Skip to content
Le Sanctum

Installing Sanctum Family Pass

Installing Sanctum Family Pass — a hand placing a uniquely-notched wooden key into a heavy stone door at twilight; family silhouettes warm in the windows above, because the installation has a destination beyond the terminal.

You blocked off the afternoon. The tea is steeping. The terminal is open. And somewhere in your gut sits that old self-host dread — every install guide you have ever opened was a thousand-line bootstrap script with a fugue-state config phase that ate forty minutes and your will to live. Nah. Not today. Sanctum Family Pass is one curl pair, one hash check, one bash run — and it ends on a green panel that straight up says Your Sanctum is alive, <your name>. That is the whole movie, no cap. If you came braced for pain, you have lowkey got the wrong era of Sanctum.

Prerequisites

Section titled “Prerequisites”
  • Mac with Apple Silicon (M-series), macOS 15 Sequoia minimum (26 Tahoe recommended)

  • =16 GB RAM, >=80 GB free disk

  • A free Cloudflare account for the R2 backup target (10 GB free tier covers most haushelds)
  • An afternoon, tea, and a willingness to read a green-or-red panel

The installer installs everything else (Homebrew if missing, sanctum-cli, the Node.js Foundation signed .pkg for TCC stability). If something is genuinely outside its reach — Apple Command Line Tools, an Apple ID prompt for the .pkg install — it stops and tells you exactly what to do.

Install

Section titled “Install”

  1. Eyeball the installer before running it.

    Terminal window
    curl -fsSL https://sanctum.run/install.sh | less

    The script opens with a clearly-labeled plan: macOS Apple Silicon preflight, Homebrew bootstrap, Apple Command Line Tools check, brew install ogilthorp3/sanctum/sanctum-cli, Node.js Foundation .pkg install, hand-off to sanctum onboard --recipe family. Read the plan. Trust is earned, not curled.

  2. Optional: verify the hash before running (trust-but-verify path).

    Terminal window
    curl -fsSLO https://sanctum.run/install.sh
    curl -fsSLO https://sanctum.run/install.sh.sha256
    shasum -a 256 -c install.sh.sha256

    Expected output: install.sh: OK. The published .sha256 always matches the served script. If the check fails, stop — the download is corrupt, mid-flight tampered, or pointed at the wrong file. Re-download both and try again.

    Then run the verified copy:

    Terminal window
    bash install.sh

  3. Or just run it (faster path — same outcome).

    Terminal window
    curl -fsSL https://sanctum.run/install.sh | bash

    The script is idempotent — every step checks whether the thing already exists before installing. You can run it twice and the second run will be a no-op. You will be asked for your Mac admin password once during the Homebrew install (Apple’s installer needs it to create /opt/homebrew/).

  4. Onboard.

    The installer ends by asking whether to immediately run sanctum onboard --recipe family. Say yes. The onboarding wizard walks you through:

    • estimating the backup scope (~5 GB after dedup for the family recipe)
    • Cloudflare R2 cloud-bucket setup if you don’t have one yet (the wizard opens the right browser tabs)
    • a dry-run backup so you can see exactly what would happen
    • the first real backup
    • a restore-canary that round-trips a known file through the bucket and back to prove it works

    When it finishes you see a green panel: “Your Sanctum is alive, <your name>.” That panel is the moment. Take a screenshot.

  5. Verify.

    Terminal window
    sanctum self-test

    Twelve probes run in about a second. Green panel = ready. If any probe is red, its own line carries the actionable detail — and Troubleshooting opens with one command, ~/.sanctum/scripts/sanctum-doctor.sh --fix, that auto-heals roughly 60% of the usual suspects before you have to read further.

  6. Back up your credentials.

    Terminal window
    sanctum keys backup ~/Documents/sanctum-keys-$(date +%Y-%m-%d).tar.gz.enc

    Move the resulting file to a USB drive, an encrypted external disk, or your password manager’s secure-files vault. AES-256-CBC + PBKDF2 with the passphrase you enter; mode 600 on disk. Without this bundle (and the passphrase), the encrypted Sanctum credentials in your Keychain are unrecoverable if you wipe the machine. We mean unrecoverable. There is no recovery email. There is no support line that will undo this for you. This is the price of running on hardware you actually own.

After install

Section titled “After install”

A short tour of the operator surface:

  • sanctum status — daily green/red health glance.
  • sanctum doctor — full diagnostic, prints what failed and a hint per failure.
  • sanctum logs <service> — tail any subsystem (e.g. sanctum logs backup); run sanctum logs list to see the sixteen known names.
  • sanctum self-test — re-run the post-install verification wall any time.

Next step

Section titled “Next step”

Pair the Firewalla bridge so Sanctum can actually enforce schedules. See Firewalla pairing.

When something breaks

Section titled “When something breaks”

sanctum doctor is the first stop. sanctum self-test is the second. The Troubleshooting page is the third.

If those three don’t help, open an issue on Ogilthorp3/sanctum-cli. The bug-report template asks for sanctum doctor and sanctum self-test output — paste both. We read them.