diff --git a/README.md b/README.md
index f3b98c9..baff615 100644
--- a/README.md
+++ b/README.md
@@ -2,13 +2,6 @@
 
 This is a repo for building an NBI (never-booted image) of an OS X (pron: oh ess **ten**) root partition, which can be easily and quickly (<10m) imaged onto a Mac with the `asr` utility readily available on OSX boot media.
 
-## TODO / Known Bugs
-
-* `new-system-setup` tries to update some system python packages that are protected by System Integrity Protection and fails.
-    * fix: move those packages to the `new-user-setup` script instead (`pip install --user $PKG`)
-* a wrong password passed to `fdesetup` in `new-system-setup` offers no attempt to retry
-    * fix: put in shell loop based on exit code
-
 # HOWTO: Creating the NBI
 
 ## Prerequisites
diff --git a/custompkg/root/etc/skel/.bashrc b/custompkg/root/etc/skel/.bashrc
new file mode 100644
index 0000000..4be9b85
--- /dev/null
+++ b/custompkg/root/etc/skel/.bashrc
@@ -0,0 +1,4 @@
+# do not edit this file. put files in the dir below.
+for FN in $HOME/Library/bashrc.d/*.sh ; do
+    source "$FN"
+done
diff --git a/custompkg/root/etc/skel/.gemrc b/custompkg/root/etc/skel/.gemrc
new file mode 100644
index 0000000..64193c3
--- /dev/null
+++ b/custompkg/root/etc/skel/.gemrc
@@ -0,0 +1 @@
+gem: --user-install
diff --git a/custompkg/root/etc/skel/.inputrc b/custompkg/root/etc/skel/.inputrc
new file mode 100644
index 0000000..8995edd
--- /dev/null
+++ b/custompkg/root/etc/skel/.inputrc
@@ -0,0 +1,8 @@
+set show-all-if-ambiguous on
+set completion-ignore-case on
+set completion-prefix-display-length 4
+Control-j: menu-complete
+Control-k: menu-complete-backward
+set show-all-if-unmodified on
+set completion-map-case on
+set horizontal-scroll-mode Off
diff --git a/custompkg/root/etc/skel/.profile b/custompkg/root/etc/skel/.profile
new file mode 100644
index 0000000..1e18ed5
--- /dev/null
+++ b/custompkg/root/etc/skel/.profile
@@ -0,0 +1,5 @@
+# do not edit this file. put files in the dir below.
+source ~/.bashrc
+for FN in $HOME/Library/profile.d/*.sh ; do
+    source "$FN"
+done
diff --git a/custompkg/root/etc/skel/.slate.js b/custompkg/root/etc/skel/.slate.js
new file mode 100644
index 0000000..6225169
--- /dev/null
+++ b/custompkg/root/etc/skel/.slate.js
@@ -0,0 +1,78 @@
+var fullscreen = slate.operation("move",{
+    "x" : "screenOriginX",
+    "y" : "screenOriginY",
+    "width" : "screenSizeX",
+    "height" : "screenSizeY"
+});
+var topleft = slate.operation("move",{
+    "x" : "screenOriginX",
+    "y" : "screenOriginY",
+    "width" : "screenSizeX/2",
+    "height" : "screenSizeY/2"
+});
+var bottomleft = slate.operation("move",{
+    "x" : "screenOriginX",
+    "y" : "screenOriginY + screenSizeY/2",
+    "width" : "screenSizeX/2",
+    "height" : "screenSizeY/2"
+});
+var bottomright = slate.operation("move",{
+    "x" : "screenOriginX + screenSizeX/2",
+    "y" : "screenOriginY + screenSizeY/2",
+    "width" : "screenSizeX/2",
+    "height" : "screenSizeY/2"
+});
+var topright = slate.operation("move",{
+    "x" : "screenOriginX + screenSizeX/2",
+    "y" : "screenOriginY",
+    "width" : "screenSizeX/2",
+    "height" : "screenSizeY/2"
+});
+var tophalf = slate.operation("move",{
+    "x" : "screenOriginX",
+    "y" : "screenOriginY",
+    "width" : "screenSizeX",
+    "height" : "screenSizeY/2"
+});
+var lefthalf = slate.operation("move",{
+    "x" : "screenOriginX",
+    "y" : "screenOriginY",
+    "width" : "screenSizeX / 2",
+    "height" : "screenSizeY"
+});
+var righthalf = slate.operation("move",{
+    "x" : "screenOriginX + screenSizeX/2",
+    "y" : "screenOriginY",
+    "width" : "screenSizeX / 2",
+    "height" : "screenSizeY"
+});
+var bottomhalf = slate.operation("move",{
+    "x" : "screenOriginX",
+    "y" : "screenOriginY + screenSizeY/2",
+    "width" : "screenSizeX",
+    "height" : "screenSizeY/2"
+});
+
+slate.bind("pad6:ctrl", function(win){ win.doOperation(righthalf);  })
+slate.bind("pad5:ctrl", function(win){ win.doOperation(fullscreen); })
+slate.bind("pad7:ctrl", function(win){ win.doOperation(topleft);    })
+slate.bind("pad9:ctrl", function(win){ win.doOperation(topright);   })
+slate.bind("pad1:ctrl", function(win){ win.doOperation(bottomleft); })
+slate.bind("pad3:ctrl", function(win){ win.doOperation(bottomright);})
+slate.bind("pad8:ctrl", function(win){ win.doOperation(tophalf);    })
+slate.bind("pad2:ctrl", function(win){ win.doOperation(bottomhalf); })
+slate.bind("pad4:ctrl", function(win){ win.doOperation(lefthalf);   })
+
+// for a laptop without a numpad:
+/*
+slate.bind("d:space,ctrl", function(win){ win.doOperation(righthalf); })
+slate.bind("s:space,ctrl", function(win){ win.doOperation(fullscreen); })
+slate.bind("q:space,ctrl", function(win){ win.doOperation(topleft); })
+slate.bind("e:space,ctrl", function(win){ win.doOperation(topright); })
+slate.bind("z:space,ctrl", function(win){ win.doOperation(bottomleft); })
+slate.bind("c:space,ctrl", function(win){ win.doOperation(bottomright); })
+slate.bind("w:space,ctrl", function(win){ win.doOperation(tophalf); })
+slate.bind("x:space,ctrl", function(win){ win.doOperation(bottomhalf); })
+slate.bind("a:space,ctrl", function(win){ win.doOperation(lefthalf); })
+
+*/
diff --git a/custompkg/root/etc/skel/Library/Local/bin/.keep b/custompkg/root/etc/skel/Library/Local/bin/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/custompkg/root/etc/skel/Library/bashrc.d/100.caskroom-dest.sh b/custompkg/root/etc/skel/Library/bashrc.d/100.caskroom-dest.sh
new file mode 100644
index 0000000..c0e04c9
--- /dev/null
+++ b/custompkg/root/etc/skel/Library/bashrc.d/100.caskroom-dest.sh
@@ -0,0 +1 @@
+export HOMEBREW_CASK_OPTS="--appdir=$HOME/Applications"
diff --git a/custompkg/root/etc/skel/Library/bashrc.d/100.homebrew-no-spyware.sh b/custompkg/root/etc/skel/Library/bashrc.d/100.homebrew-no-spyware.sh
new file mode 100644
index 0000000..8602170
--- /dev/null
+++ b/custompkg/root/etc/skel/Library/bashrc.d/100.homebrew-no-spyware.sh
@@ -0,0 +1 @@
+export HOMEBREW_NO_ANALYTICS=1
diff --git a/custompkg/root/etc/skel/Library/bashrc.d/100.homebrew-paths.sh b/custompkg/root/etc/skel/Library/bashrc.d/100.homebrew-paths.sh
new file mode 100644
index 0000000..331a348
--- /dev/null
+++ b/custompkg/root/etc/skel/Library/bashrc.d/100.homebrew-paths.sh
@@ -0,0 +1,2 @@
+export PATH+=":$HOME/Library/Homebrew/bin"
+export PATH+=":$HOME/Library/Homebrew/sbin"
diff --git a/custompkg/root/etc/skel/Library/bashrc.d/100.localbin.sh b/custompkg/root/etc/skel/Library/bashrc.d/100.localbin.sh
new file mode 100644
index 0000000..f144153
--- /dev/null
+++ b/custompkg/root/etc/skel/Library/bashrc.d/100.localbin.sh
@@ -0,0 +1,2 @@
+export PATH+=":$HOME/Library/Local/bin"
+export PATH+=":$HOME/Library/Local/sbin"
diff --git a/custompkg/root/etc/skel/Library/bashrc.d/150.python-bin-path.sh b/custompkg/root/etc/skel/Library/bashrc.d/150.python-bin-path.sh
new file mode 100644
index 0000000..19c4201
--- /dev/null
+++ b/custompkg/root/etc/skel/Library/bashrc.d/150.python-bin-path.sh
@@ -0,0 +1,7 @@
+if [[ -e $HOME/Library/Python/2.7/bin ]]; then
+    PATH+=":$HOME/Library/Python/2.7/bin"
+fi
+
+if [[ -e $HOME/Library/Python/3.5/bin ]]; then
+    PATH+=":$HOME/Library/Python/3.5/bin"
+fi
diff --git a/custompkg/root/etc/skel/Library/bashrc.d/150.rubygem-bin-path.sh b/custompkg/root/etc/skel/Library/bashrc.d/150.rubygem-bin-path.sh
new file mode 100644
index 0000000..dc40381
--- /dev/null
+++ b/custompkg/root/etc/skel/Library/bashrc.d/150.rubygem-bin-path.sh
@@ -0,0 +1,5 @@
+if [[ -d $HOME/Library/RubyGems/ruby ]]; then
+    for DIR in $HOME/Library/RubyGems/ruby/*/bin ; do
+        PATH+=":$DIR"
+    done
+fi
diff --git a/custompkg/root/etc/skel/Library/bashrc.d/200.aws-python-module-bash-completion.sh b/custompkg/root/etc/skel/Library/bashrc.d/200.aws-python-module-bash-completion.sh
new file mode 100644
index 0000000..51d8353
--- /dev/null
+++ b/custompkg/root/etc/skel/Library/bashrc.d/200.aws-python-module-bash-completion.sh
@@ -0,0 +1,8 @@
+# bash completion for awscli
+if which aws_bash_completer 2>&1 >/dev/null; then
+    source `which aws_bash_completer`
+fi
+# bash completion for elastic beanstalk
+if which eb_completion.bash 2>&1 >/dev/null; then
+    source `which eb_completion.bash`
+fi
diff --git a/custompkg/root/etc/skel/Library/bashrc.d/200.git-prompt.sh b/custompkg/root/etc/skel/Library/bashrc.d/200.git-prompt.sh
new file mode 100644
index 0000000..b566740
--- /dev/null
+++ b/custompkg/root/etc/skel/Library/bashrc.d/200.git-prompt.sh
@@ -0,0 +1,5 @@
+if [ -f "$(brew --prefix bash-git-prompt)/share/gitprompt.sh" ]; then
+  GIT_PROMPT_THEME=Default
+  GIT_PROMPT_ONLY_IN_REPO=1
+  source "$(brew --prefix bash-git-prompt)/share/gitprompt.sh"
+fi
diff --git a/custompkg/root/etc/skel/Library/bashrc.d/400.app-preferences.sh b/custompkg/root/etc/skel/Library/bashrc.d/400.app-preferences.sh
new file mode 100644
index 0000000..eccad61
--- /dev/null
+++ b/custompkg/root/etc/skel/Library/bashrc.d/400.app-preferences.sh
@@ -0,0 +1,4 @@
+export PAGER=vimpager
+export EDITOR=vim
+export VISUAL=$EDITOR
+alias less=vimpager
diff --git a/custompkg/root/etc/skel/Library/bashrc.d/900.homebrew-completion.sh b/custompkg/root/etc/skel/Library/bashrc.d/900.homebrew-completion.sh
new file mode 100644
index 0000000..569153a
--- /dev/null
+++ b/custompkg/root/etc/skel/Library/bashrc.d/900.homebrew-completion.sh
@@ -0,0 +1,3 @@
+if [ -f $(brew --prefix)/etc/bash_completion ]; then
+    source $(brew --prefix)/etc/bash_completion
+fi
diff --git a/custompkg/root/etc/skel/Library/bashrc.d/999.prompt.sh b/custompkg/root/etc/skel/Library/bashrc.d/999.prompt.sh
new file mode 100644
index 0000000..2c678d1
--- /dev/null
+++ b/custompkg/root/etc/skel/Library/bashrc.d/999.prompt.sh
@@ -0,0 +1 @@
+export PS1='\u@\h:\w\\$ '
diff --git a/custompkg/root/etc/skel/Library/profile.d/900.gpg-agent.sh b/custompkg/root/etc/skel/Library/profile.d/900.gpg-agent.sh
new file mode 100644
index 0000000..c8a8fc5
--- /dev/null
+++ b/custompkg/root/etc/skel/Library/profile.d/900.gpg-agent.sh
@@ -0,0 +1,27 @@
+# check for existing running agent info
+if [[ -e $HOME/.gpg-agent-info ]]; then
+    source $HOME/.gpg-agent-info
+    export GPG_AGENT_INFO SSH_AUTH_SOCK SSH_AGENT_PID
+fi
+
+# test existing agent, remove info file if not working
+ssh-add -L 2>/dev/null >/dev/null || rm -f $HOME/.gpg-agent-info
+
+# if no info file, start up potentially-new, working agent
+if [[ ! -e $HOME/.gpg-agent-info ]]; then
+    if which gpg-agent 2>&1 >/dev/null ; then
+        gpg-agent \
+            --enable-ssh-support \
+            --daemon \
+            --write-env-file \
+            --use-standard-socket \
+            --pinentry-program $(brew --prefix)/bin/pinentry-mac \
+            2>&1 >/dev/null
+    fi
+fi
+
+# load up new agent info
+if [[ -e $HOME/.gpg-agent-info ]]; then
+    source $HOME/.gpg-agent-info
+    export GPG_AGENT_INFO SSH_AUTH_SOCK SSH_AGENT_PID
+fi
diff --git a/custompkg/root/etc/skel/Library/user-setup/000.install-homebrew.sh b/custompkg/root/etc/skel/Library/user-setup/000.install-homebrew.sh
new file mode 100644
index 0000000..d42f883
--- /dev/null
+++ b/custompkg/root/etc/skel/Library/user-setup/000.install-homebrew.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+############################################# install homebrew under homedir
+if [[ ! -d ~/Library/Homebrew ]]; then
+    mkdir -p ~/Library/Homebrew
+    cd ~/Library/Homebrew
+    curl -fsSL https://github.com/Homebrew/brew/tarball/master | \
+        tar --strip-components 1 -xvf -
+fi
diff --git a/custompkg/root/etc/skel/Library/user-setup/000.link-rubygems-dir.sh b/custompkg/root/etc/skel/Library/user-setup/000.link-rubygems-dir.sh
new file mode 100644
index 0000000..12dd0ed
--- /dev/null
+++ b/custompkg/root/etc/skel/Library/user-setup/000.link-rubygems-dir.sh
@@ -0,0 +1,7 @@
+if [[ ! -d ~/Library/RubyGems ]]; then
+    mkdir ~/Library/RubyGems
+fi
+
+if [[ ! -e ~/.gem ]]; then
+    ln -s ~/Library/RubyGems ~/.gem
+fi
diff --git a/custompkg/root/etc/skel/Library/user-setup/000.set-user-preferences.sh b/custompkg/root/etc/skel/Library/user-setup/000.set-user-preferences.sh
new file mode 100644
index 0000000..b041ae5
--- /dev/null
+++ b/custompkg/root/etc/skel/Library/user-setup/000.set-user-preferences.sh
@@ -0,0 +1,68 @@
+#!/bin/bash
+###################################### Configure sane user preference defaults
+# black like my soul
+defaults write NSGlobalDomain AppleInterfaceStyle Dark
+# hide menu bar
+defaults write NSGlobalDomain _HIHideMenuBar -bool true
+# dock on left
+defaults write com.apple.dock orientation left
+# autohide dock
+defaults write com.apple.dock autohide -bool true
+# do not save to icloud drive by default
+defaults write NSGlobalDomain NSDocumentSaveNewDocumentsToCloud -bool FALSE
+# airdrop on all interfaces
+defaults write com.apple.NetworkBrowser BrowseAllInterfaces -bool true
+# disable spotlight search spyware ugh thx
+defaults write com.apple.lookup.shared LookupSuggestionsDisabled -int 1
+defaults write com.apple.Safari UniversalSearchEnabled -int 0
+# show battery percentage
+defaults write com.apple.menuextra.battery ShowPercent -bool TRUE
+# ask for password after 5 seconds of screen saver
+defaults write com.apple.screensaver askForPassword -int 1
+defaults write com.apple.screensaver askForPasswordDelay -int 30
+# bottom right corner to lock screen
+defaults write com.apple.dock "wvous-br-corner" -int 5
+defaults write com.apple.dock "wvous-br-modifier" -int 0
+# 10 minute screensaver activation
+defaults write com.apple.screensaver idleTime -int 600
+# terminal utf8 only
+defaults write com.apple.Terminal StringEncodings -array 4
+# close terminal window if shell exited cleanly
+defaults write com.apple.Terminal ShellExitAction 2
+defaults write com.apple.Terminal FontAntialias 1
+defaults write com.apple.Terminal "Default Window Settings" "Pro"
+defaults write com.apple.Terminal "Startup Window Settings" "Pro"
+# new finder windows use ~
+defaults write com.apple.finder NewWindowTarget -string "PfHm"
+# new finder windows show status bar
+defaults write com.apple.finder ShowStatusBar -int 1
+# don't show mounted volumes on desktop
+defaults write com.apple.finder ShowExternalHardDrivesOnDesktop -int 0
+defaults write com.apple.finder ShowRemovableMediaOnDesktop -int 0
+# set textedit to edit plain text by default:
+defaults write com.apple.TextEdit RichText -int 0
+# set airdrop/bluetooth to be discoverable by everyone in range
+defaults write com.apple.sharingd DiscoverableMode Everyone
+# finder show all file extensions
+defaults write NSGlobalDomain AppleShowAllExtensions -bool true
+# set menubar clock to 24h with date and seconds
+defaults write com.apple.menuextra.clock DateFormat -string 'EEE MMM d  H:mm:ss'
+defaults write NSGlobalDomain AppleICUForce24HourTime -bool true
+# set keyboard to be really fucking fast
+# normal minimum is 15 (225 ms)
+defaults write NSGlobalDomain InitialKeyRepeat -int 15
+# normal minimum is 2 (30 ms)
+defaults write NSGlobalDomain KeyRepeat -int 1
+# disable all spelling correction, smart quotes, capitalization, et c:
+# (*important* for code)
+defaults write NSGlobalDomain NSAutomaticCapitalizationEnabled -int 0
+defaults write NSGlobalDomain NSAutomaticDashSubstitutionEnabled -int 0
+defaults write NSGlobalDomain NSAutomaticPeriodSubstitutionEnabled -int 0
+defaults write NSGlobalDomain NSAutomaticQuoteSubstitutionEnabled -int 0
+defaults write NSGlobalDomain NSAutomaticSpellingCorrectionEnabled -int 0
+# safari debug stuff
+defaults write com.apple.Safari IncludeDevelopMenu -bool true
+defaults write com.apple.Safari \
+	WebKitDeveloperExtrasEnabledPreferenceKey -bool true
+defaults write com.apple.Safari "com.apple.Safari.ContentPageGroupIdentifier.WebKit2DeveloperExtrasEnabled" -bool true
+defaults write NSGlobalDomain WebKitDeveloperExtras -bool true
diff --git a/custompkg/root/etc/skel/Library/user-setup/100.install-caskroom-apps.sh b/custompkg/root/etc/skel/Library/user-setup/100.install-caskroom-apps.sh
new file mode 100644
index 0000000..ca6a240
--- /dev/null
+++ b/custompkg/root/etc/skel/Library/user-setup/100.install-caskroom-apps.sh
@@ -0,0 +1,33 @@
+#!/bin/bash
+
+
+# set up paths and whatnot
+source $HOME/.profile
+
+# per default settings apps are installed in homedir
+if [[ ! -d ~/Applications ]]; then
+    mkdir -p ~/Applications
+fi
+
+# install caskroom
+brew tap caskroom/cask
+
+CASKS="
+	atom
+	disk-inventory-x
+	github-desktop
+	google-chrome
+	google-drive
+	iterm2
+	keepassx
+	lastpass
+	slack
+	spotify
+	sublime-text
+	vlc
+	xscreensaver
+"
+
+for CASK in $CASKS ; do
+    brew cask install $CASK
+done
diff --git a/custompkg/root/etc/skel/Library/user-setup/100.install-homebrew-apps.sh b/custompkg/root/etc/skel/Library/user-setup/100.install-homebrew-apps.sh
new file mode 100644
index 0000000..8aab06d
--- /dev/null
+++ b/custompkg/root/etc/skel/Library/user-setup/100.install-homebrew-apps.sh
@@ -0,0 +1,70 @@
+#!/bin/bash
+
+# set up paths and whatnot
+source $HOME/.profile
+
+HOMEBREW_PKGS="
+	autoconf
+	automake
+	bash-completion
+	bash-git-prompt
+	bonnie++
+	byobu
+	cmake
+	coreutils
+	curl
+	daemontools
+	docker
+	docker-compose
+	docker-machine
+	duplicity
+	ffmpeg
+	fish
+	flac
+	geoip
+	ghc
+	gist
+	git
+	gnupg
+	gnupg2
+	go
+	gpg-agent
+	homebrew/dupes/rsync
+	irssi
+	jq
+	keybase
+	lame
+	mobile-shell
+	mtr
+	mutt
+	nmap
+	node
+	pbzip2
+	pinentry-mac
+	protobuf
+	pv
+	pwgen
+	python3
+	socat
+	sox
+	speedtest_cli
+	syncthing
+	tcptraceroute
+	terraform
+	tor
+	torsocks
+	unrar
+	unzip
+	vimpager
+	watch
+	wget
+	whatmask
+    corelocationcli
+    heroku
+    offlineimap
+    postgres
+"
+
+for PKG in $HOMEBREW_PKGS ; do
+    brew install $PKG
+done
diff --git a/custompkg/root/etc/skel/Library/user-setup/100.install-python-packages.sh b/custompkg/root/etc/skel/Library/user-setup/100.install-python-packages.sh
new file mode 100644
index 0000000..a3219dd
--- /dev/null
+++ b/custompkg/root/etc/skel/Library/user-setup/100.install-python-packages.sh
@@ -0,0 +1,9 @@
+PYTHON_PKGS="
+    awscli
+    awsebcli
+    virtualenv
+"
+
+for PKG in $PYTHON_PKGS ; do
+    /usr/local/bin/pip install --user $PKG
+done
diff --git a/custompkg/root/etc/skel/Library/user-setup/200.install-npm-packages.sh b/custompkg/root/etc/skel/Library/user-setup/200.install-npm-packages.sh
new file mode 100644
index 0000000..49202cd
--- /dev/null
+++ b/custompkg/root/etc/skel/Library/user-setup/200.install-npm-packages.sh
@@ -0,0 +1,15 @@
+#!/bin/bash
+
+# set up paths and whatnot
+source $HOME/.profile
+
+NPM_PKGS="
+    coffee-script
+    yarn
+"
+
+for PKG in $NPM_PKGS ; do
+    # -g is okay because "global" prefix is where homebrew
+    # installed npm, i.e. in ~/Library/Homebrew, not actually systemwide
+    npm install -g $PKG
+done
diff --git a/custompkg/root/etc/skel/Library/user-setup/200.install-rubygem-packages.sh b/custompkg/root/etc/skel/Library/user-setup/200.install-rubygem-packages.sh
new file mode 100644
index 0000000..fa7af51
--- /dev/null
+++ b/custompkg/root/etc/skel/Library/user-setup/200.install-rubygem-packages.sh
@@ -0,0 +1,13 @@
+#!/bin/bash
+
+# set up paths and whatnot
+source $HOME/.profile
+
+RUBYGEM_PKGS="
+    bundler
+    overcommit
+"
+
+for PKG in $RUBYGEM_PKGS ; do
+    gem install $PKG
+done
diff --git a/custompkg/root/etc/skel/Library/user-setup/200.make-paths-dir.sh b/custompkg/root/etc/skel/Library/user-setup/200.make-paths-dir.sh
new file mode 100644
index 0000000..cf4257e
--- /dev/null
+++ b/custompkg/root/etc/skel/Library/user-setup/200.make-paths-dir.sh
@@ -0,0 +1,5 @@
+#!/bin/bash
+############################################# look for vimrc in google drive
+if [[ ! -d ~/.paths ]]; then
+    mkdir ~/.paths
+fi
diff --git a/custompkg/root/etc/skel/Library/user-setup/900.link-googledrive.sh b/custompkg/root/etc/skel/Library/user-setup/900.link-googledrive.sh
new file mode 100644
index 0000000..7899d39
--- /dev/null
+++ b/custompkg/root/etc/skel/Library/user-setup/900.link-googledrive.sh
@@ -0,0 +1,5 @@
+#!/bin/bash
+# setup google drive as synceddir in ~/.paths
+if [[ ! -e ~/.paths/synceddir ]]; then
+    ln -s ~/Google\ Drive ~/.paths/synceddir
+fi
diff --git a/custompkg/root/etc/skel/Library/user-setup/999.link-vimrc.sh b/custompkg/root/etc/skel/Library/user-setup/999.link-vimrc.sh
new file mode 100644
index 0000000..f2e0bc1
--- /dev/null
+++ b/custompkg/root/etc/skel/Library/user-setup/999.link-vimrc.sh
@@ -0,0 +1,5 @@
+#!/bin/bash
+# look for vimrc in synceddir/Dotfiles
+if [[ ! -e ~/.vimrc ]]; then
+    ln -s ~/.paths/synceddir/Dotfiles/vimrc ~/.vimrc
+fi
diff --git a/custompkg/root/usr/local/bin/new-system-setup b/custompkg/root/usr/local/bin/new-system-setup
index cefaa47..029e183 100644
--- a/custompkg/root/usr/local/bin/new-system-setup
+++ b/custompkg/root/usr/local/bin/new-system-setup
@@ -33,8 +33,6 @@ sudo defaults write /Library/Preferences/com.apple.commerce AutoUpdateRestartReq
 sudo defaults write /Library/Preferences/com.apple.AppleFileServer guestAccess -bool false
 sudo defaults write /Library/Preferences/SystemConfiguration/com.apple.smb.server AllowGuestAccess -bool false
 
-# install three python modules systemwide, that's all
-# do the rest with pip install --user in homedir
+# install pip so users can
+#     pip install --user <pkg>
 sudo easy_install pip
-sudo /usr/local/bin/pip install virtualenv
-sudo /usr/local/bin/pip install awscli
diff --git a/custompkg/root/usr/local/bin/new-user-setup b/custompkg/root/usr/local/bin/new-user-setup
index f60cfa2..7b0cd04 100644
--- a/custompkg/root/usr/local/bin/new-user-setup
+++ b/custompkg/root/usr/local/bin/new-user-setup
@@ -1,261 +1,10 @@
 #!/bin/bash
-###################################### Configure sane user preference defaults
-# black like my soul
-defaults write NSGlobalDomain AppleInterfaceStyle Dark
-# hide menu bar
-defaults write NSGlobalDomain _HIHideMenuBar -bool true
-# dock on left
-defaults write com.apple.dock orientation left
-# autohide dock
-defaults write com.apple.dock autohide -bool true
-# do not save to icloud drive by default
-defaults write NSGlobalDomain NSDocumentSaveNewDocumentsToCloud -bool FALSE
-# airdrop on all interfaces
-defaults write com.apple.NetworkBrowser BrowseAllInterfaces -bool true
-# disable spotlight search spyware ugh thx
-defaults write com.apple.lookup.shared LookupSuggestionsDisabled -int 1
-defaults write com.apple.Safari UniversalSearchEnabled -int 0
-# show battery percentage
-defaults write com.apple.menuextra.battery ShowPercent -bool TRUE
-# ask for password after 5 seconds of screen saver
-defaults write com.apple.screensaver askForPassword -int 1
-defaults write com.apple.screensaver askForPasswordDelay -int 30
-# bottom right corner to lock screen
-defaults write com.apple.dock "wvous-br-corner" -int 5
-defaults write com.apple.dock "wvous-br-modifier" -int 0
-# 10 minute screensaver activation
-defaults write com.apple.screensaver idleTime -int 600
-# terminal utf8 only
-defaults write com.apple.Terminal StringEncodings -array 4
-# close terminal window if shell exited cleanly
-defaults write com.apple.Terminal ShellExitAction 2
-defaults write com.apple.Terminal FontAntialias 1
-defaults write com.apple.Terminal "Default Window Settings" "Pro"
-defaults write com.apple.Terminal "Startup Window Settings" "Pro"
-# new finder windows use ~
-defaults write com.apple.finder NewWindowTarget -string "PfHm"
-# new finder windows show status bar
-defaults write com.apple.finder ShowStatusBar -int 1
-# don't show mounted volumes on desktop
-defaults write com.apple.finder ShowExternalHardDrivesOnDesktop -int 0
-defaults write com.apple.finder ShowRemovableMediaOnDesktop -int 0
-# set textedit to edit plain text by default:
-defaults write com.apple.TextEdit RichText -int 0
-# set airdrop/bluetooth to be discoverable by everyone in range
-defaults write com.apple.sharingd DiscoverableMode Everyone
-# finder show all file extensions
-defaults write NSGlobalDomain AppleShowAllExtensions -bool true
-# set menubar clock to 24h with date and seconds
-defaults write com.apple.menuextra.clock DateFormat -string 'EEE MMM d  H:mm:ss'
-defaults write NSGlobalDomain AppleICUForce24HourTime -bool true
-# set keyboard to be really fucking fast
-# normal minimum is 15 (225 ms)
-defaults write NSGlobalDomain InitialKeyRepeat -int 15
-# normal minimum is 2 (30 ms)
-defaults write NSGlobalDomain KeyRepeat -int 1
-# disable all spelling correction, smart quotes, capitalization, et c:
-# (*important* for code)
-defaults write NSGlobalDomain NSAutomaticCapitalizationEnabled -int 0
-defaults write NSGlobalDomain NSAutomaticDashSubstitutionEnabled -int 0
-defaults write NSGlobalDomain NSAutomaticPeriodSubstitutionEnabled -int 0
-defaults write NSGlobalDomain NSAutomaticQuoteSubstitutionEnabled -int 0
-defaults write NSGlobalDomain NSAutomaticSpellingCorrectionEnabled -int 0
-# safari debug stuff
-defaults write com.apple.Safari IncludeDevelopMenu -bool true
-defaults write com.apple.Safari \
-	WebKitDeveloperExtrasEnabledPreferenceKey -bool true
-defaults write com.apple.Safari "com.apple.Safari.ContentPageGroupIdentifier.WebKit2DeveloperExtrasEnabled" -bool true
-defaults write NSGlobalDomain WebKitDeveloperExtras -bool true
-######################################################### set default inputrc
-cat > ~/.inputrc <<EOF
-set show-all-if-ambiguous on
-set completion-ignore-case on
-set completion-prefix-display-length 4
-Control-j: menu-complete
-Control-k: menu-complete-backward
-set show-all-if-unmodified on
-set completion-map-case on
-set horizontal-scroll-mode Off
-EOF
-############################################## install homebrew under homedir
-if [[ ! -d ~/Library/Homebrew ]]; then
-    mkdir -p ~/Library/Homebrew
-    cd ~/Library/Homebrew
-    curl -fsSL https://github.com/Homebrew/brew/tarball/master | \
-        tar --strip-components 1 -xvf -
-fi
-######################################## setup modular bashrc.d and profile.d
-cat > ~/.bashrc <<'EOF'
-# do not edit this file. put files in the dir below.
-for FN in $HOME/Library/bashrc.d/*.sh ; do
-    source $FN
+
+# Overlay files from /etc/skel to homedir
+rsync --no-owner -avP /etc/skel/ $HOME/
+
+# run modular setup scripts
+for FN in $HOME/Library/user-setup/*.sh ; do
+    bash "$FN" 2>&1 | tee -a $HOME/Library/Logs/user-setup.log
+    rm "$FN"
 done
-EOF
-mkdir -p ~/Library/bashrc.d
-touch ~/Library/bashrc.d/keep.sh
-cat > ~/.profile <<'EOF'
-# do not edit this file. put files in the dir below.
-source ~/.bashrc
-for FN in $HOME/Library/profile.d/*.sh ; do
-    source $FN
-done
-EOF
-mkdir -p ~/Library/profile.d
-touch ~/Library/profile.d/keep.sh
-####################################################### install homebrew path
-cat > ~/Library/bashrc.d/100homebrew.sh <<'EOF'
-export PATH+=":$HOME/Library/Homebrew/bin"
-export PATH+=":$HOME/Library/Homebrew/sbin"
-export HOMEBREW_NO_ANALYTICS=1
-EOF
-####################################### Set caskroom to install under homedir
-cat > ~/Library/bashrc.d/100homebrewcaskdir.sh <<'EOF'
-export HOMEBREW_CASK_OPTS="--appdir=$HOME/Applications"
-EOF
-##################################################################### set PS1
-cat > ~/Library/bashrc.d/000.ps1.sh <<'EOF'
-export PS1='\u@\h:\w\\$ '
-EOF
-############################################################ enable git prompt
-cat > ~/Library/bashrc.d/200.git-prompt.sh <<'EOF'
-if [ -f "$(brew --prefix bash-git-prompt)/share/gitprompt.sh" ]; then
-  GIT_PROMPT_THEME=Default
-  GIT_PROMPT_ONLY_IN_REPO=1
-  source "$(brew --prefix bash-git-prompt)/share/gitprompt.sh"
-fi
-EOF
-########################################## enable bash completion in homebrew
-cat > ~/Library/bashrc.d/900.homebrew-completion.sh <<'EOF'
-if [ -f $(brew --prefix)/etc/bash_completion ]; then
-    . $(brew --prefix)/etc/bash_completion
-fi
-EOF
-#################################################### set sane env preferences
-cat > ~/Library/bashrc.d/400.environment.sh <<'EOF'
-export PAGER=vimpager
-export EDITOR=vim
-export VISUAL=$EDITOR
-EOF
-###################################################### set up helpful aliases
-cat > ~/Library/bashrc.d/500.aliases.sh <<'EOF'
-alias less=vimpager
-EOF
-################################################################### GPG Agent
-cat > ~/Library/profile.d/900.gpg-agent.sh <<'EOF'
-# check for existing running agent info
-if [[ -e $HOME/.gpg-agent-info ]]; then
-    source $HOME/.gpg-agent-info
-    export GPG_AGENT_INFO SSH_AUTH_SOCK SSH_AGENT_PID
-fi
-
-# test existing agent, remove info file if not working
-ssh-add -L 2>/dev/null >/dev/null || rm -f $HOME/.gpg-agent-info
-
-# if no info file, start up potentially-new, working agent
-if [[ ! -e $HOME/.gpg-agent-info ]]; then
-    gpg-agent \
-        --enable-ssh-support \
-        --daemon \
-        --write-env-file \
-        --use-standard-socket \
-        --pinentry-program $(brew --prefix)/bin/pinentry-mac \
-        2>&1 >/dev/null
-fi
-
-# load up new agent info
-if [[ -e $HOME/.gpg-agent-info ]]; then
-    source $HOME/.gpg-agent-info
-    export GPG_AGENT_INFO SSH_AUTH_SOCK SSH_AGENT_PID
-fi
-EOF
-#############################################################################
-### load up profile scripts / paths for the rest of this configuration script
-source ~/.profile
-####################################################### install caskroom apps
-if [[ ! -d ~/Applications ]]; then
-    mkdir -p ~/Applications
-fi
-brew tap caskroom/cask
-CASKS="
-	atom
-	disk-inventory-x
-	github-desktop
-	google-chrome
-	google-drive
-	iterm2
-	keepassx
-	lastpass
-	slack
-	spotify
-	sublime-text
-	xscreensaver
-"
-for CASK in $CASKS ; do
-    brew cask install $CASK
-done	
-#################################################### install homebrew packages
-HOMEBREW_PKGS="
-	autoconf
-	automake
-	bash-completion
-	bash-git-prompt
-	bonnie++
-	byobu
-	cmake
-	coreutils
-	curl
-	daemontools
-	docker
-	docker-compose
-	docker-machine
-	duplicity
-	ffmpeg
-	fish
-	flac
-	geoip
-	ghc
-	gist
-	git
-	gnupg
-	gnupg2
-	go
-	gpg-agent
-	homebrew/dupes/rsync
-	irssi
-	jq
-	keybase
-	lame
-	mobile-shell
-	mtr
-	mutt
-	nmap
-	node
-	pbzip2
-	pinentry-mac
-	protobuf
-	pv
-	pwgen
-	python3
-	socat
-	sox
-	speedtest_cli
-	syncthing
-	tcptraceroute
-	terraform
-	tor
-	torsocks
-	unrar
-	unzip
-	vimpager
-	watch
-	wget
-	whatmask
-"
-
-for PKG in $HOMEBREW_PKGS ; do
-    brew install $PKG
-done
-
-############################################# look for vimrc in google drive
-ln -s ~/Google\ Drive/Dotfiles/vimrc ~/.vimrc
-
diff --git a/custompkg/scripts/postinstall b/custompkg/scripts/postinstall
index b2563bd..81a0834 100755
--- a/custompkg/scripts/postinstall
+++ b/custompkg/scripts/postinstall
@@ -5,3 +5,7 @@ touch "$3"/var/db/.AppleDiagnosticsSetupDone
 touch "$3"/var/db/.AppleSetupDone
 
 chmod a+rx "$3"/usr/local/bin/*
+chmod -R a+rX "$3"/etc/skel
+
+# silence stupid java-not-installed popups:
+rm -rf "$3"/System/Library/Frameworks/JavaVM.framework