diff --git a/doc/src/anleitung/create.md b/doc/src/anleitung/create.md
index e6bf894..da325a6 100644
--- a/doc/src/anleitung/create.md
+++ b/doc/src/anleitung/create.md
@@ -1,4 +1,36 @@
-# Create host with nixos-anywhere
+# Create a new host
+
+### Base config
+there is an example config [here](../files/base_host.md) *note: TODO*
+## If this is a physical host
+Create the keys and secrets using `add-host-keys`
+This will ask for a hostname and then
+- create and encrypt a ssh-key with sops
+- create and encrypt a second ssh-key for the init
+- convert the main key to a sops pubkey and display it
+- create public/private wireguard keys and display the pubkey
+- generate a reproducible mac-address
+
+After this you have to
+- write the age public key into machines/.sops.yaml under `keys:`
+- write a new creation rule for the `secrets.yaml` under `creation_rules:` like
+```
+creation_rules:
+  - path_regex: {hostname}/secrets.yaml$
+    key_groups:
+    - pgp:
+      - *admin_kalipso
+      - *admin_kalipso_dsktp
+      age:
+      - *admin_atlan
+      - *machine_{hostname}
+```
+- create the secrets.yaml using `sops {hostname}/secrets.yaml`
+    - you can already add `wg_private: {wg priv key}` here
+- add the host to the `hosts.nix` file (if microvm use the generated mac here)
+- add the host to `machines/modules/malobeo/peers.nix` for vpn access (use the wireguard pubkey here)
+
+# deploy the host with nixos-anywhere
 We use a nixos-anywhere wrapper script to deploy new hosts.
 The wrapper script takes care of copying persistent host keys before calling nixos-anywhere.