New Mac

Sign in with a registered YubiKey (touch it, enter its FIDO PIN).

Sign in with YubiKey Use the password instead

Signed in with . Open Terminal on the freshly set up Mac (user dariush) and paste, within minutes:

Copy

The script asks for the passphrase (the same one as the restic passphrase and the site password), then:

1. sets the computer name, installs the Xcode command line tools and Nix,
2. clones the dotfiles with a read-only deploy key and runs the first darwin-rebuild switch,
3. asks the YubiKey (PIV PIN) to re-encrypt the secrets for this machine, or signs in to Google for a session token,
4. restores the home directory from the restic backup on Google Drive.

Needed at hand: the passphrase, the YubiKey and its PIN or a Google sign-in, the Google account, and Full Disk Access for Terminal when the restore starts. Re-running the script after an interruption is fine; every step checks what is already done. If the token has expired, sign in here again or let curl ask for the password.

Read the script before running it.