diff --git a/pisetup/01-install-to-boot.sh b/pisetup/01-install-to-boot.sh
new file mode 100755
index 0000000..9c41b2d
--- /dev/null
+++ b/pisetup/01-install-to-boot.sh
@@ -0,0 +1,31 @@
+#!/bin/bash
+
+function die {
+    echo "$1" > /dev/stderr
+    exit 1
+}
+
+function info {
+    echo "$1" > /dev/stderr
+}
+
+function doinstall {
+    # assumes osx
+    [[ "$(uname -s)" != "Darwin" ]] && die "need osx"
+
+    TARGET="/Volumes/boot"
+
+    if [[ ! -e "$TARGET/LICENCE.broadcom" ]]; then
+        die "cant find rpi boot dir"
+    else
+        info "rpi boot dir found at $TARGET"
+    fi
+
+    info "disabling partition resize"
+    sed -i '' -e 's/init=[^[:space:]]*//' "$TARGET/cmdline.txt"
+
+    info "copying setup files to disk"
+
+}
+
+doinstall
diff --git a/pisetup/02-borg-via-ssh.sh b/pisetup/02-borg-via-ssh.sh
new file mode 100755
index 0000000..1680010
--- /dev/null
+++ b/pisetup/02-borg-via-ssh.sh
@@ -0,0 +1,37 @@
+#!/bin/bash
+
+if [ "$#" -ne 1 ]; then
+    echo "usage: $0 <hostname>"
+    exit 1
+fi
+
+HOSTNAME="$1"
+
+SS="$(brew --prefix)/opt/util-linux/bin/setsid"
+
+if [[ ! -e $SS ]]; then
+    brew install util-linux
+fi
+
+SSH_OPTIONS="-oLogLevel=error"
+SSH_OPTIONS="${SSH_OPTIONS} -oStrictHostKeyChecking=no"
+SSH_OPTIONS="${SSH_OPTIONS} -oUserKnownHostsFile=/dev/null"
+
+echo 'echo raspberry' > /tmp/defaultpw.sh
+chmod 777 /tmp/defaultpw.sh
+export SSH_ASKPASS="/tmp/defaultpw.sh"
+export DISPLAY=nope
+tar -c ./root | $SS ssh $SSH_OPTIONS pi@raspberrypi.local "
+    DEBIAN_FRONTEND=noninteractive
+    sudo hostname $HOSTNAME &&
+    echo $HOSTNAME | sudo tee /etc/hostname &&
+    sudo apt update &&
+    sudo apt install -y rsync bash &&
+    sudo mkdir -p /tmp/setup &&
+    sudo chmod ugoa+rx /tmp/setup &&
+    cd /tmp/setup &&
+    sudo tar xvf - &&
+    sudo rsync -avP /tmp/setup/root/ / ;
+    nohup sudo bash /etc/rc.local &
+    tail -f /var/log/messages
+"
diff --git a/pisetup/install-packages.sh b/pisetup/install-packages.sh
new file mode 100644
index 0000000..3e4e25d
--- /dev/null
+++ b/pisetup/install-packages.sh
@@ -0,0 +1,30 @@
+#!/bin/bash
+
+PKGS="
+    bash-completion
+    build-essential
+    byobu
+    command-not-found
+    cryptsetup-bin
+    daemontools
+    golang-go
+    iptables-persistent
+    iptraf-ng
+    jq
+    less
+    lsof
+    mosh
+    ntp
+    pbzip2
+    pv
+    runit
+    runit-systemd
+    socat
+    vim
+    wget
+"
+
+export DEBIAN_FRONTEND=noninteractive
+
+sudo apt update
+sudo apt install -y $PKGS
diff --git a/pisetup/root/boot/rc.local.txt b/pisetup/root/boot/rc.local.txt
new file mode 100644
index 0000000..8a3f6f4
--- /dev/null
+++ b/pisetup/root/boot/rc.local.txt
@@ -0,0 +1,21 @@
+#!/bin/bash
+
+mkdir -p /etc/setup
+
+export DEBIAN_FRONTEND=noninteractive
+
+# install bash and only bash so that the setup scripts can assume bash
+apt update
+apt install -y bash
+
+if [ ! -e /etc/setup/setup-done ]; then
+    /bin/bash << 'EOF'
+    for FILE in /boot/setup-scripts/*.sh; do
+        echo "running '$FILE'" | logger -s -t setup-scripts
+        /bin/bash $FILE 2>&1 | logger -s -t setup-scripts
+    done
+EOF
+    echo "system init complete" | logger -s -t setup-scripts
+    touch /etc/setup/setup-done
+fi
+
diff --git a/pisetup/root/boot/setup-scripts/01-set-time.sh b/pisetup/root/boot/setup-scripts/01-set-time.sh
new file mode 100644
index 0000000..1d53bc2
--- /dev/null
+++ b/pisetup/root/boot/setup-scripts/01-set-time.sh
@@ -0,0 +1,4 @@
+export DEBIAN_FRONTEND=noninteractive
+apt update
+apt -y install ntpdate
+ntpdate time.apple.com
diff --git a/pisetup/root/boot/setup-scripts/05-packages.sh b/pisetup/root/boot/setup-scripts/05-packages.sh
new file mode 100644
index 0000000..c1f922a
--- /dev/null
+++ b/pisetup/root/boot/setup-scripts/05-packages.sh
@@ -0,0 +1,36 @@
+PKGS="
+    apt-transport-https
+    byobu
+    ca-certificates
+    cryptsetup-bin
+    curl
+    dirmngr
+    dnsutils
+    gnupg-agent
+    gnupg2
+    haveged
+    inetutils-ping
+    jq
+    lsof
+    man-db
+    mosh
+    nmap
+    opensc
+    pcscd
+    pinentry-curses
+    pv
+    rsync
+    runit
+    runit-systemd
+    scdaemon
+    screen
+    software-properties-common
+    usbmount
+    vim
+    wget
+"
+
+export DEBIAN_FRONTEND=noninteractive
+apt update
+apt upgrade -y
+apt install -y $PKGS
diff --git a/pisetup/root/boot/setup-scripts/10-install-command-not-found.sh b/pisetup/root/boot/setup-scripts/10-install-command-not-found.sh
new file mode 100644
index 0000000..495582b
--- /dev/null
+++ b/pisetup/root/boot/setup-scripts/10-install-command-not-found.sh
@@ -0,0 +1,5 @@
+export DEBIAN_FRONTEND=noninteractive
+apt update
+apt -y install command-not-found
+apt-file update
+update-command-not-found
diff --git a/pisetup/root/boot/setup-scripts/20-install-nvm-and-node.sh b/pisetup/root/boot/setup-scripts/20-install-nvm-and-node.sh
new file mode 100644
index 0000000..70c9b10
--- /dev/null
+++ b/pisetup/root/boot/setup-scripts/20-install-nvm-and-node.sh
@@ -0,0 +1,20 @@
+
+export DEBIAN_FRONTEND=noninteractive
+apt update
+apt install -y git
+
+export HOME=/root
+git clone https://github.com/creationix/nvm.git /root/.nvm
+
+cat >> /root/.bashrc <<'EOF'
+export NVM_DIR="$HOME/.nvm"
+[ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"  # This loads nvm
+EOF
+
+source /root/.bashrc
+
+nvm install 10
+nvm use 10
+
+npm install -g npm@latest
+npm install -g yarn
diff --git a/pisetup/root/boot/setup-scripts/30-install-signoffline.sh b/pisetup/root/boot/setup-scripts/30-install-signoffline.sh
new file mode 100644
index 0000000..6113638
--- /dev/null
+++ b/pisetup/root/boot/setup-scripts/30-install-signoffline.sh
@@ -0,0 +1,12 @@
+export NVM_DIR="$HOME/.nvm"
+source "$NVM_DIR/nvm.sh"
+
+nvm use 8
+
+# @next as of 14 nov 2018
+VERSION="5cd9d6be4f05831f76a12cc833e1fbd5b6e143cd"
+
+unzip -d /var/lib/signoffline /boot/signoffline.zip
+cd /var/lib/signoffline
+git checkout $VERSION
+yarn install
diff --git a/pisetup/root/boot/setup-scripts/99-disable-swap.sh b/pisetup/root/boot/setup-scripts/99-disable-swap.sh
new file mode 100644
index 0000000..08855de
--- /dev/null
+++ b/pisetup/root/boot/setup-scripts/99-disable-swap.sh
@@ -0,0 +1,5 @@
+/sbin/dphys-swapfile swapoff
+/sbin/dphys-swapfile uninstall
+apt purge -y dphys-swapfile
+swapoff -a
+rm /var/swap
diff --git a/pisetup/root/etc/default/keyboard b/pisetup/root/etc/default/keyboard
new file mode 100644
index 0000000..e69de29
diff --git a/pisetup/root/etc/default/locale b/pisetup/root/etc/default/locale
new file mode 100644
index 0000000..01ec548
--- /dev/null
+++ b/pisetup/root/etc/default/locale
@@ -0,0 +1 @@
+LANG=en_US.UTF-8
diff --git a/pisetup/root/etc/rc.local b/pisetup/root/etc/rc.local
new file mode 100644
index 0000000..269ad2e
--- /dev/null
+++ b/pisetup/root/etc/rc.local
@@ -0,0 +1,24 @@
+#!/bin/sh -e
+#
+# rc.local
+#
+# This script is executed at the end of each multiuser runlevel.
+# Make sure that the script will "exit 0" on success or any other
+# value on error.
+#
+# In order to enable or disable this script just change the execution
+# bits.
+#
+# By default this script does nothing.
+
+# Print the IP address
+_IP=$(hostname -I) || true
+if [ "$_IP" ]; then
+  printf "My IP address is %s\n" "$_IP"
+fi
+
+if [ -e /boot/rc.local.txt ]; then
+  . /boot/rc.local.txt
+fi
+
+exit 0
diff --git a/pisetup/root/etc/setup/configure-pi.sh b/pisetup/root/etc/setup/configure-pi.sh
new file mode 100644
index 0000000..6ac293b
--- /dev/null
+++ b/pisetup/root/etc/setup/configure-pi.sh
@@ -0,0 +1,5 @@
+#!/bin/bash
+
+whoami
+uptime
+cat /etc/rc.local
diff --git a/pisetup/setup-keys.sh b/pisetup/setup-keys.sh
new file mode 100644
index 0000000..6488c44
--- /dev/null
+++ b/pisetup/setup-keys.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+
+KEY_URL="https://sneak.cloud/authorized_keys"
+
+curl -fLo /root/.ssh/authorized_keys --create-dirs $KEY_URL
+curl -fLo /home/pi/.ssh/authorized_keys --create-dirs $KEY_URL