fleet-mac-bootstrap¶
Onboards a fresh Mac mini into the Jones-Gaffney fleet, to parity with the four Windows boxes (greatroom, gaming, streaming, bedroom).
Legend: Clahadore = Claude · Cedric = Codex · Jenny = Gemini · Gronktayvius = Grok.
Use¶
Copy this folder to the Mac (USB, AirDrop, or git clone), then double-click
Fleet-Setup.command — or from Terminal:
./bootstrap.sh
Re-running is safe. Anything already installed is skipped.
Fleet fan-out preparation¶
After the main bootstrap and Tailscale sign-in, run only the script labeled for that physical Mac:
RUN-ON-MACBOOK-AIR.shRUN-ON-MAC-MINI-M2.shRUN-ON-MAC-MINI-M4.sh
Each script is pinned to one LocalHostName and Tailscale address and refuses a mismatch before
changing ~/.ssh/authorized_keys. Approved public keys come from ../ssh-keys relative to the
script folder—PC-Bootstrap/_shared/ssh-keys in the OneDrive layout. The M4 script additionally
requires user andrewjonesdev, Remote Login already enabled, the official Tailscale-signed app,
exactly six approved one-key files/fingerprints, and the six known Windows fleet-controller source
addresses.
Run these scripts normally, never as root or with sudo. A successful run writes a labeled
FANOUT-IDENTITY-*.txt report beside the script. PREPARED means the local key update passed; it
does not replace out-of-band host-fingerprint comparison and a live BatchMode=yes SSH probe.
The script manages and tightens the six pinned fleet keys but deliberately preserves unrelated
pre-existing SSH keys; PREPARED does not mean SSH access is fleet-exclusive. It also rejects
non-owner write-capable macOS ACLs on its script, key inputs, home, .ssh, and authorized_keys.
If the folder arrived from USB or another shared volume, first copy it into the user's OneDrive
folder and remove group/world write permission; the M4 script intentionally rejects writable
script, key, and directory paths.
What it installs¶
| Category | Items |
|---|---|
| Prerequisites | Xcode Command Line Tools, Homebrew |
| Core tooling | git, gh, node, dotnet SDK, PowerShell 7, ollama |
| Networking | Tailscale (joins the tailnet so the fleet can reach this box) |
| Remote access | Remote Login (SSH) + Screen Sharing (macOS built-in VNC) |
| Harnesses | Claude Code, Codex, Grok CLI (Antigravity/agy is a manual app install) |
| Repos | every repo in fleet-repo-sync/manifest.json, cloned flat under ~/source/repos |
What it deliberately does not do¶
Anything requiring a human decision or an interactive sign-in is collected and printed at the end rather than half-done in the middle:
- Tailscale, GitHub, Claude, Codex, and Grok sign-ins — accounts are yours.
- macOS privacy prompts (Full Disk Access) — these are GUI-only by design.
- gcloud install/auth — only if the box will touch GCP.
The script never infers success from command output; every step checks its exit code, and failures are listed separately from manual steps so a partial run is never reported as a clean one.
After it finishes¶
Once Tailscale is signed in, the box is reachable from anywhere on the tailnet:
ssh <you>@<local-host-name>
and viewable with Screen Sharing at vnc://<local-host-name> — including from
an iPhone, which is the point: watch the setup remotely instead of switching the
KVM away from the Windows boxes.
Still to decide before these count as fleet members¶
- Identity — whether each box gets its own GCP/GitHub identity is under council review (see FLT-182 follow-ups). Until that lands, a mini authenticates the same way the Windows boxes do.
- worktree-identity + board registration — needed only if the minis run agent sessions rather than serving other work.