diff --git a/.pct-helpers b/.pct-helpers
index eef57cd..eda67a0 100644
--- a/.pct-helpers
+++ b/.pct-helpers
@@ -179,6 +179,24 @@ xread(){
 		&& echo "$2=${!2}"
 }
 
+#
+#	xreadpass VAR
+#
+xreadpass(){
+	local PASS1
+	local PASS2
+	read -sep "password (Enter to skip): " PASS1
+	echo
+	if [ $PASS1 ] ; then
+		read -sep "retype password: " PASS2
+		echo
+		if [[ $PASS1 != $PASS2 ]] ; then
+			echo "ERR: passwords do not match."
+			return 1
+		fi
+		eval ''$1'='${PASS1}''
+	fi
+}
 
 #
 #	readVars
@@ -240,17 +258,8 @@ readVars(){
 
 	# root password...
 	if [ -z $ROOTPASS ] ; then
-		read -sep "root password (Enter to skip): " PASS1
-		echo
-		if [ $PASS1 ] ; then
-			read -sep "retype root password: " PASS2
-			echo
-			if [[ $PASS1 != $PASS2 ]] ; then
-				echo "ERR: passwords do not match."
-				exit 1
-			fi
-			PASS=$PASS1
-		fi
+		xreadpass PASS \
+			|| exit 1
 	else
 		PASS=$ROOTPASS
 	fi
@@ -348,7 +357,7 @@ pctCreateDebian(){
 	sleep ${TIMEOUT:=5}
 
 	@ lxc-attach $1 apt update
-	@ lxc-attach $1 apt upgrade
+	@ lxc-attach $1 -- apt upgrade -y
 }
 pctCreateUbuntu(){
 	local TEMPLATE
@@ -359,7 +368,7 @@ pctCreateUbuntu(){
 	sleep ${TIMEOUT:=5}
 
 	@ lxc-attach $1 apt update
-	@ lxc-attach $1 apt upgrade
+	@ lxc-attach $1 -- apt upgrade -y
 }
 
 
diff --git a/Makefile b/Makefile
index cc7f26c..d6be0fa 100644
--- a/Makefile
+++ b/Makefile
@@ -17,13 +17,17 @@ gate: ./gate-traefik
 ns: 
 	$@/make.sh
 
+.PHONY: ssh
+ssh: 
+	$@/make.sh
+
 .PHONY: syncthing
 syncthing: 
 	$@/make.sh
 
 
 .PHONY: all
-all: config gate dns syncthing
+all: config gate dns ssh syncthing
 
 
 
diff --git a/ssh/make.sh b/ssh/make.sh
new file mode 100644
index 0000000..698aac1
--- /dev/null
+++ b/ssh/make.sh
@@ -0,0 +1,89 @@
+#!/usr/bin/bash
+#----------------------------------------------------------------------
+
+cd $(dirname $0)
+PATH=$PATH:$(dirname "$(pwd)")
+
+
+#----------------------------------------------------------------------
+
+source ../.pct-helpers
+
+
+#----------------------------------------------------------------------
+
+[ -e ../config.global ] \
+	&& source ../config.global
+
+[ -e ./config ] \
+	&& source ./config
+
+
+#----------------------------------------------------------------------
+
+DFL_ID=${DFL_ID:=102}
+DFL_CTHOSTNAME=${DFL_CTHOSTNAME:=ssh}
+
+DFL_RAM=${DFL_RAM:=1024}
+DFL_SWAP=${DFL_SWAP:=${DFL_RAM:=1024}}
+DFL_DRIVE=${DFL_DRIVE:=16}
+
+WAN_IP=-
+WAN_GATE=-
+ADMIN_IP=-
+ADMIN_GATE=-
+LAN_IP=-
+LAN_GATE=-
+
+REBOOT=${REBOOT:=1}
+
+readVars
+
+xread "ssh user name: " USER
+
+
+#----------------------------------------------------------------------
+
+OPTS_STAGE_1="\
+	--hostname $CTHOSTNAME \
+	--memory $RAM \
+	--swap $SWAP \
+	--net0 name=lan,bridge=vmbr0,firewall=1,ip=dhcp,type=veth \
+	--net1 name=admin,bridge=vmbr1,firewall=1,ip=dhcp,type=veth \
+	--storage local-lvm \
+	--rootfs local-lvm:$DRIVE \
+	--unprivileged 1 \
+	${PCT_EXTRA} \
+"
+
+OPTS_STAGE_2="\
+	--startup order=90,up=10 \
+	--onboot 1 \
+"
+
+
+#----------------------------------------------------------------------
+
+echo "# Creating CT..."
+pctCreateDebian $ID "${OPTS_STAGE_1}" "$PASS"
+
+echo "# Installing dependencies..."
+@ lxc-attach $ID apt install vim htop iftop iotop tmux mc
+
+echo "# Setup: sshd..."
+@ lxc-attach $ID -- systemctl enable ssh.socket --now
+
+echo "# Setup: user..."
+@ lxc-attach $ID adduser $USER
+
+echo "# Post config..."
+pctSet $ID "${OPTS_STAGE_2}" $REBOOT
+
+echo "# Done."
+
+
+
+#----------------------------------------------------------------------
+# vim:set ts=4 sw=4 :
+
+
diff --git a/syncthing/make.sh b/syncthing/make.sh
index aa42355..a87d689 100755
--- a/syncthing/make.sh
+++ b/syncthing/make.sh
@@ -72,12 +72,12 @@ echo "# Setup: syncthing..."
 @ lxc-attach $ID rc-update add syncthing
 @ lxc-attach $ID rc-service syncthing start
 
-sleep ${TIMEOUT:=5}
-
 echo "# Setup: dashboard..."
-@ lxc-attach $ID -- sed \
-	-e 's/127\.0\.0\.1:8384/0.0.0.0:8384/g' \
-	-i /var/lib/syncthing/.config/syncthing/config.xml
+sleep ${TIMEOUT:=5}
+@ lxc-attach $ID -- \
+	sed \
+		-e 's/127\.0\.0\.1:8384/0.0.0.0:8384/g' \
+		-i /var/lib/syncthing/.config/syncthing/config.xml
 
 echo "# Post config..."
 pctSet $ID "${OPTS_STAGE_2}" $REBOOT