Skip to content
Le Sanctum

Quick Start

A small lit lantern on a wooden desk beside a closed Mac Mini — pencil sketch with a teal halo around the lantern

If you have an Apple Silicon Mac Mini and about thirty minutes, this is the shortest path from “I read a doc” to “a thing is alive in my haus that runs on my hardware and watches over the things I care about.” The detailed Installation page goes deeper. This one is the friendly one.

Before you start

Section titled “Before you start”

Sanctum runs on Apple Silicon Macs. The hub is a Mac Mini (M-series, 16 GB+ RAM, 256 GB+ disk). If you don’t have one yet, see Requirements — the short version is “the cheapest current-generation Mac Mini will do.”

You also need:

  • A free Cloudflare account (the R2 free tier — 10 GB — is what we’ll use for backups).
  • A spare half-hour. Bring tea.

You do not need:

  • A static IP. Sanctum runs entirely on your LAN with no inbound ports.
  • A separate domain name. The internal certificates are minted locally.
  • Apple Developer credentials. Everything in the quick path uses Homebrew + Python.
  • A subscription to anything. There’s no cloud login for Sanctum itself.

The four steps

Section titled “The four steps”

  1. Install Homebrew if you don’t already have it.

    Terminal window
    /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

    This installs brew into /opt/homebrew/. It will ask for your password once. That’s fine — it needs to write to /opt/.

  2. Install sanctum-cli via the Homebrew tap.

    Terminal window
    brew install ogilthorp3/sanctum/sanctum-cli

    That’s a tap (the formula repository) plus the formula itself in one command. It installs Python 3.12 if you don’t already have it, creates a private virtual environment under Homebrew’s libexec, pulls the CLI plus its runtime dependencies from PyPI, and symlinks the sanctum command into /opt/homebrew/bin/sanctum.

    Confirm with:

    Terminal window
    sanctum --help

    A help screen with sub-commands (status, doctor, onboard, backup, chat) means you’re ready.

  3. Run onboarding.

    This is the moment.

    Terminal window
    sanctum onboard --recipe family

    You’ll see a small ASCII splash with your name in it, then a guided flow that:

    • Estimates what you’re about to back up (Documents, Desktop, ssh keys, dotfiles).
    • Walks you through Cloudflare R2 setup if you haven’t already (auto-opens the right browser tabs).
    • Runs a dry-run backup so you can see exactly what would happen.
    • Runs the real backup.
    • Restores a known file from the cloud as a canary and confirms the round-trip.

    When it finishes, you’ll see a green panel that says “Your Sanctum is alive, <your name>.” That panel is the moment. Take a screenshot.

  4. Verify.

    Terminal window
    sanctum status        # the whole haus at a glance
    sanctum doctor        # deep health check

    You should see green across the board. If anything is yellow or red, sanctum doctor will tell you what to fix.

What you just got

Section titled “What you just got”
  • Daily backups, automatically, via a com.sanctum.backup LaunchAgent that runs at a quiet hour and verifies each snapshot. You’ll never have to remember.
  • A health-monitored stack — twelve layers of supervisor (R2D2, cathedrals, autohealers, drift sentinels) running in the background.
  • A clean audit trail — every action that matters is logged to ~/.sanctum/logs/ with bounded rotation. You can read what your haus has been doing.
  • No phone-home. Nothing leaves your machine unless you explicitly configure a cloud target (which you just did, for backups, encrypted with a key only you have).

What to expect over the first week

Section titled “What to expect over the first week”

Day 1

You’ll get a notification when the daily backup completes. That’s intentional. After that, Sanctum will go quiet for a while — it doesn’t have anything to tell you yet.

Day 2-3

Try sanctum chat to talk to your local agents. Try sanctum status first thing each morning. Sanctum is meant to fade into the background; if you find yourself running these commands less, that’s a sign it’s working.

Day 4-7

Drift sentinels will run their weekly audits. If your Mac reboots for any reason (Apple update, power blip, you walked into the cord), Sanctum will come back up by itself — no login, no manual unlock — and resume where it left off.

When something interesting happens

A real notification means something a layered system couldn’t auto-handle. Open sanctum doctor and read the report. It tries to be honest.

When something goes wrong

Section titled “When something goes wrong”

The honest part of the doctrine matters most here. Sanctum tells you when something is broken, even if it can’t fix it yet.

  • sanctum doctor is the first stop. It checks the same things the daily sentinels check, but on demand.
  • The audit log at ~/.sanctum/logs/r2d2-audit.jsonl is the second stop. Each cycle has a UUID; grep it.
  • Troubleshooting has the top issues with copy-paste fixes.
  • Bug reports: open an issue on Ogilthorp3/sanctum-cli. The bug-report template asks for sanctum doctor + sanctum self-test output and a credentials-redacted checkbox. The maintainers read it; the auto-fix drone (R2D2) might already be working on a recipe to handle it next time.

What’s next

Section titled “What’s next”

If you got through this and the green panel said hello: congratulations, you’re running. The First Run page has the deeper verification checklist. What Is Sanctum? goes into the why.

If you want to share the haus with the rest of the family, the Family Pass installation page is the next step — it adds per-person scoping for kids and partners.