diff --git a/.gitignore b/.gitignore
index 5ceb386..d09d978 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,2 @@
 venv
+.DS_Store
diff --git a/macos/README.md b/macos/README.md
new file mode 100644
index 0000000..60fad20
--- /dev/null
+++ b/macos/README.md
@@ -0,0 +1,24 @@
+# Creating a macOS CI node
+
+## Goals
+
+- [x] given a macOS host, turn it into a fully functional CI node
+  - eventually intel & arm, arm only for now
+- [x] be able to run CouchDB CI jobs against latest homebrew dependencies
+- eventually, cover erlang@23, erlang@24, erlang@25 and matching elixirs
+  - but start with erlang@25 (latest) for now
+
+## Requirements
+
+`~/.ansible/couchdb-ansible-vault` set up. Talk to the PMC if you don’t have this.
+
+## Dependencies:
+
+- Ansible (`brew install ansible`)
+
+## Usage
+
+```shell
+cd playbook
+ansible-playbook macos.yml
+```
diff --git a/macos/playbook/ansible.cfg b/macos/playbook/ansible.cfg
new file mode 100644
index 0000000..df4c698
--- /dev/null
+++ b/macos/playbook/ansible.cfg
@@ -0,0 +1,7 @@
+[defaults]
+inventory = ./inventory/macstadium
+interpreter_python = /opt/homebrew/bin/python3
+vault_password_file = ~/.ansible/couchdb-ansible-vault
+
+[ssh_connection]
+pipelining = True
diff --git a/macos/playbook/files/org.apache.couchdb.mac.arm.ci.plist b/macos/playbook/files/org.apache.couchdb.mac.arm.ci.plist
new file mode 100755
index 0000000..c3497fa
--- /dev/null
+++ b/macos/playbook/files/org.apache.couchdb.mac.arm.ci.plist
@@ -0,0 +1,36 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+  <dict>
+
+    <key>Label</key>
+    <string>org.apache.couchdb.mac.arm.ci</string>
+
+    <key>ProgramArguments</key>
+    <array>
+      <string>/Users/jenkins2/run.sh</string>
+    </array>
+
+    <key>EnvironmentVariables</key>
+    <dict></dict>
+
+    <key>RunAtLoad</key>
+    <true/>
+
+    <key>KeepAlive</key>
+    <true/>
+
+    <key>UserName</key>
+    <string>jenkins2</string>
+
+    <key>WorkingDirectory</key>
+    <string>/Users/jenkins2</string>
+
+    <key>StandardErrorPath</key>
+    <string>/Users/jenkins2/jenkins-launchd.stderr</string>
+
+    <key>StandardOutPath</key>
+    <string>/Users/jenkins2/jenkins-launchd.stdout</string>
+
+  </dict>
+</plist>
diff --git a/macos/playbook/inventory/macstadium/group_vars/all.yml b/macos/playbook/inventory/macstadium/group_vars/all.yml
new file mode 100644
index 0000000..b9106b2
--- /dev/null
+++ b/macos/playbook/inventory/macstadium/group_vars/all.yml
@@ -0,0 +1,16 @@
+---
+jenkins_pw: !vault |
+    $ANSIBLE_VAULT;1.1;AES256
+    33343535316333333039653064616331626166393538653332336535623338343565663932303839
+    3535323434373838363964656237386530663030373930370a353265343833653962616566316232
+    32383234353966336634376566623830343738393835656338323838376332653738316232646339
+    3632363762316230640a373864313435633664303933636639366439383764333364666431376565
+    6337
+
+ansible_become_password: !vault |
+    $ANSIBLE_VAULT;1.1;AES256
+    37396435623564613736656338373932353037303763613965333636653036313364363938383563
+    6432323062396263316366613239356537363262663939330a316263336661646565623664633733
+    37653761653133646438626233393239643463333463306233313335656434333437643761633365
+    3333643730613761300a656533366338313765613639643431306434376535366435376434663938
+    3132
diff --git a/macos/playbook/inventory/macstadium/hosts b/macos/playbook/inventory/macstadium/hosts
new file mode 100644
index 0000000..7358714
--- /dev/null
+++ b/macos/playbook/inventory/macstadium/hosts
@@ -0,0 +1,2 @@
+[ci]
+207.254.28.245
diff --git a/macos/playbook/macos.yml b/macos/playbook/macos.yml
new file mode 100644
index 0000000..6e2a136
--- /dev/null
+++ b/macos/playbook/macos.yml
@@ -0,0 +1,108 @@
+---
+- hosts: ci
+  remote_user: administrator
+  tasks:
+
+  - name: install tmux
+    community.general.homebrew:
+      name: tmux
+      state: present
+
+  - name: install emacs
+    community.general.homebrew:
+      name: emacs
+      state: present
+
+  - name: install erlang 25
+    community.general.homebrew:
+      name: 'erlang@25'
+      state: present
+
+  - name: install elixir
+    community.general.homebrew:
+      name: elixir
+      state: present
+
+  - name: install node
+    community.general.homebrew:
+      name: node
+      state: present
+
+  - name: install python
+    community.general.homebrew:
+      name: python
+      state: present
+
+  - name: install spidermonkey
+    community.general.homebrew:
+      name: spidermonkey
+      state: present
+
+  - name: install help2man
+    community.general.homebrew:
+      name: help2man
+      state: present
+
+  - name: install openjdk 11
+    community.general.homebrew:
+      name: 'openjdk@11'
+      state: present
+
+  - name: brew link openjdk force
+    command: /opt/homebrew/bin/brew link openjdk@11 --force
+    args:
+      creates: /opt/homebrew/bin/java
+
+  - name: install sphinx
+    ansible.builtin.pip:
+      name: sphinx
+
+  - name: install docutils
+    ansible.builtin.pip:
+      name: docutils
+
+  - name: install pygments
+    ansible.builtin.pip:
+      name: pygments
+
+  - name: install sphinx_rtd_theme
+    ansible.builtin.pip:
+      name: sphinx_rtd_theme
+
+  - name: create jenkins user
+    become: true
+    user:
+      name: jenkins2
+      group: everyone
+      shell: /bin/zsh
+      password: "{{ jenkins_pw }}"
+      system: true
+
+  - name: create LaunchDaemons dir
+    file:
+      state: directory
+      dest: /Users/administrator/Library/LaunchDaemons
+      owner: administrator
+
+  - name: upload launchd config
+    copy:
+      src: ./files/org.apache.couchdb.mac.arm.ci.plist
+      dest: /Library/LaunchDaemons/org.apache.couchdb.mac.arm.ci.plist
+    notify: restart launchd service
+
+  - name: bootstrap the launchd service
+    become: true
+    command: launchctl bootstrap system /Library/LaunchDaemons/org.apache.couchdb.mac.arm.ci.plist
+
+  - name: enable the launchd service - might be rundant
+    become: true
+    command: launchctl enable system/org.apache.couchdb.mac.arm.ci
+
+  - name: re/start the launchd service
+    become: true
+    command: launchctl kickstart -kp system/org.apache.couchdb.mac.arm.ci
+
+  handlers:
+    - name: restart launchd service
+      become: true
+      command: launchctl kickstart -kp system/org.apache.couchdb.mac.arm.ci