list).")
+    return 0
+
+
+def daemon_status():
+    active = systemctl("is-active", DAEMON_UNIT).stdout.strip() or "unknown"
+    enabled = systemctl("is-enabled", DAEMON_UNIT).stdout.strip()
+    host, port = listen_setting()
+    boot = "starts at boot" if enabled == "enabled" else "doesn't start at boot"
+    print(f"terractld:    {active}, {boot}")
+    print(f"listening on: {describe_listen(host, port)}")
+    if os.path.exists(state_path(CERT)):
+        print(f"certificate:  SHA-256 {cert_fingerprint()}")
+    try:
+        trust = load_trust()
+    except PermissionError:
+        print("trusted:      (run with sudo to see which computers)")
+        trust = None
+    if trust is not None:
+        names = ", ".join(c["name"] for c in trust["clients"]) or "none yet"
+        print(f"trusted:      {names}")
+        waiting = [t["name"] for t in trust["tokens"] if t["expires"] > time.time()]
+        if waiting:
+            print(f"tokens for:   {', '.join(waiting)} (not used yet)")
+    if active != "active":
+        print("Start it with: sudo terractl daemon enable")
+    return 0
+
+
+def trust_add(name):
+    if not CLIENT_RE.fullmatch(name):
+        die(f"invalid name '{name}' (letters, digits and _ . - @, up to 64)")
+    open_state(f"daemon trust add {name}")
+    ensure_cert()
+    secret = secrets.token_hex(32)
+    with StateLock():
+        trust = load_trust()
+        now = time.time()
+        trust["tokens"] = [t for t in trust["tokens"] if t["expires"] > now and t["name"] != name]
+        trust["tokens"].append({"name": name, "secret_sha256": sha256(secret),
+                                "expires": int(now + TOKEN_HOURS * 3600)})
+        save_trust(trust)
+        known = any(c["name"] == name for c in trust["clients"])
+    host, port = listen_setting()
+    token = make_token({"v": 1, "fp": cert_fingerprint(), "s": secret, "a": host_addresses(host, port)})
+    here = (socket.gethostname() or "").split(".")[0]
+    if not NAME_RE.fullmatch(here):
+        here = "<name>"
+    print(f"On '{name}', run this to add this host as a remote called '{here}':")
+    print()
+    print(f"  terractl remote add {here} {token}")
+    print()
+    print(f"The token works once, within {TOKEN_HOURS} hours.")
+    if known:
+        print(f"'{name}' is trusted already; joining again gives it a new key and the old one stops working.")
+    if systemctl("is-active", DAEMON_UNIT).stdout.strip() != "active":
+        print("The daemon isn't running yet; start it with: sudo terractl daemon enable")
+    return 0
+
+
+def trust_list():
+    try:
+        trust = load_trust()
+    except PermissionError:
+        die("this needs root: sudo terractl daemon trust list")
+    if not trust["clients"]:
+        print("No computers are trusted yet. Add one with: sudo terractl daemon trust add <name>")
+    else:
+        print(f"{'NAME':<24} {'ADDED':<17} FROM")
+        for c in trust["clients"]:
+            print(f"{c['name']:<24} {c.get('added', '-'):<17} {c.get('from', '-')}")
+    now = time.time()
+    for t in trust["tokens"]:
+        if t["expires"] > now:
+            hours = max(1, round((t["expires"] - now) / 3600))
+            print(f"Token for '{t['name']}' not used yet (expires in {hours} h)")
+    return 0
+
+
+def trust_remove(name):
+    open_state(f"daemon trust remove {name}")
+    with StateLock():
+        trust = load_trust()
+        clients = [c for c in trust["clients"] if c["name"] != name]
+        tokens = [t for t in trust["tokens"] if t["name"] != name]
+        if len(clients) == len(trust["clients"]) and len(tokens) == len(trust["tokens"]):
+            die(f"'{name}' isn't trusted (see: terractl daemon trust list)")
+        trust["clients"], trust["tokens"] = clients, tokens
+        save_trust(trust)
+    print(f"'{name}' can't manage this host any more.")
+    return 0
+
+
+def daemon_main(argv):
+    sub, rest = (argv[0], argv[1:]) if argv else ("", [])
+    if sub == "trust":
+        what = rest[0] if rest else "list"
+        if what == "add" and len(rest) == 2:
+            return trust_add(rest[1])
+        if what == "list" and len(rest) <= 1:
+            return trust_list()
+        if what == "remove" and len(rest) == 2:
+            return trust_remove(rest[1])
+        die("usage: terractl daemon trust add <name> | trust list | trust remove <name>")
+    commands = {"enable": daemon_enable, "disable": daemon_disable, "status": daemon_status,
+                "serve": daemon_serve}
+    if sub in commands and not rest:
+        return commands[sub]()
+    die("usage: terractl daemon enable | disable | status | trust ...")
+
+
+# --------------------------------------------------------------- client ----
+
+def config_location():
+    """This user's settings folder, and under sudo the account that owns it:
+    remotes belong to the person, even when they use sudo."""
+    if os.environ.get("TERRACTL_CONFIG_DIR"):
+        return os.environ["TERRACTL_CONFIG_DIR"], None
+    user = os.environ.get("SUDO_USER")
+    if os.geteuid() == 0 and user and user != "root":
+        try:
+            pw = pwd.getpwnam(user)
+            return os.path.join(pw.pw_dir, ".config", "terractl"), pw
+        except KeyError:
+            pass
+    base = os.environ.get("XDG_CONFIG_HOME") or os.path.join(os.path.expanduser("~"), ".config")
+    return os.path.join(base, "terractl"), None
+
+
+def load_remotes():
+    folder, _ = config_location()
+    path = os.path.join(folder, "remotes.json")
+    try:
+        with open(path) as f:
+            return json.load(f).get("remotes", {})
+    except FileNotFoundError:
+        return {}
+    except (OSError, ValueError, AttributeError) as e:
+        die(f"can't read {path}: {e}")
+
+
+def save_remotes(remotes):
+    folder, owner = config_location()
+    created = [d for d in (os.path.dirname(folder), folder) if not os.path.isdir(d)]
+    os.makedirs(folder, mode=0o700, exist_ok=True)
+    path = os.path.join(folder, "remotes.json")
+    tmp = path + ".new"
+    fd = os.open(tmp, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+    with os.fdopen(fd, "w") as f:
+        json.dump({"remotes": remotes}, f, indent=2, sort_keys=True)
+        f.write("\n")
+    if owner:
+        for p in created + [tmp]:
+            os.chown(p, owner.pw_uid, owner.pw_gid)
+    os.replace(tmp, path)
+
+
+class PinMismatch(Exception):
+    """The daemon's certificate isn't the one pinned for it."""
+
+
+class PinnedHTTPSConnection(http.client.HTTPSConnection):
+    """HTTPS to a daemon whose certificate must have a known SHA-256 fingerprint."""
+
+    def __init__(self, host, port, fingerprint, timeout):
+        context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+        context.check_hostname = False
+        context.verify_mode = ssl.CERT_NONE        # pinned instead: see connect()
+        context.minimum_version = ssl.TLSVersion.TLSv1_2
+        super().__init__(host, port, timeout=timeout, context=context, blocksize=CHUNK)
+        self.pin = fingerprint
+        self.pin_context = context
+
+    def connect(self):
+        sock = socket.create_connection((self.host, self.port), self.timeout)
+        try:
+            sock.setsockopt(socket.IPPROTO_TCP, socket.TCP_NODELAY, 1)
+            tls = self.pin_context.wrap_socket(sock)
+        except BaseException:
+            sock.close()
+            raise
+        got = hashlib.sha256(tls.getpeercert(binary_form=True) or b"").hexdigest()
+        if not hmac.compare_digest(got, self.pin):
+            tls.close()
+            raise PinMismatch(got)
+        self.sock = tls
+
+
+class LinkLost(Exception):
+    pass
+
+
+class Remote:
+    """A daemon on another host, as this user added it with 'terractl remote add'."""
+
+    def __init__(self, name, conf, via=None):
+        self.name = self.label = name
+        self.host = conf["address"]
+        self.port = int(conf["port"])
+        self.fingerprint = conf["fingerprint"]
+        self.key = conf.get("key", "")
+        self.addr = join_hostport(self.host, self.port)
+        self.via = via or f"--host {name}"
+        self.console_conn = None
+        self.info = None
+        self.joining = False
+
+    def same_host(self, other):
+        return (self.host.lower(), self.port) == (other.host.lower(), other.port)
+
+    def connect(self, timeout):
+        conn = PinnedHTTPSConnection(self.host, self.port, self.fingerprint, timeout)
+        try:
+            conn.connect()
+        except PinMismatch as e:
+            if self.joining:
+                raise Unreachable(f"the daemon at {self.addr} isn't the host the token is from (its "
+                                  f"certificate's SHA-256 is {e}, the token expects {self.fingerprint})")
+            raise Unreachable(
+                f"the daemon at {self.addr} isn't the one '{self.name}' was added with: its certificate "
+                f"changed (SHA-256 {e}, expected {self.fingerprint}). If it was replaced on purpose, add "
+                f"the remote again (terractl remote remove {self.name}, then terractl remote add ...). "
+                f"If not, something may be intercepting the connection.")
+        except OSError as e:
+            raise Unreachable(f"can't reach {self.label} at {self.addr}: {e.strerror or e}. Is its "
+                              f"daemon running? (check there with: terractl daemon status)")
+        return conn
+
+    def request(self, method, path, body=None, *, timeout=30, length=None, conn=None, auth=True):
+        """Sends a request and returns the response, or fails with the daemon's
+        error message. Without conn, the connection is closed after the response."""
+        headers = {"User-Agent": f"terractl/{VERSION}"}
+        if conn is None:
+            conn = self.connect(timeout)
+            headers["Connection"] = "close"
+            reused = False
+        else:
+            reused = True
+        if auth:
+            headers["Authorization"] = f"Bearer {self.key}"
+        if isinstance(body, dict):
+            body = json.dumps(body).encode()
+            headers["Content-Type"] = "application/json"
+        if length is not None:
+            headers["Content-Length"] = str(length)
+        try:
+            conn.request(method, path, body=body, headers=headers)
+            resp = conn.getresponse()
+        except (http.client.HTTPException, OSError, PinMismatch) as e:
+            conn.close()
+            if reused:
+                raise LinkLost()
+            die(f"lost the connection to {self.label} ({e})")
+        if resp.status >= 400:
+            raw = resp.read()
+            conn.close()
+            try:
+                message = json.loads(raw)["error"]
+            except (ValueError, KeyError, TypeError):
+                message = f"HTTP error {resp.status}"
+            if resp.status == 401:
+                die(f"{self.label} doesn't trust this computer (any more). On {self.label}, run "
+                    f"'sudo terractl daemon trust add <name for this computer>', then here: terractl "
+                    f"remote remove {self.name} && terractl remote add {self.name} {self.addr} <token>")
+            die(f"{self.label}: {message}")
+        return resp
+
+    def call(self, method, path, body=None, **kwargs):
+        resp = self.request(method, path, body, **kwargs)
+        try:
+            data = resp.read()
+        except (http.client.HTTPException, OSError) as e:
+            die(f"lost the connection to {self.label} ({e})")
+        return json.loads(data or b"{}")
+
+    def host_info(self):
+        if self.info is None:
+            info = self.call("GET", "/1.0")
+            if info.get("api") != API:
+                die(f"{self.label} runs terractl {info.get('version', '?')}, which can't work with this "
+                    f"one ({VERSION}); install the same version on both")
+            self.info = info
+        return self.info
+
+    def exec(self, args, show_stdout=True, capture=False):
+        """Runs 'terractl <args>' on the remote, showing its output as it comes.
+        Returns (exit status, last message, captured stdout)."""
+        resp = self.request("POST", "/1.0/exec", {"args": args, "via": self.via}, timeout=STREAM_TIMEOUT)
+        captured = []
+        try:
+            while True:
+                try:
+                    line = resp.readline()
+                    frame = json.loads(line) if line else None
+                except (http.client.HTTPException, OSError, ValueError) as e:
+                    die(f"lost the connection to {self.label} ({e})")
+                if frame is None:
+                    die(f"lost the connection to {self.label} during '{args[0]}'")
+                if "o" in frame:
+                    if capture:
+                        captured.append(frame["o"])
+                    elif show_stdout:
+                        sys.stdout.write(frame["o"])
+                        sys.stdout.flush()
+                elif "e" in frame:
+                    sys.stderr.write(frame["e"])
+                    sys.stderr.flush()
+                elif "x" in frame:
+                    return frame["x"], frame, "".join(captured)
+                elif "error" in frame:
+                    die(f"{self.label}: {frame['error']}")
+        finally:
+            resp.close()
+
+    def upload(self, path, stream, size, label):
+        """PUTs size bytes from stream, showing progress. Returns the reply."""
+        progress = Progress(label, size)
+        resp = self.request("PUT", path, Counted(stream, progress), length=size, timeout=IO_TIMEOUT)
+        reply = json.loads(resp.read() or b"{}")
+        progress.done()
+        return reply
+
+    def send_file(self, local_path, label):
+        self.host_info()       # fails early, before a long upload, if we're not let in
+        with open(local_path, "rb") as f:
+            return self.upload("/1.0/files", f, os.fstat(f.fileno()).st_size, label)["id"]
+
+    def console_line(self, name, line):
+        """Sends a line to a server's console, over one connection kept for attach."""
+        for attempt in (1, 2):
+            if self.console_conn is None:
+                self.console_conn = self.connect(30)
+            try:
+                return self.call("POST", f"/1.0/console/{name}", {"line": line}, conn=self.console_conn)
+            except LinkLost:
+                self.console_conn = None
+                if attempt == 2:
+                    die(f"lost the connection to {self.label}")
+
+
+class Progress:
+    """'sending x: 12.3 MB of 45.6 MB (27%)', updated in place on a terminal."""
+
+    def __init__(self, label, total):
+        self.label, self.total, self.count = label, total, 0
+        self.tty = sys.stderr.isatty()
+        self.shown = 0.0
+
+    def add(self, n):
+        self.count += n
+        now = time.monotonic()
+        if self.tty and now - self.shown >= 0.25:
+            self.shown = now
+            percent = self.count * 100 // self.total if self.total else 100
+            sys.stderr.write(f"\r  {self.label}: {human_size(self.count)} of "
+                             f"{human_size(self.total)} ({percent}%)\033[K")
+            sys.stderr.flush()
+
+    def done(self):
+        line = f"  {self.label}: {human_size(self.count)}"
+        sys.stderr.write(f"\r{line}\033[K\n" if self.tty else f"{line}\n")
+        sys.stderr.flush()
+
+
+class Counted:
+    """A readable stream that reports progress as it's read."""
+
+    def __init__(self, stream, progress):
+        self.stream, self.progress = stream, progress
+
+    def read(self, n=-1):
+        data = self.stream.read(CHUNK if n is None or n < 0 else n)
+        self.progress.add(len(data))
+        return data
+
+
+def copy_stream(src, dst, progress, size):
+    while True:
+        data = src.read(CHUNK)
+        if not data:
+            break
+        dst.write(data)
+        progress.add(len(data))
+    if progress.count != size:
+        die(f"the transfer was cut off ({human_size(progress.count)} of {human_size(size)})")
+    progress.done()
+
+
+def find_remote(spec):
+    """A remote by name, or by the address it was added with."""
+    remotes = load_remotes()
+    if spec in remotes:
+        return Remote(spec, remotes[spec], via=f"--host {spec}")
+    try:
+        host, port = split_hostport(spec)
+    except Fail:
+        host = port = None
+    for name, conf in sorted(remotes.items()):
+        if host and conf["address"].lower() == host.lower() and int(conf["port"]) == port:
+            return Remote(name, conf, via=f"--host {spec}")
+    die(f"'{spec}' isn't one of your remotes (see: terractl remote list). To add it, run "
+        f"'sudo terractl daemon trust add <name for this computer>' there, then here: "
+        f"terractl remote add <name> <token>")
+
+
+def remote_add(args):
+    if len(args) not in (2, 3):
+        die("usage: terractl remote add <name> <token>, or: terractl remote add <name> <address> [<token>]")
+    name = args[0]
+    if not NAME_RE.fullmatch(name):
+        die(f"invalid remote name '{name}' (letters, digits and _ . -, not starting with . or -)")
+    remotes = load_remotes()
+    if name in remotes:
+        die(f"there's a remote called '{name}' already (to replace it: terractl remote remove {name})")
+    if len(args) == 3:
+        address, token = args[1], args[2]
+    elif args[1].startswith(TOKEN_PREFIX):
+        address, token = None, args[1]
+    else:
+        address = args[1]
+        if not sys.stdin.isatty():
+            die("no token given")
+        token = getpass.getpass("Token (from 'sudo terractl daemon trust add' on that host): ")
+    fields = read_token(token)
+    candidates = [split_hostport(address)] if address else [split_hostport(a) for a in fields.get("a", [])]
+    if not candidates:
+        die("the token doesn't say where the host is; give its address: "
+            "terractl remote add <name> <address> <token>")
+    problems = []
+    for host, port in candidates:
+        remote = Remote(name, {"address": host, "port": port, "fingerprint": fields["fp"]})
+        remote.joining = True
+        remote.label = remote.addr
+        try:
+            reply = remote.call("POST", "/1.0/trust/join", {"secret": fields["s"]}, auth=False, timeout=5)
+            break
+        except Unreachable as e:
+            problems.append(str(e))
+    else:
+        if len(problems) == 1:
+            die(problems[0])
+        die("couldn't reach the host at any address in the token:\n  " + "\n  ".join(problems) +
+            "\nGive an address that works from here: terractl remote add <name> <address> <token>")
+    remotes[name] = {"address": host, "port": port, "fingerprint": fields["fp"], "key": reply["key"],
+                     "client_name": reply["name"], "added": time.strftime("%Y-%m-%d %H:%M")}
+    save_remotes(remotes)
+    remote.key = reply["key"]
+    remote.joining = False
+    remote.label = name
+    try:
+        info = remote.host_info()
+        about = f"{info['hostname']} at {remote.addr}, terractl {info['version']}"
+    except Fail:
+        about = remote.addr
+    print(f"added remote '{name}' ({about}); it knows this computer as '{reply['name']}'")
+    print(f"Try: terractl --host {name} list")
+    return 0
+
+
+def remote_list(args):
+    if args:
+        die("usage: terractl remote list")
+    remotes = load_remotes()
+    if not remotes:
+        print("No remotes yet. Add one with: terractl remote add <name> <token>")
+        return 0
+    print(f"{'NAME':<20} {'ADDRESS':<30} FINGERPRINT")
+    for name, conf in sorted(remotes.items()):
+        print(f"{name:<20} {join_hostport(conf['address'], conf['port']):<30} {conf['fingerprint'][:16]}")
+    return 0
+
+
+def remote_remove(args):
+    if len(args) != 1:
+        die("usage: terractl remote remove <name>")
+    remotes = load_remotes()
+    conf = remotes.pop(args[0], None)
+    if conf is None:
+        die(f"there's no remote called '{args[0]}' (see: terractl remote list)")
+    save_remotes(remotes)
+    print(f"removed remote '{args[0]}'. It still lists this computer as '{conf.get('client_name', '?')}'; "
+          f"to revoke that too, run there: sudo terractl daemon trust remove {conf.get('client_name', '<name>')}")
+    return 0
+
+
+def remote_main(argv):
+    sub, rest = (argv[0], argv[1:]) if argv else ("list", [])
+    commands = {"add": remote_add, "list": remote_list, "remove": remote_remove}
+    if sub not in commands:
+        die("usage: terractl remote add <name> <token> | remote list | remote remove <name>")
+    return commands[sub](rest)
+
+
+# ------------------------------------------------ commands on a remote ----
+
+def local_path(path):
+    return os.path.abspath(os.path.expanduser(path))
+
+
+def on_remote_attach(remote, argv):
+    if len(argv) != 2:
+        die("usage: terractl attach <name>")
+    name = argv[1]
+    if not NAME_RE.fullmatch(name):
+        die(f"invalid instance name '{name}'")
+    remote.call("POST", f"/1.0/console/{name}", {"check": True})
+    print(f"Attached to terraria@{name} on {remote.label}. Ctrl-D or Ctrl-C detaches; the server keeps running.")
+
+    def follow():
+        try:
+            remote.exec(["watch", name, "-n", "30", "-q"])
+        except Fail as e:
+            log(str(e))
+        log(f"no more output from {remote.label}; Ctrl-D detaches")
+
+    threading.Thread(target=follow, daemon=True).start()
+    try:
+        import readline          # line editing and history for input()
+        readline.set_auto_history(True)
+    except ImportError:
+        pass
+    try:
+        while True:
+            line = input()
+            if not line:
+                continue
+            if line == "exit":
+                print(f"(not sent: 'exit' would shut the server down. Use Ctrl-D to detach, "
+                      f"or 'terractl {remote.via} stop {name}' to stop it.)")
+                continue
+            try:
+                remote.console_line(name, line)
+            except Fail as e:
+                print(f"(not sent: {e})", file=sys.stderr)
+    except (EOFError, KeyboardInterrupt):
+        print()
+    return 0
+
+
+def on_remote_watch(remote, argv):
+    try:
+        return remote.exec(argv)[0]
+    except KeyboardInterrupt:
+        print()
+        return 0
+
+
+def on_remote_export(remote, argv):
+    if len(argv) < 2:
+        die("usage: terractl export <name> [file.tar.gz] [--with-server]")
+    name, out, with_server = argv[1], None, False
+    if not NAME_RE.fullmatch(name):
+        die(f"invalid instance name '{name}'")
+    for arg in argv[2:]:
+        if arg == "--with-server":
+            with_server = True
+        elif arg.startswith("-"):
+            die(f"unknown option '{arg}'")
+        elif out:
+            die("more than one output file given")
+        else:
+            out = arg
+    out = local_path(out or f"{name}-{time.strftime('%Y%m%d-%H%M%S')}.tar.gz")
+    if not out.endswith((".tar.gz", ".tgz")):
+        out += ".tar.gz"
+    if os.path.exists(out):
+        die(f"{out} already exists")
+    if not os.path.isdir(os.path.dirname(out)):
+        die(f"folder {os.path.dirname(out)} does not exist")
+    archive = RemoteHost(remote).export(name, with_server)
+    archive.save(out, f"fetching {archive.name}")
+    print(f"exported '{name}' from {remote.label} to {out} ({human_size(archive.size)}, readable only by you)")
+    if not with_server:
+        print("server/ not included; it's unpacked again from the server zip on first start after import")
+    return 0
+
+
+def on_remote_import(remote, argv):
+    if len(argv) != 3:
+        die("usage: terractl import <new instance name> <file.tar.gz>")
+    path = local_path(argv[2])
+    if not os.path.isfile(path):
+        die(f"cannot read {path}")
+    fid = remote.send_file(path, f"sending {os.path.basename(path)} to {remote.label}")
+    return remote.exec(["import", argv[1], {"file": fid}])[0]
+
+
+def on_remote_mods(remote, argv):
+    if len(argv) < 4 or argv[2] != "add":
+        return remote.exec(argv)[0]
+    tmp = big_tempdir()
+    try:
+        bundle = os.path.join(tmp, "mods.tar")
+        names = set()
+        with tarfile.open(bundle, "w", dereference=True) as tar:
+            for arg in argv[3:]:
+                path = local_path(arg)
+                if not os.path.exists(path):
+                    die(f"{path} not found")
+                base = os.path.basename(os.path.normpath(path))
+                if base in names:
+                    die(f"more than one of the given paths is called '{base}'")
+                names.add(base)
+                tar.add(path, arcname=base, filter=lambda m: m if m.isfile() or m.isdir() else None)
+        fid = remote.send_file(bundle, f"sending mods to {remote.label}")
+    finally:
+        shutil.rmtree(tmp, ignore_errors=True)
+    return remote.exec(["mods", argv[1], "add", {"dir": fid}])[0]
+
+
+def on_remote_delete(remote, argv):
+    if len(argv) >= 2 and "-y" not in argv and "--yes" not in argv:
+        name = argv[1]
+        if not sys.stdin.isatty():
+            die("not a terminal; use -y to delete without confirmation")
+        print(f"This will stop terraria@{name} on {remote.label} and remove it there.")
+        if "--no-backup" in argv:
+            print("NO BACKUP will be made. Worlds will be lost.")
+        else:
+            print(f"Worlds and configs will be archived to {remote.host_info()['base_dir']}/.deleted/ "
+                  f"on {remote.label} first.")
+        if input("Type the instance name to confirm: ") != name:
+            die("confirmation did not match; nothing deleted")
+        argv = argv + ["-y"]
+    return remote.exec(argv)[0]
+
+
+def run_on_remote(spec, argv):
+    if not argv:
+        die("usage: terractl --host <remote> <command> [args]")
+    remote = find_remote(spec)
+    command = argv[0]
+    if command in ("remote", "daemon", "copy", "move", "-H") or command.startswith("--host"):
+        die(f"'{command}' runs on this computer; use it without --host "
+            "(copy and move take <remote>:<name> instead)")
+    if command in ("prepare", "run", "service-stop", "journal-access"):
+        die(f"'{command}' is only used by the service itself")
+    handlers = {"attach": on_remote_attach, "watch": on_remote_watch, "export": on_remote_export,
+                "import": on_remote_import, "mods": on_remote_mods, "delete": on_remote_delete}
+    if command in handlers:
+        return handlers[command](remote, argv)
+    return remote.exec(argv)[0]
+
+
+# ------------------------------------------------------------ copy/move ----
+
+class LocalArchive:
+    def __init__(self, path, tmpdir):
+        self.path, self.tmpdir = path, tmpdir
+        self.name = os.path.basename(path)
+
+    def cleanup(self):
+        shutil.rmtree(self.tmpdir, ignore_errors=True)
+
+
+class RemoteArchive:
+    """An export waiting on a daemon. Fetching it (or importing it on the same
+    host) uses it up; otherwise cleanup() removes it there."""
+
+    def __init__(self, host, fid, name, size):
+        self.host, self.fid, self.name, self.size = host, fid, name, size
+        self.used = False
+
+    def claim(self):
+        self.used = True
+        return self.fid
+
+    def open(self):
+        self.used = True
+        return self.host.remote.request("GET", f"/1.0/files/{self.fid}", timeout=IO_TIMEOUT)
+
+    def save(self, path, label):
+        stream = self.open()
+        try:
+            fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+            try:
+                with os.fdopen(fd, "wb") as out:
+                    copy_stream(stream, out, Progress(label, self.size), self.size)
+            except BaseException:
+                os.unlink(path)
+                raise
+        finally:
+            stream.close()
+
+    def cleanup(self):
+        if not self.used:
+            try:
+                self.host.remote.call("DELETE", f"/1.0/files/{self.fid}")
+            except Fail:
+                pass
+
+
+class LocalHost:
+    label = "this host"
+    is_local = True
+
+    def same_host(self, other):
+        return isinstance(other, LocalHost)
+
+    def host_info(self):
+        info = parse_info(terractl(["info"], capture=True).stdout)
+        return {"hostname": one(info, "host"), "base_dir": one(info, "base_dir"),
+                "dist_dir": one(info, "dist_dir"), "dist_zips": info.get("dist_zip", [])}
+
+    def instance(self, name):
+        base = self.host_info()["base_dir"]
+        if not os.access(base, os.R_OK | os.X_OK):
+            die(f"can't read the instances in {base}: join the terraria group, or use sudo")
+        proc = terractl(["info", name], capture=True)
+        if proc.returncode != 0:
+            die(f"can't read instance '{name}' on this host")
+        return {k: v[-1] for k, v in parse_info(proc.stdout).items()}
+
+    def run(self, args, show_stdout=True):
+        return terractl(args, show_stdout=show_stdout).returncode
+
+    def export(self, name, with_server):
+        tmp = big_tempdir()
+        path = os.path.join(tmp, f"{name}.tar.gz")
+        if self.run(["export", name, path] + (["--with-server"] if with_server else []), show_stdout=False):
+            shutil.rmtree(tmp, ignore_errors=True)
+            die(f"exporting '{name}' failed")
+        return LocalArchive(path, tmp)
+
+    def import_(self, name, archive, show_stdout):
+        if isinstance(archive, LocalArchive):
+            return self.run(["import", name, archive.path], show_stdout)
+        tmp = big_tempdir()
+        try:
+            path = os.path.join(tmp, archive.name)
+            archive.save(path, f"fetching {archive.name} from {archive.host.label}")
+            return self.run(["import", name, path], show_stdout)
+        finally:
+            shutil.rmtree(tmp, ignore_errors=True)
+
+    def open_zip(self, zip_name):
+        f = open(os.path.join(self.host_info()["dist_dir"], zip_name), "rb")
+        return f, os.fstat(f.fileno()).st_size
+
+    def receive_zip(self, zip_name, stream, size, label):
+        dist = self.host_info()["dist_dir"]
+        part = os.path.join(dist, f".{zip_name}.{secrets.token_hex(4)}.part")
+        try:
+            with open(part, "xb") as out:
+                copy_stream(stream, out, Progress(label, size), size)
+            os.chmod(part, 0o644)
+            os.link(part, os.path.join(dist, zip_name))      # never replaces an existing zip
+        finally:
+            try:
+                os.unlink(part)
+            except FileNotFoundError:
+                pass
+
+
+class RemoteHost:
+    is_local = False
+
+    def __init__(self, remote):
+        self.remote = remote
+        self.label = remote.label
+
+    def same_host(self, other):
+        return isinstance(other, RemoteHost) and self.remote.same_host(other.remote)
+
+    def host_info(self):
+        return self.remote.host_info()
+
+    def instance(self, name):
+        code, _, out = self.remote.exec(["info", name], capture=True)
+        if code != 0:
+            die(f"can't read instance '{name}' on {self.label}")
+        return {k: v[-1] for k, v in parse_info(out).items()}
+
+    def run(self, args, show_stdout=True):
+        return self.remote.exec(args, show_stdout=show_stdout)[0]
+
+    def export(self, name, with_server):
+        args = ["export", name, {"output": f"{name}.tar.gz"}] + (["--with-server"] if with_server else [])
+        code, final, _ = self.remote.exec(args, show_stdout=False)
+        if code != 0 or "file" not in final:
+            die(f"exporting '{name}' on {self.label} failed")
+        f = final["file"]
+        return RemoteArchive(self, f["id"], f["name"], f["size"])
+
+    def import_(self, name, archive, show_stdout):
+        if isinstance(archive, RemoteArchive) and archive.host.same_host(self):
+            fid = archive.claim()                    # already there
+        elif isinstance(archive, LocalArchive):
+            fid = self.remote.send_file(archive.path, f"sending {archive.name} to {self.label}")
+        else:
+            self.host_info()
+            stream = archive.open()
+            try:
+                fid = self.remote.upload("/1.0/files", stream, archive.size,
+                                         f"copying {archive.name} from {archive.host.label} to {self.label}")["id"]
+            finally:
+                stream.close()
+        return self.remote.exec(["import", name, {"file": fid}], show_stdout=show_stdout)[0]
+
+    def open_zip(self, zip_name):
+        resp = self.remote.request("GET", f"/1.0/dist/{urllib.parse.quote(zip_name)}", timeout=IO_TIMEOUT)
+        return resp, int(resp.getheader("Content-Length") or 0)
+
+    def receive_zip(self, zip_name, stream, size, label):
+        self.remote.upload(f"/1.0/dist/{urllib.parse.quote(zip_name)}", stream, size, label)
+
+
+def transfer_label(src, dst, name):
+    if dst.is_local:
+        return f"fetching {name} from {src.label}"
+    if src.is_local:
+        return f"sending {name} to {dst.label}"
+    return f"copying {name} from {src.label} to {dst.label}"
+
+
+def parse_location(text):
+    """'[<remote>:]<name>' -> (host, name). The name may be empty ('nas:')."""
+    if ":" not in text:
+        return LocalHost(), text
+    spec, _, name = text.rpartition(":")
+    return RemoteHost(find_remote(spec)), name
+
+
+def copy_or_move(argv, move):
+    verb = "move" if move else "copy"
+    usage = f"usage: terractl {verb} [<remote>:]<name> [<remote>:][<new name>] [--with-server]"
+    with_server, places = False, []
+    for arg in argv:
+        if arg == "--with-server":
+            with_server = True
+        elif arg.startswith("-"):
+            die(f"unknown option '{arg}'")
+        else:
+            places.append(arg)
+    if len(places) != 2:
+        die(usage)
+    src, name = parse_location(places[0])
+    dst, new_name = parse_location(places[1])
+    new_name = new_name or name
+    for n in (name, new_name):
+        if not NAME_RE.fullmatch(n):
+            die(f"invalid instance name '{n}'" if n else usage)
+    if src.same_host(dst) and name == new_name:
+        die("the source and the destination are the same")
+    if move and src.same_host(dst):
+        # Renaming in place keeps the port, server/ and tModLoader's .NET
+        if src.is_local and os.geteuid() != 0:
+            die(f"renaming needs root: sudo terractl move {shlex.join(argv)}")
+        return src.run(["rename", name, new_name])
+
+    # Check everything first, so nothing changes if it can't work
+    if move and src.is_local and os.geteuid() != 0:
+        die(f"moving '{name}' deletes it on this host, which needs root: sudo terractl move {shlex.join(argv)}")
+    if dst.is_local and os.geteuid() != 0 and not os.access(dst.host_info()["base_dir"], os.W_OK):
+        die(f"adding an instance on this host needs root: sudo terractl {verb} {shlex.join(argv)}")
+    source = src.instance(name)
+    if source.get("exists") != "yes":
+        die(f"no instance '{name}' on {src.label}")
+    if dst.instance(new_name).get("exists") == "yes":
+        prefix = places[1].rpartition(":")[0] + ":" if ":" in places[1] else ""
+        die(f"'{new_name}' already exists on {dst.label}; give it another name there, "
+            f"e.g. terractl {verb} {places[0]} {prefix}<new name>")
+    # The server zip the instance runs (import pins it). It has to be in the
+    # destination's dist folder, unless the unpacked server goes along.
+    needed = os.path.basename(source.get("pinned_zip", "")) or source.get("installed_zip", "")
+    send_zip = None
+    if needed and not with_server and not src.same_host(dst):
+        dst_info = dst.host_info()
+        if needed not in dst_info["dist_zips"]:
+            if needed not in src.host_info()["dist_zips"]:
+                die(f"'{name}' runs {needed}, which {dst.label} doesn't have in {dst_info['dist_dir']} and "
+                    f"{src.label} has no copy of to send. Put it there first, or add --with-server to "
+                    f"include the unpacked server")
+            send_zip = needed
+
+    was_running = source.get("state") in ("active", "activating", "reloading")
+    was_enabled = source.get("boot") == "enabled"
+    to = f" as '{new_name}'" if new_name != name else ""
+    print(f"{'Moving' if move else 'Copying'} '{name}' from {src.label} to {dst.label}{to}")
+    stopped = imported = False
+    archive = None
+    try:
+        if move and was_running:
+            print(f"stopping '{name}' on {src.label} (saves the world first)...")
+            if src.run(["stop", name], show_stdout=False) != 0:
+                die(f"couldn't stop '{name}' on {src.label}")
+            stopped = True
+        archive = src.export(name, with_server)
+        if send_zip:
+            stream, size = src.open_zip(send_zip)
+            try:
+                dst.receive_zip(send_zip, stream, size, transfer_label(src, dst, send_zip))
+            finally:
+                stream.close()
+        if dst.import_(new_name, archive, show_stdout=not move) != 0:
+            die(f"importing on {dst.label} failed; '{name}' on {src.label} is unchanged")
+        imported = True
+    except BaseException:
+        if stopped and not imported:
+            log(f"starting '{name}' on {src.label} again")
+            try:
+                src.run(["start", name], show_stdout=False)
+            except Fail as e:
+                log(f"that failed too: {e}")
+        raise
+    finally:
+        if archive:
+            archive.cleanup()
+    if not move:
+        return 0
+
+    if src.run(["delete", name, "-y"]) != 0:
+        die(f"'{new_name}' is on {dst.label} now, but deleting '{name}' on {src.label} failed (see above), "
+            f"so it's in both places. The copy on {dst.label} wasn't started.")
+    now = []
+    if was_enabled and dst.run(["enable", new_name], show_stdout=False) == 0:
+        now.append("starts at boot")
+    if was_running and dst.run(["start", new_name], show_stdout=False) == 0:
+        now.append("is running")
+    state = f"; it {' and '.join(now)} there" if now else ""
+    print(f"moved '{name}' from {src.label} to {dst.label}{to}{state}")
+    return 0
+
+
+# ---------------------------------------------------------------- main ----
+
+def main(argv):
+    if not argv:
+        die("usage: terractl --host <remote> <command> | remote ... | daemon ... | copy ... | move ...")
+    first = argv[0]
+    if first in ("--host", "-H"):
+        if len(argv) < 2:
+            die("usage: terractl --host <remote> <command> [args]")
+        return run_on_remote(argv[1], argv[2:])
+    if first.startswith("--host="):
+        return run_on_remote(first[len("--host="):], argv[1:])
+    if first == "remote":
+        return remote_main(argv[1:])
+    if first == "daemon":
+        return daemon_main(argv[1:])
+    if first in ("copy", "move"):
+        return copy_or_move(argv[1:], first == "move")
+    die(f"unknown command '{first}'")
+
+
+if __name__ == "__main__":
+    sys.stdout.reconfigure(line_buffering=True)    # keeps it in order with terractl's own output
+    # terractl works from / and says where it was called from (see abspath there)
+    try:
+        os.chdir(os.environ.get("TERRACTL_CALLER_PWD") or ".")
+    except OSError:
+        pass
+    try:
+        sys.exit(main(sys.argv[1:]))
+    except Fail as e:
+        print(f"terractl: {e}", file=sys.stderr)
+        sys.exit(1)
+    except OSError as e:
+        where = f": {e.filename}" if e.filename else ""
+        print(f"terractl: {e.strerror or e}{where}", file=sys.stderr)
+        sys.exit(1)
+    except KeyboardInterrupt:
+        print(file=sys.stderr)
+        sys.exit(130)
diff --git a/packaging/deb/control b/packaging/deb/control
index 03a4f3d..b67a704 100644
--- a/packaging/deb/control
+++ b/packaging/deb/control
@@ -5,8 +5,8 @@ Priority: optional
 Architecture: all
 Installed-Size: @INSTALLED_SIZE@
 Maintainer: Your Name <you@example.com>
-Depends: unzip, systemd
-Recommends: curl, libicu76 | libicu74 | libicu72 | libicu70 | libicu-dev
+Depends: unzip, systemd, python3, openssl
+Recommends: curl, libicu76 | libicu74 | libicu72 | libicu70 | libicu-dev, polkitd
 Conflicts: terraria-instance
 Replaces: terraria-instance
 Suggests: bash-completion
@@ -18,6 +18,11 @@ Description: run multiple Terraria and tModLoader dedicated servers with systemd
  Server software is not included. Place the official server zips in
  /var/lib/terraria/dist and they are unpacked into each instance on demand.
  .
- curl and ICU are only needed for tModLoader instances.
+ .
+ Hosts can also be managed from other hosts (terractl --host, copy, move)
+ through the optional terractld daemon.
+ .
+ curl and ICU are only needed for tModLoader instances. polkitd lets members
+ of the terraria group start, stop and restart servers without sudo.
  .
  This package replaces terraria-instance (the same tool under its old name).
diff --git a/packaging/deb/postinst b/packaging/deb/postinst
index 5008e4f..1aea29e 100755
--- a/packaging/deb/postinst
+++ b/packaging/deb/postinst
@@ -19,6 +19,11 @@ case "$1" in
                 for unit in $running; do echo "  sudo systemctl restart $unit"; done
             fi
         fi
+        # The daemon (if it's on) runs the new version right away; it only serves
+        # other hosts, so restarting it doesn't affect the game servers
+        if [ -d /run/systemd/system ]; then
+            systemctl try-restart terractld.service || true
+        fi
         # Running instances are not restarted; they pick up changes on their next start.
         ;;
 esac
diff --git a/packaging/deb/postrm b/packaging/deb/postrm
index 220b20b..c1b4c96 100755
--- a/packaging/deb/postrm
+++ b/packaging/deb/postrm
@@ -6,6 +6,9 @@ case "$1" in
         # Forget which instances were enabled at boot
         rm -f /etc/systemd/system/multi-user.target.wants/terraria@*.service
         rm -rf /etc/systemd/system/terraria@.service.d
+        # The daemon: whether it's on, its certificate and the computers it trusts
+        rm -f /etc/systemd/system/multi-user.target.wants/terractld.service
+        rm -rf /etc/systemd/system/terractld.service.d /var/lib/terractl
         cat >&2 <<MSG
 terraria-server-manager purged. Worlds and instances in /var/lib/terraria and the
 'terraria' user were kept. Remove them manually if they are no longer needed:
diff --git a/packaging/deb/prerm b/packaging/deb/prerm
index 0f2a7be..f85e16f 100755
--- a/packaging/deb/prerm
+++ b/packaging/deb/prerm
@@ -7,6 +7,7 @@ set -e
 case "$1" in
     remove|deconfigure)
         if [ -d /run/systemd/system ]; then
+            systemctl stop terractld.service || true
             units=$(systemctl list-units --plain --no-legend --all 'terraria@*.service' | awk '{print $1}')
             if [ -n "$units" ]; then
                 echo "Stopping Terraria instances: $units"
diff --git a/systemd/terractld.service b/systemd/terractld.service
new file mode 100644
index 0000000..d1ac0ce
--- /dev/null
+++ b/systemd/terractld.service
@@ -0,0 +1,31 @@
+[Unit]
+Description=terractl daemon: lets other hosts manage this host's Terraria servers
+Documentation=file://@DOCDIR@/README.md
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+# Listens on TERRACTL_LISTEN from /etc/default/terractl (default: all addresses,
+# port 7776). Its certificate and the list of trusted computers are kept in
+# /var/lib/terractl. Manage it with: terractl daemon enable|disable|status|trust
+ExecStart=@BINDIR@/terractl daemon serve
+Restart=on-failure
+RestartSec=5
+StateDirectory=terractl
+StateDirectoryMode=0755
+
+# Runs as root: it creates, deletes, starts and stops instances for trusted
+# computers, like sudo terractl does. Everything else is locked down.
+NoNewPrivileges=true
+ProtectSystem=full
+ProtectHome=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+LockPersonality=true
+
+[Install]
+WantedBy=multi-user.target
diff --git a/systemd/terraria@.service b/systemd/terraria@.service
index 73357a6..325fe70 100644
--- a/systemd/terraria@.service
+++ b/systemd/terraria@.service
@@ -18,7 +18,7 @@ ExecStartPre=@BINDIR@/terractl prepare %i
 # Execs the vanilla or tModLoader server depending on instance.conf
 ExecStart=@BINDIR@/terractl run %i
 # Sends "exit" to the console (saves the world) and waits for shutdown
-ExecStop=@BINDIR@/terractl stop %i $MAINPID
+ExecStop=@BINDIR@/terractl service-stop %i $MAINPID
 
 StandardInput=socket
 StandardOutput=journal