██ ██████╗ ██████╗ ███╗ ██╗███████╗ █ ██╔════╝██╔═══██╗████╗ ██║██╔════╝ ██ ██║ ██║ ██║██╔██╗ ██║█████╗ █ ██║ ██║ ██║██║╚██╗██║██╔══╝ ███ ╚██████╗╚██████╔╝██║ ╚████║██║ ██▄██ ╚═════╝ ╚═════╝ ╚═╝ ╚═══╝╚═╝
1 install path. 0 daemons. Private releases that still decrypt locally.
Stable install URLs, release-aware rollback, and a trust boundary you can explain to a security-conscious teammate in one minute.
PROTOCOL-FIRST DELIVERY
1Conf keeps the install path as simple as copy-paste while giving the backend enough structure for private payloads, release history, and rollback.
STABLE INSTALL PATH
The command stays the same while the active release changes behind it. That means fewer “which file was the latest one?” moments and fewer setup instructions to maintain.
PRIVATE WHEN NEEDED
Private configs are encrypted before upload, decrypted on the client, and stored as blobs. The service helps deliver them without becoming the place that knows your plaintext.
RECOVERY BUILT IN
Config changes are safer when recovery is part of the product. Release history and rollback move 1Conf away from save-and-hope config management.
CLEAR TRUST BOUNDARY
Upload encrypts locally. Install decrypts locally. 1Conf brokers release metadata and encrypted blobs without needing your private plaintext at either end.
upload path
local encrypt before release
+------+ +----------+ +--------+ +---------+
| You | | Terminal | | 1Conf | | Release |
+------+ +----------+ +--------+ +---------+
| | | |
| curl -L ... | | |
|-------------->| | |
| | | |
| | [local] read [config] |
| | [local] encrypt payload |
| | [local] derive HMAC |
| | create draft | |
| |-------------->| |
| | | |
| | ciphertext | |
| | + metadata | |
| |-------------->| |
| | | |
| | | store version |
| | |-------------->|
| | | |
| | | |
// local: choose file, enter passphrase, encrypt, derive HMAC
// remote: store release metadata and encrypted blob only
install path
local decrypt before write
+------+ +----------+ +--------+ +-------+
| You | | Terminal | | 1Conf | | Files |
+------+ +----------+ +--------+ +-------+
| | | |
| curl -L ... | | |
|-------------->| | |
| | GET /team/prod-env |
| |-------------->| |
| | script | |
| |<--------------| |
| | manifest | |
| |<--------------| |
| | enc blob | |
| |<--------------| |
| passphrase | | |
|-------------->| | |
| | [local] verify HMAC |
| | [local] decrypt payload |
| | write [config] |
| |------------------------------>|
| | | |
// network: script, manifest, encrypted payload
// local: password entry, HMAC verify, decrypt, write
REAL SETUP MOMENTS
Keep the “fresh machine” moment to one command instead of a dozen tabs, paste buffers, and missing dotfiles.
Hand teammates one install URL for common envs or local tooling setup without teaching a custom release ritual.
Turn your Claude Code globals into something you can publish, update, and safely roll onto another machine.
READY WHEN YOU ARE
Keep one memorable install command, ship encrypted configs when you need privacy, and recover quickly when a release goes sideways.