New Machine
TS_AUTHKEY env var
YubiKey (PIV slot 9d)
→ interactive prompt
→
notstrap
1. prereqs check
2. → notnet
3. clone Gitea
4. → notsecrets
5. link dotfiles
6. run hooks
→
notnet NEW
detect existing Tailscale
install if missing
resolve auth key
join tailnet
verify peer reachable
→
Tailnet
minibox (VPS)
Gitea repo
→
notsecrets +YubiKey
YubikeySource (PIV 9c)
BitwardenSource
FileSource
PromptSource
Already on Tailnet? notstrap detects active Tailscale → skips notnet entirely