diff --git a/.bash_aliases b/.bash_aliases
new file mode 100644
index 0000000..34245f9
--- /dev/null
+++ b/.bash_aliases
@@ -0,0 +1,20 @@
+# if we are in a tmate session, alias tmux as tmate
+if [[ $TMUX =~ tmate ]]; then alias tmux=tmate; fi
+
+# nice directory listing
+alias l="ls -Glah"
+
+# nice directory tree listing showing permissions, user, group and size (human readable)
+alias t="tree -L 1 --dirsfirst -shugp"
+# nice directory tree listing, but just 2 levels
+alias tt="tree -L 2 --dirsfirst"
+
+# I use git so often that aliasing it saves a lot
+alias g="git"
+
+# Add simulator to start the iOS simulator
+alias simulator="open -a Simulator"
+
+# Access the console of the knot-resolver
+alias kresd-console="sudo socat - /usr/local/var/kresd/tty/*"
+
diff --git a/.bash_functions b/.bash_functions
new file mode 100644
index 0000000..d322c30
--- /dev/null
+++ b/.bash_functions
@@ -0,0 +1,105 @@
+# print some information on the current tmate session
+function tmate-info {
+  echo "rw: $(tmate -S /tmp/tmate.sock display -p '#{tmate_ssh}' 2>/dev/null)"
+  echo "ro: $(tmate -S /tmp/tmate.sock display -p '#{tmate_ssh_ro}' 2>/dev/null)"
+}
+
+# start tmate session
+function tmate-start {
+  tmate -S /tmp/tmate.sock new-session -d
+  tmate -S /tmp/tmate.sock wait tmate-ready
+  eval "$(tmate -S /tmp/tmate.sock display -p '#{tmate_ssh}')"
+}
+
+# tmux, be there and be named well
+function tms {
+  local name=$(basename $PWD | sed -e s/\[^a-zA-Z0-9\\\//\$]/-/g -e s/--*/-/g)
+  tmux new -s $name || tmux attach-session -t $name
+}
+
+# docker-machine, be there and make it happen
+function dms {
+  docker-machine start
+  eval `docker-machine env`
+}
+
+# Start an HTTP server from a directory, optionally specifying the port
+function server() {
+  local port="${1:-8000}"
+  open "http://localhost:${port}/"
+  # Set the default Content-Type to `text/plain` instead of `application/octet-stream`
+  # And serve everything as UTF-8 (although not technically correct, this doesn’t break anything for binary files)
+  python -c $'import SimpleHTTPServer;\nmap = SimpleHTTPServer.SimpleHTTPRequestHandler.extensions_map;\nmap[""] = "text/plain";\nfor key, value in map.items():\n\tmap[key] = value + ";charset=UTF-8";\nSimpleHTTPServer.test();' "$port"
+}
+
+# Mirror a complete website
+function mirror-website() {
+  local url=$@
+  local domain=`expr "$url" : '^http[s]*://\([^/?]*\)'`
+  wget \
+    --recursive \
+    --no-clobber \
+    --page-requisites \
+    --html-extension \
+    --convert-links \
+    --restrict-file-names=windows \
+    --domains $domain \
+    --no-parent \
+    $url
+}
+
+# Put my computer to sleep in X minutes
+function sleep-in() {
+  local minutes=$1
+  if [ -z "$minutes" ]; then
+    echo "Usage: sleep-in <minutes>"
+  else
+    local datetime=`date -v+${minutes}M +"%m/%d/%y %H:%M:%S"`
+    echo "Scheduling sleep at $datetime"
+    sudo pmset schedule sleep "$datetime"
+  fi
+}
+
+# Open conflicts at once, setting the search pattern to <<<<<<< in order to cycle through them pressing 'n'
+function editconflicts() { 
+  vim +/"<<<<<<<" `git diff --name-only --diff-filter=U | xargs`
+}
+
+# quickly cleanup cruft from docker machine
+function docker-cleanup() {
+  docker rm `docker ps -a -q`
+  docker rmi `docker images | grep "^<none" | tr -s ' ' | cut -d' ' -f 3`
+  docker volume prune -f
+}
+
+# quickly peek at secrets stored in kubernetes yaml files (base64 encoded)
+function print-kube-secrets() {
+  for file in $@; do
+    echo "${file}:"
+    yaml2json < $file | jq '[.select(.type == "Secret") | .data | to_entries[] | .value = (.value | @base64d)] | from_entries'
+  done
+}
+
+# better bundle open, that changes current directory
+function bundle-open() {
+  (cd $($(which bundle) show $@) && $EDITOR .)
+}
+
+# Use local dns server
+function localdns() {
+  if [[ "x$2" == "x" ]]; then
+    local network="Wi-Fi"
+  fi
+  if [[ "$1" == "on" ]]; then
+    sudo networksetup -setdnsservers "$network" 127.0.0.1
+    sudo killall -HUP mDNSResponder
+  elif [[ "$1" == "off" ]]; then
+    sudo networksetup -setdnsservers "$network" empty
+    sudo killall -HUP mDNSResponder
+  else
+    cat <<USAGE
+Usage: localdns <enable|disable>
+Enables or disables local DNS configuration (knot-resolver@127.0.0.1 ==(tls)==> cloudflare)
+USAGE
+  fi
+}
diff --git a/.git-crypt/.gitattributes b/.git-crypt/.gitattributes
new file mode 100644
index 0000000..665b10e
--- /dev/null
+++ b/.git-crypt/.gitattributes
@@ -0,0 +1,4 @@
+# Do not edit this file.  To specify the files to encrypt, create your own
+# .gitattributes file in the directory where your files are.
+* !filter !diff
+*.gpg binary
diff --git a/.git-crypt/keys/default/0/716AB422E5AF3B07CD08D61C4905A8AC784E1A78.gpg b/.git-crypt/keys/default/0/716AB422E5AF3B07CD08D61C4905A8AC784E1A78.gpg
new file mode 100644
index 0000000..184e033
Binary files /dev/null and b/.git-crypt/keys/default/0/716AB422E5AF3B07CD08D61C4905A8AC784E1A78.gpg differ
diff --git a/.gitattributes b/.gitattributes
index 2125666..56662a3 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -1 +1,4 @@
-* text=auto
\ No newline at end of file
+* text=auto
+.ssh/config filter=git-crypt diff=git-crypt
+.ssh/*.pem  filter=git-crypt diff=git-crypt
+
diff --git a/.gitconfig b/.gitconfig
index c0d1527..1c47af2 100644
--- a/.gitconfig
+++ b/.gitconfig
@@ -46,7 +46,10 @@
 	pick = "cherry-pick"
   contributors = "shortlog -n -s --no-merges"
   amend = "commit -a --amend"
+  staged = "diff --staged"
 [push]
 	default = upstream
 [status]
 	submoduleSummary = true
+[http]
+        cookiefile = /Users/lukas/.gitcookies
diff --git a/.gitignore b/.gitignore
index 76496b7..e60f10c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -10,11 +10,5 @@ Thumbs.db
 .Spotlight-V100
 .Trashes
 
-# vim plugins handled by vundle
-.vim/bundle
-!.vim/bundle/vundle
-
-.ssh/config
-.ssh/wooga_heroku_id_rsa
-
+# Ruby byebug debugger history files
 .byebug_history
diff --git a/.hushlogin b/.hushlogin
new file mode 100644
index 0000000..e69de29
diff --git a/.profile b/.profile
index 2acf8a9..5eb34d3 100644
--- a/.profile
+++ b/.profile
@@ -1,70 +1,42 @@
+# PATH setup
+export PATH="$HOME/bin:$PATH"
+# add escripts (elixir scripts) to PATH
+export PATH="/Users/lukas/.mix/escripts:$PATH"
+# add brew version of curl to PATH
+export PATH="/usr/local/opt/curl/bin:$PATH"
+
+export GOPATH="$HOME/Projects/go"
+export PATH="$GOPATH/bin:$PATH"
+
+# Jenv setup
+export JENV_ROOT="$HOME/.jenv"
+export PATH="$JENV_ROOT/bin:$PATH"
+eval "$(jenv init -)"
+
+# Rbenv setup
 export RBENV_ROOT="$HOME/.rbenv"
 export RBENV_BUILD_ROOT="$RBENV_ROOT/sources"
-export PATH="$RBENV_ROOT/bin:./node_modules/.bin:$PATH"
+# add ruby gems/rbenv shims to PATH
+export PATH="$RBENV_ROOT/bin:$PATH"
 eval "$(rbenv init -)"
-alias l="ls -Glah"
-alias g="git"
-alias minecraft="java -d64 -Xms4096M -Xmx4096M -jar Minecraft.app/Contents/Resources/Java/MinecraftLauncher.jar"
+
+# vim all the things
 export EDITOR="vim"
-export PATH="$HOME/bin:$PATH"
+export VISUAL="$EDITOR"
+
+# utf-8 all the things
 export LC_ALL=en_US.UTF-8
 export LANG=en_US.UTF-8
+
+# prevent API throttling when installing/updating homebrew things
 export HOMEBREW_GITHUB_API_TOKEN=9d9f01f0d6cf2214fe951cc95f9d79872fbd5499
 export HOMEBREW_NO_ANALYTICS=1
+export HOMEBREW_NO_INSECURE_REDIRECT=1
+export HOMEBREW_CASK_OPTS=--require-sha
 
-# used to install/use go packages
-export GOPATH="$HOME/.gopath"
-export PATH="$GOPATH/bin:$PATH"
-
-# add escripts (elixir scripts) to PATH
-export PATH="/Users/lukas/.mix/escripts:$PATH"
-
-# ansible configuration, used at Betterplace
-export ANSIBLE_REMOTE_USER=lukas.rieder
-export ANSIBLE_HOST_KEY_CHECKING=False
-
-# if we are in a tmate session, alias tmux as tmate
-if [[ $TMUX =~ tmate ]]; then alias tmux=tmate; fi
-function tmate-info {
-  echo "rw: $(tmate -S /tmp/tmate.sock display -p '#{tmate_ssh}' 2>/dev/null)"
-  echo "ro: $(tmate -S /tmp/tmate.sock display -p '#{tmate_ssh_ro}' 2>/dev/null)"
-}
-function tmate-start {
-  tmate -S /tmp/tmate.sock new-session -d
-  tmate -S /tmp/tmate.sock wait tmate-ready
-  eval "$(tmate -S /tmp/tmate.sock display -p '#{tmate_ssh}')"
-}
-
-# Fancy prompt
-function git-prompt {
-  if (git status >/dev/null 2>&1); then
-    local symbolic_ref_head=$(git symbolic-ref HEAD 2> /dev/null)
-    local branch=${symbolic_ref_head#refs/heads/}
-    local stash_count=$(git stash list --oneline 2> /dev/null | sed -n "$=")
-    local dirty_star=$(git status --porcelain . | sed -e "$ ! d" -e "s/.*/*/")
-    echo "$branch$stash_count$dirty_star"
-  else
-    echo ""
-  fi
-}
-function rbenv-prompt {
-  local version=$(rbenv version-name | sed -e 's/system/s/; s/jruby-/j/')
-  local gemset=$(rbenv gemset active 2>&1 | cut -d ' ' -f1)
-  if (test "$gemset" = "no"); then
-    echo " $version"
-  else
-    echo " $version@$gemset"
-  fi
-}
-if [[ $TERM != "" ]]; then
-  export red=$(tput setaf 1)
-  export green=$(tput setaf 2)
-  export yellow=$(tput setaf 3)
-  export bold=$(tput bold)
-  export reset=$(tput sgr0)
-fi
+# setup a simple PROMPT/PS1
 export PROMPT_DIRTRIM=1
-#export PS1="\[$yellow\]\$(git-prompt)\[$red\]\$(rbenv-prompt)\n\[$reset\]\w: "
+export PS1="\n\W$ "
 
 # Case-insensitive globbing (used in pathname expansion)
 shopt -s nocaseglob
@@ -73,99 +45,31 @@ shopt -s nocaseglob
 export HISTCONTROL=ignoreboth
 export HISTSIZE=1000000
 
+# directly save every command to history
 shopt -s histappend
 if [ "x$PROMPT_COMMAND" != "x" ]; then
   export PROMPT_COMMAND="$PROMPT_COMMAND;"
 fi
 export PROMPT_COMMAND="$PROMPT_COMMAND history -a; history -n" # preserve other PROMPT_COMMAND stuff!
 
-# Start an HTTP server from a directory, optionally specifying the port
-function server() {
-  local port="${1:-8000}"
-  open "http://localhost:${port}/"
-  # Set the default Content-Type to `text/plain` instead of `application/octet-stream`
-  # And serve everything as UTF-8 (although not technically correct, this doesn’t break anything for binary files)
-  python -c $'import SimpleHTTPServer;\nmap = SimpleHTTPServer.SimpleHTTPRequestHandler.extensions_map;\nmap[""] = "text/plain";\nfor key, value in map.items():\n\tmap[key] = value + ";charset=UTF-8";\nSimpleHTTPServer.test();' "$port"
-}
-
-# Mirror a complete website
-function mirror-website() {
-  local url=$@
-  local domain=`expr "$url" : '^http[s]*://\([^/?]*\)'`
-  wget \
-    --recursive \
-    --no-clobber \
-    --page-requisites \
-    --html-extension \
-    --convert-links \
-    --restrict-file-names=windows \
-    --domains $domain \
-    --no-parent \
-    $url
-}
-
-# Put my computer to sleep in X minutes
-function sleep-in() {
-  local minutes=$1
-  if [ -z "$minutes" ]; then
-    echo "Usage: sleep-in <minutes>"
-  else
-    local datetime=`date -v+${minutes}M +"%m/%d/%y %H:%M:%S"`
-    echo "Scheduling sleep at $datetime"
-    sudo pmset schedule sleep "$datetime"
-  fi
-}
-
-# Open conflicts at once, setting the search pattern to <<<<<<< in order to cycle through them pressing 'n'
-function editconflicts() { 
-  vim +/"<<<<<<<" `git diff --name-only --diff-filter=U | xargs`
-}
-
-# Selectively load bash completions for better performance
-function load-bash-completion() {
-  local file="$(brew --prefix)/etc/bash_completion.d/$1"
-  if [ -f "$file" ]; then
-    . "$file"
-  fi
-}
-. "$(brew --prefix)/etc/bash_completion"
-# load-bash-completion "git-completion.bash"
-# load-bash-completion "ssh"
-
-# Heroku Toolbelt
-export PATH="/usr/local/heroku/bin:$PATH"
-
-function docker-cleanup() {
-  docker rm `docker ps -a -q`
-  docker rmi `docker images | grep "^<none" | tr -s ' ' | cut -d' ' -f 3`
-  docker volume prune -f
-}
-
-function docker-ip() {
-  docker inspect --format '{{ .NetworkSettings.IPAddress }}' "$@"
-}
-
-function print-kube-secrets() {
-  for file in $@; do
-    echo "${file}:"
-    yaml2json < $file | jq '[.select(.type == "Secret") | .data | to_entries[] | .value = (.value | @base64d)] | from_entries'
-  done
-}
-
-# project specific .envrc
+# directory specific .envrc files
 eval "$(direnv hook bash)"
 
-# better bundle open, that changes current directory
-function bundle-open() {
-  (cd $($(which bundle) show $@) && $EDITOR .)
-}
-
 # The next line updates PATH for the Google Cloud SDK.
-if [ -f /usr/local/google-cloud-sdk/path.bash.inc ]; then
-  source '/usr/local/google-cloud-sdk/path.bash.inc'
-fi
+source "/usr/local/Caskroom/google-cloud-sdk/latest/google-cloud-sdk/path.bash.inc"
 
 # The next line enables shell command completion for gcloud.
-if [ -f /usr/local/google-cloud-sdk/completion.bash.inc ]; then
-  source '/usr/local/google-cloud-sdk/completion.bash.inc'
-fi
+source "/usr/local/Caskroom/google-cloud-sdk/latest/google-cloud-sdk/completion.bash.inc"
+
+# Source kubectl bash completion (generated with `kubectl completion bash > ~/.kube/bash_completion`)
+source ~/.kube/bash_completion
+
+# Bash completion for brew installed tools
+source "$(brew --prefix)/etc/bash_completion"
+
+# Aliases are managed here
+source ~/.bash_aliases
+
+# Functions are managed here
+source ~/.bash_functions
+
diff --git a/.pryrc b/.pryrc
new file mode 100644
index 0000000..705f61f
--- /dev/null
+++ b/.pryrc
@@ -0,0 +1,6 @@
+if defined?(PryByebug)
+  Pry.commands.alias_command 'c', 'continue'
+  Pry.commands.alias_command 's', 'step'
+  Pry.commands.alias_command 'n', 'next'
+  Pry.commands.alias_command 'f', 'finish'
+end
diff --git a/.ssh/config b/.ssh/config
new file mode 100644
index 0000000..e8af5e2
Binary files /dev/null and b/.ssh/config differ
diff --git a/.ssh/whatdropsnow-production.pem b/.ssh/whatdropsnow-production.pem
new file mode 100644
index 0000000..5efabad
Binary files /dev/null and b/.ssh/whatdropsnow-production.pem differ
diff --git a/.ssh/whatdropsnow-staging.pem b/.ssh/whatdropsnow-staging.pem
new file mode 100644
index 0000000..a0888c7
Binary files /dev/null and b/.ssh/whatdropsnow-staging.pem differ
diff --git a/.tmux.conf b/.tmux.conf
index 8e1a069..3492a1b 100644
--- a/.tmux.conf
+++ b/.tmux.conf
@@ -16,15 +16,11 @@ setw -g mouse on
 # monitor activity
 setw -g monitor-activity on
 
-# status bar setup
-set -g status-bg black
-set -g status-fg white
-
 # enable clipboard
 # set -g clipboard jn
 
 # reattach to user namespace to enable mac osx clipboard
-set-option -g default-command "reattach-to-user-namespace -l $SHELL"
+# set-option -g default-command "reattach-to-user-namespace -l $SHELL"
 
 # set faster escape time (ms)
 set escape-time 150
@@ -64,13 +60,3 @@ set -g status-right ''
 # increase scrollback lines
 set -g history-limit 10000
 
-# plugins, keep this section at the very bottom
-
-# tpm is the tmux plugin manager itself
-set -g @plugin 'tmux-plugins/tpm'
-
-# persists tmux environment across system restarts
-set -g @plugin 'tmux-plugins/tmux-resurrect'
-
-# Initialize TMUX plugin manager (keep this line at the very bottom of tmux.conf)
-run '~/.tmux/plugins/tpm/tpm'
diff --git a/.vim/colors/Tomorrow-Night.vim b/.vim/colors/Tomorrow-Night.vim
deleted file mode 100644
index 208b6d4..0000000
--- a/.vim/colors/Tomorrow-Night.vim
+++ /dev/null
@@ -1,362 +0,0 @@
-" Tomorrow Night - Full Colour and 256 Colour
-" http://chriskempson.com
-"
-" Hex colour conversion functions borrowed from the theme "Desert256""
-
-" Default GUI Colours
-let s:foreground = "c5c8c6"
-let s:background = "1d1f21"
-let s:selection = "373b41"
-let s:line = "282a2e"
-let s:comment = "969896"
-let s:red = "cc6666"
-let s:orange = "de935f"
-let s:yellow = "f0c674"
-let s:green = "b5bd68"
-let s:aqua = "8abeb7"
-let s:blue = "81a2be"
-let s:purple = "b294bb"
-let s:window = "4d5057"
-
-" Console 256 Colours
-if !has("gui_running")
-	let s:background = "303030"
-	let s:window = "5e5e5e"
-	let s:line = "3a3a3a"
-	let s:selection = "585858"
-end
-
-set background=dark
-hi clear
-syntax reset
-
-let g:colors_name = "Tomorrow-Night"
-
-if has("gui_running") || &t_Co == 88 || &t_Co == 256
-	" Returns an approximate grey index for the given grey level
-	fun <SID>grey_number(x)
-		if &t_Co == 88
-			if a:x < 23
-				return 0
-			elseif a:x < 69
-				return 1
-			elseif a:x < 103
-				return 2
-			elseif a:x < 127
-				return 3
-			elseif a:x < 150
-				return 4
-			elseif a:x < 173
-				return 5
-			elseif a:x < 196
-				return 6
-			elseif a:x < 219
-				return 7
-			elseif a:x < 243
-				return 8
-			else
-				return 9
-			endif
-		else
-			if a:x < 14
-				return 0
-			else
-				let l:n = (a:x - 8) / 10
-				let l:m = (a:x - 8) % 10
-				if l:m < 5
-					return l:n
-				else
-					return l:n + 1
-				endif
-			endif
-		endif
-	endfun
-
-	" Returns the actual grey level represented by the grey index
-	fun <SID>grey_level(n)
-		if &t_Co == 88
-			if a:n == 0
-				return 0
-			elseif a:n == 1
-				return 46
-			elseif a:n == 2
-				return 92
-			elseif a:n == 3
-				return 115
-			elseif a:n == 4
-				return 139
-			elseif a:n == 5
-				return 162
-			elseif a:n == 6
-				return 185
-			elseif a:n == 7
-				return 208
-			elseif a:n == 8
-				return 231
-			else
-				return 255
-			endif
-		else
-			if a:n == 0
-				return 0
-			else
-				return 8 + (a:n * 10)
-			endif
-		endif
-	endfun
-
-	" Returns the palette index for the given grey index
-	fun <SID>grey_colour(n)
-		if &t_Co == 88
-			if a:n == 0
-				return 16
-			elseif a:n == 9
-				return 79
-			else
-				return 79 + a:n
-			endif
-		else
-			if a:n == 0
-				return 16
-			elseif a:n == 25
-				return 231
-			else
-				return 231 + a:n
-			endif
-		endif
-	endfun
-
-	" Returns an approximate colour index for the given colour level
-	fun <SID>rgb_number(x)
-		if &t_Co == 88
-			if a:x < 69
-				return 0
-			elseif a:x < 172
-				return 1
-			elseif a:x < 230
-				return 2
-			else
-				return 3
-			endif
-		else
-			if a:x < 75
-				return 0
-			else
-				let l:n = (a:x - 55) / 40
-				let l:m = (a:x - 55) % 40
-				if l:m < 20
-					return l:n
-				else
-					return l:n + 1
-				endif
-			endif
-		endif
-	endfun
-
-	" Returns the actual colour level for the given colour index
-	fun <SID>rgb_level(n)
-		if &t_Co == 88
-			if a:n == 0
-				return 0
-			elseif a:n == 1
-				return 139
-			elseif a:n == 2
-				return 205
-			else
-				return 255
-			endif
-		else
-			if a:n == 0
-				return 0
-			else
-				return 55 + (a:n * 40)
-			endif
-		endif
-	endfun
-
-	" Returns the palette index for the given R/G/B colour indices
-	fun <SID>rgb_colour(x, y, z)
-		if &t_Co == 88
-			return 16 + (a:x * 16) + (a:y * 4) + a:z
-		else
-			return 16 + (a:x * 36) + (a:y * 6) + a:z
-		endif
-	endfun
-
-	" Returns the palette index to approximate the given R/G/B colour levels
-	fun <SID>colour(r, g, b)
-		" Get the closest grey
-		let l:gx = <SID>grey_number(a:r)
-		let l:gy = <SID>grey_number(a:g)
-		let l:gz = <SID>grey_number(a:b)
-
-		" Get the closest colour
-		let l:x = <SID>rgb_number(a:r)
-		let l:y = <SID>rgb_number(a:g)
-		let l:z = <SID>rgb_number(a:b)
-
-		if l:gx == l:gy && l:gy == l:gz
-			" There are two possibilities
-			let l:dgr = <SID>grey_level(l:gx) - a:r
-			let l:dgg = <SID>grey_level(l:gy) - a:g
-			let l:dgb = <SID>grey_level(l:gz) - a:b
-			let l:dgrey = (l:dgr * l:dgr) + (l:dgg * l:dgg) + (l:dgb * l:dgb)
-			let l:dr = <SID>rgb_level(l:gx) - a:r
-			let l:dg = <SID>rgb_level(l:gy) - a:g
-			let l:db = <SID>rgb_level(l:gz) - a:b
-			let l:drgb = (l:dr * l:dr) + (l:dg * l:dg) + (l:db * l:db)
-			if l:dgrey < l:drgb
-				" Use the grey
-				return <SID>grey_colour(l:gx)
-			else
-				" Use the colour
-				return <SID>rgb_colour(l:x, l:y, l:z)
-			endif
-		else
-			" Only one possibility
-			return <SID>rgb_colour(l:x, l:y, l:z)
-		endif
-	endfun
-
-	" Returns the palette index to approximate the 'rrggbb' hex string
-	fun <SID>rgb(rgb)
-		let l:r = ("0x" . strpart(a:rgb, 0, 2)) + 0
-		let l:g = ("0x" . strpart(a:rgb, 2, 2)) + 0
-		let l:b = ("0x" . strpart(a:rgb, 4, 2)) + 0
-
-		return <SID>colour(l:r, l:g, l:b)
-	endfun
-
-	" Sets the highlighting for the given group
-	fun <SID>X(group, fg, bg, attr)
-		if a:fg != ""
-			exec "hi " . a:group . " guifg=#" . a:fg . " ctermfg=" . <SID>rgb(a:fg)
-		endif
-		if a:bg != ""
-			exec "hi " . a:group . " guibg=#" . a:bg . " ctermbg=" . <SID>rgb(a:bg)
-		endif
-		if a:attr != ""
-			exec "hi " . a:group . " gui=" . a:attr . " cterm=" . a:attr
-		endif
-	endfun
-
-	" Vim Highlighting
-	call <SID>X("Normal", s:foreground, s:background, "")
-	call <SID>X("LineNr", s:selection, "", "")
-	call <SID>X("NonText", s:selection, "", "")
-	call <SID>X("SpecialKey", s:selection, "", "")
-	call <SID>X("Search", s:background, s:yellow, "")
-	call <SID>X("TabLine", s:foreground, s:background, "reverse")
-	call <SID>X("StatusLine", s:window, s:yellow, "reverse")
-	call <SID>X("StatusLineNC", s:window, s:foreground, "reverse")
-	call <SID>X("VertSplit", s:window, s:window, "none")
-	call <SID>X("Visual", "", s:selection, "")
-	call <SID>X("Directory", s:blue, "", "")
-	call <SID>X("ModeMsg", s:green, "", "")
-	call <SID>X("MoreMsg", s:green, "", "")
-	call <SID>X("Question", s:green, "", "")
-	call <SID>X("WarningMsg", s:red, "", "")
-	call <SID>X("MatchParen", "", s:selection, "")
-	call <SID>X("Folded", s:comment, s:background, "")
-	call <SID>X("FoldColumn", "", s:background, "")
-	if version >= 700
-		call <SID>X("CursorLine", "", s:line, "none")
-		call <SID>X("CursorColumn", "", s:line, "none")
-		call <SID>X("PMenu", s:foreground, s:selection, "none")
-		call <SID>X("PMenuSel", s:foreground, s:selection, "reverse")
-		call <SID>X("SignColumn", "", s:background, "none")
-	end
-	if version >= 703
-		call <SID>X("ColorColumn", "", s:line, "none")
-	end
-
-	" Standard Highlighting
-	call <SID>X("Comment", s:comment, "", "")
-	call <SID>X("Todo", s:comment, s:background, "")
-	call <SID>X("Title", s:comment, "", "")
-	call <SID>X("Identifier", s:red, "", "none")
-	call <SID>X("Statement", s:foreground, "", "")
-	call <SID>X("Conditional", s:foreground, "", "")
-	call <SID>X("Repeat", s:foreground, "", "")
-	call <SID>X("Structure", s:purple, "", "")
-	call <SID>X("Function", s:blue, "", "")
-	call <SID>X("Constant", s:orange, "", "")
-	call <SID>X("String", s:green, "", "")
-	call <SID>X("Special", s:foreground, "", "")
-	call <SID>X("PreProc", s:purple, "", "")
-	call <SID>X("Operator", s:aqua, "", "none")
-	call <SID>X("Type", s:blue, "", "none")
-	call <SID>X("Define", s:purple, "", "none")
-	call <SID>X("Include", s:blue, "", "")
-	"call <SID>X("Ignore", "666666", "", "")
-
-	" Vim Highlighting
-	call <SID>X("vimCommand", s:red, "", "none")
-
-	" C Highlighting
-	call <SID>X("cType", s:yellow, "", "")
-	call <SID>X("cStorageClass", s:purple, "", "")
-	call <SID>X("cConditional", s:purple, "", "")
-	call <SID>X("cRepeat", s:purple, "", "")
-
-	" PHP Highlighting
-	call <SID>X("phpVarSelector", s:red, "", "")
-	call <SID>X("phpKeyword", s:purple, "", "")
-	call <SID>X("phpRepeat", s:purple, "", "")
-	call <SID>X("phpConditional", s:purple, "", "")
-	call <SID>X("phpStatement", s:purple, "", "")
-	call <SID>X("phpMemberSelector", s:foreground, "", "")
-
-	" Ruby Highlighting
-	call <SID>X("rubySymbol", s:green, "", "")
-	call <SID>X("rubyConstant", s:yellow, "", "")
-	call <SID>X("rubyAttribute", s:blue, "", "")
-	call <SID>X("rubyInclude", s:blue, "", "")
-	call <SID>X("rubyLocalVariableOrMethod", s:orange, "", "")
-	call <SID>X("rubyCurlyBlock", s:orange, "", "")
-	call <SID>X("rubyStringDelimiter", s:green, "", "")
-	call <SID>X("rubyInterpolationDelimiter", s:orange, "", "")
-	call <SID>X("rubyConditional", s:purple, "", "")
-	call <SID>X("rubyRepeat", s:purple, "", "")
-
-	" Python Highlighting
-	call <SID>X("pythonInclude", s:purple, "", "")
-	call <SID>X("pythonStatement", s:purple, "", "")
-	call <SID>X("pythonConditional", s:purple, "", "")
-	call <SID>X("pythonFunction", s:blue, "", "")
-
-	" JavaScript Highlighting
-	call <SID>X("javaScriptBraces", s:foreground, "", "")
-	call <SID>X("javaScriptFunction", s:purple, "", "")
-	call <SID>X("javaScriptConditional", s:purple, "", "")
-	call <SID>X("javaScriptRepeat", s:purple, "", "")
-	call <SID>X("javaScriptNumber", s:orange, "", "")
-	call <SID>X("javaScriptMember", s:orange, "", "")
-
-	" HTML Highlighting
-	call <SID>X("htmlTag", s:red, "", "")
-	call <SID>X("htmlTagName", s:red, "", "")
-	call <SID>X("htmlArg", s:red, "", "")
-	call <SID>X("htmlScriptTag", s:red, "", "")
-
-	" Diff Highlighting
-	call <SID>X("diffAdded", s:green, "", "")
-	call <SID>X("diffRemoved", s:red, "", "")
-
-    " ShowMarks Highlighting
-    call <SID>X("ShowMarksHLl", s:orange, s:background, "none")
-    call <SID>X("ShowMarksHLo", s:purple, s:background, "none")
-    call <SID>X("ShowMarksHLu", s:yellow, s:background, "none")
-    call <SID>X("ShowMarksHLm", s:aqua, s:background, "none")
-
-	" Delete Functions
-	delf <SID>X
-	delf <SID>rgb
-	delf <SID>colour
-	delf <SID>rgb_colour
-	delf <SID>rgb_level
-	delf <SID>rgb_number
-	delf <SID>grey_colour
-	delf <SID>grey_level
-	delf <SID>grey_number
-endif
diff --git a/.vim/colors/paramount.vim b/.vim/colors/paramount.vim
deleted file mode 100644
index 25500ed..0000000
--- a/.vim/colors/paramount.vim
+++ /dev/null
@@ -1,198 +0,0 @@
-" Name:       paramount.vim
-" Version:    0.1.0
-" Maintainer: github.com/owickstrom
-" License:    The MIT License (MIT)
-"
-" A minimal colorscheme for Vim that only puts emphasis on the paramount.
-"
-" Based on the pencil and off colorschemes:
-"
-" https://github.com/reedes/vim-colors-pencil
-" https://github.com/reedes/vim-colors-off
-"
-"""
-hi clear
-
-if exists('syntax on')
-    syntax reset
-endif
-
-let g:colors_name='paramount'
-
-let s:black           = { "gui": "#212121", "cterm": "235" }
-let s:medium_gray     = { "gui": "#767676", "cterm": "243" }
-let s:white           = { "gui": "#F1F1F1", "cterm": "15"  }
-let s:actual_white    = { "gui": "#FFFFFF", "cterm": "231" }
-let s:light_black     = { "gui": "#424242", "cterm": "238" }
-let s:lighter_black   = { "gui": "#545454", "cterm": "240" }
-let s:subtle_black    = { "gui": "#303030", "cterm": "236" }
-let s:light_gray      = { "gui": "#B2B2B2", "cterm": "249" }
-let s:lighter_gray    = { "gui": "#C6C6C6", "cterm": "251" }
-let s:lightest_gray   = { "gui": "#DADADA", "cterm": "253" }
-let s:pink            = { "gui": "#fb007a", "cterm": "9"   }
-let s:dark_red        = { "gui": "#C30771", "cterm": "1"   }
-let s:light_red       = { "gui": "#E32791", "cterm": "1"   }
-let s:orange          = { "gui": "#D75F5F", "cterm": "167" }
-let s:darker_blue     = { "gui": "#005F87", "cterm": "18"  }
-let s:dark_blue       = { "gui": "#008EC4", "cterm": "4"   }
-let s:blue            = { "gui": "#20BBFC", "cterm": "12"  }
-let s:light_blue      = { "gui": "#b6d6fd", "cterm": "153" }
-let s:dark_cyan       = { "gui": "#20A5BA", "cterm": "6"   }
-let s:light_cyan      = { "gui": "#4FB8CC", "cterm": "14"  }
-let s:dark_green      = { "gui": "#10A778", "cterm": "2"   }
-let s:light_green     = { "gui": "#5FD7A7", "cterm": "10"  }
-let s:dark_purple     = { "gui": "#af5fd7", "cterm": "134" }
-let s:light_purple    = { "gui": "#a790d5", "cterm": "140" }
-let s:yellow          = { "gui": "#F3E430", "cterm": "11"  }
-let s:dark_yellow     = { "gui": "#A89C14", "cterm": "3"   }
-
-if &background == "dark"
-  let s:bg              = s:black
-  let s:bg_subtle       = s:lighter_black
-  let s:bg_very_subtle  = s:subtle_black
-  let s:norm            = s:lighter_gray
-  let s:norm_subtle     = s:medium_gray
-  let s:purple          = s:light_purple
-  let s:cyan            = s:light_cyan
-  let s:green           = s:light_green
-  let s:red             = s:light_red
-  let s:visual          = s:light_purple
-else
-  let s:bg              = s:actual_white
-  let s:bg_subtle       = s:light_gray
-  let s:bg_very_subtle  = s:lightest_gray
-  let s:norm            = s:light_black
-  let s:norm_subtle     = s:medium_gray
-  let s:purple          = s:dark_purple
-  let s:cyan            = s:dark_cyan
-  let s:green           = s:dark_green
-  let s:red             = s:dark_red
-  let s:visual          = s:dark_purple
-endif
-
-" https://github.com/noahfrederick/vim-hemisu/
-function! s:h(group, style)
-  execute "highlight" a:group
-    \ "guifg="   (has_key(a:style, "fg")    ? a:style.fg.gui   : "NONE")
-    \ "guibg="   (has_key(a:style, "bg")    ? a:style.bg.gui   : "NONE")
-    \ "guisp="   (has_key(a:style, "sp")    ? a:style.sp.gui   : "NONE")
-    \ "gui="     (has_key(a:style, "gui")   ? a:style.gui      : "NONE")
-    \ "ctermfg=" (has_key(a:style, "fg")    ? a:style.fg.cterm : "NONE")
-    \ "ctermbg=" (has_key(a:style, "bg")    ? a:style.bg.cterm : "NONE")
-    \ "cterm="   (has_key(a:style, "cterm") ? a:style.cterm    : "NONE")
-endfunction
-
-call s:h("Normal",        {"bg": s:bg, "fg": s:norm})
-call s:h("Cursor",        {"bg": s:purple, "fg": s:norm })
-call s:h("Comment",       {"fg": s:bg_subtle, "gui": "italic"})
-
-call s:h("Constant",      {"fg": s:purple})
-hi! link Character        Constant
-hi! link Number           Constant
-hi! link Boolean          Constant
-hi! link Float            Constant
-hi! link String           Constant
-
-"call s:h("Identifier",    {"fg": s:dark_blue})
-hi! link Identifier       Normal
-hi! link Function         Identifier
-
-call s:h("Statement",     {"fg": s:norm_subtle})
-hi! link Conditonal       Statement
-hi! link Repeat           Statement
-hi! link Label            Statement
-hi! link Keyword          Statement
-hi! link Exception        Statement
-
-call s:h("Operator",      {"fg": s:norm, "cterm": "bold", "gui": "bold"})
-
-call s:h("PreProc",     {"fg": s:norm_subtle})
-hi! link Include          PreProc
-hi! link Define           PreProc
-hi! link Macro            PreProc
-hi! link PreCondit        PreProc
-
-call s:h("Type",          {"fg": s:norm})
-hi! link StorageClass     Type
-hi! link Structure        Type
-hi! link Typedef          Type
-
-call s:h("Special",       {"fg": s:norm_subtle, "gui": "italic"})
-hi! link SpecialChar      Special
-hi! link Tag              Special
-hi! link Delimiter        Special
-hi! link SpecialComment   Special
-hi! link Debug            Special
-
-call s:h("Underlined",    {"fg": s:norm, "gui": "underline", "cterm": "underline"})
-call s:h("Ignore",        {"fg": s:bg})
-call s:h("Error",         {"fg": s:actual_white, "bg": s:red, "cterm": "bold"})
-call s:h("Todo",          {"fg": s:purple, "gui": "underline", "cterm": "underline"})
-call s:h("SpecialKey",    {"fg": s:light_green})
-call s:h("NonText",       {"fg": s:medium_gray})
-call s:h("Directory",     {"fg": s:dark_blue})
-call s:h("ErrorMsg",      {"fg": s:pink})
-call s:h("IncSearch",     {"bg": s:yellow, "fg": s:light_black})
-call s:h("Search",        {"bg": s:bg_subtle})
-call s:h("MoreMsg",       {"fg": s:medium_gray, "cterm": "bold", "gui": "bold"})
-hi! link ModeMsg MoreMsg
-call s:h("LineNr",        {"fg": s:bg_subtle})
-call s:h("CursorLineNr",  {"fg": s:purple, "bg": s:bg_very_subtle})
-call s:h("Question",      {"fg": s:red})
-call s:h("StatusLine",    {"bg": s:bg_very_subtle})
-call s:h("StatusLineNC",  {"bg": s:bg_very_subtle, "fg": s:medium_gray})
-call s:h("VertSplit",     {"bg": s:bg_very_subtle, "fg": s:bg_very_subtle})
-call s:h("Title",         {"fg": s:dark_blue})
-call s:h("Visual",        {"fg": s:norm, "bg": s:visual})
-call s:h("VisualNOS",     {"bg": s:bg_subtle})
-call s:h("WarningMsg",    {"fg": s:red})
-call s:h("WildMenu",      {"fg": s:bg, "bg": s:norm})
-call s:h("Folded",        {"fg": s:medium_gray})
-call s:h("FoldColumn",    {"fg": s:bg_subtle})
-call s:h("DiffAdd",       {"fg": s:green})
-call s:h("DiffDelete",    {"fg": s:red})
-call s:h("DiffChange",    {"fg": s:dark_yellow})
-call s:h("DiffText",      {"fg": s:dark_blue})
-call s:h("SignColumn",    {"fg": s:light_green})
-
-if has("gui_running")
-  call s:h("SpellBad",    {"gui": "underline", "sp": s:red})
-  call s:h("SpellCap",    {"gui": "underline", "sp": s:light_green})
-  call s:h("SpellRare",   {"gui": "underline", "sp": s:pink})
-  call s:h("SpellLocal",  {"gui": "underline", "sp": s:dark_green})
-else
-  call s:h("SpellBad",    {"cterm": "underline", "fg": s:red})
-  call s:h("SpellCap",    {"cterm": "underline", "fg": s:light_green})
-  call s:h("SpellRare",   {"cterm": "underline", "fg": s:pink})
-  call s:h("SpellLocal",  {"cterm": "underline", "fg": s:dark_green})
-endif
-
-call s:h("Pmenu",         {"fg": s:norm, "bg": s:bg_subtle})
-call s:h("PmenuSel",      {"fg": s:norm, "bg": s:purple})
-call s:h("PmenuSbar",     {"fg": s:norm, "bg": s:bg_subtle})
-call s:h("PmenuThumb",    {"fg": s:norm, "bg": s:bg_subtle})
-call s:h("TabLine",       {"fg": s:norm, "bg": s:bg_very_subtle})
-call s:h("TabLineSel",    {"fg": s:purple, "bg": s:bg_subtle, "gui": "bold", "cterm": "bold"})
-call s:h("TabLineFill",   {"fg": s:norm, "bg": s:bg_very_subtle})
-call s:h("CursorColumn",  {"bg": s:bg_very_subtle})
-call s:h("CursorLine",    {"bg": s:bg_very_subtle})
-call s:h("ColorColumn",   {"bg": s:bg_subtle})
-
-call s:h("MatchParen",    {"bg": s:bg_subtle, "fg": s:norm})
-call s:h("qfLineNr",      {"fg": s:medium_gray})
-
-call s:h("htmlH1",        {"bg": s:bg, "fg": s:norm})
-call s:h("htmlH2",        {"bg": s:bg, "fg": s:norm})
-call s:h("htmlH3",        {"bg": s:bg, "fg": s:norm})
-call s:h("htmlH4",        {"bg": s:bg, "fg": s:norm})
-call s:h("htmlH5",        {"bg": s:bg, "fg": s:norm})
-call s:h("htmlH6",        {"bg": s:bg, "fg": s:norm})
-
-" Signify, git-gutter
-hi link SignifySignAdd              LineNr
-hi link SignifySignDelete           LineNr
-hi link SignifySignChange           LineNr
-hi link GitGutterAdd                LineNr
-hi link GitGutterDelete             LineNr
-hi link GitGutterChange             LineNr
-hi link GitGutterChangeDelete       LineNr
diff --git a/.vim/snippets/ruby.snippets b/.vim/snippets/ruby.snippets
deleted file mode 100644
index 195bc52..0000000
--- a/.vim/snippets/ruby.snippets
+++ /dev/null
@@ -1,5 +0,0 @@
-snippet test
-	test "${1:method_name}" do
-		${2}
-	end
-
diff --git a/.vimrc b/.vimrc
index f9c9350..53e46be 100644
--- a/.vimrc
+++ b/.vimrc
@@ -9,19 +9,9 @@ Plugin 'gmarik/Vundle.vim'
 " repeat hooks for other plugins
 Plugin 'tpope/vim-repeat'
 
-" OCaml
-Plugin 'def-lkb/ocp-indent-vim'
-let g:opamshare = substitute(system('opam config var share'),'\n$','','''')
-execute "set rtp+=" . g:opamshare . "/merlin/vim"
-execute "set rtp+=" . g:opamshare . "/merlin/vimbufsync"
-let g:syntastic_ocaml_checkers = ['merlin']
-" skip default merlin key bindings (e.g. I am using \t for Command-t)
-let g:merlin_disable_default_keybindings = 1
-" map them differently (:MerlinTypeOf* to ?, \n and \p are left default)
-autocmd FileType ocaml map  <buffer> ? :MerlinTypeOf<return>
-autocmd FileType ocaml vmap <buffer> ? :MerlinTypeOfSel<return>
-autocmd FileType ocaml map  <buffer> <LocalLeader>n :MerlinGrowEnclosing<return>
-autocmd FileType ocaml map  <buffer> <LocalLeader>p :MerlinShrinkEnclosing<return>
+" Dart / Flutter
+Plugin 'dart-lang/dart-vim-plugin'
+Plugin 'reisub0/hot-reload.vim'
 
 " fuzzy search files
 Plugin 'wincent/command-t'
@@ -135,6 +125,7 @@ let g:syntastic_always_populate_loc_list = 1
 let g:syntastic_auto_loc_list = 1
 let g:syntastic_check_on_open = 0
 let g:syntastic_check_on_wq = 0
+let g:syntastic_mode_map = {'mode':'passive'}
 set statusline+=%#warningmsg#
 set statusline+=%{SyntasticStatuslineFlag()}
 set statusline+=%*
@@ -154,6 +145,12 @@ Plugin 'tpope/vim-fugitive'
 " Mainly working with bash .sh scripts
 let g:is_bash=1
 
+" Install colorschema paramount
+Plugin 'owickstrom/vim-colors-paramount'
+
+" Terraform support
+Plugin 'hashivim/vim-terraform'
+
 call vundle#end()
 
 filetype plugin indent on
@@ -213,8 +210,8 @@ set smartcase
 set nofoldenable
 
 " directories for backup, tmp and swp files
-set backupdir=~/.vimtmp/backup
-set directory=~/.vimtmp/swap
+set backupdir=~/.vim/tmp/backup
+set directory=~/.vim/tmp/swap
 
 " save an undofile to be able to undo changes after closing files
 set undofile
@@ -239,6 +236,10 @@ set synmaxcol=160
 " we have a good terminal connection, send more characters for redrawing
 set ttyfast
 
+" Disable modeline as a security precaution
+set modelines=0
+set nomodeline
+
 " disable arrow keys
 " noremap <Up> <NOP>
 " noremap <Down> <NOP>
diff --git a/Makefile b/Makefile
index 96b3edf..7590ca2 100644
--- a/Makefile
+++ b/Makefile
@@ -1,13 +1,28 @@
-EXCLUDED_DOTFILES := .git .gitattributes .gitignore .gitmodules
+EXCLUDED_DOTFILES := .git .git-crypt .gitattributes .gitignore .gitmodules .ssh
 DOTFILES := $(addprefix ~/, $(filter-out $(EXCLUDED_DOTFILES), $(wildcard .*)))
 
+# everything, geared towards to be run for setup and maintenance
 all: \
 	brew \
 	casks \
+	fonts \
 	bash \
+	ruby \
 	vim \
 	tmux \
-	dotfiles
+	dotfiles \
+	defaults \
+	docker \
+	harder
+
+# bootstrap only, add one-time bootstrap tasks here
+# setups everything
+# restore .gnupg and thus decrypt the secrets from this repository
+# setup ssh config (relies on decrypted repository)
+bootstrap: \
+	all \
+	~/.gnupg \
+	~/.ssh/config
 
 brew: \
 	/usr/local/bin/brew
@@ -32,36 +47,41 @@ brew: \
 	brew install postgres 
 	# mysql
 	brew install mysql
-	# elasticsearch
-	brew install elasticsearch
+	# redis
+	brew install redis
 	# sed, stream editor, but replace mac os version
 	brew install gnu-sed --with-default-names
 	# erlang programming language
 	brew install erlang
 	# elixir programming language
 	brew install elixir
-	# docker related tools
-	brew install docker
-	brew install docker-machine
-	brew install docker-compose
 	# handle amazon web services related stuff
 	brew install awscli
 	# handle json on the command line
 	brew install jq --HEAD
 	# pipeviewer allows to display throughput/eta information on unix pipes
 	brew install pv
+	# pstree is nice to look at
+	brew install pstree
+	# watch is great for building an overview on running stuff
+	brew install watch
+	# nmap is great for test and probing network related stuff
+	brew install nmap
+	# curl is a http development essential
+	brew install curl
+	# hugo is my blogging engine
+	brew install hugo
+	# jenv manages different java versions
+	brew install jenv
 
 /usr/local/bin/brew:
-	ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"
+	ruby -e "$$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"
+	brew analytics off
 
 casks: \
 	/usr/local/bin/brew
 	# tap homebrew-cask to install other osx related stuff
 	brew tap caskroom/cask
-	# tap into homebrew-fonts
-	brew tap caskroom/fonts
-	# install Adobe Source Code Pro, an excellent mono space font for programming
-	brew cask install font-source-code-pro
 	# spectacle for mac osx window management/tiling
 	brew cask install spectacle
 	# opera for browsing the web
@@ -70,12 +90,49 @@ casks: \
 	brew cask install dropbox
 	# 1password is an excellent password manager
 	brew cask install 1password
-	# gpgtools provide me with all gpp related things
-	brew cask install gpgtools
+	# gpg-suite provide me with all gpp related things
+	brew cask install gpg-suite
 	# virtualbox to handle virtual machines
 	brew cask install virtualbox
 	# handle google cloud related stuff
 	brew cask install google-cloud-sdk
+	# adium is a nice chat client
+	brew cask install adium
+	# I do some JRuby development where java comes in handy :)
+	brew cask install java
+	# Skype is still used by many of my friends :)
+	brew cask install skype
+	# VLC an excellent video player
+	brew cask install vlc
+	# TextMate is an excellent GUI based editor
+	brew cask install textmate
+	# Flux reduces blue/green colors on the display spectrum and helps me sleep better
+	brew cask install flux
+	# slack is my preferred team chat
+	brew cask install slack
+	# launchbar is my preferred app launcher/clipboard history, calculator and goto mac utility
+	brew cask install launchbar
+	# graphiql helps debugging graphql based apis
+	brew cask install graphiql
+	# sequel-pro is a great graphical MySQL client
+	brew cask install sequel-pro
+	# postico is a great graphical PostgreSQL client
+	brew cask install postico
+	# itsycal is a nice menu bar clock replacement that features a calendar with events from iCal
+	brew cask install itsycal
+	# macdown is a nice markdown editor, I use it to write my articles/presentation scripts
+	brew cask install macdown
+	# Dash gives your Mac instant offline access to 200+ API documentation sets.
+	brew cask install dash
+
+fonts: \
+	/usr/local/bin/brew
+	# tap homebrew-fonts to install freely available fonts
+	brew tap caskroom/fonts
+	# install IBM Plex, an excellent modern font (https://www.ibm.com/plex/)
+	brew cask install font-ibm-plex
+	# install Adobe Source Code Pro, an excellent mono space font for programming
+	brew cask install font-source-code-pro
 
 bash:
 	# newer version of bash
@@ -85,38 +142,234 @@ bash:
 	echo "/usr/local/bin/bash" | sudo tee -a /etc/shells
 	chsh -s /usr/local/bin/bash
 
+ruby: \
+	~/.rbenv \
+	~/.rbenv/plugins/ruby-build \
+	~/.rbenv/plugins/rbenv-update \
+	~/.rbenv/plugins/rbenv-readline \
+	~/.rbenv/plugins/rbenv-gemset
+
+# rbenv is an amazing ruby version manager, simple, straightforward, local
+~/.rbenv:
+	git clone https://github.com/rbenv/rbenv.git ~/.rbenv
+	cd ~/.rbenv && src/configure && make -C src
+
+# ruby-build is a repository hosting all kinds of ruby versions to install
+~/.rbenv/plugins/ruby-build:
+	git clone https://github.com/rbenv/ruby-build.git ~/.rbenv/plugins/ruby-build
+
+# rbenv-update allows updating rbenv plugins easily
+~/.rbenv/plugins/rbenv-update:
+	git clone https://github.com/rkh/rbenv-update.git ~/.rbenv/plugins/rbenv-update
+
+# rbenv-readline does the right thing when it comes to linking a brew installed readline to ruby
+~/.rbenv/plugins/rbenv-readline:
+	git clone git://github.com/tpope/rbenv-readline.git ~/.rbenv/plugins/rbenv-readline
+
+# rbenv-gemset allows managing project specific set of gems
+~/.rbenv/plugins/rbenv-gemset:
+	git clone git://github.com/jf/rbenv-gemset.git ~/.rbenv/plugins/rbenv-gemset
+
 vim: \
 	vim-itself \
 	vim-plugins
 
 vim-itself:
 	# newer version of vim
-	brew install vim --with-override-system-vi
+	brew install vim
 	# create vim directories
-	mkdir -p .vim/tmp/{backup,swap,undo}
+	mkdir -p ~/.vim/tmp/{backup,swap,undo}
 
 vim-plugins: \
 	~/.vim/bundle/Vundle.vim
-	vim +PluginInstall +qall
+	# disable colorscheme for installing plugins to a temporary .vimrc
+	sed 's/colorscheme/"colorscheme/' .vimrc > /tmp/.vimrc
+	# install plugins with temporary vimrc
+	vim -u /tmp/.vimrc +PluginInstall +qall
+	-rm /tmp/.vimrc
+	# post installation steps of command-t (use the ruby that ships with vim)
+	cd ~/.vim/bundle/command-t/ruby/command-t/ext/command-t && /usr/local/opt/ruby/bin/ruby extconf.rb && make
 
 # install vundle, a vim package manager
 ~/.vim/bundle/Vundle.vim:
-	git clone https://github.com/gmarik/Vundle.vim.git ~.vim/bundle/Vundle.vim
+	git clone https://github.com/gmarik/Vundle.vim.git ~/.vim/bundle/Vundle.vim
 
 tmux: \
 	~/.tmux.conf \
-	~/.tmux/plugins/tpm
 	brew install tmux
-	tmux source ~/.tmux.conf
-	# install plugins
-	~/.tmux/plugins/tpm/bin/install_plugins
 
-~/.tmux/plugins/tpm:
-	# install tmux plugin manager
-	git clone --depth=10 https://github.com/tmux-plugins/tpm ~/.tmux/plugins/tpm
+defaults: \
+	defaults-Dock \
+	defaults-NSGlobalDomain \
+	defaults-Calendar
+	# Show remaining battery time; hide percentage
+	defaults write com.apple.menuextra.battery ShowPercent -string "NO"
+	defaults write com.apple.menuextra.battery ShowTime -string "YES"
+	# Enable AirDrop over Ethernet and on unsupported Macs running Lion
+	defaults write com.apple.NetworkBrowser BrowseAllInterfaces -bool true
+	# Automatically open a new Finder window when a volume is mounted
+	defaults write com.apple.frameworks.diskimages auto-open-ro-root -bool true
+	defaults write com.apple.frameworks.diskimages auto-open-rw-root -bool true
+	# Avoid creating .DS_Store files on network volumes
+	defaults write com.apple.desktopservices DSDontWriteNetworkStores -bool true
+	# Disable the warning when changing a file extension
+	defaults write com.apple.finder FXEnableExtensionChangeWarning -bool false
+	# Automatically quit printer app once the print jobs complete
+	defaults write com.apple.print.PrintingPrefs "Quit When Finished" -bool true
+	# Check for software updates daily, not just once per week
+	defaults write com.apple.SoftwareUpdate ScheduleFrequency -int 1
+	# Automatically illuminate built-in MacBook keyboard in low light
+	defaults write com.apple.BezelServices kDim -bool true
+	# Turn off keyboard illumination when computer is not used for 5 minutes
+	defaults write com.apple.BezelServices kDimTime -int 300
+	# Save screenshots to the desktop
+	defaults write com.apple.screencapture location -string "${HOME}/Desktop"
+	# Disable shadow in screenshots
+	defaults write com.apple.screencapture disable-shadow -bool true
+	# Save screenshots in PNG format (other options: BMP, GIF, JPG, PDF, TIFF)
+	defaults write com.apple.screencapture type -string "png"
+	# Hide all desktop icons because who need 'em'
+	defaults write com.apple.finder CreateDesktop -bool false
+	# Enable HiDPI display modes (requires restart)
+	sudo defaults write /Library/Preferences/com.apple.windowserver DisplayResolutionEnabled -bool true
+	# Finder: disable window animations and Get Info animations
+	defaults write com.apple.finder DisableAllAnimations -bool true
+	# Finder: show hidden files by default
+	defaults write com.apple.Finder AppleShowAllFiles -bool true
+	# Finder: show path bar
+	defaults write com.apple.finder ShowPathbar -bool true
+	# Empty Trash securely by default
+	defaults write com.apple.finder EmptyTrashSecurely -bool false
+	# Require password immediately after 5 seconds on sleep or screen saver begins
+	defaults write com.apple.screensaver askForPassword -int 1
+	defaults write com.apple.screensaver askForPasswordDelay -int 5
+	# Only use UTF-8 in Terminal.app
+	defaults write com.apple.terminal StringEncodings -array 4
+	# Show the ~/Library folder
+	chflags nohidden ~/Library
+	# disable apple captive portal (seucrity issue)
+	sudo defaults write /Library/Preferences/SystemConfiguration/com.apple.captive.control Active -bool false
+	# setup Quad9 DNS
+	networksetup -setdnsservers Wi-Fi 9.9.9.9
+	# Keep this bit last
+	# Kill affected applications
+	for app in Safari Finder Mail SystemUIServer; do killall "$$app" >/dev/null 2>&1; done
+	# Re-enable subpixel aliases that got disabled by default in Mojave
+	defaults write -g CGFontRenderingFontSmoothingDisabled -bool NO
+
+defaults-Dock:
+	# Enable the 2D Dock
+	defaults write com.apple.dock no-glass -bool true
+	# Automatically hide and show the Dock
+	defaults write com.apple.dock autohide -bool true
+	# Make Dock icons of hidden applications translucent
+	defaults write com.apple.dock showhidden -bool true
+	# Enable highlight hover effect for the grid view of a stack (Dock)
+	defaults write com.apple.dock mouse-over-hilte-stack -bool true
+	# Enable spring loading for all Dock items
+	defaults write enable-spring-load-actions-on-all-items -bool true
+	# Show indicator lights for open applications in the Dock
+	defaults write com.apple.dock show-process-indicators -bool true
+	# Don’t animate opening applications from the Dock
+	defaults write com.apple.dock launchanim -bool false
+	# clean up right side (persistent)
+	-defaults delete com.apple.dock persistent-others
+	# and add these folders
+	defaults write com.apple.dock persistent-others -array-add "$$(echo '{"tile-type": "directory-tile", "tile-data": {"displayas": 0, "file-type":2, "showas":1, "file-label":"Dropbox", "file-data":{"_CFURLString":"file:///Users/lukas/Dropbox/","_CFURLStringType":15}}}' | plutil -convert xml1 - -o -)";
+	defaults write com.apple.dock persistent-others -array-add "$$(echo '{"tile-type": "directory-tile", "tile-data": {"displayas": 0, "file-type":2, "showas":1, "file-label":"Desktop", "file-data":{"_CFURLString":"file:///Users/lukas/Desktop/","_CFURLStringType":15}}}' | plutil -convert xml1 - -o -)";
+	defaults write com.apple.dock persistent-others -array-add "$$(echo '{"tile-type": "directory-tile", "tile-data": {"displayas": 0, "file-type":2, "showas":1, "file-label":"Downloads", "file-data":{"_CFURLString":"file:///Users/lukas/Downloads/","_CFURLStringType":15}}}' | plutil -convert xml1 - -o -)";
+	# restart dock
+	killall Dock
+
+defaults-NSGlobalDomain:
+	# Locale
+	defaults write NSGlobalDomain AppleLocale -string "en_US"
+	defaults write NSGlobalDomain AppleMeasurementUnits -string "Centimeters"
+	defaults write NSGlobalDomain AppleMetricUnits -bool true
+	# 24-Hour Time
+	defaults write NSGlobalDomain AppleICUForce12HourTime -bool false
+	# Enable full keyboard access for all controls (e.g. enable Tab in modal dialogs)
+	defaults write NSGlobalDomain AppleKeyboardUIMode -int 3
+	# Enable subpixel font rendering on non-Apple LCDs
+	defaults write NSGlobalDomain AppleFontSmoothing -int 2
+	# Disable menu bar transparency
+	defaults write NSGlobalDomain AppleEnableMenuBarTransparency -bool false
+	# Enable press-and-hold for keys
+	defaults write NSGlobalDomain ApplePressAndHoldEnabled -bool false
+	# Set a blazingly fast keyboard repeat rate (1 = fastest for macOS high sierra, older versions support 0)
+	defaults write NSGlobalDomain KeyRepeat -int 2
+	# Decrase the time to initially trigger key repeat
+	defaults write NSGlobalDomain InitialKeyRepeat -int 15
+	# Enable auto-correct
+	defaults write NSGlobalDomain NSAutomaticSpellingCorrectionEnabled -bool true
+	# Disable window animations
+	defaults write NSGlobalDomain NSAutomaticWindowAnimationsEnabled -bool false
+	# Increase window resize speed for Cocoa applications
+	defaults write NSGlobalDomain NSWindowResizeTime -float 0.001
+	# Save to disk (not to iCloud) by default
+	defaults write NSGlobalDomain NSDocumentSaveNewDocumentsToCloud -bool false
+	# Disable smart quotes as they’re annoying when typing code
+	defaults write NSGlobalDomain NSAutomaticQuoteSubstitutionEnabled -bool false
+	# Disable smart dashes as they’re annoying when typing code
+	defaults write NSGlobalDomain NSAutomaticDashSubstitutionEnabled -bool false
+	# Trackpad: enable tap to click for this user and for the login screen
+	defaults write com.apple.driver.AppleBluetoothMultitouch.trackpad Clicking -bool true
+	defaults -currentHost write NSGlobalDomain com.apple.mouse.tapBehavior -int 1
+	defaults write NSGlobalDomain com.apple.mouse.tapBehavior -int 1
+	# Finder: show all filename extensions
+	defaults write NSGlobalDomain AppleShowAllExtensions -bool true
+
+defaults-Calendar:
+	# Show week numbers (10.8 only)
+	defaults write com.apple.iCal "Show Week Numbers" -bool true
+	# Show 7 days
+	defaults write com.apple.iCal "n days of week" -int 7
+	# Week starts on monday
+	defaults write com.apple.iCal "first day of week" -int 1
+	# Show event times
+	defaults write com.apple.iCal "Show time in Month View" -bool true
 
 dotfiles: $(DOTFILES)
 
+~/.ssh/config:
+	# Test that .ssh/config is decrypted (gpg has been setup)
+	grep "Host *" ~/dotfiles/.ssh/config
+	# Symlink .ssh/config
+	cd ~/.ssh && ln -sv ../dotfiles/.ssh/config .
+
+~/.gnupg:
+	# Ask where to get .gnupg from
+	@read -p "Where is .gnupg (from backup) located?" gnupg_source;
+	cp -v $$gnupg_source ~/.gnupg
+
 ~/.%:
 	cd ~ && ln -sv dotfiles/$(notdir $@) $@
 
+~/.kube/bash_completion:
+	kubectl completion bash > ~/.kube/bash_completion
+
+docker:
+	brew cask install docker
+
+# Here is a comprehensive guide: https://github.com/drduh/macOS-Security-and-Privacy-Guide
+# The following settings implement some basic security measures
+harder: \
+	harder-dns-resolver
+	# Enable the firewall
+	sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on
+	# Enable logging on the firewall
+	sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setloggingmode on
+	# Enable stealth mode (computer does not respond to PING or TCP connections on closed ports)
+	sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on
+	# Prevent built-in software as well as code-signed, downloaded software from being whitelisted automatically
+	sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setallowsigned off
+	sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setallowsignedapp off
+	# Restart the firewall (this should remain last)
+	-sudo pkill -HUP socketfilterfw
+	# Enable touch id for sudo (if available)
+	-@test -f /usr/lib/pam/pam_tid.so* && (grep pam_tid.so /etc/pam.d/sudo || sudo /usr/local/bin/sed -e '2iauth       sufficient     pam_tid.so' -i /etc/pam.d/sudo)
+
+harder-dns-resolver:
+	brew install knot-resolver
+	cp -v ~/dotfiles/etc/kresd/config /usr/local/etc/kresd/config
+	sudo brew services restart knot-resolver
diff --git a/README.md b/README.md
index fd19e30..cf1fe52 100644
--- a/README.md
+++ b/README.md
@@ -1,22 +1,61 @@
 # Overbryd's dotfiles
+
+## Bootstrap
+
+On a new mac, open a Terminal and run:
+
+    curl -O https://raw.githubusercontent.com/Overbryd/dotfiles/master/bootstrap.sh
+    chmod +x bootstrap.sh
+    ./bootstrap.sh
+
+## Maintenance
+
+Enter the `~/dotfiles` directory, make changes and `make` it:
+
+    cd ~/dotfiles
+    make
+
+The Makefile contains sections for installing \*nix command line utilities, macOS applications, macOS settings and maintaing specific configurations.
+
+So you can also only re-make a section of the project, for example the macOS dock settings:
+
+    cd ~/dotfiles
+    make defaults-Dock
+
+Or only rebuild your vim:
+
+    cd ~/dotfiles
+    make vim
+
+Or upgrade all installed packages:
+
+    cd ~/dotfiles
+    make brew
+
+## Contents
+
     .
+    ├── Makefile        # This makefile controls all sections of this project
+    ├── bootstrap.sh    # 0-100 bootstrap script for a new freshly installed Mac
     ├── .gitattributes  # 
     ├── .gitconfig      # colorful git config, including aliases
     ├── .gitignore      # general gitignore
     ├── .inputrc        # great for navigating bash history
-    ├── .profile        # simple bash setup
+    ├── .profile        # the complete bash setup with comments
     ├── .slate          # configuration for Slate, a Mac OSX window manager
-    ├── .tm_properties  # configuration for TextMate, a great Code editor
+    ├── .tm_properties  # configuration for TextMate
     ├── .vimrc          # a great .vimrc with comments
     ├── decrypt.sh      # decrypt sensitive files and put them in place
-    ├── defaults.sh     # a collection of interesting Mac OSX defaults
     └── encrypt.sh      # simple wrapper to encrypt sensitive files for storage
 
-## Maintain and setup OSX defaults
+## Credits
 
-While working with your Mac you start customizing all the stuff. If you setup a new machine you can reproduce the setup using `defaults.sh`.
-Any customization that you do via `defaults` should be appended to `defaults.sh`.
+This seletion of dotfiles and system settings would not be possible without the great examples provided by:
 
-```bash
-~/.dotfiles/defaults.sh
-```
+* https://github.com/mathiasbynens/dotfiles
+* https://github.com/matijs/dotfiles
+* https://github.com/paulirish/dotfiles
+* https://github.com/why-jay/osx-init
+* https://github.com/simonmcc/osx-bootstrap/blob/master/osx-user-defaults.sh
+* http://dotfiles.github.io
+* https://www.stackoverflow.com/ :)
diff --git a/bootstrap.sh b/bootstrap.sh
new file mode 100644
index 0000000..31a0f9b
--- /dev/null
+++ b/bootstrap.sh
@@ -0,0 +1,23 @@
+#!/bin/bash
+
+# generate a new, strong rsa ssh key
+ssh-keygen -t rsa -b 4096
+
+# wait for the user to add it to github
+pbcopy < ~/.ssh/id_rsa.pub
+echo "Now login to https://github.com/settings/keys and add the key that has already been copied to your clipboard."
+read -p "Press any key to continue. Ctrl-C to abort."
+
+# install Xcode Command Line Tools
+# https://github.com/timsutton/osx-vm-templates/blob/ce8df8a7468faa7c5312444ece1b977c1b2f77a4/scripts/xcode-cli-tools.sh
+touch /tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress;
+PROD=$(softwareupdate -l |
+  grep "\*.*Command Line" |
+  head -n 1 | awk -F"*" '{print $2}' |
+  sed -e 's/^ *//' |
+  tr -d '\n')
+softwareupdate -i "$PROD" -v
+
+# clone my dotfiles and make them
+git clone git@github.com:Overbryd/dotfiles.git ~/dotfiles
+make -C ~/dotfiles bootstrap
diff --git a/etc/certs/DigiCertECCSecureServerCA.pem b/etc/certs/DigiCertECCSecureServerCA.pem
new file mode 100644
index 0000000..ba07b8c
--- /dev/null
+++ b/etc/certs/DigiCertECCSecureServerCA.pem
@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDrDCCApSgAwIBAgIQCssoukZe5TkIdnRw883GEjANBgkqhkiG9w0BAQwFADBh
+MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
+d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBD
+QTAeFw0xMzAzMDgxMjAwMDBaFw0yMzAzMDgxMjAwMDBaMEwxCzAJBgNVBAYTAlVT
+MRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxJjAkBgNVBAMTHURpZ2lDZXJ0IEVDQyBT
+ZWN1cmUgU2VydmVyIENBMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE4ghC6nfYJN6g
+LGSkE85AnCNyqQIKDjc/ITa4jVMU9tWRlUvzlgKNcR7E2Munn17voOZ/WpIRllNv
+68DLP679Wz9HJOeaBy6Wvqgvu1cYr3GkvXg6HuhbPGtkESvMNCuMo4IBITCCAR0w
+EgYDVR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwNAYIKwYBBQUHAQEE
+KDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wQgYDVR0f
+BDswOTA3oDWgM4YxaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0R2xv
+YmFsUm9vdENBLmNybDA9BgNVHSAENjA0MDIGBFUdIAAwKjAoBggrBgEFBQcCARYc
+aHR0cHM6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzAdBgNVHQ4EFgQUo53mH/naOU/A
+buiRy5Wl2jHiCp8wHwYDVR0jBBgwFoAUA95QNVbRTLtm8KPiGxvDl7I90VUwDQYJ
+KoZIhvcNAQEMBQADggEBAMeKoENL7HTJxavVHzA1Nm6YVntIrAVjrnuaVyRXzG/6
+3qttnMe2uuzO58pzZNvfBDcKAEmzP58mrZGMIOgfiA4q+2Y3yDDo0sIkp0VILeoB
+UEoxlBPfjV/aKrtJPGHzecicZpIalir0ezZYoyxBEHQa0+1IttK7igZFcTMQMHp6
+mCHdJLnsnLWSB62DxsRq+HfmNb4TDydkskO/g+l3VtsIh5RHFPVfKK+jaEyDj2D3
+loB5hWp2Jp2VDCADjT7ueihlZGak2YPqmXTNbk19HOuNssWvFhtOyPNV6og4ETQd
+Ea8/B6hPatJ0ES8q/HO3X8IVQwVs1n3aAr0im0/T+Xc=
+-----END CERTIFICATE-----
diff --git a/etc/kresd/config b/etc/kresd/config
new file mode 100644
index 0000000..9a4e698
--- /dev/null
+++ b/etc/kresd/config
@@ -0,0 +1,55 @@
+-- Config file for personal tls enabled resolver.
+-- Refer to manual: https://knot-resolver.readthedocs.io/en/latest/daemon.html#configuration
+--
+-- How to enter the knot resolver CLI
+-- Ctrl+D to exit
+--
+-- $ sudo socat - /tmp/kresd/tty/*
+--
+-- > cache.clear()
+--
+-- > trust_anchors.insecure
+
+-- Listen on localhost (default)
+net = { '127.0.0.1', '::1' }
+-- net.listen(net.lo)
+
+-- Drop root privileges
+-- user('knot-resolver', 'knot-resolver')
+
+-- Auto-maintain root TA
+trust_anchors.file = 'root.keys'
+
+-- If there are problems accessing a single DNSSEC domain, without turning DNSSEC off for others
+-- trust_anchors.negative = { 'some.bad.domain' }
+
+-- Load Useful modules
+modules = {
+  'hints > iterate', -- Load /etc/hosts and allow custom root hints
+  'stats',    -- Track internal statistics
+  'predict',  -- Prefetch expiring/frequent records
+}
+
+-- Configure blocks (e.g. block YouTube for getting productive)
+-- modules.load('daf')
+-- daf.add 'qname youtube.com deny'
+-- daf.add 'qname youtu.be deny'
+
+-- Smaller cache size
+cache.size = 10 * MB
+
+-- use the homebrew openssl ca cert bundle
+cloudflare_ca_file='/Users/lukas/dotfiles/etc/certs/DigiCertECCSecureServerCA.pem'
+
+-- forward all queries to Cloudflare DNS over tls
+policy.add(
+  policy.all(
+    policy.TLS_FORWARD({
+      {'1.1.1.1', hostname='cloudflare-dns.com', ca_file=cloudflare_ca_file},
+      {'1.0.0.1', hostname='cloudflare-dns.com', ca_file=cloudflare_ca_file},
+      {'2606:4700:4700::1111', hostname='cloudflare-dns.com', ca_file=cloudflare_ca_file},
+      {'2606:4700:4700::1001', hostname='cloudflare-dns.com', ca_file=cloudflare_ca_file},
+    })
+  )
+)
+