Skip to content

Windows Home Bootstrap

Per-computer Windows bootstrap scripts for Andrew's home machines. Scripts are pure PowerShell, idempotent, best-effort, and safe to sync through OneDrive. No secrets live in this repo.

Run Order

  1. Run deploy-to-onedrive.ps1 from this repo when you want to refresh the OneDrive copy.
  2. On each PC, open its OneDrive folder under PC-Bootstrap\<PC>\.
  3. Right-click setup.ps1 and choose Run with PowerShell, or run:
pwsh -File .\setup.ps1

Use -PullModels only on gaming or streaming hosts when you want Ollama model downloads to start. Default behavior prints the ollama pull commands because those pulls can take hours.

Manual Steps

gh auth login must be run once per machine. Use browser auth, the andrewjonesdev account, scopes repo and workflow; admin:org is needed for the GitHub Actions runner section.

claude must be run once interactively per machine to authenticate Claude Code with the Max account. Scripts install Claude Code if missing but never attempt auth.

Sections

Each run logs section status as OK, SKIP, or WARN, continues after failed sections, and writes a summary under:

%OneDrive%\PC-Bootstrap\_shared\logs\<COMPUTERNAME>-<yyyyMMdd-HHmm>.txt

Sections install/configure elevation, OpenSSH Server, SSH key mesh, winget prereqs, GitHub auth checks, tool repos, usage-governor, Claude Code, GitHub Actions runner, claude-mem client settings, and role-specific council host services.

SSH Mesh

Each PC creates %USERPROFILE%\.ssh\id_ed25519 if missing, publishes its public key to:

%OneDrive%\PC-Bootstrap\_shared\ssh-keys\<COMPUTERNAME>.pub

Every *.pub found there is imported into both user authorized_keys and C:\ProgramData\ssh\administrators_authorized_keys with duplicate lines removed. Run on every PC, then rerun anywhere after OneDrive sync delivers a new public key. Reruns are safe.

Security Notes

Scripts contain no API keys, passwords, runner tokens, or private keys. GitHub runner registration tokens are fetched live through gh api. administrators_authorized_keys inheritance is removed and access is granted to Administrators and SYSTEM.