diff --git a/README.md b/README.md
index 79eeebe..78f0132 100644
--- a/README.md
+++ b/README.md
@@ -6,18 +6,15 @@ I hate it when I need to setup a computer from scratch, but from time to time I
 
 It is **not** meant to be used for linux or windows environments and **not** meant to support setting up a remote host. It's just a tiny helper to automate installing all the tools and software you expect on your local machine.
 
-**compare with** https://github.com/geerlingguy/mac-dev-playbook as it may make this repo obsolete.
+**Much simpler than** https://github.com/geerlingguy/mac-dev-playbook, but obviously not as sophisticated.
 
 ## features
+* system configuration (`sudo defaults write XXX`) - hostname, 
+* user configuration (`defaults write XXX`) - dock behaviour, hot corners, finder defaults, ...
 * setup the environment (.profile/.zshrc/aliases/...)
 * install brew / pip3 packages
 * download and install individual apps (zip or dmg)
-
-## ideas/planned features
-* [ ] support multiple environments for pip (virtualenv) 
-* [x] support adding brew casks
-* [ ] (maybe) add a flag through which you can force install to update apps (most apps ask to update themselves though)
-* [ ] maybe add some OSX setting stuff used here: https://github.com/roberth1988/osx-bootstrap
+* optionally use a URL to download the `localhost.yml` configuration
 
 # usage
 
@@ -40,13 +37,14 @@ cd macdev
 ```shell
 cp host_vars/localhost-example.yml host_vars/localhost.yml
 open -e host_vars/localhost.yml
+# replace "YOUR_MACDEV_DIRECTORY" with the directory where the cloned repository resides
 ```
 
 ## run it
 `ansible-playbook macdev.yml`
 
 ## maintain it
-You want to install a new package? Edit your `host_vars/localhost.yml`, then simply run your alias `localdev` (see `host_vars/localhost-example.yml`) or the above command.
+You want to install a new package? Edit your `host_vars/localhost.yml`, then simply run your alias `updatemac` (see `host_vars/localhost-example.yml`) or the above command.
 
 ## troubleshooting
 * if you get this (after updating brew): `/usr/local/bin/ansible-playbook: bad interpreter: /usr/local/opt/python/bin/python3.7: no such file or directory`
diff --git a/host_vars/localhost-M1example.yaml b/host_vars/localhost-M1example.yaml
index d6413b3..3f9a81b 100644
--- a/host_vars/localhost-M1example.yaml
+++ b/host_vars/localhost-M1example.yaml
@@ -8,7 +8,50 @@ role_pip: yes
 role_brew: yes
 role_app: no
 
-# files and templates:
+## system configuration (requires sudo)
+system:
+#  # set ComputerName, HostName and NetBIOS Name
+#  hostname: example
+  # sudo systemsetup -help
+  systemsetup:
+#    - { key: "-setrestartfreeze", value: "on" }
+#    - { key: "-setdisplaysleep", value: "10" }
+  loginwindow:
+#    - { key: "AdminHostInfo", value: "HostName" }
+#    - { key: "GuestEnabled", value: "0" }
+  generic:
+#    - { domain: "/Library/Preferences/com.apple.loginwindow", key: "AdminHostInfo", string: "HostName" }
+#    - { domain: "/Library/Preferences/com.apple.loginwindow", key: "GuestEnabled", bool: false }
+
+## user configuration (must be run per user)
+config:
+  # domain = NSGlobalDomain
+  global:
+#    - { key: "InitialKeyRepeat", int: 15 }
+#    - { key: "KeyRepeat", int: 1 }
+  generic:
+#    - { domain: "com.apple.desktopservices", key: "DSDontWriteNetworkStores", bool: true }
+  # domain = com.apple.finder
+  finder:
+    # available views: `icnv`, `clmv`, `Flwv`, `Nlsv`
+#    - { key: "FXPreferredViewStyle", string: "Nlsv" }
+  # domain = com.apple.dock
+  dock:
+    # https://github.com/mathiasbynens/dotfiles/blob/c886e139233320e29fd882960ba3dd388d57afd7/.macos#L356
+#    - { key: "magnification", int: 1 }
+#    - { key: "tilesize", int: 32 }
+#    - { key: "largesize", int: 128 }
+#    - { key: "autohide", int: 1 }
+#    - { key: "wvous-tl-corner", int: 5 }
+#    - { key: "wvous-tl-modifier", int: 0 }
+#    - { key: "wvous-tr-corner", int: 11 }
+#    - { key: "wvous-tr-modifier", int: 0 }
+#    - { key: "wvous-bl-corner", int: 3 }
+#    - { key: "wvous-bl-modifier", int: 0 }
+#    - { key: "wvous-br-corner", int: 2 }
+#    - { key: "wvous-br-modifier", int: 0 }
+
+## user files and templates:
 # overwrite: replace file on target, if it exists
 # shell: source file in .profile
 
diff --git a/host_vars/localhost-drpsychick-jones.yml b/host_vars/localhost-drpsychick-jones.yml
new file mode 100644
index 0000000..d771915
--- /dev/null
+++ b/host_vars/localhost-drpsychick-jones.yml
@@ -0,0 +1,162 @@
+---
+
+# roles
+role_ssh: yes
+role_sys: yes
+role_cfg: yes
+role_ansible: true
+role_pip: yes
+role_brew: yes
+role_app: no
+
+config_url: "https://raw.githubusercontent.com/DrPsychick/macdev/master/host_vars/localhost-drpsychick-jones.yml"
+
+system:
+  hostname: jones
+  # sudo systemsetup -help
+  systemsetup:
+    - { key: "-setrestartfreeze", value: "on" }
+    - { key: "-setdisplaysleep", value: "10" }
+  # domain = /Library/Preferences/com.apple.loginwindow
+  loginwindow:
+    - { key: "AdminHostInfo", value: "HostName" }
+    - { key: "GuestEnabled", value: "0" }
+  generic:
+    - { domain: "/Library/Preferences/com.apple.loginwindow", key: "AdminHostInfo", string: "HostName" }
+    - { domain: "/Library/Preferences/com.apple.loginwindow", key: "GuestEnabled", bool: false }
+
+config:
+  # domain = NSGlobalDomain
+  global:
+    - { key: "InitialKeyRepeat", int: 20 }
+    - { key: "KeyRepeat", int: 1 }
+  generic:
+    - { domain: "com.apple.desktopservices", key: "DSDontWriteNetworkStores", bool: true }
+    - { domain: "com.apple.Safari", key: "IncludeDevelopMenu", bool: true }
+    - { domain: "com.apple.Safari", key: "WebKitDeveloperExtrasEnabledPreferenceKey", bool: true }
+    - { domain: "com.apple.Safari", key: "com.apple.Safari.ContentPageGroupIdentifier.WebKit2DeveloperExtrasEnabled", bool: true }
+    - { domain: "com.apple.gamed",  key: "Disabled", bool: true }
+  # domain = com.apple.finder
+  finder:
+    - { key: "FXPreferredViewStyle", string: "Nlsv" }
+  # domain = com.apple.dock
+  dock:
+    - { key: "magnification", bool: true }
+    - { key: "tilesize", int: 32 }
+    - { key: "largesize", int: 128 }
+    - { key: "autohide", bool: true }
+    - { key: "showhidden", bool: true }
+    - { key: "wvous-tl-corner", int: 5 }
+    - { key: "wvous-tl-modifier", int: 0 }
+    - { key: "wvous-tr-corner", int: 11 }
+    - { key: "wvous-tr-modifier", int: 0 }
+    - { key: "wvous-bl-corner", int: 3 }
+    - { key: "wvous-bl-modifier", int: 0 }
+    - { key: "wvous-br-corner", int: 2 }
+    - { key: "wvous-br-modifier", int: 0 }
+    - { key: "expose-animation-duration", float: 0.5 }
+
+## user files and templates:
+# overwrite: replace file on target, if it exists
+# source: "interactive" or "login"
+
+# files you want to copy to the target
+files:
+  #- { name: "file-example", path: "$HOME/file-example", overwrite: true, shell: false }
+
+# templates you want to copy to the target
+templates:
+  - { name: "myfunctions.sh", path: "$HOME/bin/myfunctions.sh", overwrite: true, source: "interactive" }
+  - { name: "home-functions.sh", path: "$HOME/bin/home-functions.sh", overwrite: true }
+  - { name: "finicky.js", path: "$HOME/.finicky.js", overwrite: true }
+  - { name: "gitconfig", path: "$HOME/.gitconfig", overwrite: true }
+  - { name: "gitconfig-work", path: "$HOME/.gitconfig-work", overwrite: true }
+  - { name: "gitconfig-private", path: "$HOME/.gitconfig-private", overwrite: true }
+
+# instead of copying a file or template, you can define aliases one by one
+shell_aliases:
+  - { name: "updatemac", cmd: "(cd ~/work/git/macdev; {{ 'echo \"password for sudo:\"; sudo echo;' if role_sys }} ansible-playbook macdev.yml)" }
+  - { name: "rancherVM", cmd: 'LIMA_HOME="$HOME/Library/Application Support/rancher-desktop/lima" "/Applications/Rancher Desktop.app/Contents/Resources/resources/darwin/lima/bin/limactl" shell 0' }
+  - { name: "fixvpn", cmd: "sudo route delete -host 85.190.148.133 192.168.1.200; sudo route add -host 85.190.148.133 192.168.1.200" }
+
+ansible_collections:
+  - { name: community.general }
+  # see https://docs.ansible.com/ansible/latest/user_guide/collections_using.html#install-multiple-collections-with-a-requirements-file
+  - { name: community.docker }
+  - { name: community.kubernetes } # , version: "", source: "" }
+
+brew_packages:
+  - { name: gnupg, path: "{{brew_bin}}/gpg" }
+  - { name: jq, path: "{{brew_bin}}/jq" }
+  - { name: watch, path: "{{brew_bin}}/watch" }
+  - { name: gnupg, path: "{{brew_bin}}/gpg" }
+  #- { name: kubernetes-cli, path: "{{brew_bin}}/kubectl" } # conflicts with Rancher Desktop
+  #- { name: kubectx, path: "{{brew_bin}}/kubectx" }
+  #- { name: helm, path: "{{brew_bin}}/helm" } # conflicts with Rancher Desktop
+  - { name: pinentry-mac, path: "{{brew_bin}}/pinentry-mac" }
+  - { name: node, path: "{{brew_bin}}/node" }
+  - { name: telegraf, path: "{{brew_bin}}/telegraf" }
+  - { name: mtr, path: "{{brew_sbin}}/mtr" }
+  - { name: smartmontools, path: "{{brew_bin}}/smartctl" }
+  - { name: glances, path: "{{brew_bin}}/glances" }
+  - { name: hub, path: "{{brew_bin}}/hub" }
+  - { name: qemu, path: "{{brew_bin}}/qemu-img" }
+  - { name: k3d, path: "{{brew_bin}}/k3d" }
+  - { name: kustomize, path: "{{brew_bin}}/kustomize" }
+  - { name: kubeval, path: "{{brew_bin}}/kubeval" }
+  - { name: kubeseal, path: "{{brew_bin}}/kubeseal" }
+  - { name: pwgen, path: "{{brew_bin}}/pwgen" }
+  - { name: yamllint, path: "{{brew_bin}}/yamllint" }
+
+brew_cask_packages:
+  #- { name: docker, path: /Applications/Docker.app }
+  - { name: iterm2, path: /Applications/iTerm.app }
+  - { name: google-chrome, path: /Applications/Google Chrome.app }
+  - { name: atom, path: /Applications/Atom.app }
+  - { name: slack, path: /Applications/Slack.app }
+  - { name: macpass, path: /Applications/MacPass.app }
+  - { name: zoomus, path: /Applications/zoom.us.app }
+  #- { name: openoffice, path: /Applications/OpenOffice.app }
+  #- { name: libreoffice, path: "/Applications/LibreOffice.app" }
+  #- { name: gimp, path: /Applications/Gimp-2.10.app }
+  #- { name: pycharm-ce, path: "/Applications/PyCharm CE.app" }
+  - { name: pycharm, path: "/Applications/PyCharm.app" }
+  - { name: goland, path: "/Applications/GoLand.app" }
+  - { name: tunnelblick, path: "/Applications/Tunnelblick.app" }
+  - { name: spectacle, path: "/Applications/Spectacle.app" }
+  - { name: drawio, path: "/Applications/draw.io.app" }
+  - { name: postman, path: "/Applications/Postman.app" }
+  - { name: moonlight, path: "/Applications/Moonlight.app" }
+  - { name: krita, path: "/Applications/krita.app" }
+  - { name: spotify, path: "/Applications/Spotify.app" }
+  - { name: sweet-home3d, path: "/Applications/Sweet Home 3D.app" }
+  - { name: monitorcontrol, path: "/Applications/MonitorControl.app" }
+  - { name: macs-fan-control, path: "/Applications/Macs Fan Control.app" }
+  - { name: qsync-client, path: "/Applications/QSync Client.app" }
+  - { name: discord, path: "/Applications/Discord.app" }
+  - { name: google-drive, path: "/Applications/Google Drive.app" }
+  - { name: vlc, path: "/Applications/VLC.app" }
+  #- { name: virtualbox, path: "/Applications/VirtualBox.app" }
+  #- { name: virtualbox-extension-pack, path: "{{ brew_prefix }}/Caskroom/virtualbox-extension-pack/6.1.28/Oracle_VM_VirtualBox_Extension_Pack-6.1.28.vbox-extpack" }
+  - { name: obsidian, path: "/Applications/Obsidian.app" }
+  - { name: mindforger, path: "/Applications/mindforger.app" }
+  - { name: moom, path: "/Applications/Moom.app" }
+  - { name: obs, path: "/Applications/OBS.app" }
+  - { name: obs-virtualcam, path: "{{ brew_prefix }}/Caskroom/obs-virtualcam" }
+  #- { name: qdslrdashboard, path: "/Applications/qDslrDashboard.app" }
+  - { name: finicky, path: "/Applications/finicky.app" }
+  - { name: microsoft-teams, path: "/Applications/Microsoft Teams.app" }
+  - { name: utm, path: "/Applications/UTM.app" }
+  - { name: minecraft, path: "/Applications/Minecraft.app" }
+  - { name: curseforge, path: "/Applications/CurseForge.app" }
+  - { name: rancher, path: "/Applications/Rancher Desktop.app" }
+  - { name: 1password, path: "/Applications/1Password 7.app" }
+
+pip_packages:
+  - { name: yamale, path: "{{pip_bin}}/yamale" }
+#  - { name: kubernetes, path: "/lib/python3.9/site-packages/kubernetes" }
+#  - { name: ansible, path: /usr/local/bin/ansible }
+#  - { name: awscli, path: /usr/local/bin/aws } 
+
+# supports .zip and .dmg
+app_packages:
diff --git a/host_vars/localhost-example.yml b/host_vars/localhost-example.yml
index 8d55b49..71e7540 100644
--- a/host_vars/localhost-example.yml
+++ b/host_vars/localhost-example.yml
@@ -2,28 +2,74 @@
 
 # roles
 role_ssh: yes
+# role_sys requires sudo
+role_sys: no
+role_cfg: no
 role_ansible: yes
-role_pip: yes
+role_pip: no
 role_brew: yes
 role_app: no
 
-# files and templates:
+## system configuration (requires sudo)
+system:
+#  # set ComputerName, HostName and NetBIOS Name
+#  hostname: example
+  # sudo systemsetup -help
+  systemsetup:
+#    - { key: "-setrestartfreeze", value: "on" }
+#    - { key: "-setdisplaysleep", value: "10" }
+  loginwindow:
+#    - { key: "AdminHostInfo", value: "HostName" } # shows host name and info on login screen
+#    - { key: "GuestEnabled", value: "0" }
+  generic:
+#    - { domain: "/Library/Preferences/com.apple.loginwindow", key: "AdminHostInfo", string: "HostName" }
+#    - { domain: "/Library/Preferences/com.apple.loginwindow", key: "GuestEnabled", bool: false }
+
+## user configuration (must be run per user)
+config:
+  # domain = NSGlobalDomain
+  global:
+#    - { key: "InitialKeyRepeat", int: 15 }
+#    - { key: "KeyRepeat", int: 1 }
+  generic:
+#    - { domain: "com.apple.desktopservices", key: "DSDontWriteNetworkStores", bool: true }
+  # domain = com.apple.finder
+  finder:
+    # available views: `icnv`, `clmv`, `Flwv`, `Nlsv`
+    - { key: "FXPreferredViewStyle", string: "Nlsv" }
+  # domain = com.apple.dock
+  dock:
+    # https://github.com/mathiasbynens/dotfiles/blob/c886e139233320e29fd882960ba3dd388d57afd7/.macos#L356
+#    - { key: "magnification", int: 1 }
+#    - { key: "tilesize", int: 32 }
+#    - { key: "largesize", int: 128 }
+#    - { key: "autohide", int: 1 }
+    # hot corners: tl = top-left, br = bottom-right
+#    - { key: "wvous-tl-corner", int: 5 }
+#    - { key: "wvous-tl-modifier", int: 0 }
+#    - { key: "wvous-tr-corner", int: 11 }
+#    - { key: "wvous-tr-modifier", int: 0 }
+#    - { key: "wvous-bl-corner", int: 3 }
+#    - { key: "wvous-bl-modifier", int: 0 }
+#    - { key: "wvous-br-corner", int: 2 }
+#    - { key: "wvous-br-modifier", int: 0 }
+
+## user files and templates:
 # overwrite: replace file on target, if it exists
-# shell (OBSOLETE): source file in .bashrc/.zshrc
-# source=(interactive|login): source file in "interactive" = .bashrc/.zshrc or "login" = .profile/.zprofile
+# source=(interactive|login): source file for "interactive" session = .bashrc/.zshrc or "login" session = .profile/.zprofile
 
 # files you want to copy to the target
 files:
-  - { name: "gitconfig-example", path: "$HOME/.gitconfig-example", overwrite: true }
+#  - { name: "gitconfig-example", path: "$HOME/.gitconfig-example", overwrite: true }
 
 # templates you want to copy to the target
 templates:
-  - { name: "bashrc-example", path: "$HOME/.bashrc-example", overwrite: true }
-  - { name: "bash_aliases-example", path: "$HOME/.bash_aliases-example", overwrite: true, source: "interactive" }
+#  - { name: "bashrc-example", path: "$HOME/.bashrc-example", overwrite: true }
+#  - { name: "bash_aliases-example", path: "$HOME/.bash_aliases-example", overwrite: true, source: "interactive" }
 
 # instead of copying a file or template, you can define aliases one by one
 shell_aliases:
-  - { name: "localdev", cmd: "(cd ~/YOUR_MACDEV_DIRECTORY; ansible-playbook macdev.yml)" }
+  - { name: "updatemac", cmd: "(cd ~/YOUR_MACDEV_DIRECTORY; {{ 'echo \"password for sudo:\"; sudo echo;' if role_sys }} ansible-playbook macdev.yml)" }
 
 ansible_collections:
   - { name: community.general }
@@ -31,6 +77,7 @@ ansible_collections:
   #- { name: community.docker, version: "=1.9.0" }
   #- { name: community.kubernetes, source: "" }
 
+# TODO: at this time, only ONE user can control brew packages
 brew_packages:
   - { name: python, path: "{{ brew_bin }}/python3" }
   - { name: pwgen, path: "{{ brew_bin }}/pwgen" }
@@ -54,10 +101,10 @@ brew_packages:
   - { name: zsh-autosuggestions, path: /usr/local/share/zsh-autosuggestions }
 
 brew_cask_packages:
-  - { name: docker, path: /Applications/Docker.app }
   - { name: iterm2, path: /Applications/iTerm.app }
   - { name: google-chrome, path: /Applications/Google Chrome.app }
-  - { name: atom, path: /Applications/Atom.app }
+  #- { name: docker, path: /Applications/Docker.app }
+  #- { name: atom, path: /Applications/Atom.app }
   #- { name: postman, path: /Applications/Postman.app }
   #- { name: slack, path: /Applications/Slack.app }
   #- { name: macpass, path: /Applications/MacPass.app }
@@ -71,11 +118,11 @@ brew_cask_packages:
   #- { name: moonlight, path: "/Applications/Moonlight.app" }
   #- { name: zoom, path: "/Applications/zoom.us.app" }
   #- { name: discord, path: "/Applications/Discord.app" }
-  #- { name: google-backup-and-sync, path: "/Applications/Backup and Sync.app" }
+  #- { name: google-drive, path: "/Applications/Google Drive.app" }
 
-pip_packages:
-  - { name: ansible, path: "{{ pip_bin }}/ansible" }
-  - { name: awscli, path: "{{ pip_bin }}/aws" }
+#pip_packages:
+#  - { name: ansible, path: "{{ pip_bin }}/ansible" }
+#  - { name: awscli, path: "{{ pip_bin }}/aws" }
 
 # supports .zip and .dmg
 app_packages:
diff --git a/host_vars/localhost-standardapps.yml b/host_vars/localhost-standardapps.yml
index 7db10df..b975787 100644
--- a/host_vars/localhost-standardapps.yml
+++ b/host_vars/localhost-standardapps.yml
@@ -6,11 +6,57 @@
 
 # roles
 role_ssh: no
+role_sys: no
+role_cfg: no
+role_ansible: true
 role_pip: yes
 role_brew: yes
 role_app: no
 
-# files and templates:
+## system configuration (requires sudo)
+system:
+#  # set ComputerName, HostName and NetBIOS Name
+#  hostname: example
+  # sudo systemsetup -help
+  systemsetup:
+#    - { key: "-setrestartfreeze", value: "on" }
+#    - { key: "-setdisplaysleep", value: "10" }
+  loginwindow:
+#    - { key: "AdminHostInfo", value: "HostName" }
+#    - { key: "GuestEnabled", value: "0" }
+  generic:
+#    - { domain: "/Library/Preferences/com.apple.loginwindow", key: "AdminHostInfo", string: "HostName" }
+#    - { domain: "/Library/Preferences/com.apple.loginwindow", key: "GuestEnabled", bool: false }
+
+## user configuration (must be run per user)
+config:
+  # domain = NSGlobalDomain
+  global:
+#    - { key: "InitialKeyRepeat", int: 15 }
+#    - { key: "KeyRepeat", int: 1 }
+  generic:
+#    - { domain: "com.apple.desktopservices", key: "DSDontWriteNetworkStores", bool: true }
+  # domain = com.apple.finder
+  finder:
+    # available views: `icnv`, `clmv`, `Flwv`, `Nlsv`
+    - { key: "FXPreferredViewStyle", string: "Nlsv" }
+  # domain = com.apple.dock
+  dock:
+    # https://github.com/mathiasbynens/dotfiles/blob/c886e139233320e29fd882960ba3dd388d57afd7/.macos#L356
+#    - { key: "magnification", int: 1 }
+#    - { key: "tilesize", int: 32 }
+#    - { key: "largesize", int: 128 }
+#    - { key: "autohide", int: 1 }
+#    - { key: "wvous-tl-corner", int: 5 }
+#    - { key: "wvous-tl-modifier", int: 0 }
+#    - { key: "wvous-tr-corner", int: 11 }
+#    - { key: "wvous-tr-modifier", int: 0 }
+#    - { key: "wvous-bl-corner", int: 3 }
+#    - { key: "wvous-bl-modifier", int: 0 }
+#    - { key: "wvous-br-corner", int: 2 }
+#    - { key: "wvous-br-modifier", int: 0 }
+
+## user files and templates:
 # overwrite: replace file on target, if it exists
 # shell: source file in .profile
 
@@ -67,7 +113,7 @@ brew_cask_packages:
   #- { name: moonlight, path: "/Applications/Moonlight.app" }
   - { name: zoom, path: "/Applications/zoom.us.app" }
   - { name: discord, path: "/Applications/Discord.app" }
-  - { name: google-backup-and-sync, path: "/Applications/Backup and Sync.app" }
+  - { name: google-drive, path: "/Applications/Google Drive.app" }
   - { name: vlc, path: "/Applications/VLC.app" }
   #- { name: iina, path: "/Applications/Iina.app" }
   #- { name: background-music, path: "/Applications/Background Music.app" }
diff --git a/macdev.yml b/macdev.yml
index acb1b95..a7d4712 100644
--- a/macdev.yml
+++ b/macdev.yml
@@ -1,17 +1,47 @@
 ---
-- name: Simple macOS setup
+- name: Download config
+  hosts: localhost
+  tasks:
+    - name: Download config
+      get_url:
+        url: "{{ config_url }}"
+        dest: "{{ playbook_dir }}/host_vars/localhost.yml"
+      register: config_download
+      when: config_url is defined
+    - fail:
+      when: config_download is changed
+
+- name: Sudo check
   hosts: localhost
   # set defaults
   pre_tasks:
     - set_fact:
         role_ssh: "{{ role_ssh|default(false) }}"
+        role_sys: "{{ role_sys|default(false) }}"
+        role_cfg: "{{ role_cfg|default(false) }}"
         role_ansible: "{{ role_ansible|default(false) }}"
         role_pip: "{{ role_pip|default(false) }}"
         role_brew: "{{ role_brew|default(false) }}"
         role_app: "{{ role_app|default(false) }}"
+  tasks:
+    - name: Check if sudo works
+      shell: sudo echo "sudo works"
+      become: yes
+      become_user: root
+      register: sudo_check
+      ignore_errors: true
+      when: role_sys
+    - debug: msg="Run 'sudo echo' to fix this."
+      failed_when: true
+      when: role_sys and sudo_check is failed
+
+- name: Simple macOS setup
+  hosts: localhost
   roles:
     - { role: env }
     - { role: ssh, when: role_ssh|bool }
+    - { role: system, when: role_sys|bool }
+    - { role: config, when: role_cfg|bool }
     - { role: ansible, when: role_ansible|bool }
     - { role: pip, when: role_pip|bool }
     - { role: brew, when: role_brew|bool }
diff --git a/roles/brew/tasks/main.yml b/roles/brew/tasks/main.yml
index f0e57c8..8728192 100644
--- a/roles/brew/tasks/main.yml
+++ b/roles/brew/tasks/main.yml
@@ -2,7 +2,7 @@
 
 - name: Check for homebrew
   shell: >
-    [ -n "$HOMEBREW_PREFIX" ] && echo "$HOMEBREW_PREFIX" || echo "/usr/local/"
+    [ -n "$HOMEBREW_PREFIX" ] && echo "$HOMEBREW_PREFIX" || echo "/usr/local"
   register: homebrew_prefix
   changed_when: false
 
diff --git a/roles/config/tasks/main.yml b/roles/config/tasks/main.yml
new file mode 100644
index 0000000..cb1dedb
--- /dev/null
+++ b/roles/config/tasks/main.yml
@@ -0,0 +1,56 @@
+---
+- name: Check vars
+  debug: msg="`config` is defined"
+  failed_when: config is not defined
+
+- name: Global configuration
+  shell: |
+    defaults write NSGlobalDomain {{ item.key }} \
+    {{ "-int "+item.int|string if item.int is defined }} \
+    {{ "-float "+item.float|string if item.float is defined }} \
+    {{ "-bool "+item.bool|string if item.bool is defined }} \
+    {{ "-string "+item.string if item.string is defined }}
+  with_items: "{{ config.global }}"
+  register: global_config
+  when: config.global is defined
+
+- name: Generic configuration
+  shell: |
+    defaults write {{ item.domain }} {{ item.key }} \
+    {{ "-int "+item.int|string if item.int is defined }} \
+    {{ "-float "+item.float|string if item.float is defined }} \
+    {{ "-bool "+item.bool|string if item.bool is defined }} \
+    {{ "-string "+item.string if item.string is defined }}
+  with_items: "{{ config.generic }}"
+  register: generic_config
+  when: config.generic is defined and item.domain is defined
+
+- name: Configure Finder
+  shell: |
+    defaults write com.apple.finder {{ item.key }} \
+    {{ "-int "+item.int|string if item.int is defined }} \
+    {{ "-float "+item.float|string if item.float is defined }} \
+    {{ "-bool "+item.bool|string if item.bool is defined }} \
+    {{ "-string "+item.string if item.string is defined }}
+  with_items: "{{ config.finder }}"
+  register: finder_config
+  when: config.finder is defined
+
+- name: Restart Finder
+  shell: killall Finder
+  when: finder_config is changed
+
+- name: Configure Dock
+  shell: |
+    defaults write com.apple.dock {{ item.key }} \
+    {{ "-int "+item.int|string if item.int is defined }} \
+    {{ "-float "+item.float|string if item.float is defined }} \
+    {{ "-bool "+item.bool|string if item.bool is defined }} \
+    {{ "-string "+item.string if item.string is defined }}
+  with_items: "{{ config.dock }}"
+  register: dock_config
+  when: config.dock is defined
+
+- name: Restart Dock
+  shell: killall Dock
+  when: dock_config is changed
diff --git a/roles/env/tasks/main.yml b/roles/env/tasks/main.yml
index a7d5910..e6ec59b 100644
--- a/roles/env/tasks/main.yml
+++ b/roles/env/tasks/main.yml
@@ -83,7 +83,7 @@
     line: "source {{ item.path }}"
     create: yes
   with_items: "{{ files }}"
-  when: files|length > 0 and (item.shell|default(false) or item.source|default("") == "interactive")
+  when: files|length > 0 and item.source|default("") == "interactive"
 
 # templates
 # fails if a file exists that should not be overwritten
@@ -115,4 +115,4 @@
     line: "source {{ item.path }}"
     create: yes
   with_items: "{{ templates }}"
-  when: templates|length > 0 and (item.shell|default(false) or item.source|default("") == "interactive")
+  when: templates|length > 0 and item.source|default("") == "interactive"
diff --git a/roles/system/tasks/main.yml b/roles/system/tasks/main.yml
new file mode 100644
index 0000000..2b1d673
--- /dev/null
+++ b/roles/system/tasks/main.yml
@@ -0,0 +1,40 @@
+---
+- name: Set hostname
+  shell: |
+    systemsetup -setcomputername {{ system.hostname }};
+    scutil --set ComputerName {{ system.hostname }};
+    scutil --set HostName {{ system.hostname }}
+    scutil --set LocalHostName {{ system.hostname }}
+    defaults write /Library/Preferences/SystemConfiguration/com.apple.smb.server NetBIOSName -string {{ system.hostname|lower }}
+  become: yes
+  become_user: "root"
+  when: system.hostname is defined
+
+- name: System Setup
+  shell: |
+    systemsetup {{ item.key }} {{ item.value }}
+  with_items: "{{ system.systemsetup }}"
+  become: yes
+  become_user: "root"
+  when: system.systemsetup is defined
+
+- name: Generic configuration
+  shell: |
+    defaults write {{ item.domain }} {{ item.key }} \
+    {{ "-int "+item.int|string if item.int is defined }} \
+    {{ "-float "+item.float|string if item.float is defined }} \
+    {{ "-bool "+item.bool|string if item.bool is defined }} \
+    {{ "-string "+item.string if item.string is defined }}
+  with_items: "{{ system.generic }}"
+  become: yes
+  become_user: "root"
+  register: generic_config
+  when: system.generic is defined and item.domain is defined
+
+- name: Configure Login Window
+  shell: defaults write /Library/Preferences/com.apple.loginwindow {{ item.key }} {{ item.value }}
+  with_items: "{{ system.loginwindow }}"
+  become: yes
+  become_user: "root"
+  when: system.loginwindow is defined
+