--- /dev/null
+# If you change this file, run 'update-grub' afterwards to update
+# /boot/grub/grub.cfg.
+# For full documentation of the options in this file, see:
+#   info -f grub -n 'Simple configuration'
+
+GRUB_DEFAULT=0
+GRUB_TIMEOUT=5
+GRUB_DISTRIBUTOR=`lsb_release -i -s 2> /dev/null || echo Debian`
+GRUB_CMDLINE_LINUX_DEFAULT="quiet  nvidia.NVreg_OpenRmEnableUnsupportedGpus=1"
+GRUB_CMDLINE_LINUX=""
+
+# Uncomment to enable BadRAM filtering, modify to suit your needs
+# This works with Linux (no patch required) and with any kernel that obtains
+# the memory map information from GRUB (GNU Mach, kernel of FreeBSD ...)
+#GRUB_BADRAM="0x01234567,0xfefefefe,0x89abcdef,0xefefefef"
+
+# Uncomment to disable graphical terminal (grub-pc only)
+#GRUB_TERMINAL=console
+
+# The resolution used on graphical terminal
+# note that you can use only modes which your graphic card supports via VBE
+# you can see them in real GRUB with the command `vbeinfo'
+#GRUB_GFXMODE=640x480
+
+# Uncomment if you don't want GRUB to pass "root=UUID=xxx" parameter to Linux
+#GRUB_DISABLE_LINUX_UUID=true
+
+# Uncomment to disable generation of recovery mode menu entries
+#GRUB_DISABLE_RECOVERY="true"
+
+# Uncomment to get a beep at grub start
+#GRUB_INIT_TUNE="480 440 1"
 
--- /dev/null
+#!/bin/sh
+set -e
+debian_version="bookworm"
+legal_system_names="x220 w530"
+
+if [ "$#" -ne 1 ]; then
+    echo 'Need exactly one argument (system name).'
+    false
+fi
+found=0
+for system_name_i in $legal_system_names; do
+    if [ "$1" = "$system_name_i" ]; then
+        found=1
+        system_name="${system_name_i}"
+        continue       
+    fi
+done
+if [ "$found" = 0 ]; then
+    echo "Need legal system name."
+    false
+fi
+system_name="$1"
+
+# config_tree_prefix="${public_repos_dir}/config/${debian_version}"
+git clone https://plomlompom.com/repos/clone/config
+./copy_dirtree.sh "${config_tree_prefix}/home_files" "${HOME}" minimal user "${system_name}"
+
+# public_repos_dir="${HOME}/public_repos"
+# config_tree_prefix="${public_repos_dir}/config/${debian_version}"
+# # path_borgscript="${config_tree_prefix}//borg.sh"
+# setup_scripts_dir="${config_tree_prefix}/setup_scripts"
+# repos_list_file="${public_repos_dir}/repos"
+# # dir_secrets="${HOME}/tmp_secrets"
+# # borgkeys_dir=~/.config/borg/keys
+# # borgrepos_file=~/.borgrepos
+# ssh_dir=~/.ssh
+# # authinfo_file=.authinfo
+# maildir=~/mail/maildir
+# 
+# ensure_repo() {
+#     repo_name="${1}"
+#     if [ ! -d "${public_repos_dir}/${repo_name}" ]; then
+#         cd "${public_repos_dir}"
+#         git clone plom@plomlompom.com:/var/repos/${repo_name}
+#     fi
+# }
+# 
+# # Set up iniitial non-public parts of infrastructure: SSH authentication.
+# cd "${dir_secrets}"
+# mkdir -p "${ssh_dir}"
+# echo "Setting up .ssh"
+# cp id_rsa ~/.ssh
+# stty -echo
+# ssh-keygen -y -f ~/.ssh/id_rsa > ~/.ssh/id_rsa.pub
+# stty echo
+# eval $(ssh-agent)
+# ssh-add
+# ssh-keyscan -H "plomlompom.com" >> ~/.ssh/known_hosts
+# 
+# # Clone config to copy dotfiles etc. from it.
+# cd
+# mkdir -p "${public_repos_dir}"
+# ensure_repo config
+# cd "${setup_scripts_dir}"
+# ./copy_dirtree.sh "${config_tree_prefix}/home_files" "${HOME}" minimal user "${system_name}"
+# 
+# # Set up native messenger for tridactyl.
+# version='ef9f02d0da258f68d7faf8898707f6d83d90d07a'
+# curl -fsSl "https://raw.githubusercontent.com/tridactyl/tridactyl/${version}/native/install.sh" | bash
+# 
+# # Set up further non-public parts of infrastructure.
+# cd "${dir_secrets}"
+# script -c 'gpg --import secret_keys.asc' /dev/null
+# tar xf borg_keyfiles.tar
+# mkdir -p "${borgkeys_dir}"
+# mv borg_keyfiles/* "${borgkeys_dir}"
+# # .authinfo may not be present on every secrets drive yet
+# if [ -f "${authinfo_file}" ]; then
+#     cp "${authinfo_file}" ~
+# fi
+# cd
+# rm -rf "${dir_secrets}"
+# 
+# # Sync org dir via borgbackup. For this we need the borgbackup servers
+# # in our .ssh/known_hosts file.
+# cat "${borgrepos_file}" | while read line; do
+#     first_char=$(echo "${line}" | cut -c1)
+#     if [ "${first_char}" = "#" ]; then
+#         continue
+#     fi
+#     server=$(echo "${line}" | sed 's/.*@//')
+#     ssh-keyscan "${server}" >> "${ssh_dir}"/known_hosts
+# done
+# BORG_PASSPHRASE="${SECRETS_PASS}" "${path_borgscript}" orgpull
+# 
+# # Fill ~/public_repos.
+# cat "${repos_list_file}" | while read line; do
+#     first_char=$(echo "${line}" | cut -c1)
+#     if [ "${first_char}" = "#" ]; then
+#         continue
+#     fi
+#     ensure_repo "${line}"
+# done
+# 
+# # Set up e-mail system. Note that we only do mbsync if the imap pass file
+# # is found. It may not be present on every secrets drive yet, so we have to
+# # deal with the possibility of it being absent at this point.
+# mkdir -p "${maildir}"  # expected by mbsync/isync
+# if [ -f "${HOME}/${authinfo_file}" ]; then
+#     mbsync -a
+#     notmuch new
+# fi
+# 
+# # # Final note on how to integrate tridactyl.
+# # echo "TODO: As tridactyl user, don't forget to do :source on the first Firefox run, wait a little while (Tridactyl needs to walk through all commands in the .tridactylrc) and then re-start."