// POS31 / CLOUD WIRING

ONE TIME SETUP

Do this once on this browser. Firebase keys and the Google Drive grant are stored in localStorage and reused for the life of this profile. The master password still unlocks the OS. This page only links cloud.

Serve the folder over http://localhost — Google will not accept a file:// origin.

AUTHORIZED ORIGIN TO PASTE →

// 01 FIREBASE

SYNC THE OS

Firestore holds the encrypted database dump. Auth is a synthetic owner account derived from your master key — you do not create a Gmail for this.

  1. 01Open console.firebase.google.com → Add project (name it something like personal-os-31). Use a dedicated project. Do not reuse the DevLog project if you want them isolated.
  2. 02Add a Web app. Copy the firebaseConfig object (apiKey, authDomain, projectId, storageBucket, messagingSenderId, appId).
  3. 03Build → Authentication → Sign-in method → enable Email/Password.
  4. 04Build → Firestore Database → Create database. Start in test mode if you want, then paste the rules below.
  5. 05Paste the config here → SAVE KEYS. This browser remembers them. Reloading Personal OS picks them up automatically.
  6. 06Unlock the workstation with your master key. First unlock after keys are saved creates os-owner@{projectId}.web.app from the master password. Later unlocks sign into that same account and sync.

FIRESTORE RULES

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**} {
      allow read, write: if request.auth != null
        && request.auth.token.email.matches('os-owner@.*');
    }
  }
}

CHECKING…

// 02 GOOGLE DRIVE

ONE SIGN-IN

Sign in with Google once. This browser remembers the Client ID and that you granted Drive. Access tokens expire about every hour — Personal OS silently asks Google again with no extra consent as long as you stay signed into that Google account in Chrome.

  1. 01Open console.cloud.google.com (same Google account). You can use the Cloud project Firebase created.
  2. 02APIs & Services → Library → enable Google Drive API.
  3. 03APIs & Services → OAuth consent screen. User type External. App name PERSONAL OS. Add your Gmail under Test users.
  4. 04Scopes: add https://www.googleapis.com/auth/drive.file (files this app creates only) and email.
  5. 05Credentials → Create credentials → OAuth client ID → Application type Web application.
  6. 06Authorized JavaScript origins: add the origin shown at the top of this page (example http://localhost:5500). Add every origin you actually use. No trailing slash.
  7. 07Authorized redirect URIs: same origin, and origin + / if Google asks. Save. Copy the Client ID (….apps.googleusercontent.com).
  8. 08Paste Client ID → SAVE ID → CONNECT GOOGLE. Approve Drive. A folder named PERSONAL-OS is created in that Drive. New uploads go there and stay cached locally.

CHECKING…

// 03 AFTER THIS

REMEMBERED

Keys live in this browser only (localStorage key pos-cloud-v1). Another PC or a wiped Chrome profile needs this page again. Vault secrets never go to Drive as plaintext. Firestore stores the OS dump after master unlock. Files: local first, Drive copy when linked.

If Google pops up again, the token expired and Chrome was signed out of that account — click CONNECT GOOGLE once more. You should not need to re-paste IDs.

OPEN WORKSTATION POCKET