Apple TV and Profiles: An Easy Install
Hello everyone. Recently I've been thinking about an easier way to create iOS profiles and specifically profiles for Apple TV, and I think I've stumble on to something. I'm sharing this here as a proof of concept in the hopes it helps others and that it gives the NextDNS team a permanent solution they can implement is on their side.
TL;DR: Skip to the bold TL;DR down below.
Background
Apple requires the use of profiles to configure more advanced settings, such as DNS over HTTPS. In practice this means using Safari on iPhone/iPad to generate a profile and kick off the installation process in Settings. This is easy enough on those devices using the web GUI at apple.nextdns.io.
The Problem
To install a profile on Apple TV, you must tell Apple TV where to download the .mobileconfig file from. As in, you first need to generate a profile (from apple.nextdns.io above), then arrange to host the file somewhere online and enter that URL into Apple TV using the remote. Fun. (For completeness sake I will mention that profiles can be installed by directly connecting Apple TV via a USB cable--so un-Apple I know.)
The (Real) Solution
Apple should add native support for DoH and/or DoT to every currently supported OS. Google did, Microsoft is, Apple should. Forcing users to install apps or custom config files to change DNS servers is getting old. (apple.com/feedback for those playing along at home.)
The (Proposed) Solution
NextDNS could add short codes, or short subdomains to ease in data entry in Apple TVs limited UI for profile installation. This feels like a clever workaround for Apples bad UI/UX/policy--but easier for the user is still easier.
The Proof of Concept (aka The Fix)
Why--it's DNS of course! Well, actually it's mostly Page Rules from Cloudflare but DNS was step one. I reused an existing domain of mine and added a 'dns' subdomain which Cloudflare forwards to NextDNS directly for fulfilment.
TL;DR: When prompted by Apple TV to enter a profile URL, enter:
dns.infolux.net/<NextDNS ID>The Disclosures
You are trusting an internet rando to serve you privileged DNS settings. USUALLY THIS IS A BAD IDEA. I am not affiliated with NextDNS. I am a paying customer though. NextDNS does not approve of this method. Their approved methods are documented in their help articles.
That being said, I am not pulling a fast one nor am I being dishonest in anyway. I would like this concept to be adopted by NextDNS if possible and in the meantime I believe this is a reasonable workaround for other forum members.
The Technical Bits
- I added a Proxied DNS entry via Cloudflare for "dns.infolux.net". I used a CNAME which points at "ns.infolux.net". This is not required for the proxy feature, but this lookup made sense in my head for the task at hand.
- A Page Rule was then added for "dns.infolux.net/*" with a 302 Forwarding URL pointed at "http://api.nextdns.io/apple/profile?profile=$1&trust_ca=1&sign=0".
- HTTP was specifically used to ensure the HTTPS upgrade would be done by NextDNS. A packet capture will confirm the HTTPS upgrade is handled by NextDNS and the profile securely delivered by NextDNS.
- The NextDNS CA option is added so the profile will include their root CA. To use the CA, you will still need to manually enable it in Settings. By including the CA now, it will already be installed should you want to enable it later.
- The option to sign the configuration profile has been disabled. This was intentional so that "long lived" profiles would be generated without any worry of an expired message in a year. This signing is only for the profile itself--all DoH queries are always secure.
- Other than the NextDNS ID you enter, no other options are set. Not the name, model, networks, nor domain fields.
27 replies
-
I tried it and at the end it gives my the same error code [-1004]
dns.infolux.net/<NextDNS IDbut this didn't work either, do you have any discord or telegram
-
I might be missing something, but the Apple TV profile install took me less than 2 minutes after generating the profile. iCloud or Dropbox the URL and copy that. Universal pasteboard makes this URL available on your other iCloud devices instantly (iPhone / iPad). Then, just use the keyboard feature of your iPhone / iPad to paste the URL to the Apple TV. Seamless. I have never used the Siri remote for text entry before.
-
Chris I’ve used all of those in the past with great success yeah.
I was surprised there wasn’t an even easier way to add a profile though and thought of a way to streamline it. That’s all
-
Taylor It's impressive that you made this work.
-
Chris So I have to admit I was surprised that nextDNS CLI wasn't already managing my Apple TV since I have it running on my router and the LAN the Apple TV is managed on points to nextDNS.
In any case, I'm not sure I follow your instructions. I don't see where in the Apple TV Settings to add the profile. Can you elaborate?
-
Michael Bierman So I used the nextDNS instructions and I find the path to profiles... but I get can't be installed -1003.
-
Michael Bierman Hey, I also just used the NextDNS instructions, as found on the NextDNS Apple profile page:
Install on tvOS
Requires tvOS 14 or higher.
1. Open the Settings app.
2. Go to General → Privacy.
3. Hover over Share Apple TV Analytics without pressing.
4. Press Play on the remote.
5. Select Add Profile.
6. Make the downloaded .mobileconfig file accessible publicly and enter its URL.
7. Install the profile following the onscreen instructions.
No issues on 2 Apple TVs. Maybe NextDNS can help with your error code in case you're lucky enough they see this. Maybe open a thread about it?
-
Chris can I ask where you hosted the .mobileconfig file? I tried iCloud and Google drive and had no luck.
-
Michael Bierman Dropbox copy link and navigate with the Apple TV Remote App to the destination Menu Point on the Apple TV and the „0“ at the end of the link when you paste with Remote app to Apple TV change to „1“ without „“ and no freespace and hit enter and follow allow and install instructions on the tv.
-
Michael Bierman Yeah, I think one was Dropbox and the other one was CloudApp. It shouldn't matter as far as I can tell.
Did you make sure that your link was a direct link with .mobileconfig at the end? Sometimes (even in the case of CloudApp), services add tracking parameters or other stuff, often after a question mark.
Example:
https://p178.p0.n0.cdn.getcloudapp.com/items/mXaxk3Lx/c8df35a8-ec16-447f-aa82-f7091a3a76e4.mobileconfig?source=client&v=793762075612b76cbca0gfd0d4I deleted the "?source=client…" before using the URL. Maybe the services you tried added those as well.
-
Chris important at the end of the link change the 0 to 1
this is command signal for Apple TV to apply to install this profile!
-
Benjamin Urner Sorry I am not following. I don't think there is a separate remote app anymore. It is in Control Center... in any case, what link are you referring to? I gave up on iCloud because the share link is to the page, not the file itself. So I put it on my own site... now I have a direct link to the file and the name is in my control. Can you walk me through what you did?
-
Chris Yes, I hosted the file myself and
https://domain/filename.mobileconfig -
Benjamin Urner Good call, I forgot about that.
-
Michael Bierman
Ok, so I just tried this again a few times on an Apple TV 4K with tvOS 16 installed* and here is what I can summarize... (*I originally did this in tvOS 15, which also worked)
Using iCloud as a host does not seem to work, I can confirm your findings. Changing the URL so that it ends with .mobileconfig also does not work.
Using CloudApp as a host works, as long as the direct link is used and everything after .mobileconfig (?source=client…) is deleted before pasting the URL. I think they use S3 to host files.
Using Dropbox as a host works, as long as the ending of the URL is changed from .mobileconfig?dl=0 to .mobileconfig?dl=1, as mentioned by @benjamin_urner.
I also have a Backblaze B2 account and used a (public) bucket to temporarily host the file. This also works for an installation. The URL does not have to be changed and looks like in the screenshot attached.
So these 3 services worked fine for me. After step 5 (select add profile), there is a text entry field coming up on Apple TV and this is where I usually get a notification on my iPhone to open the keyboard feature (screenshot attached). You are correct, this is also available from control center any time. That's where I paste the URL and press return. Then, there are 3 "install profile" prompts following on Apple TV and a final "done".
-
Thanks Chris I tried dropbox and changed the URL. I get the same -1004 error as if I host the file on my own server.
to be clear, I am able to paste the URL via iOS. Then the -1004 error appears on Apple TV. -
Michael Bierman Oh, ok. I found someone else mentioning this error here, after they tried to install a profile from ControlD. So this doesn't seem to be a NextDNS problem.
The comments implied that there might be an issue with spaces in the URL. You could check if there are any by dragging the cursor backwards to the beginning of the text entry field.
If you host the file on your website with a shorter name, maybe try entering manually instead of pasting with the iPhone keyboard feature?
There aren't any further comments in the Reddit post, maybe this solved the issue for OP.
Let me know what you find, hoping this works out for you.
-
Michael Bierman Have you had any success in using my method? The redirect I setup was to make this process easier.
If the configuration ID you wanted to use was "abc123" then you could paste the following URL using iOS into Apple TV. Naturally you'd want to use your correct ID.
dns.infolux.net/abc123That's only a redirect that points to NextDNS's API. NextDNS generates and sends the file so it will correctly install. If you want to customize various parameters you can edit these examples and paste them in the same way.
Apple TV 4K named Living Room using config ID abc123:
https://api.nextdns.io/apple/profile?profile=abc123&device_name=Living+Room&device_model=Apple+~apple-tv-4kApple TV HD named Bedroom using config ID abc123:
https://api.nextdns.io/apple/profile?profile=abc123&device_name=Bedroom&device_model=Apple+AppleTV5,3Apple TV 4K named Conference Room using config ID abc123 excluding SSID "Lab" and "Hilton WiFi":
https://api.nextdns.io/apple/profile?profile=abc123&device_name=Conference+Room&device_model=Apple+~apple-tv-4k&exclude_ssids=Lab,Hilton+WiFi -
Taylor I get why you wanted to make this easier now by the way. I was just missing the fact people had any issues because of my own uneventful experience with installing the profile.
-
Taylor Appreciate your help!
Are you saying you can use this in the Apple TV?
https://api.nextdns.io/apple/profile?profile=abc124&device_name=Living+Room&device_model=Apple+~apple-tv-4k in theI get the same error as before.
I really appreciate the proxy, but I'm just cautious about sending the my profile anywhere and then using the resulting profile. I'd like to understand what needs to be done, if it all possible.
-
Taylor so I can see wha pt the output of the URL is. I saved it and on iOS anyway it has the right icon. The file looks good. But Apple TV just isn’t having it.
-
-
Problem solved. I forgot that Apple TV was hooked up to Unbound. When I disabled that it worked great. Thanks all!
-
Not sure if I misunderstand, but you have the option to generate a short link in profile configuration https://apple.nextdns.io/. Right under download.
And if you don’t want to enter The short link manually, you can connect to the Apple TV via iPhone’s TV-remote and copy it in.
Content aside
-
1
Likes
- 4 mths agoLast active
- 27Replies
- 2822Views
-
8
Following