First run

Create the first owner#

Open the address the installer printed. A vault with no owner shows Set up your vault instead of a sign-in page: your name, your email, and a password of at least twelve characters.

If you chose to reach the vault directly on the internet, the installer printed a setup link instead, such as https://harbor.example.com/setup?token=…. Open that link: the vault creates its first account only through it, so nobody who finds the address before you can claim it. On every other path, whoever opens the vault first can create the account, so do it as soon as the installer finishes.

The next screen shows an authenticator key and ten recovery codes, once. Add the key to your authenticator app and print the codes now. Two-factor is required for every account. Harbor does not provide password reset by email. Keep the recovery codes somewhere safe, separate from your phone. Everyone else in the household joins through an invitation from Settings.

For command-line setup, run the following from the deployment directory. Replace the example password and account details before running it:

docker compose --env-file /data/harbor.env -f compose.yml -f compose.prod.yml \
  run --rm -e HARBOR_SETUP_PASSWORD='choose-a-long-password' api node dist/setup.js \
  --email you@example.com --name "Your name"

Choose a language model#

Settings, Suggestions: pick a provider and press Test, which makes a real call before saving anything. You can skip this and run with no model; cards then arrive without a summary. The language model explains the choices and what each sends.

Verify the installation#

If text extraction fails, retry the document from the Inbox and check harbor logs worker. If a backup or restore test fails, review its error in Settings → Backups before relying on it. See When something breaks.

Save your recovery information#

Print the break-glass envelope. Keep it with your recovery codes, separate from the server. Encrypted backups require the keys recorded on the sheet.