Complete first-run setup

After component installation, run oore setup. Oore shows the service plan before it starts.

Interactive oore install starts this step automatically.

Automatic interface choice

Oore selects the setup interface from the session and device role.

To override the choice, use --interface terminal or --interface browser.

Browser setup requires the Complete role. It supports This device and Identity provider access.

Use terminal setup for Trusted proxy access. Over SSH, the automatic interface is the terminal.

oore setup --interface browser

Complete the role journey

Each role asks only for its required information.

The Complete role always keeps its web listener on loopback in this release.

Use a Web node behind protected ingress when the web listener must use a non-loopback address.

Complete and Control plane setup offer three access choices:

• This device uses passwordless sign-in over loopback. Use it on the backend Mac or through an SSH tunnel.
• Identity provider configures OIDC and verifies the first owner in a browser.
• Trusted proxy accepts identity from an existing access proxy. This choice uses terminal setup.

This device is the default choice.

If setup stops at idp_configured before owner creation, terminal setup can select This device or Trusted proxy instead.

Setup does not replace access after owner creation. Use Oore Settings after the instance becomes ready.

For terminal OIDC setup, add this exact callback URL to the identity provider:

http://localhost:4174/auth/callback

Keep this callback registered for setup retries. Over SSH, Oore prints the tunnel command for port 4174 before sign-in.

For Complete Trusted Proxy setup, Oore generates the private proof between its web service and control plane.

Oore also generates the upstream proof when you do not supply one. It prints the file path and this required proxy header:

x-oore-web-trusted-proxy-secret

Configure the access proxy to send that proof and the signed-in email header selected during setup.

For a Control plane role, the access proxy connects directly to oored.

Oore stores a generated direct proof at <install-root>/secrets/control-plane-proxy-proof.

It prints the direct proof header, selected email header, and the exact command that reads the proof file.

Administrator access

Service roles need administrator access to install and start macOS services.

In an interactive terminal, Oore requests access after you review the plan. The request expires after 60 seconds.

Without an interactive terminal, Oore uses non-interactive sudo. It never opens a password prompt.

For headless setup, activate administrator access first:

sudo -v
oore setup --config ./oore-setup.yaml

For CLI only setup, omit sudo -v.

If access fails, Oore stops before it changes setup state.

Use a configuration file

For repeatable setup, put values in a YAML or JSON file:

interface: terminal
access: this-device
owner_email: [email protected]
daemon_listen: 127.0.0.1:8787
web_listen: 127.0.0.1:4173

Review the plan first:

chmod 600 ./oore-setup.yaml
oore setup --config ./oore-setup.yaml --plan

Then apply it:

sudo -v
oore setup --config ./oore-setup.yaml

Verify the result

Setup must end with <Profile> setup is ready. Oore prints this message only after final service verification.

For This device and Identity provider access, Complete setup prints the local web URL.

Over SSH, it prints the exact tunnel command to run on your computer.

For Trusted Proxy access, setup hides the loopback URL. Finish the HTTPS proxy route, then open the proxy’s HTTPS address.

If setup prints an SSH tunnel, keep it open before you use the printed URL. Local Only sign-in remains passwordless through loopback.

For Complete, Control plane, or CLI only, run:

oore status

For a remote Runner or Web node, run:

oore status --daemon-url https://oore.example.com

For local browser setup, the web UI opens the ready instance.

For every setup option, read the oore setup reference.

Next step

Build your first debug APK.