diff --git a/install-encrypted.sh b/install-encrypted.sh
new file mode 100755
index 00000000..e044cd56
--- /dev/null
+++ b/install-encrypted.sh
@@ -0,0 +1,121 @@
+# Setup
+# Presumes pre-formatted harddrives 
+BOOT=/dev/sda1
+DISK=/dev/sda2
+
+dd if=/dev/urandom of=./keyfile0.bin bs=1024 count=4
+dd if=/dev/urandom of=./keyfile1.bin bs=1024 count=4
+
+echo "Creating LUKS partitions..."
+# Enter the passphrase which is used to unlock disk. You will enter this in grub on every boot
+cryptsetup luksFormat --type luks1 -c aes-xts-plain64 -s 256 -h sha512 $DISK
+# Add a second key which will be used by nixos. You will need to enter the pasphrase from previous step
+cryptsetup luksAddKey $DISK keyfile0.bin
+cryptsetup luksOpen $DISK crypted-nixos -d keyfile0.bin
+
+# Create the LVM
+echo "Creating LVM partitions..."
+pvcreate /dev/mapper/crypted-nixos
+vgcreate vg /dev/mapper/crypted-nixos
+lvcreate -L 4G -n swap vg
+lvcreate -l '100%FREE' -n root vg
+
+# Format the disks
+echo "Formatting disks..."
+mkfs.fat -F 32 $BOOT
+mkswap -L swap /dev/vg/swap
+mkfs.ext4 -L root /dev/vg/root
+# mkfs.ext4 -L data /dev/mapper/crypted-data
+
+echo "Mounting drives..."
+mount /dev/vg/root /mnt
+mkdir -p /mnt/boot/efi
+mount $BOOT /mnt/boot/efi
+swapon /dev/vg/swap
+
+# Copy the keys
+
+mkdir -p /mnt/etc/secrets/initrd/
+cp keyfile0.bin keyfile1.bin /mnt/etc/secrets/initrd
+chmod 000 /mnt/etc/secrets/initrd/keyfile*.bin
+
+# Generate and edit configuration
+
+echo "Generating NixOS config..."
+nixos-generate-config --root /mnt
+
+# TODO:  neds to get the uuid of each of the disks 
+# UUID=$(blkid) 
+echo "Extending NixOS config..."
+cat >> /mnt/etc/nixos/configuration.nix <<'endmsg'
+  boot.loader.efi.canTouchEfiVariables = true;
+  boot.loader.efi.efiSysMountPoint = "/boot/efi";
+  boot.loader.grub = {
+    enable = true;
+    device = "nodev";
+    version = 2;
+    efiSupport = true;
+    enableCryptodisk = true;
+  };
+  
+  boot.initrd = {
+    luks.devices."root" = {
+			# UPDATE ME
+      device = "/dev/disk/by-uuid/a8b302cf-5296-4a2e-a7ba-707e6fa75123"; # UUID for /dev/nvme01np2 
+      preLVM = true;
+      keyFile = "/keyfile0.bin";
+      allowDiscards = true;
+    };
+    secrets = {
+      # Create /mnt/etc/secrets/initrd directory and copy keys to it
+      "keyfile0.bin" = "/etc/secrets/initrd/keyfile0.bin";
+      "keyfile1.bin" = "/etc/secrets/initrd/keyfile1.bin";
+    };
+	};
+
+  # Data mount
+	# This is all wrong for box for now
+  # fileSystems."/data" = {
+  #   device = "/dev/disk/by-uuid/79630267-5766-4c7d-85a5-1d5f1dcd58ad"; # UUID for /dev/mapper/crypted-data
+  #   encrypted = {
+  #     enable = true;
+  #     label = "crypted-data";
+  #     blkDev = "/dev/disk/by-uuid/3476cb09-b3c4-4301-9ec9-84f60f32828a"; # UUID for /dev/sda1
+  #     keyFile = "/keyfile1.bin";
+  #   };
+  # };
+
+  time.timeZone = "Australia/Brisbane";
+
+  networking.useDHCP = false;
+
+  nix = {
+    package = pkgs.nixUnstable;
+    extraOptions = ''
+      experimental-features = nix-command flakes
+    '';
+  };
+
+  users.users.anish = {
+    isNormalUser = true;
+    hashedPassword = "MVHHpy9gbe3ow";
+    extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
+    openssh.authorizedKeys.keys = [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDM0Zvei46x/yZl/IeBCq6+IYQQ0avulzVyBysF9cPigZMCybWRV7IEU+E3k9t6JrbdbdGfJkcZIWmsWDdKS8W8mBnZpVoT0ffLynu8JQ/TKdGm4Qv6bgUeKNrGsNv0ZPs2CDaGSLj0oJfRF7Ko10tcLP0vW+yujrh+y6TH/vVzJioaV4TGvtCUpn+wEQah9ROwPQLUUofsSWdnRsDJ/gp37zXWs4l5wyjSKtP3O9RZUP7kBekbSqEgSXiTk0oUQSVqIWl9NDiP6onk/gSOjXsR/JPqsSN/XI/c/yj6gyY0f51Ru2D7iBxuMJIJcWV+rU6coIj+ULcQWLzt/7TI8jq5AOOzI/ll4zbL24Eo84Rz+TP9tvMMhDZ0VaMN22AJ8qQEjc5P09tWKsX7Jg39XelyV1jHXncE4yvIE9F4RSCHzWCeKeXakizQNuzSaxTxIExRFYHjNW5bR6+3MTGwVrEIXU+qML+0yFTR86MT+tdY5AreAJQLwbog79O1NupeXJE= anish@curve" ];
+  };
+  security.sudo.wheelNeedsPassword = false; # needed for deploy-rs
+
+  services.openssh.enable = true;
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "21.05"; # Did you read the comment?
+}
+
+endmsg
+
+
+# sudo nixos-install
diff --git a/install-yubikey.sh b/install-yubikey.sh
new file mode 100755
index 00000000..2ddac5b9
--- /dev/null
+++ b/install-yubikey.sh
@@ -0,0 +1,172 @@
+rbtohex() {
+    ( od -An -vtx1 | tr -d ' \n' )
+}
+
+hextorb() {
+    ( tr '[:lower:]' '[:upper:]' | sed -e 's/\([0-9A-F]\{2\}\)/\\\\\\x\1/gI'| xargs printf )
+}
+
+# Setup
+# nix-env -i gcc-wrapper
+# nix-env -i yubikey-personalization
+# nix-env -i openssl
+# Use nix-shell https://github.com/sgillespie/nixos-yubikey-luks/archive/master.tar.gz
+
+# Compile correct version of OpenSSL key derivation
+cc -O3 -I$(nix-build "<nixpkgs>" --no-build-output -A openssl.dev)/include -L$(nix-build "<nixpkgs>" --no-build-output -A openssl.out)/lib $(nix eval "(with import <nixpkgs> {}; pkgs.path)")/nixos/modules/system/boot/pbkdf2-sha512.c -o ./pbkdf2-sha512 -lcrypto
+
+# Yubikey Setup
+SLOT=2
+ykpersonalize -"$SLOT" -ochal-resp -ochal-hmac
+SALT_LENGTH=16
+salt="$(dd if=/dev/random bs=1 count=$SALT_LENGTH 2>/dev/null | rbtohex)"
+k_user=PASSWORDCHANGEMEPLAEASES 
+challenge="$(echo -n $salt | openssl dgst -binary -sha512 | rbtohex)"
+response="$(ykchalresp -2 -x $challenge 2>/dev/null)"
+
+# Setup LUKS device
+KEY_LENGTH=512
+ITERATIONS=1000000
+k_luks="$(echo -n $k_user | ./pbkdf2-sha512 $(($KEY_LENGTH / 8)) $ITERATIONS $response | rbtohex)"
+
+EFI_PART=/dev/sda1
+LUKS_PART=/dev/sda2
+EFI_MNT=/boot/
+mkdir -p "$EFI_MNT"
+mkfs.fat -F 32 -n boot "$EFI_PART"
+mount "$EFI_PART" "$EFI_MNT"
+STORAGE=/crypt-storage/default
+mkdir -p "$(dirname $EFI_MNT$STORAGE)"
+echo -ne "$salt\n$ITERATIONS" > $EFI_MNT$STORAGE
+CIPHER=aes-xts-plain64
+HASH=sha512
+echo -n "$k_luks" | hextorb | cryptsetup luksFormat --cipher="$CIPHER" --key-size="$KEY_LENGTH" --hash="$HASH" --key-file=- "$LUKS_PART"
+umount "$EFI_MNT"
+
+# LVM Setup
+LUKSROOT=crypthome
+echo -n "$k_luks" | hextorb | cryptsetup luksOpen $LUKS_PART $LUKSROOT --key-file=- 
+pvcreate "/dev/mapper/$LUKSROOT"
+VGNAME=partitions
+vgcreate "$VGNAME" "/dev/mapper/$LUKSROOT"
+lvcreate -L 2G -n swap "$VGNAME"
+FSROOT=fsroot
+lvcreate -l 100%FREE -n "$FSROOT" "$VGNAME"
+
+vgchange -ay
+mkswap -L swap /dev/partitions/swap
+
+# BTRFS Setup
+mkfs.btrfs -L "$FSROOT" "/dev/partitions/$FSROOT"
+
+# incase the above breaks
+#mkdir /mnt-root
+#touch /mnt-root/nix-store.squashfs
+
+mount "/dev/partitions/$FSROOT" /mnt
+cd /mnt
+btrfs subvolume create root
+btrfs subvolume create home
+cd
+umount /mnt
+mount -o subvol=root "/dev/partitions/$FSROOT" /mnt
+mkdir /mnt/home
+mount -o subvol=home "/dev/partitions/$FSROOT" /mnt/home
+mkdir /mnt/boot
+mount "$EFI_PART" /mnt/boot
+
+swapon /dev/partitions/swap
+
+# Install NixOS
+nixos-generate-config --root /mnt
+
+# Change the config
+cat > /mnt/etc/nixos/configuration.nix <<'endmsg'
+{ config, pkgs, ... }:
+
+{
+  imports =
+    [ # Include the results of the hardware scan.
+      ./hardware-configuration.nix
+    ];
+
+  boot.loader.grub.enable = true;
+  boot.loader.grub.version = 2;
+  # Define on which hard drive you want to install Grub.
+  boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
+
+  # Minimal list of modules to use the EFI system partition and the YubiKey
+  boot.initrd.kernelModules = [ "vfat" "nls_cp437" "nls_iso8859-1" "usbhid" ];
+  
+  # Enable support for the YubiKey PBA
+  boot.initrd.luks.yubikeySupport = true;
+  
+  # Configuration to use your Luks device
+  boot.initrd.luks.devices = {
+    "crypthome" = {
+      device = "/dev/sda2";
+      preLVM = true; # You may want to set this to false if you need to start a network service first
+      yubikey = {
+        slot = 2;
+        twoFactor = true; # Set to false if you did not set up a user password.
+        storage = {
+          device = "/dev/sda1";
+        };
+      };
+    }; 
+  };
+
+  # Enable Flakes
+  nix = {
+    package = pkgs.nixUnstable;
+    extraOptions = ''
+      experimental-features = nix-command flakes
+    '';
+   };
+
+  networking.hostName = "curve"; # Define your hostname.
+  networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
+
+  time.timeZone = "Australia/Brisbane";
+
+  networking.useDHCP = false;
+  networking.interfaces.enp0s31f6.useDHCP = true;
+  networking.interfaces.wlp3s0.useDHCP = true;
+
+  # Select internationalisation properties.
+  i18n.defaultLocale = "en_US.UTF-8";
+  # console = {
+  #   font = "Lat2-Terminus16";
+  #   keyMap = "us";
+  # };
+
+  services.xserver.layout = "us,dvorak";
+
+  sound.enable = true;
+  hardware.pulseaudio.enable = true;
+
+  services.xserver.libinput.enable = true;
+
+  # Hmmm maybe somewhere else? 
+  users.users.anish = {
+    isNormalUser = true;
+    extraGroups = [ "wheel" ]; 
+  };
+
+  # Enable the OpenSSH daemon.
+  # services.openssh.enable = true;
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "21.05"; # Did you read the comment?
+}
+
+endmsg
+
+cd /mnt
+nixos-install --root /mnt
+passwd