First run

Create the first owner#

Open the address the installer printed. A vault with no owner shows Set up your vault instead of a sign-in page: your name, your email, and a password of at least twelve characters.

The next screen shows an authenticator key and ten recovery codes, once. Add the key to your authenticator app and print the codes now. Two-factor is required for every account. There is no password reset by email, on purpose, and this page never appears again. Everyone else in the household joins through an invitation from Settings.

If you prefer a console:

docker compose --env-file /data/harbor.env -f compose.yml -f compose.prod.yml \
  run --rm -e HARBOR_SETUP_PASSWORD='choose-a-long-password' api node dist/setup.js \
  --email you@example.com --name "Your name"

Choose a language model#

Settings, Suggestions: pick a provider and press Test, which makes a real call before saving anything. You can skip this and run with no model; cards then arrive without a summary. The language model explains the choices and what each sends.

Prove it#

head -c 5 /data/blobs/*/* | xxd | head -1

Note how long the first scan took per page; the Inbox card shows it. That number is the box's budget for everything it does from now on.

Then#

Print the break-glass envelope. Without it a dead disk means the documents are gone.