feat(setup): one-command workstation setup with keys in 1Password #2

2026-10-09T14:14:18Z

KofTwentyTwo commented

2026-10-09 14:14:18 +00:00

(Migrated from github.com)

What

One-liners per OS that set up a KofTwentyTwo workstation:
- Windows: & ([scriptblock]::Create((irm https://raw.githubusercontent.com/KofTwentyTwo/standards/main/setup/bootstrap.ps1)))
- macOS/Linux: curl -fsSL https://raw.githubusercontent.com/KofTwentyTwo/standards/main/setup/bootstrap.sh | bash
setup/Install-Workstation.ps1 (PowerShell 7, all three OSes) installs the core tools plus optional language toolchains, configures git to sign with an SSH key held in 1Password (op-ssh-sign), points ssh at the 1Password agent, can register the signing key on GitHub, and checks disk encryption, firewall, malware protection, and private key files on disk. Idempotent; -WhatIf and -CheckOnly.
New workstation standard (K22-WS-*); the security program now names 1Password and forbids private key files (K22-SEC-10, K22-SEC-14).
README "Set up your machine" rewritten around the one-liners.

Why

Setup instructions were a list of commands to type; keys were allowed as files. A single script makes every machine identical and re-checkable, and keys created in 1Password never touch disk.

How tested

On Windows 11 (this machine):

-CheckOnly and -WhatIf: correct detection (including the Microsoft Store 1Password install), the right signing key chosen, no changes made.
PSScriptAnalyzer with configs/shell/PSScriptAnalyzerSettings.psd1: 0 findings; Invoke-Formatter: no layout changes.
shellcheck --enable=all and shfmt --diff on bootstrap.sh: clean.

Not yet run on macOS or Linux.

Depends on #1 for the markdownlint config (one code-fence finding in policies/README.md is fixed there).

Generated with Claude Code

## What - **One-liners per OS** that set up a KofTwentyTwo workstation: - Windows: `& ([scriptblock]::Create((irm https://raw.githubusercontent.com/KofTwentyTwo/standards/main/setup/bootstrap.ps1)))` - macOS/Linux: `curl -fsSL https://raw.githubusercontent.com/KofTwentyTwo/standards/main/setup/bootstrap.sh | bash` - `setup/Install-Workstation.ps1` (PowerShell 7, all three OSes) installs the core tools plus optional language toolchains, configures git to **sign with an SSH key held in 1Password** (`op-ssh-sign`), points ssh at the 1Password agent, can register the signing key on GitHub, and checks disk encryption, firewall, malware protection, and private key files on disk. Idempotent; `-WhatIf` and `-CheckOnly`. - New **workstation standard** (`K22-WS-*`); the security program now names 1Password and forbids private key files (`K22-SEC-10`, `K22-SEC-14`). - README "Set up your machine" rewritten around the one-liners. ## Why Setup instructions were a list of commands to type; keys were allowed as files. A single script makes every machine identical and re-checkable, and keys created in 1Password never touch disk. ## How tested On Windows 11 (this machine): - `-CheckOnly` and `-WhatIf`: correct detection (including the Microsoft Store 1Password install), the right signing key chosen, no changes made. - PSScriptAnalyzer with `configs/shell/PSScriptAnalyzerSettings.psd1`: 0 findings; `Invoke-Formatter`: no layout changes. - `shellcheck --enable=all` and `shfmt --diff` on `bootstrap.sh`: clean. Not yet run on macOS or Linux. Depends on #1 for the markdownlint config (one code-fence finding in `policies/README.md` is fixed there). Generated with [Claude Code](https://claude.com/claude-code)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/standards#2