diff --git a/include/llarp/config.h b/include/llarp/config.h
index dae2d105f..90408a703 100644
--- a/include/llarp/config.h
+++ b/include/llarp/config.h
@@ -42,16 +42,6 @@ extern "C"
   llarp_config_iter(struct llarp_config *conf,
                     struct llarp_config_iterator *iter);
 
-  /// ensure configuration exists
-  /// populate with defaults
-  /// return if this succeeded
-  /// if overwrite is true then overwrite old config file
-  /// if basedir is not nullptr then use basedir as an absolute
-  /// base path for all files in config
-  bool
-  llarp_ensure_config(const char *fname, const char *basedir = nullptr,
-                      bool overwrite = false);
-
 #ifdef __cplusplus
 }
 #endif
diff --git a/llarp/config.cpp b/llarp/config.cpp
index 6da883b48..34b2ff106 100644
--- a/llarp/config.cpp
+++ b/llarp/config.cpp
@@ -35,6 +35,9 @@ namespace llarp
       iwp_links = find_section(top, "bind", section_t{});
       services  = find_section(top, "services", section_t{});
       system    = find_section(top, "system", section_t{});
+      // std::ofstream ft("config_test.ini");
+      // parser.dump(ft);
+      parser.write("config_test.ini");
       return true;
     }
     return false;
@@ -42,6 +45,246 @@ namespace llarp
 
 }  // namespace llarp
 
+bool
+llarp_ensure_config(const char *fname, const char *basedir, bool overwrite, bool asRouter)
+{
+  std::error_code ec;
+  if(fs::exists(fname, ec) && !overwrite)
+  {
+    llarp::LogError(fname, " currently exists, please use -f to overwrite");
+    return true;
+  }
+  if(ec)
+  {
+    llarp::LogError(ec);
+    return false;
+  }
+  
+  std::string basepath = "";
+  if(basedir)
+  {
+    basepath = basedir;
+    basepath += "/";
+  }
+  
+  // abort if client.ini already exists
+  if (!asRouter)
+  {
+    if(fs::exists(basepath+"client.ini", ec) && !overwrite)
+    {
+      llarp::LogError(basepath, "client.ini currently exists, please use -f to overwrite");
+      return true;
+    }
+    if(ec)
+    {
+      llarp::LogError(ec);
+      return false;
+    }
+  }
+  
+  // write fname ini
+  std::ofstream f(fname);
+  if(!f.is_open())
+  {
+    llarp::LogError("failed to open ", fname, " for writing");
+    return false;
+  }
+  llarp_generic_ensure_config(f, basepath);
+  if (asRouter)
+  {
+    llarp_ensure_router_config(f);
+  }
+  else
+  {
+    llarp_ensure_client_config(f, basepath);
+  }
+  llarp::LogInfo("Generated new config ", fname);
+  return true;
+}
+
+void
+llarp_generic_ensure_config(std::ofstream &f, std::string basepath)
+{
+  f << "# this configuration was auto generated with 'sane' defaults"
+  << std::endl;
+  f << "# change these values as desired" << std::endl;
+  f << std::endl << std::endl;
+  
+  f << "# number of crypto worker threads " << std::endl;
+  f << "threads=4" << std::endl;
+  f << "# path to store signed RC" << std::endl;
+  f << "contact-file=" << basepath << "self.signed" << std::endl;
+  f << "# path to store transport private key" << std::endl;
+  f << "transport-privkey=" << basepath << "transport.private" << std::endl;
+  f << "# path to store identity signing key" << std::endl;
+  f << "ident-privkey=" << basepath << "identity.private" << std::endl;
+  f << "# encryption key for onion routing" << std::endl;
+  f << "encryption-privkey=" << basepath << "encryption.private" << std::endl;
+  f << std::endl;
+  f << "# uncomment following line to set router nickname to 'lokinet'"
+  << std::endl;
+  f << "# nickname=lokinet" << std::endl;
+  f << std::endl << std::endl;
+  
+  f << "# system settings for priviledges and such" << std::endl;
+  f << "[system]" << std::endl;
+#ifdef _WIN32
+  f << "# ";
+#endif
+  f << "user=" << DEFAULT_LOKINET_USER << std::endl;
+#ifdef _WIN32
+  f << "# ";
+#endif
+  f << "group=" << DEFAULT_LOKINET_GROUP << std::endl;
+  f << std::endl << std::endl;
+  
+  f << "# dns provider configuration section" << std::endl;
+  f << "[dns]" << std::endl;
+  f << "# opennic us resolver" << std::endl;
+  f << "upstream=" << DEFAULT_RESOLVER_US << std::endl;
+  f << "# opennic eu resolver" << std::endl;
+  f << "upstream=" << DEFAULT_RESOLVER_EU << std::endl;
+  f << "# opennic au resolver" << std::endl;
+  f << "upstream=" << DEFAULT_RESOLVER_AU << std::endl;
+  f << "bind=127.3.2.1:53" << std::endl;
+  f << std::endl << std::endl;
+  
+  f << "# network database settings block " << std::endl;
+  f << "[netdb]" << std::endl;
+  f << "# directory for network database skiplist storage" << std::endl;
+  f << "dir=" << basepath << "netdb" << std::endl;
+  f << std::endl << std::endl;
+  
+  f << "# bootstrap settings " << std::endl;
+  f << "[connect]" << std::endl;
+  f << "bootstrap=" << basepath << "bootstrap.signed" << std::endl;
+  f << std::endl << std::endl;
+  
+}
+
+void
+llarp_ensure_router_config(std::ofstream &f)
+{
+  f << "# ROUTERS ONLY: router settings block" << std::endl;
+  f << "[router]" << std::endl;
+  f << "# uncomment these to manually set public address and port"
+  << std::endl;
+  f << "# this is required on providers like AWS because of their firewall "
+  "rules"
+  << std::endl;
+  f << "# public-address=your.ip.goes.here" << std::endl;
+  f << "# public-port=1090" << std::endl;
+  f << std::endl;
+  
+  f << "# ROUTERS ONLY: publish network interfaces for handling inbound traffic"
+  << std::endl;
+  f << "[bind]" << std::endl;
+  
+  std::string ifname;
+  
+  if(llarp::GetBestNetIF(ifname, AF_INET))
+    f << ifname << "=1090" << std::endl;
+  else
+    f << "# could not autodetect network interface" << std::endl
+    << "# eth0=1090" << std::endl;
+  
+  f << std::endl;
+  
+}
+
+bool
+llarp_ensure_client_config(std::ofstream &f, std::string basepath)
+{
+  f << "# ROUTERS ONLY: router settings block" << std::endl;
+  f << "[router]" << std::endl;
+  f << "# uncomment these to manually set public address and port"
+  << std::endl;
+  f << "# this is required on providers like AWS because of their firewall "
+  "rules"
+  << std::endl;
+  f << "# public-address=your.ip.goes.here" << std::endl;
+  f << "# public-port=1090" << std::endl;
+  f << std::endl;
+  
+  f << "# ROUTERS ONLY: publish network interfaces for handling inbound traffic"
+  << std::endl;
+  f << "[bind]" << std::endl;
+  std::string ifname;
+  
+  if(llarp::GetBestNetIF(ifname, AF_INET))
+    f << "# " << ifname << "=1090" << std::endl;
+  else
+    f << "# could not autodetect network interface" << std::endl
+    << "# eth0=1090" << std::endl;
+  
+  f << std::endl;
+  f << "[services]" << std::endl;
+  f << "client=" << basepath << "client.ini" << std::endl;
+  f << std::endl;
+  
+  // done with fname.ini
+  // start client.ini
+  // write fname ini
+  std::ofstream clientini_f(basepath + "client.ini");
+  if(!f.is_open())
+  {
+    llarp::LogError("failed to open ", basepath, "client.ini for writing");
+    return false;
+  }
+  clientini_f << "[client-hidden-service-name]" << std::endl;
+  clientini_f << "keyfile=client-keyfile.private" << std::endl;
+  
+  // pick ip
+  struct privatesInUse ifsInUse = llarp_getPrivateIfs();
+  std::string ip = "";
+  if (!ifsInUse.ten)
+  {
+    ip = "10.10.0.1/24";
+  }
+  else
+    if (!ifsInUse.oneSeven)
+    {
+      ip = "172.16.10.1/24";
+    }
+    else
+      if (!ifsInUse.oneNine)
+      {
+        ip = "192.168.10.1/24";
+      }
+      else
+      {
+        llarp::LogError("Couldn't easily detect a private range to map lokinet onto");
+        return false;
+      }
+  llarp::LogDebug("Detected "+ip+" is available for use, configuring as such");
+  clientini_f << "ifaddr=" << ip << std::endl;
+  // pick interface name
+  uint8_t num = 0;
+  while(num < 255)
+  {
+    std::string iftestname = "lokitun" + std::to_string(num);
+    struct sockaddr addr;
+    bool found = llarp_getifaddr(iftestname.c_str(), AF_INET, &addr);
+    if (!found)
+    {
+      llarp::LogDebug("Detected "+iftestname+" is available for use, configuring as such");
+      break;
+    }
+    num ++;
+  }
+  if (num == 255)
+  {
+    llarp::LogError("Could not find any free lokitun interface names");
+    return false;
+  }
+  clientini_f << "ifname=lokinum" << std::to_string(num) << std::endl;
+  // prefetch-tags=test
+  // enable netns?
+  
+  llarp::LogInfo("Generated hidden service client as " + basepath + "client.ini");
+  return true;
+}
+
 extern "C"
 {
   void
@@ -87,109 +330,4 @@ extern "C"
                     item.second.c_str());
   }
 
-  bool
-  llarp_ensure_config(const char *fname, const char *basedir, bool overwrite)
-  {
-    std::error_code ec;
-    if(fs::exists(fname, ec) && !overwrite)
-      return true;
-    if(ec)
-    {
-      llarp::LogError(ec);
-      return false;
-    }
-    std::string basepath = "";
-    if(basedir)
-    {
-      basepath = basedir;
-      basepath += "/";
-    }
-
-    std::ofstream f(fname);
-    if(!f.is_open())
-    {
-      llarp::LogError("failed to open ", fname, " for writing");
-      return false;
-    }
-    f << "# this configuration was auto generated with 'sane' defaults"
-      << std::endl;
-    f << "# change these values as desired" << std::endl;
-    f << std::endl << std::endl;
-
-    f << "# router settings block" << std::endl;
-    f << "[router]" << std::endl;
-    f << "# uncomment these to manually set public address and port"
-      << std::endl;
-    f << "# this is required on providers like AWS because of their firewall "
-         "rules"
-      << std::endl;
-    f << "# public-address=your.ip.goes.here" << std::endl;
-    f << "# public-port=1090" << std::endl;
-    f << std::endl;
-    f << "# number of crypto worker threads " << std::endl;
-    f << "threads=4" << std::endl;
-    f << "# path to store signed RC" << std::endl;
-    f << "contact-file=" << basepath << "self.signed" << std::endl;
-    f << "# path to store transport private key" << std::endl;
-    f << "transport-privkey=" << basepath << "transport.private" << std::endl;
-    f << "# path to store identity signing key" << std::endl;
-    f << "ident-privkey=" << basepath << "identity.private" << std::endl;
-    f << "# encryption key for onion routing" << std::endl;
-    f << "encryption-privkey=" << basepath << "encryption.private" << std::endl;
-    f << std::endl;
-    f << "# uncomment following line to set router nickname to 'lokinet'"
-      << std::endl;
-    f << "# nickname=lokinet" << std::endl;
-    f << std::endl << std::endl;
-
-    f << "# system settings for priviledges and such" << std::endl;
-    f << "[system]" << std::endl;
-#ifdef _WIN32
-    f << "# ";
-#endif
-    f << "user=" << DEFAULT_LOKINET_USER << std::endl;
-#ifdef _WIN32
-    f << "# ";
-#endif
-    f << "group=" << DEFAULT_LOKINET_GROUP << std::endl;
-    f << std::endl << std::endl;
-
-    f << "# dns provider configuration section" << std::endl;
-    f << "[dns]" << std::endl;
-    f << "# opennic us resolver" << std::endl;
-    f << "upstream=" << DEFAULT_RESOLVER_US << std::endl;
-    f << "# opennic eu resolver" << std::endl;
-    f << "upstream=" << DEFAULT_RESOLVER_EU << std::endl;
-    f << "# opennic au resolver" << std::endl;
-    f << "upstream=" << DEFAULT_RESOLVER_AU << std::endl;
-    f << "bind=127.3.2.1:53" << std::endl;
-    f << std::endl << std::endl;
-
-    f << "# network database settings block " << std::endl;
-    f << "[netdb]" << std::endl;
-    f << "# directory for network database skiplist storage" << std::endl;
-    f << "dir=" << basepath << "netdb" << std::endl;
-    f << std::endl << std::endl;
-
-    f << "# bootstrap settings " << std::endl;
-    f << "[connect]" << std::endl;
-    f << "bootstrap=" << basepath << "bootstrap.signed" << std::endl;
-    f << std::endl << std::endl;
-
-    f << "# publish network interfaces for handling inbound traffic"
-      << std::endl;
-    f << "[bind]" << std::endl;
-
-    std::string ifname;
-
-    if(llarp::GetBestNetIF(ifname, AF_INET))
-      f << ifname << "=1090" << std::endl;
-    else
-      f << "# could not autodetect network interface" << std::endl
-        << "# eth0=1090" << std::endl;
-
-    f << std::endl;
-    llarp::LogInfo("Generated new config ", fname);
-    return true;
-  }
 }
diff --git a/llarp/config.hpp b/llarp/config.hpp
index a24e5cf97..9edca96a7 100644
--- a/llarp/config.hpp
+++ b/llarp/config.hpp
@@ -31,4 +31,23 @@ struct llarp_config
   llarp::Config impl;
 };
 
+  /// ensure configuration exists
+  /// populate with defaults
+  /// return if this succeeded
+  /// if overwrite is true then overwrite old config file
+  /// if basedir is not nullptr then use basedir as an absolute
+  /// base path for all files in config
+  bool
+  llarp_ensure_config(const char *fname, const char *basedir = nullptr,
+                      bool overwrite = false, bool asRouter = true);
+
+  void
+  llarp_generic_ensure_config(std::ofstream &f, std::string basepath);
+
+  void
+  llarp_ensure_router_config(std::ofstream &f);
+
+  bool
+  llarp_ensure_client_config(std::ofstream &f, std::string basepath);
+
 #endif