From a65379316019b0342c05ebcced9f1e3ce9f2095e Mon Sep 17 00:00:00 2001
From: Geno Roupsky <185580+groupsky@users.noreply.github.com>
Date: Mon, 9 Nov 2026 06:23:02 +0200
Subject: [PATCH 1/3] docs: unpack bws and bw on disk, not in /run/nodkey-setup

Refs #107
---
 docs/setup.md | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/docs/setup.md b/docs/setup.md
index aedabc2..c81c2a8 100644
--- a/docs/setup.md
+++ b/docs/setup.md
@@ -254,7 +254,11 @@ install -d -o root -g root -m 0700 /etc/nodkey/credentials /run/nodkey-setup
   the disk, unless the machine moves them to swap. So before you make
   any key, make sure that the machine has no swap, or only encrypted
   swap ([section 9](#swap-and-hibernation)). The directory is gone after
-  a reboot; then make it again with the same command.
+  a reboot; then make it again with the same command. Use it only for
+  secrets: `/run` is small (on Debian, 10 % of the RAM by default), so
+  large files that hold no secret, such as the downloads of `bws` and
+  `bw` in [section 5](#where-bws-and-bw-come-from), go to a directory
+  on disk.
 - `/var/lib/nodkey` is the state directory: the audit log, and a home
   directory for each store. systemd makes it at the first start
   (`StateDirectory=` in the unit). For some store steps, you make it
@@ -564,16 +568,20 @@ program: see [1password](#1password-a-vault-only-for-nodkey). Nor does an
 
 An example with bws 2.1.0 on x86-64 (take the newest release, and
 `aarch64` instead of `x86_64` on 64-bit ARM). The checksum file of the
-release lists the SHA-256 of each file:
+release lists the SHA-256 of each file. The downloads hold no secret,
+so they do not need `/run/nodkey-setup`, and they may not fit there:
+the standalone `bw` zip alone is about 46 MB. So unpack them in a
+private directory on disk, and remove it after the install:
 
 ```sh
-cd /run/nodkey-setup
+install -d -o root -g root -m 0700 /root/bw-setup
+cd /root/bw-setup
 curl -fLO https://github.com/bitwarden/sdk-sm/releases/download/bws-v2.1.0/bws-x86_64-unknown-linux-gnu-2.1.0.zip
 curl -fLO https://github.com/bitwarden/sdk-sm/releases/download/bws-v2.1.0/bws-sha256-checksums-2.1.0.txt
 sha256sum -c --ignore-missing bws-sha256-checksums-2.1.0.txt
 unzip bws-x86_64-unknown-linux-gnu-2.1.0.zip bws
 install -o root -g root -m 0755 bws /usr/local/bin/bws
-rm bws bws-x86_64-unknown-linux-gnu-2.1.0.zip bws-sha256-checksums-2.1.0.txt
+cd / && rm -r /root/bw-setup
 ```
 
 `sha256sum` must print `OK` for the zip file. An example with the
@@ -582,12 +590,13 @@ has no checksum file, so compare the SHA-256 with the `sha256:` value
 that GitHub shows next to the file on the release page:
 
 ```sh
-cd /run/nodkey-setup
+install -d -o root -g root -m 0700 /root/bw-setup
+cd /root/bw-setup
 curl -fLO https://github.com/bitwarden/clients/releases/download/cli-v2026.9.1/bw-linux-2026.9.1.zip
 sha256sum bw-linux-2026.9.1.zip
 unzip bw-linux-2026.9.1.zip bw
 install -o root -g root -m 0755 bw /usr/local/bin/bw
-rm bw bw-linux-2026.9.1.zip
+cd / && rm -r /root/bw-setup
 ```
 
 With [gh](https://cli.github.com/), this prints the value from the

From 8dbdf5d2c2b0f4debea7873d144f954af796ab10 Mon Sep 17 00:00:00 2001
From: Geno Roupsky <185580+groupsky@users.noreply.github.com>
Date: Mon, 9 Nov 2026 06:23:41 +0200
Subject: [PATCH 2/3] docs: give the unpacked size of bw

Refs #107
---
 docs/setup.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/docs/setup.md b/docs/setup.md
index c81c2a8..708f9a9 100644
--- a/docs/setup.md
+++ b/docs/setup.md
@@ -570,7 +570,8 @@ An example with bws 2.1.0 on x86-64 (take the newest release, and
 `aarch64` instead of `x86_64` on 64-bit ARM). The checksum file of the
 release lists the SHA-256 of each file. The downloads hold no secret,
 so they do not need `/run/nodkey-setup`, and they may not fit there:
-the standalone `bw` zip alone is about 46 MB. So unpack them in a
+the standalone `bw` zip is about 46 MB, and the unpacked `bw` about
+140 MB. So unpack them in a
 private directory on disk, and remove it after the install:
 
 ```sh

From 94d426bbdeaa7fb31c72a14ee466ecdd0298af87 Mon Sep 17 00:00:00 2001
From: Geno Roupsky <185580+groupsky@users.noreply.github.com>
Date: Mon, 9 Nov 2026 06:23:50 +0200
Subject: [PATCH 3/3] docs: wrap a line

Refs #107
---
 docs/setup.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/setup.md b/docs/setup.md
index 708f9a9..d8294b4 100644
--- a/docs/setup.md
+++ b/docs/setup.md
@@ -571,8 +571,8 @@ An example with bws 2.1.0 on x86-64 (take the newest release, and
 release lists the SHA-256 of each file. The downloads hold no secret,
 so they do not need `/run/nodkey-setup`, and they may not fit there:
 the standalone `bw` zip is about 46 MB, and the unpacked `bw` about
-140 MB. So unpack them in a
-private directory on disk, and remove it after the install:
+140 MB. So unpack them in a private directory on disk, and remove it
+after the install:
 
 ```sh
 install -d -o root -g root -m 0700 /root/bw-setup