diff --git a/installer/http-get.sh b/installer/http-get.sh
new file mode 100644
index 0000000..6e05247
--- /dev/null
+++ b/installer/http-get.sh
@@ -0,0 +1,48 @@
+###############################
+#                             #
+#         http_get            #
+# boilerplate for curl / wget #
+#                             #
+###############################
+
+# See https://git.daplie.com/Daplie/daplie-snippets/blob/master/bash/http-get.sh
+
+_h_http_get=""
+_h_http_opts=""
+_h_http_out=""
+
+detect_http_get()
+{
+  set +e
+  if type -p curl >/dev/null 2>&1; then
+    _h_http_get="curl"
+    _h_http_opts="-fsSL"
+    _h_http_out="-o"
+  elif type -p wget >/dev/null 2>&1; then
+    _h_http_get="wget"
+    _h_http_opts="--quiet"
+    _h_http_out="-O"
+  else
+    echo "Aborted, could not find curl or wget"
+    return 7
+  fi
+  set -e
+}
+
+http_get()
+{
+  $_h_http_get $_h_http_opts $_h_http_out "$2" "$1"
+  touch "$2"
+}
+
+http_bash()
+{
+  _http_url=$1
+  #dap_args=$2
+  rm -rf dap-tmp-runner.sh
+  $_h_http_get $_h_http_opts $_h_http_out dap-tmp-runner.sh "$_http_url"; bash dap-tmp-runner.sh; rm dap-tmp-runner.sh
+}
+
+detect_http_get
+
+## END HTTP_GET ##
diff --git a/installer/install-for-launchd.sh b/installer/install-for-launchd.sh
new file mode 100644
index 0000000..2079b16
--- /dev/null
+++ b/installer/install-for-launchd.sh
@@ -0,0 +1,17 @@
+set -u
+
+my_app_launchd_service="Library/LaunchDaemons/${my_app_pkg_name}.plist"
+
+echo ""
+echo "Installing as launchd service"
+echo ""
+
+# See http://www.launchd.info/
+safe_copy_config "$my_app_dist/$my_app_launchd_service" "$my_root/$my_app_launchd_service"
+
+$sudo_cmd chown root:wheel "$my_root/$my_app_launchd_service"
+
+$sudo_cmd launchctl unload -w "$my_root/$my_app_launchd_service" >/dev/null 2>/dev/null
+$sudo_cmd launchctl load -w "$my_root/$my_app_launchd_service"
+
+echo "$my_app_name started with launchd"
diff --git a/installer/install-for-systemd.sh b/installer/install-for-systemd.sh
new file mode 100644
index 0000000..e2c5028
--- /dev/null
+++ b/installer/install-for-systemd.sh
@@ -0,0 +1,23 @@
+set -u
+
+my_app_systemd_service="etc/systemd/system/${my_app_name}.service"
+my_app_systemd_tmpfiles="etc/tmpfiles.d/${my_app_name}.conf"
+
+echo ""
+echo "Installing as systemd service"
+echo ""
+
+sed "s/MY_USER/$my_user/g" "$my_app_dist/$my_app_systemd_service" > "$my_app_dist/$my_app_systemd_service.2"
+sed "s/MY_GROUP/$my_group/g" "$my_app_dist/$my_app_systemd_service.2" > "$my_app_dist/$my_app_systemd_service"
+rm "$my_app_dist/$my_app_systemd_service.2"
+safe_copy_config "$my_app_dist/$my_app_systemd_service" "$my_root/$my_app_systemd_service"
+safe_copy_config "$my_app_dist/$my_app_systemd_tmpfiles" "$my_root/$my_app_systemd_tmpfiles"
+
+$sudo_cmd systemctl stop "${my_app_name}.service" >/dev/null 2>/dev/null
+$sudo_cmd systemctl daemon-reload
+$sudo_cmd systemctl start "${my_app_name}.service"
+$sudo_cmd systemctl enable "${my_app_name}.service"
+
+echo "$my_app_name started with systemctl, check its status like so:"
+echo "  $sudo_cmd systemctl status $my_app_name"
+echo "  $sudo_cmd journalctl -xe -u $my_app_name"
diff --git a/installer/install-system-service.sh b/installer/install-system-service.sh
new file mode 100644
index 0000000..a0af5d0
--- /dev/null
+++ b/installer/install-system-service.sh
@@ -0,0 +1,37 @@
+safe_copy_config()
+{
+  src=$1
+  dst=$2
+  $sudo_cmd mkdir -p $(dirname "$dst")
+  if [ -f "$dst" ]; then
+    $sudo_cmd rsync -a "$src" "$dst.latest"
+    # TODO edit config file with $my_user and $my_group
+    if [ "$(cat $dst)" == "$(cat $dst.latest)" ]; then
+      $sudo_cmd rm $dst.latest
+    else
+      echo "MANUAL INTERVENTION REQUIRED: check the systemd script update and manually decide what you want to do"
+      echo "diff $dst $dst.latest"
+      $sudo_cmd chown -R root:root "$dst.latest"
+    fi
+  else
+    $sudo_cmd rsync -a --ignore-existing "$src" "$dst"
+  fi
+  $sudo_cmd chown -R root:root "$dst"
+  $sudo_cmd chmod 644 "$dst"
+}
+
+installable=""
+if [ -d "$my_root/etc/systemd/system" ]; then
+  source ./installer/install-for-systemd.sh
+  installable="true"
+fi
+if [ -d "/Library/LaunchDaemons" ]; then
+  source ./installer/install-for-launchd.sh
+  installable="true"
+fi
+if [ -z "$installable" ]; then
+  echo ""
+  echo "Unknown system service init type. You must install as a system service manually."
+  echo '(please file a bug with the output of "uname -a")'
+  echo ""
+fi
diff --git a/installer/install.sh b/installer/install.sh
new file mode 100644
index 0000000..bc7e635
--- /dev/null
+++ b/installer/install.sh
@@ -0,0 +1,178 @@
+#!/bin/bash
+
+set -e
+set -u
+
+### IMPORTANT ###
+###  VERSION  ###
+#my_app_ver="v1.1"
+my_app_ver="installer-v2"
+my_launchpad_ver="v1.2"
+my_azp_oauth3_ver="v1.1.3"
+my_iss_oauth3_rest_ver="v1.2.0"
+my_iss_oauth3_pages_ver="v1.2.1"
+my_www_daplie_ver=v1.0.15
+export NODE_VERSION="v8.9.0"
+#################
+export NODE_PATH=$my_tmp/opt/$my_app_name/lib/node_modules
+export PATH=$PATH:$my_tmp/opt/$my_app_name/bin/
+export NPM_CONFIG_PREFIX=$my_tmp/opt/$my_app_name
+my_npm="$NPM_CONFIG_PREFIX/bin/npm"
+#################
+
+
+
+my_app_name=walnut
+my_app_pkg_name=com.daplie.walnut.web
+my_tmp=$(mktemp -d)
+my_app_dir=$my_tmp
+# TODO un-hardcode core at al
+#my_app_dist=$my_tmp/opt/$my_app_name/lib/node_modules/$my_app_name/dist
+my_app_dist=$my_tmp/opt/$my_app_name/core/dist
+git_base="https://git.daplie.com/Daplie/walnut.js.git"
+installer_base="https://git.daplie.com/Daplie/walnut.js/raw/$my_app_ver"
+
+
+
+#
+# Install to tmp location, then move to /opt
+#
+echo "Installing to $my_tmp (will be moved after install)"
+#mkdir -p $my_tmp/opt/$my_app_name/lib/node_modules/$my_app_name
+mkdir -p $my_tmp/opt/walnut/lib/node_modules/$my_app_name
+#git clone $git_base $my_tmp/opt/$my_app_name/lib/node_modules/$my_app_name
+git clone $git_base $my_tmp/opt/$my_app_name/core
+#pushd $my_tmp/opt/$my_app_name/lib/node_modules/$my_app_name
+pushd $my_tmp/opt/$my_app_name/core
+  git checkout $my_app_ver
+
+  ln -s ../core/$my_app_name/bin/$my_app_name.js $my_tmp/opt/$my_app_name/bin/$my_app_name
+  ln -s ../core/$my_app_name/bin/$my_app_name.js $my_tmp/opt/$my_app_name/bin/$my_app_name.js
+  mkdir -p "$my_tmp/opt/$my_app_name"/{bin,config,core,etc,lib,node_modules,var}
+  #ln -s ../lib/node_modules/$my_app_name/bin/$my_app_name.js $my_tmp/opt/$my_app_name/bin/$my_app_name
+  #ln -s ../lib/node_modules/$my_app_name/bin/$my_app_name.js $my_tmp/opt/$my_app_name/bin/$my_app_name.js
+  mkdir -p "$my_tmp/opt/$my_app_name"/packages/{api,pages,rest,services}
+  mkdir -p "$my_tmp/opt/$my_app_name"/etc/client-api-grants
+  # TODO move packages and sites to /srv, grants to /etc
+  ln -s ../etc/client-api-grants "$my_tmp/opt/$my_app_name"/packages/client-api-grants
+  mkdir -p "$my_tmp/opt/$my_app_name"/var/sites
+  ln -s ../var/sites "$my_tmp/opt/$my_app_name"/packages/sites
+  mkdir -p "$my_tmp/etc/$my_app_name"
+  chmod 775 "$my_tmp/etc/$my_app_name"
+  cat "$my_app_dist/etc/$my_app_name/$my_app_name.example.yml" > "$my_tmp/etc/$my_app_name/$my_app_name.example.yml"
+  chmod 664 "$my_tmp/etc/$my_app_name/$my_app_name.example.yml"
+  mkdir -p $my_tmp/var/log/$my_app_name
+
+
+
+  #
+  # Helpers
+  #
+  installer_prefix="."
+  source ./$installer_prefix/sudo-cmd.sh
+  source ./$installer_prefix/http-get.sh
+
+
+
+  #
+  # Dependencies
+  #
+  echo $NODE_VERSION > /tmp/NODEJS_VER
+  # This will read the NODE_* and PATH variables set previously, as well as /tmp/NODEJS_VER
+  http_bash "https://git.coolaj86.com/coolaj86/node-installer.sh/raw/v1.1/install.sh"
+  $my_npm install -g npm@4
+  $my_npm install -g bower
+  touch $my_tmp/opt/$my_app_name/.bowerrc
+  echo '{ "allow_root": true }' > $my_tmp/opt/$my_app_name/.bowerrc
+
+  #pushd $my_tmp/opt/$my_app_name/lib/node_modules/$my_app_name
+  pushd $my_tmp/opt/$my_app_name/core
+    mkdir -p ../node_modules
+    ln -s ../node_modules node_modules
+    $my_npm install
+  popd
+
+  pushd $my_tmp/opt/$my_app_name/core/lib/walnut@daplie.com/setup
+    git pull
+    git checkout $my_launchpad_ver
+
+    git clone https://git.daplie.com/OAuth3/oauth3.js.git ./assets/oauth3.org
+    pushd assets/oauth3.org
+      git checkout $my_azp_oauth3_ver
+    popd
+  popd
+
+  pushd $my_tmp/opt/$my_app_name/packages
+    git clone https://git.daplie.com/OAuth3/issuer_oauth3.org.git rest/issuer@oauth3.org
+    pushd rest/issuer@oauth3.org/
+        git checkout $my_iss_oauth3_rest_ver
+        $my_npm install
+    popd
+
+    git clone https://git.daplie.com/OAuth3/org.oauth3.git pages/issuer@oauth3.org
+    pushd pages/issuer@oauth3.org
+      git checkout $my_iss_oauth3_pages_ver
+      bash ./install.sh
+
+      pushd ./assets/oauth3.org
+        git checkout $my_azp_oauth3_ver
+      popd
+    popd
+
+    git clone https://git.daplie.com/Daplie/walnut_rest_www_daplie.com.git rest/www@daplie.com
+    pushd rest/www@daplie.com
+      git checkout $my_www_daplie_ver
+      $my_npm install
+    popd
+  popd
+
+
+
+  #
+  # System Service
+  #
+  source ./$installer_prefix/my-root.sh
+  echo "Pre-installation to $my_tmp complete, now installing to $my_root/ ..."
+  set +e
+  if type -p tree >/dev/null 2>/dev/null; then
+    #tree -I "node_modules|include|share" $my_tmp
+    tree -L 6 -I "include|share|npm" $my_tmp
+  else
+    ls $my_tmp
+  fi
+  set -e
+
+  source ./$installer_prefix/my-user-my-group.sh
+  echo "User $my_user Group $my_group"
+
+  $sudo_cmd chown -R $my_user:$my_group $my_tmp
+  rsync -a $my_tmp/ $my_root/
+  rsync -a --ignore-existing $my_app_dist/etc/$my_app_name/$my_app_name.yml $my_root/etc/$my_app_name/$my_app_name.yml
+  source ./$installer_prefix/install-system-service.sh
+
+  # Change to admin perms
+  $sudo_cmd chown -R $my_user:$my_group $my_root/opt/$my_app_name
+  $sudo_cmd chown -R $my_user:$my_group $my_root/var/www $my_root/srv/www
+
+  # make sure the files are all read/write for the owner and group, and then set
+  # the setuid and setgid bits so that any files/directories created inside these
+  # directories have the same owner and group.
+  $sudo_cmd chmod -R ug+rwX /opt/$my_app_name
+  find /opt/$my_app_name -type d -exec $sudo_cmd chmod ug+s {} \;
+popd
+
+
+rm -rf $my_tmp
+
+echo ""
+echo "You must have some set of domain set up to properly use goldilocks+walnut:"
+echo ""
+echo "  example.com"
+echo "  www.example.com"
+echo "  api.example.com"
+echo "  assets.example.com"
+echo "  cloud.example.com"
+echo "  api.cloud.example.com"
+echo ""
+echo "Check the WALNUT README.md for more info and how to set up /etc/goldilocks/goldilocks.yml"
+echo ""
diff --git a/installer/my-root.sh b/installer/my-root.sh
new file mode 100644
index 0000000..6fec42f
--- /dev/null
+++ b/installer/my-root.sh
@@ -0,0 +1,8 @@
+# something or other about android and tmux using PREFIX
+#: "${PREFIX:=''}"
+my_root=""
+if [ -z "${PREFIX-}" ]; then
+  my_root=""
+else
+  my_root="$PREFIX"
+fi
diff --git a/installer/my-user-my-group.sh b/installer/my-user-my-group.sh
new file mode 100644
index 0000000..82282a3
--- /dev/null
+++ b/installer/my-user-my-group.sh
@@ -0,0 +1,19 @@
+if type -p adduser >/dev/null 2>/dev/null; then
+  if [ -z "$(cat $my_root/etc/passwd | grep $my_app_name)" ]; then
+    $sudo_cmd adduser --home $my_root/opt/$my_app_name --gecos '' --disabled-password $my_app_name
+  fi
+  my_user=$my_app_name
+  my_group=$my_app_name
+elif [ -n "$(cat /etc/passwd | grep www-data:)" ]; then
+  # Linux (Ubuntu)
+  my_user=www-data
+  my_group=www-data
+elif [ -n "$(cat /etc/passwd | grep _www:)" ]; then
+  # Mac
+  my_user=_www
+  my_group=_www
+else
+  # Unsure
+  my_user=$(whoami)
+  my_group=$(id -g -n)
+fi
diff --git a/installer/sudo-cmd.sh b/installer/sudo-cmd.sh
new file mode 100644
index 0000000..b6b3ff8
--- /dev/null
+++ b/installer/sudo-cmd.sh
@@ -0,0 +1,7 @@
+# Not every platform has or needs sudo, gotta save them O(1)s...
+sudo_cmd=""
+set +e
+if type -p sudo >/dev/null 2>/dev/null; then
+  ((EUID)) && [[ -z "${ANDROID_ROOT-}" ]] && sudo_cmd="sudo"
+fi
+set -e