Set up your assistant.
Everything runs on accounts you open yourself. There is no account to create here, and no password is ever typed into this site.
Before you start.
Four things. Gather them first and the rest takes minutes.
A Cloudflare account
With a domain already added to it as a site. Your console will live at a name under that domain, and Cloudflare guards the door.
You will create an API token scoped to that one zone, with permission to write tunnels, Access applications and DNS records.
Somewhere to run it
Easiest is a Hetzner Cloud account with an API token that can read and write. The installer makes the server for you, billed to you at €8.49 a month before tax.
If you already have a server running Ubuntu, you can use that instead and the installer gives you one command to paste into it.
Your own copy of the code
Fork or clone the repository, because your server pulls the code from a repository you control.
The installer makes a deploy key in your browser and shows you where to paste it.
The phone your WhatsApp is on
You will scan a QR code with it at the end, the same way you link WhatsApp Web.
Also decide which email address should be the only one able to open your console.
Run the installer on your own account.
The installer is a small page plus one function. You put it on your own Cloudflare Pages so that your tokens go from your browser to Cloudflare and Hetzner, and nowhere else.
That puts the installer on your Cloudflare account and opens it. The page is already built, so there is nothing to compile and nothing to configure. Then fill it in: your domain, the email that should be allowed in, the two tokens, and the address of your own repository. A Tailscale key is optional and only adds direct SSH. Every field says what it is used for and confirms that it is never stored.
Or do it by hand
The button is a convenience. If you would rather not hand Cloudflare a repository, or you want to read the code first, these three steps reach the same place.
Build it
From your clone, with Node 22 and pnpm installed.
pnpm install
pnpm --filter @cxw/installer build
Put it on Cloudflare Pages
Create a Pages project on your own account and publish the installer's public folder to it. The function beside it forwards one request at a time and keeps nothing.
npx wrangler pages deploy apps/installer/public
Open it and fill it in
Your domain, the email that should be allowed in, the two tokens, and the address of your own repository. A Tailscale key is optional and only adds direct SSH.
Every field says what it is used for and confirms that it is never stored.
Where the button sends you
The button points at cxw-installer, a public snapshot of the installer directory from the main repository. It exists because Cloudflare clones the repository without credentials, and because a one click deploy cannot build a package that lives inside a larger workspace. The snapshot ships already built.
What the installer does for you.
Nine steps, in this order. If any call is refused because a token is missing a permission, the page shows you the exact command or the exact form to do that one step by hand.
The door
- Finds your domain and reads its zone.
- Creates a tunnel to your server.
- Routes the tunnel to the console.
- Points a DNS record at it.
- Puts Access in front of the address.
- Allows your email, and only yours.
The machine
- Builds the first boot instructions, checked so no secret can land in the wrong place.
- Creates the server with a firewall that allows nothing inbound, or hands you one command to run on a machine you already own.
The handover
- Watches your address until the tunnel answers and Access is in front of it, then gives you one button through to the wizard. Three to five minutes.
Then the wizard takes over.
The rest happens on your own server, behind the door that was built before the machine even booted. There is no moment when it is open to the internet.
It asks for your WhatsApp number, shows the QR to link your phone, signs you in to Claude, connects Gmail and Calendar if you want them, lets you switch routines on, and offers to give your notes their own git remote.
Every step can be run again later from the console, so a phone that needs re-linking or a Google token that expires is a two minute fix, not a reinstall.