Setting up a machine

Install the binary, generate and trust a local certificate authority, and take the one privileged step that lets grove answer on port 443.

npm install -g @grove-sh/cli

Or, if you’ve got Go handy, go install github.com/grove-sh/cli/cmd/grove@latest. Either way there’s one more step, once per machine:

grove install

That generates a local certificate authority, adds it to your trust stores, and shows you the one privileged step your platform needs. Installing into the system trust store needs elevated privileges, so it may ask for your password. Everything else is written under your own state directory. Re-running is safe: an existing CA is reused, and an already trusted root is left alone.

The privileged step

Reaching port 443 is a machine-wide change. On Linux it’s a sysctl lowering the unprivileged port floor. On macOS it’s a pf redirect and a loopback alias, because nothing there can bind 443 as you. Those commands change your machine rather than your project, so grove prints them in full and asks before running them. grove install --yes answers in advance, and if there’s no terminal to ask, the commands are printed and left to you.

The printed lines and the lines grove runs come from the same list, so what you were shown and what happened can’t differ. Linux and macOS has the step for each platform and what it changes.

Where grove listens

Grove serves 127.0.0.4, not 127.0.0.1, so it sits beside whatever else wants port 443. The wildcard DNS for grov.site points there, so you never see the address in a URL, and a lando or docker proxy on 127.0.0.1:443 never notices grove.

Nothing runs at boot. Grove is up while you’re using it. Any grove exec starts a daemon when none is answering, and grove start does it on its own. The exception is CI, where nothing answering means grove steps aside instead.

Check it

grove doctor

Grove           running
Authority       installed and trusted
Runtime bundle  /etc/ssl/certs/ca-certificates.crt, which carries grove's root
Version         v0.5.0
Platform        linux-x64

That’s a healthy machine. Doctor also checks that the wildcard DNS resolves here and that 443 reaches grove, but those two only speak up when something is wrong, and when they do they name the fix. It’s also the first thing to run after grove install, before anything has had a chance to go wrong.

Taking it back out

grove uninstall

This stops grove, removes its root from the trust stores, and offers to undo the privileged step the same way install offered to take it: printed in full, run on a yes or with --yes. The CA files stay on disk, so a later grove install trusts the same root rather than generating another one. On macOS, removing a trust root asks for authorization, since that isn’t something to do quietly.