Connect each trusted device.

1. Check your server computer

Check these before requesting or downloading the trial. The current packages use a Linux amd64 container engine, Windows/Linux x64 clients, and Node.js 24. macOS packages are not available yet. Windows 10 is currently a supervised test environment.

• Install Node.js 24; node --version must show v24.
• Install a current Docker Desktop with Docker Compose, or Podman Desktop with native Compose. Python Compose is not required. Start the engine and check docker info / docker compose ls or podman info / podman compose ls.
• On Windows, enable hardware virtualization and install/update WSL 2. Check wsl --version; complete any requested restart before continuing. Installation may require Windows administrator approval; ordinary client use should run as your signed-in user.
• Plan at least 2 GiB for the container VM and several GB of free disk for images, your database and backups. Sunrise's basic trial used an 8 GiB host; these are test budgets, not a capacity guarantee.
• Use a private network and a verified HTTPS certificate. Keep your installation identity and backup keys outside the extracted package.

If a prerequisite fails, stop here, finish its installer/restart, then rerun the check. A version command alone does not prove the engine is running.

2. Verify your packages

Request access, then use your approved private invitation to download the server and clients. Compare every file's SHA-256 with the value on that invitation before extracting or running it.

Windows: Get-FileHash FILE -Algorithm SHA256. Linux: sha256sum FILE. From the extracted server directory, run node install.mjs verify, then node install.mjs doctor (add --docker for Docker).

If verification fails, download that package again. Do not edit its manifest or disable checks. Preserve an existing installation; do not initialize a replacement database or keys to resolve an update error.

3. Start your private server

For a new single-computer installation, run node install.mjs setup --endpoint 127.0.0.1; add --docker for Docker. Then run node server.mjs install status and node server.mjs install identify.

For an existing installation, keep its original private identity, project, database volume and license. Back up before upgrading. Do not run initialization or overwrite the old installation configuration.

Network choice: loopback is the default and works on this computer only. An intranet endpoint needs an explicitly selected private interface, HTTPS trust and firewall policy. Tailscale integration and Cloudflare private routing are being reviewed; a public Cloudflare hostname or Tailscale Funnel is not the private-network setup. Do not use wildcard listeners or public port forwarding.

If startup fails, rerun doctor and inspect local engine/container logs. Keep the database volume and private identity intact. After restarting Windows or the engine, resume at this stage and check status again.

4. Activate the trial

Return to your private invitation, enter the installation ID and confirm the binding. Activation starts the ten-day trial. Download the signed license and install it locally with node server.mjs install license --file license.json, then node install.mjs start and check status (use --docker consistently when applicable).

Keep this license and the existing installation when upgrading. Do not activate another installation to repair a failed restart. A signature, installation-binding or sequence error needs the matching license; never bypass verification.

5. Trust HTTPS and create the owner

Confirm the operator's public CA certificate fingerprint independently before installing trust in the browser or operating system. The public certificate is normally ~/.127vaults-test/ca/ca.crt. Never copy ca.key. Desktop/CLI use the SHA-256 of the CA file bytes; certificate tools may separately display the certificate DER fingerprint.

Open the exact private HTTPS address. Certificate warnings are a stop condition. For the first owner only, run node server.mjs install bootstrap locally and enter the one-time code in the server-hosted screen. Save your generated account secret and master password privately. Your public contact email does not create a vault account.

6. Enroll your clients

Desktop: choose “Register or create an account,” verify the server address, installation ID, public CA path and CA file SHA-256, then register this desktop. In the unlocked web app, open Settings → Devices → Register a device and approve its one-time code. Complete one online unlock to hydrate the encrypted offline copy.

CLI: run 127vaults server trust --url https://PRIVATE-IP:12780 --ca ca.crt --server-id INSTALLATION-ID, then 127vaults login USERNAME --enroll. Approve its code from an existing trusted client. On Windows, use your signed-in session so Windows credential storage is available.

Extension: load the approved Chromium package and register its packaged native connector, then unlock desktop or CLI. For a web-tab source, use the same browser profile as the unlocked vault tab. Open a matching sign-in page and click the extension in the toolbar; choose the source and login. It fills after your action and does not submit the form.

7. Verify sync and keep a backup

Create a fictitious vault and login. Edit it on one client, sync, and check another. Test an installed client's offline unlock and queued edit, then reconnect and confirm no pending changes remain. Ordinary browser tabs need the server online.

Back up the database together with its matching installation identity and preserve the encryption/restore key separately. Test restore before depending on the installation. Keep encrypted pending edits during renewal or repair.

License state: active allows licensed writes; expiry enters a 30-day read-only period; locked/revoked or detected clock rollback blocks licensed writes. Sign-in, reads and recovery remain available; encrypted data is retained. Check node server.mjs install status for the authoritative state. Configure and verify SMTP and available seats before inviting another vault user.