Setup brief — Julianna's Mac mini home base

Where are you running?

First message to Julianna (verbatim, friendly):

Then run hostname yourself to confirm.

If you are on the Mac mini already

Continue to Phase 1.

If you are on a different Mac (e.g., MacBook Pro)

Tell her: "For the first 20 minutes I need you to physically sit at your Mac mini, because I need to enable some things via its keyboard. Once Tailscale is installed there, you can come back to whichever device you prefer and I can do the rest remotely."

Then ask her to install Claude Code on the Mac mini and start a new session there with the same URL. (If Claude Code isn't yet installed on the Mac mini, walk her through one command: brew install anthropic-ai/tap/claude-code after installing Homebrew per Phase 3.1 — but the cleanest path is for her to switch to the Mac mini physically.)

Batch credential collection (do this first)

Send Julianna a single batched message asking her to spend 15-20 minutes signing up for accounts and pasting back tokens. This is the only block of "her doing things" before you take over.

Wait until you have all 3 tokens. Store them in a TodoWrite item or your scratch context so you don't lose them.

Mac mini system prep (automated)

Collect her macOS user password once. Tell her: "I need your Mac password for sudo — I'll use it for a batch of system-level changes and then drop it. Paste it now and I won't ask again for this batch."

Use sudo -v to cache it, then run a keepalive in the background while you batch:

# Validate sudo and start keepalive
sudo -v
( while true; do sudo -n true; sleep 50; kill -0 "$$" || exit; done 2>/dev/null ) &
KEEPALIVE_PID=$!

# Disable system sleep entirely (display sleep is fine, just don't suspend)
sudo pmset -a sleep 0
sudo pmset -a disablesleep 1

# Wake on network access (so the Mac mini wakes for SSH if it ever does sleep)
sudo pmset -a womp 1

# Don't sleep on power adapter (paranoid double-tap)
sudo pmset -c sleep 0

# Enable Remote Login (SSH)
sudo systemsetup -setremotelogin on

# Stop the sudo keepalive
kill $KEEPALIVE_PID 2>/dev/null
sudo -k

Verification (you, automatically)

# Confirm sleep is off
pmset -g | grep -E "sleep|disablesleep|womp"
# Should show: sleep 0, disablesleep 1, womp 1

# Confirm SSH is on
sudo systemsetup -getremotelogin
# Should print: Remote Login: On

# Confirm SSH actually works locally
ssh -o BatchMode=no -o StrictHostKeyChecking=accept-new localhost echo OK
# (will prompt for her password once; expected)

If any of these don't pass, stop and explain. Don't continue to Phase 3.

Install all tools (automated)

3.1 Homebrew

Check first:

brew --version 2>/dev/null || /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

If installing fresh, the installer will ask for sudo. Use her cached password if still valid, otherwise ask once and use the keepalive trick again.

After install, ensure Homebrew is on her PATH (Apple Silicon location):

if ! grep -q 'opt/homebrew/bin' ~/.zprofile 2>/dev/null; then
  echo 'eval "$(/opt/homebrew/bin/brew shellenv)"' >> ~/.zprofile
fi
eval "$(/opt/homebrew/bin/brew shellenv)"

3.2 Batch install

brew install gh jq coreutils
brew install --cask tailscale docker 1password 1password-cli

Notes:

• jq for JSON parsing in your scripts
• coreutils for GNU date and others (BSD versions on macOS are quirky)
• 1password cask is safe to include even if she already has it (Homebrew will skip)

3.3 Start Docker Desktop

open -a Docker
# Wait for Docker daemon to be ready
echo "Waiting for Docker daemon..."
while ! docker info >/dev/null 2>&1; do sleep 2; done
echo "Docker is ready."

If Docker prompts a GUI dialog (terms acceptance, privileged helper install), tell Julianna: "Docker is asking you to click through one dialog — accept the terms and let it install its helper. I'll wait."

Verification

brew --version
gh --version
docker --version
docker run --rm hello-world | head -5
ls /Applications | grep -E "Tailscale|1Password"

Tailscale provisioning + verification

Use the auth key from Phase 1 to bring up Tailscale unattended.

# Open the Tailscale GUI app (registers the system extension on first run)
open -a Tailscale

# Give the app a moment to register
sleep 8

# CLI may live at /Applications/Tailscale.app/Contents/MacOS/Tailscale
TAILSCALE="/Applications/Tailscale.app/Contents/MacOS/Tailscale"
if [ ! -x "$TAILSCALE" ]; then
  TAILSCALE="$(which tailscale || echo '')"
fi
[ -z "$TAILSCALE" ] && { echo "Tailscale CLI not found"; exit 1; }

# Bring up Tailscale with the auth key (replace TSKEY with her actual key)
"$TAILSCALE" up --authkey="$TSKEY" --hostname="mac-mini" --accept-routes

Verification (you, automatically)

# Should return a 100.x.x.x address
"$TAILSCALE" ip -4

# Should show "Logged in" and the device's MagicDNS name
"$TAILSCALE" status | head -3

Set up Tailscale on her other devices

After Mac mini is on, tell Julianna (one batched message):

Verification: SSH from outside the Mac mini

Once she confirms her MacBook Pro is on Tailscale, run a probe yourself:

# Get the Mac mini's Tailscale name
MAC_MINI_TS_NAME="$("$TAILSCALE" status --json | jq -r '.Self.DNSName' | sed 's/\.$//')"

# From the Mac mini, attempt to ping the MacBook Pro by its tailnet name
# (You'll need to ask her: "What's the name of your MacBook Pro in Tailscale?
#  Open Tailscale on it and look at the device list — looks like
#  julianna-mbp.tail-scale.ts.net or similar.")
"$TAILSCALE" ping --c 3 "$MBP_TS_NAME"

If ping succeeds, the mesh is working. Note her MacBook Pro tailnet name in your todo list — you'll use it for the final SSH-in test in Phase 12.

GitHub auth + verification

# Authenticate gh non-interactively using her PAT
echo "$GITHUB_PAT" | gh auth login --with-token --hostname github.com

# Configure git to use gh's credentials
gh auth setup-git

# Set her git identity if not already
git config --global user.email "$(gh api user --jq .email)"
# If above is null, ask her: "What email should I use for git commits?"
git config --global user.name "$(gh api user --jq .name)"

Verification

gh auth status
gh api user --jq '.login'
# Should print her GitHub username

1Password CLI (the one manual signin)

This is unfortunately the one step that requires her interaction. The 1Password CLI must authorize through the desktop app.

After she confirms, verify and create the working vault:

# Verify CLI ↔ app integration
op vault list 2>&1 | head -5
# If this fails, ask her to open the 1Password app to the front so it can authorize.

# Create a dedicated vault for code-accessed secrets
if ! op vault list --format=json | jq -e '.[] | select(.name == "Code Secrets")' >/dev/null; then
  op vault create "Code Secrets" --description "Secrets fetched at runtime by code on the Mac mini"
fi

# Verify
op vault list --format=json | jq -r '.[].name'

Healthchecks (API-driven, no UI clicks for her)

Use the Healthchecks API key from Phase 1 to create checks for every cron, then rewrite her crontab to ping. Do not modify the actual cron commands themselves — only wrap them.

7.1 Back up her crontab

crontab -l > ~/.crontab.backup-$(date +%Y%m%d-%H%M%S)
crontab -l > /tmp/crontab.current

7.2 Install the hc-run wrapper

sudo tee /usr/local/bin/hc-run > /dev/null <<'EOF'
#!/bin/bash
# Usage: hc-run <healthchecks-uuid> <cmd> [args...]
HC_UUID="$1"; shift
HC_BASE="https://hc-ping.com"
curl -fsS -m 10 --retry 3 "$HC_BASE/$HC_UUID/start" > /dev/null 2>&1 || true
"$@"
EXIT=$?
curl -fsS -m 10 --retry 3 "$HC_BASE/$HC_UUID/$EXIT" > /dev/null 2>&1 || true
exit $EXIT
EOF
sudo chmod +x /usr/local/bin/hc-run

7.3 Create a check per cron via the API

For each line in her crontab that runs a real command (skip blanks/comments):

1. Parse the schedule (first 5 fields) and the command (everything after).
2. Generate a friendly name. Try to extract from the command path (e.g. /Users/julianna/scripts/lead-intake.sh → "lead-intake") or ask her to confirm names if the command is opaque.
3. POST to Healthchecks API:

curl -fsS https://healthchecks.io/api/v3/checks/ \
  -H "X-Api-Key: $HC_API_KEY" \
  -d "{
    \"name\": \"$NAME\",
    \"schedule\": \"$CRON_SCHEDULE\",
    \"tz\": \"$(date +%Z)\",
    \"grace\": 600,
    \"unique\": [\"name\"]
  }" | jq -r '.ping_url' | awk -F/ '{print $NF}'

Capture the returned UUID for each check.

7.4 Rewrite the crontab

Build a new crontab where each command line becomes:

# BEFORE:
*/15 8-18 * * * /Users/julianna/scripts/lead-intake.sh

# AFTER:
*/15 8-18 * * * /usr/local/bin/hc-run <UUID> /Users/julianna/scripts/lead-intake.sh

Preserve all comments, blank lines, and ordering. Show Julianna the proposed diff and get a "yes" before installing it. Then:

crontab /tmp/crontab.new

7.5 Configure email + SMS alerts

Via API, create an email integration (her account email is already there by default — just verify):

curl -fsS https://healthchecks.io/api/v3/channels/ \
  -H "X-Api-Key: $HC_API_KEY" | jq '.channels[] | {kind, name, id}'

If no email channel exists, ask her: "What phone number should I send SMS alerts to?" and add SMS via the API (requires her to upgrade to a paid plan if she wants SMS — email-only is fine on free).

7.6 Self-test the wrapper

Verify hc-run end-to-end with a throwaway check:

# Create a throwaway test check
TEST_UUID=$(curl -fsS https://healthchecks.io/api/v3/checks/ \
  -H "X-Api-Key: $HC_API_KEY" \
  -d '{"name": "self-test (delete me)", "timeout": 60}' | jq -r '.ping_url' | awk -F/ '{print $NF}')

# Run hc-run with a successful command
/usr/local/bin/hc-run "$TEST_UUID" /bin/true

# Wait for the API to reflect the ping
sleep 5

# Verify the check is now "up"
STATUS=$(curl -fsS "https://healthchecks.io/api/v3/checks/$TEST_UUID" -H "X-Api-Key: $HC_API_KEY" | jq -r '.status')
[ "$STATUS" = "up" ] && echo "PASS" || echo "FAIL: status=$STATUS"

# Clean up
curl -fsS -X DELETE "https://healthchecks.io/api/v3/checks/$TEST_UUID" -H "X-Api-Key: $HC_API_KEY" > /dev/null

If FAIL, debug before continuing — the wrapper is foundational.

Project organization → GitHub (automated)

8.1 Inventory existing projects

# Common locations for her projects
ls -la ~ ~/Documents ~/Desktop 2>/dev/null | grep "^d"

# Look for git repos already
find ~ ~/Documents ~/Desktop -name ".git" -type d -maxdepth 4 2>/dev/null | head -30

Ask her to confirm which directories are projects vs. personal files. Show her a list, get a yes/no on each.

8.2 Move into ~/projects/

mkdir -p ~/projects
# For each confirmed project:
mv "$SOURCE_PATH" ~/projects/$PROJECT_NAME

8.3 Init + push to GitHub (per project)

for proj in ~/projects/*/; do
  cd "$proj"
  PROJECT_NAME="$(basename "$proj")"

  # Skip if already has a remote
  if git remote get-url origin >/dev/null 2>&1; then
    echo "$PROJECT_NAME: already has remote, skipping"
    continue
  fi

  # Init if needed
  [ -d .git ] || git init -b main

  # Standard .gitignore for safety — don't push secrets
  cat <<'EOF' >> .gitignore
.env
.env.*
*.key
*.pem
credentials.json
secrets.json
.DS_Store
__pycache__/
node_modules/
*.log
EOF
  # Dedupe
  sort -u .gitignore -o .gitignore

  git add .gitignore
  git diff --staged --quiet || git commit -m "Add baseline .gitignore"

  # Stage everything ELSE
  git add .
  git diff --staged --quiet || git commit -m "Initial commit"

  # Create private GitHub repo + push
  gh repo create "$PROJECT_NAME" --private --source=. --push
done

Verification

# Confirm every local project has a GitHub remote
for proj in ~/projects/*/; do
  cd "$proj"
  REMOTE=$(git remote get-url origin 2>/dev/null || echo "MISSING")
  echo "$(basename "$proj"): $REMOTE"
done

Secret migration to 1Password (semi-automated)

9.1 Scan for secrets across all projects

cd ~/projects
grep -rEn '(api[_-]?key|secret|password|token|sk-[a-zA-Z0-9]+|ghp_[a-zA-Z0-9]+|xoxb-|AKIA[0-9A-Z]{16})' \
  --include="*.py" --include="*.js" --include="*.ts" \
  --include="*.sh" --include="*.rb" --include="*.go" \
  --include=".env*" --include="config.*" \
  . 2>/dev/null > /tmp/secret-candidates.txt
wc -l /tmp/secret-candidates.txt

Filter aggressively — many matches will be false positives (variable names, comments, doc strings). Build a shortlist of actual values.

9.2 Single batched ask to Julianna

Show her a deduplicated list of distinct secrets you found, grouped by service. Ask her to add each one to 1Password under the "Code Secrets" vault, in a single batch:

[OpenAI]    found in: openai_key.py:3, lead_intake.sh:12  →  api key starting with sk-...
[GitHub PAT]   found in: scripts/sync.sh:4  →  token starting with ghp_...
[Asana]    found in: asana_sync.py:18  →  long opaque token
...

9.3 Refactor code to fetch from 1Password

After she confirms, for each secret-bearing file:

1. Shell scripts: replace inline secret with $(op read "op://Code Secrets/<name>/credential").
2. Python/Node/etc.: create a .env.template next to the script:

   OPENAI_API_KEY=op://Code Secrets/OpenAI/credential
   ASANA_TOKEN=op://Code Secrets/Asana/credential

   Then change the script's invocation to op run --env-file=.env.template -- python script.py.
3. Cron lines referencing those scripts: prefix the command with op run --env-file=... if needed. Cron's PATH won't include /opt/homebrew/bin by default — use absolute paths.

For each refactor, leave the old hardcoded value as a backup in a commented-out line ONE TIME for the commit, then delete it in the next commit. This way the migration commit is reviewable.

9.4 Test each refactored script

# For each script you modified, run a dry-equivalent that exercises the secret
# (don't run the real cron command — pick something that just authenticates and exits)
for script in $MODIFIED_SCRIPTS; do
  echo "Testing: $script"
  bash -n "$script"  # syntax check
  # Then a real test if you can identify a non-destructive auth check
done

If any test fails, restore from the backup commit and explain.

9.5 Push the cleaned code

for proj in ~/projects/*/; do
  cd "$proj"
  git diff --quiet && continue
  git add -u
  git commit -m "Move secrets to 1Password CLI"
  git push
done

Backblaze (manual install — no API for personal backup)

Send Julianna a single message:

Verification (you, after she confirms)

# Backblaze app is at /Applications/Backblaze.app and runs a daemon.
ls /Applications/ | grep -i backblaze
ps aux | grep -i bzbmenu | grep -v grep

If running: confirm to her, move on.

Cloudflare Tunnel (deferred — only when she launches her first public thing)

When she's ready: batched credential ask (phase 1, addendum)

11.1 Install cloudflared + create tunnel

brew install cloudflared

# Authenticate cloudflared (this opens a browser — one click for her)
cloudflared tunnel login
# After login, certificate lands at ~/.cloudflared/cert.pem

# Create the tunnel
cloudflared tunnel create mac-mini
TUNNEL_ID=$(cloudflared tunnel list -o json | jq -r '.[] | select(.name == "mac-mini") | .id')

11.2 Write tunnel config

cat <<EOF > ~/.cloudflared/config.yml
tunnel: $TUNNEL_ID
credentials-file: $HOME/.cloudflared/$TUNNEL_ID.json

ingress:
  # Add hostname → service entries per project as you launch them.
  # Example:
  #   - hostname: my-app.her-domain.com
  #     service: http://localhost:3000
  - service: http_status:404
EOF

For reference, here's a working multi-hostname config you can use as a template when she's running multiple public services:

# Multi-hostname example (for when she has 2+ public projects)
tunnel: <tunnel-id>
credentials-file: /Users/julianna/.cloudflared/<tunnel-id>.json

ingress:
  # Project 1 (apex + www)
  - hostname: my-first-project.com
    service: http://localhost:3000
  - hostname: www.my-first-project.com
    service: http://localhost:3000

  # Project 2 (subdomain on her main domain)
  - hostname: scheduler.julianna-domain.com
    service: http://localhost:3001

  # Project 3 (with TLS termination at the origin — rare)
  - hostname: secure-app.julianna-domain.com
    service: https://localhost:8443
    originRequest:
      noTLSVerify: true

  # Catch-all 404 — must be the last rule
  - service: http_status:404

Each public hostname needs (a) an ingress entry here, (b) a DNS route created via cloudflared tunnel route dns (Phase 11.3 below), and (c) the actual service running on the specified localhost:port. Reload after edits with sudo launchctl kickstart -k system/com.cloudflare.cloudflared (the launchd label may differ — check with sudo launchctl list | grep cloudflare).

11.3 Per-project DNS routing

For each public hostname:

cloudflared tunnel route dns mac-mini <subdomain>.<her-domain>

11.4 Run as a launchd service (so it survives reboots)

sudo cloudflared service install
# Or for user-only:
# cloudflared service install (without sudo, depending on version)

# Verify
sudo launchctl list | grep cloudflared

11.5 Verification

# Tunnel should show as connected
cloudflared tunnel info mac-mini

# Public hostname should resolve via Cloudflare
dig +short <subdomain>.<her-domain> @1.1.1.1

# End-to-end: from outside the LAN
curl -sI https://<subdomain>.<her-domain>/

End-to-end verification (you, autonomously)

Write a single verification script that tests every layer. Run it. Report a clean pass/fail summary to Julianna.

#!/bin/bash
# verify-stack.sh — runs all the smoke tests
set -u
PASS=0
FAIL=0
report() { if [ "$2" = "0" ]; then echo "PASS  $1"; PASS=$((PASS+1)); else echo "FAIL  $1"; FAIL=$((FAIL+1)); fi }

# 1. SSH from outside (run a remote command via Tailscale name, from the Mac mini, to itself by tailnet name — proves DNS + SSH listener)
TS_NAME=$(/Applications/Tailscale.app/Contents/MacOS/Tailscale status --json | jq -r '.Self.DNSName' | sed 's/\.$//')
ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new "$TS_NAME" "echo ok" >/dev/null 2>&1
report "Tailscale SSH self-loop" $?

# 2. Healthchecks roundtrip
TEST_UUID=$(curl -fsS https://healthchecks.io/api/v3/checks/ -H "X-Api-Key: $HC_API_KEY" -d '{"name":"verify-stack ephemeral","timeout":60}' | jq -r '.ping_url' | awk -F/ '{print $NF}')
/usr/local/bin/hc-run "$TEST_UUID" /bin/true
sleep 4
STATUS=$(curl -fsS "https://healthchecks.io/api/v3/checks/$TEST_UUID" -H "X-Api-Key: $HC_API_KEY" | jq -r '.status')
[ "$STATUS" = "up" ]
report "Healthchecks ping/status roundtrip" $?
curl -fsS -X DELETE "https://healthchecks.io/api/v3/checks/$TEST_UUID" -H "X-Api-Key: $HC_API_KEY" >/dev/null

# 3. GitHub: list one of her repos
gh repo list --limit 1 -q '.[].name' >/dev/null 2>&1
report "GitHub auth + repo list" $?

# 4. 1Password: list vaults
op vault list --format=json | jq -e '.[] | select(.name == "Code Secrets")' >/dev/null
report "1Password CLI + Code Secrets vault" $?

# 5. Docker: run hello-world
docker run --rm hello-world >/dev/null 2>&1
report "Docker daemon" $?

# 6. Sleep settings
SLEEP_VAL=$(pmset -g | awk '/^ +sleep/ {print $2; exit}')
[ "$SLEEP_VAL" = "0" ]
report "Mac mini sleep disabled" $?

# 7. SSH service
sudo systemsetup -getremotelogin 2>/dev/null | grep -q "On"
report "Remote Login enabled" $?

# 8. Cron healthchecks instrumented
HC_LINES=$(crontab -l 2>/dev/null | grep -c "hc-run")
TOTAL_LINES=$(crontab -l 2>/dev/null | grep -cE "^[^#]*[a-z]")
echo "INFO  Crons instrumented: $HC_LINES / $TOTAL_LINES"

# 9. Backblaze running
pgrep -f bzbmenu >/dev/null
report "Backblaze daemon" $?

echo ""
echo "Results: $PASS passed, $FAIL failed"
exit $FAIL

Save as ~/verify-stack.sh, chmod +x, run it, and show Julianna only the final summary line plus any failures.

Hand-off summary

Write a final state summary to ~/.julianna-setup/done.md for any future Claude session to pick up:

cat <<EOF > ~/.julianna-setup/done.md
# Julianna's Mac mini setup — completed $(date)
- Phase 1 credentials: stored in ~/.julianna-setup/
- Phase 2 system prep: pmset, SSH on
- Phase 3 tools: $(brew list --formula 2>/dev/null | wc -l) brew formulas, $(brew list --cask 2>/dev/null | wc -l) casks
- Phase 4 Tailscale: $(/Applications/Tailscale.app/Contents/MacOS/Tailscale ip -4 2>/dev/null)
- Phase 5 GitHub: $(gh api user --jq .login 2>/dev/null)
- Phase 6 1Password: $(op vault list --format=json 2>/dev/null | jq length) vaults
- Phase 7 Healthchecks: $(crontab -l 2>/dev/null | grep -c hc-run) crons instrumented
- Phase 8 Projects: $(ls -d ~/projects/*/ 2>/dev/null | wc -l) repos
- Phase 9 Secrets migrated: see ~/.julianna-setup/secrets-migrated.txt
- Phase 10 Backblaze: $(pgrep -f bzbmenu >/dev/null && echo "running" || echo "NOT INSTALLED")
- Phase 11 Cloudflare: $(which cloudflared >/dev/null && echo "installed" || echo "deferred")
EOF

Then send Julianna this final message, in her language (no jargon):

End the session here. Your work is complete.