Self-hosting guide · GitHub + Vercel
Everything to stand up this PowerShell toolkit under your GitHub repo, your Vercel account, and your name — from zero to a working one-line install.
# Windows (PowerShell) irm https://your-project.vercel.app | iex
Before you start
The whole system is three things: a private GitHub repo that holds all the content, a handful of tiny serverless functions on Vercel that read that repo using a secret token, and the launcher that client PCs run. Client PCs never see the token or the repo — only text over HTTPS.
So to run your own, you need a GitHub account (for the repo + token) and a Vercel account (to host the proxy). Both have free tiers that are plenty for this.
A GitHub account · a Vercel account · Git installed on this PC · about 20 minutes. No custom domain or paid plan required — Vercel gives you a free *.vercel.app address.
The file example.env in this project currently contains a live GitHub token and a real admin password (the current owner's). It is git-ignored, so it won't be pushed — but before you share this project folder with anyone, or if that token was ever exposed, rotate it at github.com/settings/tokens. You will create your own fresh token in Step 4 and never reuse that one.
Part 1 of 5
You'll create an empty private repository and push this project into it. Private is not optional — anyone who can push to the repo can run code on every client PC.
If you don't have one, sign up at github.com/signup. A free account is enough — it includes unlimited private repositories.
Go to github.com/new. Give it any name (for example my-toolkit), and — this is the important part — choose Private. Leave "Add a README" unchecked so the repo starts empty.
Illustration — the New repository screen. Pick Private.
Open PowerShell in this project folder and run the commands below, swapping in your username and repo name. This points the folder at your new repo and uploads everything (the git-ignored .env / example.env stay on your machine).
# replace YOU and my-toolkit with your own git remote remove origin # ignore an error if there's no origin yet git remote add origin https://github.com/YOU/my-toolkit.git git branch -M main git add -A git commit -m "Initial import" # skip if nothing to commit git push -u origin main
The first git push may open a browser to authorize Git. Approve it for your account — that's a one-time login, unrelated to the API token you make next.
Vercel needs a token to read (and, for the admin panel, write) your private repo. Make a fine-grained personal access token scoped to only this one repo — never a classic all-repo token.
Go to github.com/settings/personal-access-tokens/new and set:
toolkit-vercel.my-toolkit.Illustration — only Contents (read + write) is needed.
Click Generate token and copy it now — it looks like github_pat_11ABC… and GitHub shows it only once. Paste it somewhere safe for the next part.
The launcher only needs read. Write is what lets the /admin web console save changes back to the repo. If you'll never use the admin panel, you can grant Contents Read-only — but then admin editing won't work.
Part 2 of 5
Vercel runs the small functions in api/ and serves the launcher and admin panel. You import the repo, add your secrets as environment variables, and deploy.
Create an account at vercel.com/signup — choose Continue with GitHub so Vercel can see your repos. Then on your dashboard click Add New… → Project, find my-toolkit, and click Import.
Illustration — importing your repo into Vercel.
Leave the build settings at their defaults — Vercel detects "Other" and serves the api/ functions and public/ files as-is. There's no build step to configure.
On the import screen (or later under Project → Settings → Environment Variables) add the keys below. These are the only things that make it your deployment.
Illustration — add each key/value, targeting the Production environment.
Full list and what each does is in the reference table below. The three above are the minimum; the rest are optional. Make sure each is enabled for the Production environment.
Vercel's env-var screen has an Import .env option — you can paste the contents of your filled-in .env file to add them all at once.
Click Deploy. After a minute you'll get a live URL like my-toolkit.vercel.app (find it under Project → Domains). Write this down — it's the address you'll wire into the launcher next, and the address clients will run.
Open https://my-toolkit.vercel.app/admin in a browser. If you see the sign-in screen and your ADMIN_PASSWORD works, the token and repo are wired up correctly. (If it errors, see Troubleshooting.)
Part 3 of 5 · required
The launcher scripts still have the original address baked in (toolkit.bistab.com.np). Until you change it, a client would talk to the old deployment. Update it to your Vercel domain in three files, then push so Vercel redeploys.
The three spots are the BaseUrl / BASE lines:
| File | Line | Change |
|---|---|---|
public/launcher.ps1 | ~23 | $script:BaseUrl = 'https://YOUR-DOMAIN' |
public/console.ps1 | ~14 | $script:BaseUrl = 'https://YOUR-DOMAIN' |
public/linux.sh | ~19 | BASE="${TOOLKIT_URL:-https://YOUR-DOMAIN}" |
Or do all three at once — run this in the project folder (set your domain first, no https://):
$Domain = 'my-toolkit.vercel.app' # <- your Vercel domain, no https:// $enc = New-Object System.Text.UTF8Encoding($false) Get-ChildItem public -Recurse -Include *.ps1,*.sh,*.html -File | ForEach-Object { $t = [IO.File]::ReadAllText($_.FullName) $t = $t -replace 'toolkit\.bistab\.com\.np', $Domain [IO.File]::WriteAllText($_.FullName, $t, $enc) } git commit -am "Point launcher at my domain" ; git push
The push triggers an automatic Vercel redeploy. Once it finishes, irm https://my-toolkit.vercel.app | iex serves your launcher.
Part 4 of 5 · optional
The name appears in the app window, the admin panel, the docs, and a few folder paths on client machines. One script swaps them all. Skip this part if you don't care about branding.
BIJAY'S Toolkit → your name).C:\ProgramData\BijayToolkit, %LOCALAPPDATA%\BijayToolkit, and the Task Scheduler \BijayToolkit\ folder.~/.bijays-toolkit directory used by the Linux launcher.# --- set these three, then run the whole block --- $Brand = 'Acme Toolkit' # display name (spaces OK) $Slug = 'AcmeToolkit' # path/folder token (NO spaces) $Domain = 'acme.vercel.app' # your domain (optional here; safe to repeat) $enc = New-Object System.Text.UTF8Encoding($false) Get-ChildItem public,README.md -Recurse -Include *.ps1,*.sh,*.html,*.md -File | ForEach-Object { $t = [IO.File]::ReadAllText($_.FullName) $t = $t -replace "BIJAY'S TOOLKIT", $Brand.ToUpper() $t = $t -replace "BIJAYS TOOLKIT", $Brand.ToUpper() $t = $t -replace "BIJAY'S Toolkit", $Brand $t = $t -replace 'BijayToolkit', $Slug $t = $t -replace 'bijays-toolkit', $Slug.ToLower() $t = $t -replace 'toolkit\.bistab\.com\.np', $Domain [IO.File]::WriteAllText($_.FullName, $t, $enc) } git commit -am "Rebrand to $Brand" ; git push
The logo letter. The admin panel and docs show a single letter badge <span class="logo">B</span>. Search public/ for class="logo" and change the B to your initial.
Existing client folders. Renaming the path token only affects new installs. PCs that already ran the old toolkit keep their old BijayToolkit folder until you remove it manually.
Change only display strings and path tokens as above. Don't rename API files, env-var names, or the data/ folder structure — the launcher and functions look for those exact names.
Part 5 of 5
On any Windows PC, open PowerShell and run your one-liner. The WPF app should open with your name in the title bar.
irm https://my-toolkit.vercel.app | iex
Linux clients use the parallel command:
curl -fsSL https://my-toolkit.vercel.app/linux | bash
Browse to https://my-toolkit.vercel.app/admin and sign in with your ADMIN_PASSWORD. From here you add scripts, software, commands, docs and notebook entries — every save commits back to your private repo through the token. Clients pick up changes on their next run.
If the app opens, the admin panel accepts your password, and a script runs — your own toolkit is fully deployed. 🎉
Reference
Set these in Vercel → Project → Settings → Environment Variables. After changing any of them you must redeploy — env changes don't apply to the running build.
| Key | Req? | What it is |
|---|---|---|
GITHUB_REPO | yes | Your repo as owner/repo, e.g. YOU/my-toolkit. |
GITHUB_TOKEN | yes | The fine-grained PAT from Step 4 (github_pat_…). Lives only on the server. |
ADMIN_PASSWORD | yes* | Password for /admin and the write/delete APIs. *Required if you use the admin console. |
GITHUB_REF | no | Branch to serve. Defaults to main. |
LAUNCHER_KEY | no | Optional shared secret to gate the launcher itself. If set, clients must supply it ($env:MSP_KEY='…' before the one-liner, or export MSP_KEY=… on Linux). Leave blank to keep it open. |
ADMIN_RECOVERY_KEY | no | Optional long random string that recovers admin access if you get locked out. Set it once and store it offline. |
Reference
| Symptom | Most likely cause & fix |
|---|---|
/admin shows server not configured | GITHUB_REPO or GITHUB_TOKEN is missing/empty in Vercel, or you didn't redeploy after adding them. Add them for Production and redeploy. |
| Admin loads but saving fails | The token lacks Contents: Read and write, or it's scoped to the wrong repo. Regenerate with the right permission. |
github 404 in responses | Wrong GITHUB_REPO value, wrong branch in GITHUB_REF, or the token can't see that repo. Verify owner/repo spelling. |
| Launcher opens the old toolkit | You didn't update BaseUrl (Part 3) or didn't push/redeploy. Confirm the domain in public/launcher.ps1. |
irm … | iex returns text, not an app | The domain redirected a browser but PowerShell got an error page. Check the Vercel deployment is "Ready" and the domain is correct. |
| Client asks for a password unexpectedly | LAUNCHER_KEY is set. Either supply it via MSP_KEY, or clear the variable in Vercel and redeploy. |
Keep the repo Private · never commit a real token or .env (they're git-ignored — keep it that way) · give the token the narrowest scope (one repo, Contents only) · set an expiry and rotate it · use a strong, unique ADMIN_PASSWORD · and rotate the token that's sitting in example.env today if it was ever shared.
Self-hosting guide · GitHub + Vercel · generated for your fork of the Toolkit