diff --git a/.gitignore b/.gitignore
index 187f80f..cee98e2 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,5 @@
 .direnv
 .terraform
 .terraform.lock.hcl
+tfinit
+tfplan
diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000..23d6333
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,40 @@
+SRC_DIR=tf
+SRC=$(shell find $(SRC_DIR) -type f -name "*.tf")
+
+TERRAFORM=terraform -chdir=$(SRC_DIR)
+
+PG_USER=terraform
+PG_HOST=pg.monotremata.xyz
+PG_DB=terraform_backend
+PG_PORT=5432
+PG_PASSWD=$(shell pass "$(PG_HOST)/$(PG_USER)")
+PG_CONN_STR=postgres://$(PG_USER):$(PG_PASSWD)@$(PG_HOST):$(PG_PORT)/$(PG_DB)
+
+NAMECHEAP_API_KEY=$(shell pass namecheap.com/api_key)
+LINODE_TOKEN=$(shell pass linode.com/token)
+VULTR_API_KEY=$(shell pass vultr.com/api_key)
+
+HTTP_PROXY=caladan:8888
+HTTPS_PROXY=caladan:8888
+
+export HTTP_PROXY
+export HTTPS_PROXY
+
+export NAMECHEAP_API_KEY
+export LINODE_TOKEN
+export VULTR_API_KEY
+
+.PHONY: apply clean
+
+apply: $(SRC_DIR)/tfplan $(SRC)
+	$(TERRAFORM) apply $(<F)
+
+$(SRC_DIR)/tfplan: $(SRC_DIR)/tfinit $(SRC)
+	$(TERRAFORM) plan -out=$(@F)
+
+$(SRC_DIR)/tfinit: $(SRC)
+	$(TERRAFORM) init -backend-config="conn_str=$(PG_CONN_STR)"
+	@touch $@
+
+clean:
+	rm -f $(SRC_DIR)/tfplan $(SRC_DIR)/tfinit
diff --git a/README.md b/README.md
index 5dce77c..b3be1af 100644
--- a/README.md
+++ b/README.md
@@ -39,6 +39,8 @@ to the partially-configured pg backend.
 fetches the secrets (from `pass`) and exports the variables for api keys and
 tokens needed by the different providers.
 
+Additionally, I also wrote a simple `Makefile` to init/plan/apply quickly.
+
 ## Backend
 
 I use the pg backend on a PostgreSQL hosted on my NAS.