Installation & First Run

FrontierStack installs like any other Mac app — drag it to /Applications and open it. What happens next is up to you: it can run entirely with the per-action password prompts macOS already gives you, or you can grant it a small set of permissions once and never be asked again. This chapter walks the whole first run, then shows how to migrate an existing local stack so you keep your sites and databases.

2.1System requirements

FrontierStack is a native, signed macOS application. You need:

Nothing in this list is unusual; if your Mac is recent enough to run a current macOS, it can run FrontierStack.

2.2Downloading and first launch

Download the app, move FrontierStack.app into your /Applications folder, and double-click it. Because the app is signed by Enfour, Inc. (Apple Developer team 6Y87KNMALP) and notarised, macOS opens it without the unidentified-developer warning.

1. Open FrontierStack. The main window appears with the service sidebar on the left and a health overview in the centre — the layout you met in Chapter 1.
2. If Homebrew isn't present yet, panes that need it will say so and offer to install it. You can do that now or later.
3. FrontierStack enforces a single running instance. If a copy is already open and you launch it again, the existing window is simply brought to the front rather than a second copy starting. This keeps two windows from fighting over the same services and config files.

The first launch makes no changes to your system. The app reads what is installed and shows you the state of things; nothing is started, stopped or reconfigured until you ask.

2.3The Setup Assistant

The first time you open FrontierStack it offers a short Setup Assistant rather than dropping you into a sidebar of several hundred services. It is eight pages, it asks about you rather than about configuration, and nothing it asks is permanent — every answer only decides what the app shows and suggests first. You can leave at any point and reopen it from Add Server or Device ▸ Setup Assistant.

Finishing opens one more step: the Services Manager, filling the screen, with the sections that match your answers already open and every item in them switched off. Switch on what you want in the sidebar and choose Continue. Choose Skip — or Continue without switching anything on — and everything recommended is turned on instead. The AI Administrator and AI Models stay on either way, and the AI Administrator is briefed only once this step closes.

The last page is about licensing, and it is honest rather than a sales gate. FrontierStack works unlicensed — monitor this Mac, connect servers, use the AI Administrator, read every diagnostic. One capability in the plan you just built is licensed: running a migration. Moving a stack copies databases, sites and configuration onto a target and changes what runs there, so it needs a licence. Without one FrontierStack still detects the source, lists the sites and databases it found, and shows exactly what a migration would move — and the AI Administrator will still write you the full plan. Only carrying the move out is gated, and the Migration pane says so on the button rather than failing silently.

Containers, backup destinations and monitoring are deliberately not installed from the Stack page. They need decisions the assistant should not make on your behalf, so they go into the plan instead.

2.4The privileged helper — and the permissions macOS asks for

Starting and stopping services and editing system configuration (Apache, Nginx, MySQL, DNS, the firewall) are privileged operations. Out of the box, FrontierStack performs each one through the standard macOS authorisation prompt: you type your password every time. That is safe but quickly becomes tedious.

The optional helper removes that friction. It is a small privileged tool — an SMAppService daemon — that the app registers with macOS so it can carry out admin actions without re-entering your password each time. You install it deliberately: use the Install affordance at the foot of the sidebar, or accept the prompt when an action first needs it.

1. Click Install on the helper row at the bottom of the sidebar.
2. macOS shows its Login Items & Extensions approval (or asks you to enable the background item in System Settings ▸ General ▸ Login Items). Approve it — this is macOS asking whether to let the daemon run, not the app overriding anything.
3. The sidebar row flips to show the helper registered and running. From now on, service start/stop and config edits proceed without the per-action password prompt.

You can remove the helper at any time; FrontierStack then falls back to per-action admin prompts. Both modes work — the helper is purely a convenience.

2.5Installing Homebrew

Most of the catalog — web servers, databases, caches, mail, dozens of CLI tools — is installed as Homebrew formulae. Homebrew is the package manager FrontierStack uses to fetch and update those services, so if it isn't already on your Mac you'll want it early.

Open the Homebrew pane from the sidebar. If Homebrew is missing, the pane says "Homebrew isn't installed. It's the package manager this app uses to install services," with a Get Homebrew… button. Installation runs in the app's in-app console: it executes the official Homebrew installer and, at the point the installer needs administrator rights, you type your own password into the console. FrontierStack never captures or stores it — the prompt is Homebrew's own.

Once Homebrew is present, the pane becomes a full package manager: a searchable table of installed formulae and casks with their versions, an Install formula or cask field, an Update All button that shows the outstanding count, and per-row Update / Uninstall actions. The AI Administrator can drive the same flow with its install_homebrew and install_package tools, again through the in-app console where you enter your password.

2.6Nix, Devbox and Home Manager

Everything Nix lives in the Nix pane (under Infrastructure as Code), in tabs. Overview shows which Nix is installed — upstream Nix, Determinate Nix or Lix — whether its daemon is running and whether flakes are on. Without Nix, it offers both installers. It also catches the problem Mac users meet most: a macOS update replaces /etc/zshrc, so new terminals say nix: command not found although Nix is fine. Repair Shell Set-up puts the installer’s lines back.

• Packages searches nixpkgs and installs, removes, upgrades or rolls back the packages in your Nix profile.
• Devbox lists every project with a devbox.json in your usual project folders, with its packages, scripts and the services Devbox runs for it. Start, stop, restart or attach to them, open a devbox shell, or generate a Dev Container, Dockerfile or direnv file. Run a service with Devbox sets up PostgreSQL, MySQL, MariaDB, Redis, Valkey, Nginx, Caddy, Apache or PHP + Nginx in its own folder under ~/FrontierStack/Devbox and starts it, with no Docker and no Homebrew service.
• nix-darwin (when installed) switches, builds and rolls back the Mac’s system configuration. Store shows how much space /nix/store uses and collects garbage.
• A stopped daemon, a missing /nix volume or a failing Devbox service shows under Needs Attention and can raise an alert. Servers with Nix, NixOS or Devbox get a Nix tab in the Server Activity window.

The Home Manager tab is for Nix Home Manager, set up on its own or as a nix-darwin module. It shows where your configuration lives and whether it is a flake, and can set Home Manager up with a flake in ~/.config/home-manager.

• Switch Configuration builds and activates your configuration, Build Only checks it without activating, and Update Inputs runs nix flake update. Each runs in the in-app console.
• Flake inputs shows how long ago nixpkgs was pinned and turns orange after 60 days: Nix packages only get security fixes when you update and switch.
• Generations lists every generation with its date. Activate rolls back to one; Remove Old Generations clears those older than 30 days and frees the disk space.
• The pane also lists the packages and dotfiles the current generation provides and Home Manager’s launchd agents. Nix packages using too much CPU or memory appear under Needs Attention, as in the Homebrew pane.

2.7Tool versions with mise

mise (short for mise-en-place) gives each project the right Node, Python, Ruby, Go or Terraform version, its environment variables and its tasks — one tool in place of nvm, pyenv, asdf, direnv and make. The mise pane (under Runtimes) installs it and warns when your shell doesn’t activate it, since until then new terminals ignore the versions mise installed; Activate in Shell fixes that.

• Tools lists every installed version, the config that asks for it and which one is active. Add a tool for every folder, uninstall a version, or prune versions nothing uses.
• Updates shows tools behind the newest version their config allows and upgrades them.
• Projects lists folders with a mise.toml or .tool-versions: their tools and tasks, whether mise trusts them yet, and which kinds of secrets they use (age, SOPS or fnox). FrontierStack never decrypts or shows a secret value.
• Secrets (fnox) lists every fnox.toml with its providers and secret names, warns about secrets kept as plain text, and marks the ones KeyRotate can rotate through fnox.
• Servers with mise get a mise tab in the Server Activity window.

2.8The Command-Line PATH pane

FrontierStack detects installed tools by resolving them the way your shell does. Occasionally a tool you've installed (via pip, pipx, a virtualenv, or a non-standard prefix) isn't on the PATH the app sees, so it reports the tool as missing. The Command-Line PATH pane fixes that.

• Pick your shell profile (for example ~/.zprofile). Directories you add are written to a clearly marked managed block in that file and prepended to your PATH — open a new terminal to pick up the change.
• Directories to add lets you add a path by typing it or with Choose…; the top entry is searched first. Current PATH (effective) shows your login shell's PATH, tagging entries the app manages.
• PATH Doctor diagnoses why a tool isn't detected: enter a command (e.g. mlx_lm.server, gcloud) and it reports whether the app finds it, whether only your shell finds it, or whether it isn't installed at all — with a one-click Add to managed PATH for any directory the app is missing.

2.9The Install Wizard

If you're starting from scratch, the Install Wizard (in the sidebar) is the fastest way to a working stack. Pick a target use-case — WordPress/PHP, Full-Stack JS, Python/Django, Rails, static site, database, or reverse proxy — and the wizard pre-selects the recommended components (web server, database, cache) for that goal. Adjust the selection to taste, then it installs everything through Homebrew.

The same pane shows the status of the native Apache + MySQL + PHP stack at a glance, and detects all-in-one bundles already on your Mac — XAMPP, MAMP, AMPPS, Local. If it finds one, it routes you to Migrate Setups rather than installing a parallel stack, so you don't end up running two of everything.

2.10Migrating an existing stack

If you already run sites locally under MAMP, XAMPP or Apple's Server.app, you don't have to rebuild them. The Migrate Setups pane detects those stacks and brings their pieces into FrontierStack's native Homebrew stack: web files, MySQL databases, PHP settings, and the Apache vhosts that define each site.

1. Open Migrate Setups. It scans for installed sources — MAMP / MAMP Pro, XAMPP, Pancake Stack and Apple Server — and reports what it found: the sites, the database, and whether PHP was detected. (The AI Administrator's detect_migration_sources tool runs the same read-only scan.)
2. Review the Sites to import list. Each candidate shows its server name and listening port; anything that can't be brought across cleanly appears under Skipped with the reason.
3. For settings, the Import All Settings action copies the source's php.ini, my.cnf and nginx.conf over the matching Homebrew config. A .pre-mamp.bak backup of each file is kept so you can compare or revert.
4. Choose Import Selected to run the migration. Live progress is shown in the pane as it installs the needed Homebrew services, copies web files, migrates the MySQL databases and imports the vhosts.
5. Review afterwards. Source configs often reference the old tool's paths and ports (for example MAMP's extension_dir, datadir, socket, or port 8889), so check the imported settings before relying on them.

From Pancake Stack. Keep Pancake running so its MySQL answers. FrontierStack reads Pancake's site list and copies its databases with the Homebrew MySQL tools, using the root password Pancake keeps in your keychain; macOS asks once whether FrontierStack may read Pancake's data and use that password — choose Allow. Pancake gave each site its database settings through the environment, so the Give each site its own MySQL user step creates a MySQL user per site and writes it into the site's wp-config.php or Laravel .env. Python apps, custom Apache directives and sites without one of those files are listed in the log for you to finish by hand. Pancake itself is not changed.

The AI Administrator can drive this end-to-end with run_migration, but only after detecting sources and confirming with you — and only with changes enabled.

2.11Where your data lives

FrontierStack keeps its own state in predictable, standard places, so you always know what it touches and can back it up:

Keeping the app's Apache config in its own frontierstack/ directory means FrontierStack can manage vhosts safely without clobbering configuration you maintain by hand. The bundle identifier is jp.co.enfour.frontierstack (the helper and DDNS components use the .helper and .ddns suffixes).

With the app installed, the helper decided, Homebrew in place and any old stack migrated, you're ready to actually use it. Chapter 3, The Interface tours the window in detail: the sidebar, panes, search, the menu bar, and the controls you'll reach for every day.