diff --git a/readme.org b/readme.org
index ceba32c..8c40987 100644
--- a/readme.org
+++ b/readme.org
@@ -1,8 +1,8 @@
 #+OPTIONS: toc:nil
 * iPad Jailbreaking/Downgrading
-** iPad 1: just use 3utools to update/restore and jailbreak
+** iPad 1: just use [[http://3u.com/][3utools]] to update/restore and jailbreak
 ** iPad2,3 or iPad3,2
-*** We want to be on an untethered jailbreak, which seems to mean iOS 8.4.1. Some sources claim it is also noticably faster
+   We want to be on an untethered jailbreak, which seems to mean iOS 8.4.1. Some sources claim it is also noticably faster
 *** steps:
     1. JB with Phoenix (via https://jailbreaks.app/legacy.html or 3uTools)
     2. Follow instructions here to downgrade to 8.4.1: [[http://www.3u.com/news/articles/5841/untethered-downgrade-iphone-5-ipad234-ipad-mini-to-ios841-without-shsh][Untethered Downgrade iPhone 5/iPad 2,3,4/iPad mini to iOS 8.4.1 without SHSH]]
@@ -16,39 +16,57 @@
        - used Sideloadly on MacOS
        - daibutsu did not support iPad2,3 so EtasonJB was used
 
-** Initial Setup
-   1. ansible setup:
-      1. install "openssh" and "apt 0.7 strict" via cydia
-      2. ssh with =ssh -o PubkeyAuthentication=no mobile@iPad=, password =alpine=
-      4. =su= to root (also password =alpine=)
-      3. change passwords for mobile and root users
-      5. =apt-get install sudo python vim=
-      6. edit =/etc/sudoers= to allow =wheel=
-      7. edit =/etc/group= to add mobile to =wheel=
-   2. install [[https://cydia.akemi.ai/?page/net.angelxwind.mikoto][mikoto]] to disable OTA update notifications (and some other things)
+* Initial Setup
+  1. install "openssh" and "apt 0.7 strict" via cydia
+  2. ssh with =ssh -o PubkeyAuthentication=no mobile@iPad=, password =alpine=
+  3. =su= to root (also password =alpine=)
+  4. change passwords for mobile and root users
+  5. =apt-get install sudo vim=
+  6. edit =/etc/sudoers= to allow =wheel=
+  7. edit =/etc/group= to add mobile to =wheel=
+  8. run =initial-setup.yml= playbook
+     - sets up ssh pubkey auth
+     - installs Python 2.7, needed for most ansible commands (retrieved from https://github.com/linusyang/python-for-ios/releases)
+  9. run =ipads.yml= playbook
+     - installs [[https://cydia.akemi.ai/?page/net.angelxwind.mikoto][mikoto]] to disable OTA update notifications (and some other things)
+     - installs libactivator
+     - installs =Maximization= (=be.rud0lf77.maximization=) for fullscreen/status bar hide
+     - makes a webclip for https://reservations.claremontmakerspace.org, with tools defined in =hosts= file
 
-* ansible
-** Python 2.7 availible from https://github.com/linusyang/python-for-ios/releases
-
-* Fullscreen/status bar hide:
-  - =Maximization= (=be.rud0lf77.maximization=) seems to work fine on iPad 1/2/3 and doesn't need to be applied manually
-  - =Monocle= (=com.rpetrich.monocle=) works on iPad 2/3, but not iPad 1
-
-* iPad lock/unlock via activator
-  #+begin_src bash
-    activator send libactivator.system.sleepbutton # lock
-    activator send libactivator.lockscreen.dismiss # unlock
-  #+end_src
-
-* Editing preferences:
-  can use plutil from http://repo.bingner.com/ to convert from/to binary plist
-  to restart the preferences daemon after editing a plist:
+* Other notes
+** iPad lock/unlock via activator
    #+begin_src bash
-     launchctl kickstart -k system/com.apple.cfprefsd.xpc.daemon
+     activator send libactivator.system.sleepbutton # lock
+     activator send libactivator.lockscreen.dismiss # unlock
    #+end_src
+   - Use Activator to schedule
+     - might just be easier to config manually
+     - activator config is in =/private/var/mobile/Library/Caches/libactivator.plist=
+     - can't do =LAScheduledEvents= events via =activator set=
 
-* making a webclip:
-** ~/Library/WebClips/whatever.webclip
-   can place an Info.plist and icon then respring and it kind of just works
-   - Can launch with =activator send com.apple.webapp= maybe?
+** Fullscreen/status bar hide
+   - =Maximization= (=be.rud0lf77.maximization=) seems to work fine on iPad 1/2/3 and doesn't need to be applied manually
+   - =Monocle= (=com.rpetrich.monocle=) works on iPad 2/3, but not iPad 1
+
+** Editing preferences
+   - can use plutil from http://repo.bingner.com/ to convert from/to binary plist
+   - to restart the preferences daemon after editing a plist:
+     #+begin_src bash
+       launchctl kickstart -k system/com.apple.cfprefsd.xpc.daemon
+     #+end_src
+
+** Making a webclip
+   - can place an Info.plist and icon into =~/Library/WebClips/<whatever>.webclip= then respring and it kind of just works
+   - can launch with =activator send com.apple.webapp= maybe?
      - only seems to work when it is already running (ie to switch to it, not launch it)
+
+** Kiosk mode
+   - in iOS >=6, just use guided access
+   - in iOS <=7, maybe use IncarcerApp
+
+** Let's Encrypt certificates
+   - Can install cert PEM via gui, probably too much of a pain to automate it
+     - profile installed as =/User/Library/ConfigurationProfiles/<something>.stub=
+     - enabled in =/User/Library/ConfigurationProfiles/PayloadManifest.plist=
+     - cert also enabled/trusted somewhere else?
+   - seems like it will only install one cert per pem, so install ISRG root cert