diff --git a/legacy-of-lunatic-kingdom/README.md b/legacy-of-lunatic-kingdom/README.md
new file mode 100644
index 0000000..b83c600
--- /dev/null
+++ b/legacy-of-lunatic-kingdom/README.md
@@ -0,0 +1,55 @@
+# legacy-of-lunatic-kingdom
+
+## bootstrapping
+
+- Assumes the base OS has been installed and the system is accessible via SSH.
+
+### Adding SSH keys
+
+```sh
+# To log in and add keys manually, PubkeyAuthentication needs to be disabled
+# since otherwise we'll run out of authentication attempts from trying SSH keys.
+ssh -o PubkeyAuthentication=no 192.168.1.xyz
+
+# Alternatively, ssh-copy-id can be used, but it'll put a bunch of other keys
+# into .ssh/authorized_keys that should be cleaned up. Also SSH_AUTH_SOCK is
+# needed since it uses ssh-add to get the public keys.
+SSH_AUTH_SOCK=~/Library/Group\ Containers/2BUA8C4S2C.com.1password/t/agent.sock ssh-copy-id 192.168.1.xyz
+```
+
+### Ansible
+
+This needs to be done until we have Tailscale up and running, since otherwise
+we can't get the IP for the hostname.
+
+```sh
+# Using ssh_config
+Host legacy-of-lunatic-kingdom
+  Hostname 192.168.1.xyz
+
+# Using hosts.yml
+all:
+  hosts:
+    legacy-of-lunatic-kingdom:
+      ansible_host: 192.168.1.xyz
+```
+
+Now Ansible can be run, needing `--ask-become-pass` since `/etc/sudoers` needs
+to be updated:
+
+```sh
+ansible-playbook --ask-become-pass --limit=legacy-of-lunatic-kingdom legacy-of-lunatic-kingdom/main.yml
+```
+
+Tailscale should be installed now, so SSH in and log into Tailscale:
+
+```sh
+ssh 192.168.1.xyz
+
+sudo tailscale login
+```
+
+Disable key expiry in Tailscale.
+
+And now the IP override can be removed since we should get DNS resolution
+through Tailscale.
diff --git a/legacy-of-lunatic-kingdom/main.yml b/legacy-of-lunatic-kingdom/main.yml
new file mode 100644
index 0000000..7425e3b
--- /dev/null
+++ b/legacy-of-lunatic-kingdom/main.yml
@@ -0,0 +1,48 @@
+- name: Basic requirements
+  hosts: legacy-of-lunatic-kingdom
+  become: true
+  tasks:
+
+    - name: Install basic packages
+      apt:
+        name:
+          - git
+          - net-tools # ifconfig
+          - neovim
+        state: present
+        update_cache: true
+
+- name: Secure the system
+  hosts: legacy-of-lunatic-kingdom
+  become: true
+  tasks:
+
+    - name: Disable SSH password logins
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: '^(#\s*)?{{ item }} '
+        line: "{{ item }} no"
+      with_items:
+        - ChallengeResponseAuthentication
+        - PasswordAuthentication
+        - UsePAM
+      notify: Restart sshd
+
+    - name: Allow sudo without password
+      lineinfile:
+        path: /etc/sudoers
+        regexp: '^%sudo'
+        line: '%sudo ALL=(ALL:ALL) NOPASSWD:ALL'
+        validate: 'visudo -cf %s'
+
+  handlers:
+    - name: Restart sshd
+      systemd:
+        name: sshd
+        state: restarted
+
+# TODO disallow network access from non-tailscale interfaces
+- import_playbook: ../playbooks/tailscale.yml # noqa: name[play]
+- import_playbook: ../playbooks/docker.yml    # noqa: name[play]
+
+# vim: ft=yaml.ansible