diff --git a/bin/make-rocky b/bin/make-rocky
index 328d24e..ae2512e 100755
--- a/bin/make-rocky
+++ b/bin/make-rocky
@@ -1,18 +1,37 @@
 #!/bin/bash
+#============================================================================
+# Title       : make-iso
+# Description : Make a custom Rocky Linux installable ISO
+# ---------------------------------------------------------------------------
+# requires lorax, genisoimage: dnf install lorax genisoimage
 
 die() { echo "$(basename $0): [die] $@" >&2 ; exit 1 ; }
 
+test $(id -u) == 0 || die "Run as root (sudo $(basename $0) <opts>"
+
+# Setup temp working directory - clean it up when program ends
+readonly WORKDIR=$(/bin/mktemp --tmpdir -d)
+cleanup() { /bin/rm -rf ${WORKDIR:-/none} ; }
+trap "cleanup" INT TERM HUP EXIT
+
+topdir=$(git rev-parse --show-toplevel)
+echo $topdir
+
 # requires lorax, genisoimage: dnf install lorax genisoimage
 
 isopath=/nfs/sw/os/rocky/Rocky-9.7-x86_64-minimal.iso
 target=/nfs/pve/template/iso/custom.iso
-ks=/users/bart/git/rocky/kickstart/rocky-9.cfg
-custom=/users/bart/git/rocky/custom
+
+ks=$topdir/kickstart/rocky-9.cfg
+custom=$topdir/custom
+
+cp -r $custom $WORKDIR
+cp $ks $WORKDIR
 
 rpm -q --quiet lorax       || die "lorax not installed"
 rpm -q --quiet genisoimage || die "genisoimage not installed"
 
-test -f $target && rm -f $target
+test -f $target && sudo rm -f $target
 
-sudo mkksiso -a $custom --ks=$ks $isopath $target
+mkksiso -a $WORKDIR/custom --ks=$WORKDIR/$(basename $ks) $isopath $target
 
diff --git a/custom/authorized_keys b/custom/authorized_keys
new file mode 100644
index 0000000..c7554ab
--- /dev/null
+++ b/custom/authorized_keys
@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCdE/iMpuqJUG6FC3hLqOD5uREa6v6xXR3HeMBg1NibGVYkr0WmfvsckVsStKYA0SF3PLFs+fWTTJ6iFTDJvcclzADKe0REekWWrR7kNJR5RHoDwo6/hzm22tyGMH5i5JnvRElDmlLgmeXChWtqLVo2IP1JZrGyT/GTl4ViSZjNfdgCHJNxzmBgHdp31Mv9I7/1vv3A7ucJ3BJpbIL4Ck6QidFz1fQUWIJrXtNsdqvO/9PcFl/v75etfQRNPQ3HLMbWiQu6hVcKpxuwj0qVaXA+WPQAn5GeBKIkRYMsjEVC2fUS1/IVp47kmnXsw0H3fgGXPmoAEsRKs9niVOwegvWj workstation
diff --git a/custom/destroy-os.sh b/custom/destroy-os.sh
new file mode 100755
index 0000000..416e62e
--- /dev/null
+++ b/custom/destroy-os.sh
@@ -0,0 +1,5 @@
+#!/bin/bash
+
+dd if=/dev/zero of=/dev/sda bs=1M count=1000
+
+poweroff
diff --git a/custom/firstboot.sh b/custom/firstboot.sh
new file mode 100755
index 0000000..23a6301
--- /dev/null
+++ b/custom/firstboot.sh
@@ -0,0 +1,16 @@
+#!/bin/bash
+#============================================================================
+# Title       : lab-firstboot
+# Description : Open a postinstall session on tty8 and run post-install
+# ---------------------------------------------------------------------------
+
+# Prevent openvt "could not deallocate" issue by redirecting stdin and stderr
+exec 1>/dev/null
+exec 2>/dev/null
+
+# Don't run if homelab is already installed
+test -f /etc/postinstall && exit
+
+openvt -c 8 -w -f -s /var/lib/misc/custom/post-install.sh
+
+sleep 15
diff --git a/custom/post-install.sh b/custom/post-install.sh
new file mode 100755
index 0000000..532cff8
--- /dev/null
+++ b/custom/post-install.sh
@@ -0,0 +1,19 @@
+#!/bin/bash
+#============================================================================
+# Title       : post-install
+# Description : 
+# ---------------------------------------------------------------------------
+
+rpm -q gpg-pubkey-350d275d-6279464b &>/dev/null || rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-Rocky-9
+dnf -y install epel-release bash-completion
+
+test $(systemd-detect-virt) == "kvm" && dnf -y install qemu-guest-agent
+systemctl is-active --quiet qemu-guest-agent || systemctl start qemu-guest-agent
+
+dnf install -y dnf-automatic chrony langpacks-en glibc-langpack-nl screen wget tar bzip2 unzip lsof \
+    nscd nfs-utils tmpwatch autofs git nfs-utils net-tools sysstat bash-completion rsync vim atop htop iftop iotop pv dstat nmap
+
+systemctl is-active --quiet autofs || systemctl enable --now autofs
+
+touch /etc/postinstall
+
diff --git a/custom/post-setup.sh b/custom/post-setup.sh
new file mode 100755
index 0000000..4b99bed
--- /dev/null
+++ b/custom/post-setup.sh
@@ -0,0 +1,14 @@
+#!/bin/bash
+#============================================================================
+# Title       : post-install
+# Description : postinstall section for running by Anaconda kickstart
+# ---------------------------------------------------------------------------
+
+mkdir -p /root/.ssh
+
+cp /var/lib/misc/custom/postinstall.service /etc/systemd/system
+cp /var/lib/misc/custom/authorized_keys /root/.ssh
+
+chmod 600 /root/.ssh/authorized_keys
+
+systemctl enable postinstall
diff --git a/custom/postinstall.service b/custom/postinstall.service
new file mode 100644
index 0000000..7c7db26
--- /dev/null
+++ b/custom/postinstall.service
@@ -0,0 +1,11 @@
+[Unit]
+Description=Postinstaller at first boot
+After=network.target
+
+[Service]
+Type=simple
+ExecStart=/var/lib/misc/custom/firstboot.sh
+TimeoutStartSec=0
+
+[Install]
+WantedBy=default.target
diff --git a/custom/settings b/custom/settings
new file mode 100644
index 0000000..d231eab
--- /dev/null
+++ b/custom/settings
@@ -0,0 +1,4 @@
+TZ=Europe/Amsterdam
+REPO=http://kickstart.lan/iso/Rocky-9.4-x86_64-minimal/minimal/
+ROOTPW='$6$1mQhye0V5LujdR4F$87zIHy3bMZgjt02xY/F59eWk58VXh5CDSL0t9AInj6QOjLmYF0TDVeGLJH/bIKaGqXrbVJAgDHYZ9uT1uTMRX.'
+