Open this page on the X1

X1 Setup Day

Every command has a copy button. Work top to bottom. Roughly 2 hours, most of it progress bars.

01 Diagnostics — before wiping

Open Terminal (Admin): right-click the Start button → Terminal (Admin). Admin matters, the TPM check fails without it.

Write-Host "=== MACHINE ===" -ForegroundColor Cyan
Get-ComputerInfo | Select-Object CsManufacturer,CsModel,CsProcessors,@{n='RAM_GB';e={[math]::Round($_.CsTotalPhysicalMemory/1GB,1)}},OsName,BiosSMBIOSBIOSVersion | Format-List
Write-Host "=== DISK ===" -ForegroundColor Cyan
Get-PhysicalDisk | Select-Object FriendlyName,MediaType,@{n='Size_GB';e={[math]::Round($_.Size/1GB)}},HealthStatus | Format-Table -AutoSize
Write-Host "=== TPM ===" -ForegroundColor Cyan
try { Get-Tpm | Select-Object TpmPresent,TpmReady,TpmEnabled,ManufacturerVersionFull20 | Format-List } catch { "TPM query failed" }
Write-Host "=== SECURE BOOT ===" -ForegroundColor Cyan
try { "SecureBoot enabled: " + (Confirm-SecureBootUEFI) } catch { "Secure Boot query failed" }
Write-Host "=== NETWORK ===" -ForegroundColor Cyan
Get-NetAdapter | Select-Object Name,InterfaceDescription,Status | Format-Table -AutoSize

Send the output back. If the terminal is being difficult, the one thing that actually blocks a decision is the TPM — press Win+R, type tpm.msc, Enter, and screenshot that instead.

Battery: already settled. 45.02 Wh usable (79% health, 260 cycles) ≈ 7 hours of headless runtime. Keep it. It is a better UPS than anything worth buying.

02 Install Ubuntu

Download (do this on the MacBook, it is faster): Ubuntu 26.04.1 LTS Desktop. Desktop, not Server — APEX needs a real graphical Chrome for the logged-in profiles.

Write the USB stick (8 GB+) with balenaEtcher: pick ISO, pick stick, flash.

Boot from it: power on the X1 and tap F12 repeatedly for the boot menu. (F1 = BIOS, if the stick does not appear.)

The four decisions you cannot undo

Setting	Choose	Why
Username	`stefan`	Every service path hardcodes /home/stefan
Hostname	`x1`	Makes `ssh stefan@x1` work later
Install type	Erase disk	Full wipe, no dual boot
Encryption	Enable — prefer TPM-backed	Cannot be added afterwards

Write down the recovery key the encryption step gives you, into your password manager. A future BIOS update can invalidate the TPM seal, and that key is the only way back in.

Also tick "Download updates while installing" and third-party drivers (WiFi firmware).

If the installer offers no TPM-backed option: pick normal encryption with a passphrase and tell me. Solvable afterwards, no reinstall.

03 First boot — hand it over

Open Terminal on Ubuntu (Ctrl+Alt+T). Two blocks, then you are done touching this machine.

a. Enable SSH:

sudo apt update && sudo apt install -y openssh-server
sudo systemctl enable --now ssh
hostname -I

b. Install Tailscale (so I can reach it from anywhere, not just your WiFi):

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

It prints a login link — open it, sign in with the same account as your MacBook. Then run:

tailscale ip -4

Send me that address. From there I connect over SSH and do the rest: packages, Claude Code, power settings, firewall, the APEX service, the credential bundles, the exit node.

After this point there is no more copy-paste. I run commands on the X1 directly from the MacBook session.

04 The acceptance test

Not "does it run" but "does it come back":

DM status to APEX in Slack → reply within ~15 seconds
Pull the power cable. Walk away. Bring it back from your phone.
Then have Fatima run the restart drill without calling you

Step 2 is the test Vox never had, and the reason it failed silently for seven weeks.

05 If something goes sideways

Symptom	Do this
USB will not boot	F1 → BIOS → check boot order; try disabling Secure Boot
No WiFi after install	Ethernet dongle, or tether the phone and `sudo apt install linux-firmware`
No encryption option offered	Install unencrypted, tell me — fixable without reinstalling
Locked out after a firmware update	The recovery key from step 02. This is what it is for