← Back to Continuity
First setup guide
Where this says to clone the repository, unpack the download instead.
# First setup of the real vault
A one-time procedure. It follows ADR-001, ADR-002, and ADR-007 (vault codes). It ends with the
first real restore test, and until that passes nothing counts as backed up
(charter §9). Allow about half a day. Tick each box as you go and keep this
page with the paper-kit notes until step 9 is done.
Placeholders: `vps` is the Continuity server, `laptop` is your own machine.
## 1. Tools (laptop and VPS)
- [ ] Clone this repository on both machines.
- [ ] `tools/fetch-binaries ~/.local/continuity` on both, then add
`~/.local/continuity/bin` to `PATH`.
- [ ] VPS: create the `continuity` user (no sudo, key-only SSH). Nothing
else runs as this user. Confirm `/dev/fuse` exists and `fusermount3`
is installed.
## 2. The PAPER code and the post-quantum identity (offline)
- [ ] Boot an Ubuntu live USB **with networking disabled**. Copy
`age-keygen` into it from the bundle.
- [ ] `age-keygen -o paper.txt` and `age-keygen -pq -o paper-pq.txt`.
- [ ] Print (or hand-copy) both secret-key lines for the paper kit, plus a
QR code of each if a printer is attached to the live system only.
The `AGE-SECRET-KEY-1…` line is the vault code **PAPER**.
- [ ] Write both **public** keys (`age1…`, `age1pq1…`) onto a USB stick.
Shut down; the live USB forgets the secret keys.
## 3. The DAILY code (laptop)
- [ ] `tools/new-code daily --add`. It shows the code once and adds its
public half to `continuity-data/recipients/owner.txt`.
- [ ] Save the code in the password manager as a new entry,
"Continuity vault code". Do not save it in any file. Then
`clear; history -c`.
## 4. Recipients and config
- [ ] Add the PAPER public key (`age1…`, from the USB stick) to
`recipients/owner.txt`, on its own line under a `# paper` comment.
The file now holds two recipients: daily and paper. Copy it to
`archive.txt`.
- [ ] `recipients/archive-pq.txt`: the `age1pq1…` public key.
- [ ] Copy `tools/config.example` to `~/.config/continuity/config` on both
machines and fill it in: `CONTINUITY_REMOTE` on the laptop, `REPO_*`
on each machine for its own targets. No code goes into the config.
## 5. Create the vault (on the VPS)
- [ ] `tools/init-vault`, run from an interactive SSH session. **Write the
five master keys onto paper now.** Then `clear; history -c`.
- [ ] Copy `continuity-data/keys/` to the laptop (`tools/mirror` does it).
- [ ] From the laptop: `tools/unlock`. On the VPS, put a `COMPARTMENT.md`
from `templates/COMPARTMENT.md` into each `mnt/cN/`.
- [ ] Write the first records: the key inventory (c1 `recovery/`), then
whatever is most urgent to preserve.
- [ ] `tools/lock`.
## 6. Backups
- [ ] Laptop: `tools/init-repo object-store` (repository URL reachable from
both machines). Put that password in a 0600 file for the `continuity`
user on the VPS and set `PASSFILE_object_store=` there. It only opens
ciphertext the VPS already holds. Turn on object lock / append-only
for the bucket, so a compromised VPS cannot delete old snapshots.
- [ ] VPS: `tools/backup object-store`.
- [ ] Laptop, HDD-home attached: `tools/mirror`,
`tools/init-repo hdd-home`, `tools/backup hdd-home`.
- [ ] Same for HDD-offsite.
- [ ] Write every restic password onto paper as printed.
## 7. Archive and recovery bundle
- [ ] Unlock, then `tools/archive-export /media/…/HDD-HOME/continuity/archive`.
- [ ] Run it again with `--recipients …/archive-pq.txt`. When it asks for
a code, type the post-quantum line (`AGE-SECRET-KEY-PQ-1…`) from the
paper, or use `--no-verify` and verify it in step 9.
- [ ] Lock. Run `tools/make-bundle /media/…/HDD-HOME/continuity` for each HDD.
## 8. START-HERE and paper kit
- [ ] Fill in `START-HERE.template.md` as `START-HERE.md` **outside Git**,
and set `CONTINUITY_START_HERE` in the config. Re-run `make-bundle`.
- [ ] Print three copies: home, L2, L3.
- [ ] Assemble the paper kit (ADR-002 §2), seal it, and take it to its secure
location (L3).
## 9. First restore test, on a clean machine
- [ ] Boot a live USB. Using **only** the printed START-HERE, the paper
kit, and one HDD, follow sections 5.1–5.6.
- [ ] Then, from the repository: `tools/restore-test --repo hdd-home
--archive <archive dir> --keys <bundle>/keys --log
<c1>/recovery/restore-test-log.md`, and type the **PAPER** code when
asked. Repeat once with the DAILY code.
- [ ] Start the app (`tools/start`), enter the one-time code it shows,
and make the sign-in code. Save it in the password manager as
"Continuity sign-in", then sign in with it once.
- [ ] Write down anything START-HERE got wrong, fix it, and reprint.
Only after step 9 passes do the backups count.