Set up a device

One command, no arguments

The script works out whether this is a fresh install or a deploy and does the right one. Every flag is an override, never a requirement.

curl -fsSL https://forgezero.net/setup.sh | bash

Try it without touching anything first

A dry run prints every action and changes nothing. It never asks for sudo, which makes it the safe first command on a machine you do not know well.

./setup.sh --dry-run

The platform invite

Bootstrap mints a single-use link and stores the token 0600, readable only by the service account. Open it to claim the platform account, register a passkey and write down a recovery phrase. Until it is claimed, no tenant can be created — and re-running bootstrap will not mint a second link.

Deploys are blue-green

Two slots run side by side. A deploy starts the idle slot, health-checks that slot directly, flips the edge, and only then stops the old one. A release that fails its check never receives traffic.