diff --git a/.gitignore b/.gitignore
index e554ece..2ea602c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,6 @@
 # ---> Ansible
 *.retry
-inventory/group_vars/secret/
\ No newline at end of file
+inventory/group_vars/secret/
+
+# Ignore python venv
+.venv
\ No newline at end of file
diff --git a/inventory/group_vars/all/main.yaml b/inventory/group_vars/all/main.yaml
index a1632cc..8e4ba15 100644
--- a/inventory/group_vars/all/main.yaml
+++ b/inventory/group_vars/all/main.yaml
@@ -1,3 +1,3 @@
 ---
 
-ansible_become_passwd: "{{ ansible_password }}"
\ No newline at end of file
+ansible_become_passwd: "{{ ansible_password }}"
diff --git a/inventory/group_vars/all/secrets template.yaml b/inventory/group_vars/all/secrets template.yaml
index dad995a..5fb266d 100644
--- a/inventory/group_vars/all/secrets template.yaml	
+++ b/inventory/group_vars/all/secrets template.yaml	
@@ -4,4 +4,12 @@ ansible_become_password: p@a$$word
 # SSH key for Ansible user
 ansible_ssh_key: $$h_key
 # Password for the default unprivileged user
-user_password: p@a$$word
\ No newline at end of file
+user_password: p@a$$word
+# ntfy topic
+ntfy_topic: https://x.y.z/topic
+# ntfy topic token
+ntfy_topic_token: t0ken
+# Home Assistant Webhook token
+ha_webhook_token: h@_t0ken
+# Proxmox API token secret
+proxmox_token_secret: t0ken_$ecret
diff --git a/inventory/group_vars/all/secrets.yaml b/inventory/group_vars/all/secrets.yaml
index 83ec629..d382ff1 100644
--- a/inventory/group_vars/all/secrets.yaml
+++ b/inventory/group_vars/all/secrets.yaml
@@ -1,21 +1,35 @@
 $ANSIBLE_VAULT;1.1;AES256
-37386438323934313261326132383539643062353335333661326131643032316239326161373930
-3264633766303937353938343565326562626535343830370a303632386666613033323132616561
-33353565616333346663396535613738343439323535663932633134663139623032353764633333
-6533366164393164300a303963343863323133303565323635313030396532336237313837633231
-35653733306565386665333739323433646238343961396234666232666238363264333639346265
-31323037356665366138663365653666623066393661353035636239656136323466633461323765
-34323836623766643562363035313465343863633534646466376437633761373665636233646532
-39616362353930376464626136336133333639636638623138313065383934666237383738396334
-34323930306536663131333639373764393135653161663431373563323837313964333736643238
-61353861656431396366616534633935636332323665336536353337646133653333663436623633
-34616333393666356632656238333935636562366237393162653864306462316231376666653932
-32373336373231306134343337373736656638343439373564343464653030623034333734656462
-63633634396631333233323939663763313163373863326634306663656638373239306634643337
-32343262393761643237653538376163633066376538616537653139376637663339646234383535
-62396663396161396130303135396330303530333533363533366330303831326661653138333336
-37386436373337613064343138373433393435653066303364326461303565336539396362373135
-31663538383030326566303166353934626639653432356562613938646364666337383835353234
-62383838346339653766393233383563356363383039303862393564353464343534373666376434
-33323136613337366566393535633730643064353664393436363830333561643265623163386165
-62323337363238643166
+37396233623362356239383039306566316433613761383032386566643964326638663830343837
+3031613035666339666634393439386463373734336130320a646331343036626234316131313265
+36666134646236333162316237326362333430616235633130633364666261343133306637623165
+6565633434353035390a323665636234616230373430663030666564363434623930656264343231
+39623465326661393832633661393437396535363434646261323737303163623230366161366163
+35373561636233313764366631373261316635386463353464306437323461613033313836383238
+36316133343737373666386534663939636234363831633738383738386433663533306465333230
+64633161396538316535346333343937306431386364363736656131613939336438663364323262
+34636633366464306231373739343764333935623434633331316463323961363364393865383732
+31393834626561643235393035666263646334613837666436333632393665346638623965346461
+35343966633631386330653834623234626537353739323938323339663836616139633832303465
+66356564636233663230633732333363343732396264653339396562353734643561643536616237
+34366536623535313533623634653632316538326137363034653030346337646264653765316662
+30613430636433303661353266666635333362613964383337643130316563633438653631373665
+37393465343561333966303137373636613937383261616365613463393263303863333134653630
+66386165303135343662346335653537366230316332666439326639613063383931313839376237
+64626362386666613362616666373565336666623837323064386262393135343834323161366163
+63393765653964633861663765343735626462303064383063643563393332653738343633313466
+61613264303139623530393765636162373136363837626134653930376230343463623433643063
+62393337623566616431306632333337616263633031613437643334363162623331653535396233
+63323939633563373137346537363834306261613738333636303762353639366136373734346632
+39333135616335343561626133386539333833366339613463626637326337333430376430393538
+33373234353064326435376432383139623561646361303063386531373164353335323265616566
+61643765313264626232366161313232323437306333316161663433643534363063393864666563
+35353966396164633534386663616233383236663466356465306361613039353366343630343063
+61643131343731366237313666626366656639663136393834376531323136653064383533383436
+31313038303766633339323465316236356536623362656432346233306434643236373831613339
+65663031326630303665306265623937623965633333363736373237333732306566386138396633
+36386461633762326466383436623263303935643133383365333664663665396134383730373030
+62663264363438336638663161366637663232383032633762373232396366633631666265323934
+62366536336435306539393662623962656335356439376466396539653263653033313964363364
+30303238646338396663323262653562353332346136323862616165663066373163313132396633
+31346438616130396332613736613635306530626663623634636434643137343262663635613061
+3762346665393865336666386163616430633731326237623733
diff --git a/inventory/hosts.yaml b/inventory/hosts.yaml
index 1e49217..3fd09b0 100644
--- a/inventory/hosts.yaml
+++ b/inventory/hosts.yaml
@@ -1,5 +1,5 @@
 ---
 physical:
   hosts:
-    192.168.0.5:
-      ansible_become_password: "{{ ansible_become_passwd }}"
\ No newline at end of file
+    192.168.0.45:
+      ansible_become_password: "{{ ansible_become_passwd }}"
diff --git a/playbooks/deploy.yaml b/playbooks/deploy_lxc.yaml
similarity index 63%
rename from playbooks/deploy.yaml
rename to playbooks/deploy_lxc.yaml
index 16d5029..b492713 100644
--- a/playbooks/deploy.yaml
+++ b/playbooks/deploy_lxc.yaml
@@ -1,17 +1,17 @@
 ---
+- name: Deplot simple test LXC on Proxmox VE
+  hosts: localhost
+  gather_facts: false
+  roles:
+    - ../roles/basic_proxmox_lxc
+
 - name: Basic Proxmox guest deployment
   hosts: all
   remote_user: root
   roles:
-    - ../roles/0_basic_postinstall
+    - ../roles/basic_postinstall
   vars_files:
     ../inventory/group_vars/all/secrets.yaml
   vars:
     ansible_user_passwd_hash: "{{ ansible_password | password_hash('sha512', 's3edscrj45e6r') }}"
-    user_passwd_hash: "{{ user_password | password_hash('sha512', 's3ed6123jhgcr') }}"
-
-  handlers:
-    - name: restart sshd
-      service:
-        name: sshd
-        state: restarted
\ No newline at end of file
+    user_passwd_hash: "{{ user_password | password_hash('sha512', 's3ed6123jhgcr') }}"
\ No newline at end of file
diff --git a/playbooks/deploy_vm_from_cloud_init.yaml b/playbooks/deploy_vm_from_cloud_init.yaml
new file mode 100644
index 0000000..96c045c
--- /dev/null
+++ b/playbooks/deploy_vm_from_cloud_init.yaml
@@ -0,0 +1,28 @@
+---
+- name: Deploy a virtual machine from a cloud init image
+  hosts: localhost
+  gather_facts: false
+  roles:
+    - ../roles/basic_proxmox_vm
+
+- name: Basic Proxmox guest deployment
+  hosts: all
+  remote_user: ansible
+  roles:
+    - ../roles/basic_postinstall
+  vars_files:
+    ../inventory/group_vars/all/secrets.yaml
+  vars:
+    ansible_user_passwd_hash: "{{ ansible_password | password_hash('sha512', 's3edscrj45e6r') }}"
+    user_passwd_hash: "{{ user_password | password_hash('sha512', 's3ed6123jhgcr') }}"
+
+  handlers:
+    - name: restart ssh-server
+      service:
+        name: ssh
+        state: restarted
+    
+    - name: restart sshd-server
+      service:
+        name: sshd
+        state: restarted
\ No newline at end of file
diff --git a/playbooks/maintain.yaml b/playbooks/maintain.yaml
new file mode 100644
index 0000000..368befe
--- /dev/null
+++ b/playbooks/maintain.yaml
@@ -0,0 +1,12 @@
+---
+- name: Physical machines maintanance play
+  hosts: all
+  remote_user: ansible
+  roles:
+    - ../roles/common_healthcheck
+  vars_files:
+    ../inventory/group_vars/all/secrets.yaml
+  vars:
+    ansible_user_passwd_hash: "{{ ansible_password | password_hash('sha512', 's3edscrj45e6r') }}"
+    user_passwd_hash: "{{ user_password | password_hash('sha512', 's3ed6123jhgcr') }}"
+    ha_addr: https://ha.lan
diff --git a/requirements.txt b/requirements.txt
new file mode 100644
index 0000000..1d11f18
--- /dev/null
+++ b/requirements.txt
@@ -0,0 +1,30 @@
+ansible-compat==26.6.0
+ansible-core==2.21.1
+ansible-lint==26.6.0
+attrs==26.1.0
+black==26.5.1
+bracex==3.0
+cffi==2.1.0
+click==8.4.2
+cryptography==49.0.0
+distro==1.9.0
+filelock==3.29.7
+Jinja2==3.1.6
+jsonschema==4.26.0
+jsonschema-specifications==2025.9.1
+MarkupSafe==3.0.3
+mypy_extensions==1.1.0
+packaging==26.2
+pathspec==1.1.1
+platformdirs==4.10.0
+pycparser==3.0
+pytokens==0.4.1
+PyYAML==6.0.3
+referencing==0.37.0
+resolvelib==1.2.1
+rpds-py==2026.6.3
+ruamel.yaml==0.19.1
+ruamel.yaml.clib==0.2.15
+subprocess-tee==0.4.2
+wcmatch==11.0
+yamllint==1.38.0
diff --git a/roles/0_basic_postinstall/tasks/harden_ssh.yaml b/roles/0_basic_postinstall/tasks/harden_ssh.yaml
deleted file mode 100644
index 0938667..0000000
--- a/roles/0_basic_postinstall/tasks/harden_ssh.yaml
+++ /dev/null
@@ -1,15 +0,0 @@
----
-
-- name: Configure ssh-server daemon
-  copy:
-    src: ../files/hardened_sshd.conf
-    dest: /etc/ssh/sshd_config.d/hardened_sshd.conf
-    mode: u=rw,g=r,o=r
-  notify: restart sshd
-
-
-- name: Configure ssh client
-  copy:
-    src: ../files/hardened_ssh.conf
-    dest: /etc/ssh/ssh_config.d/hardened_ssh.conf
-    mode: u=rw,g=r,o=r
\ No newline at end of file
diff --git a/roles/0_basic_postinstall/tasks/main.yaml b/roles/0_basic_postinstall/tasks/main.yaml
deleted file mode 100644
index fc3092a..0000000
--- a/roles/0_basic_postinstall/tasks/main.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
----
-- name: Create and set up Ansible user and environment
-  ansible.builtin.include_tasks: prepare_ansible_user.yaml
-
-- name: Improve SSH configuration
-  ansible.builtin.include_tasks: harden_ssh.yaml
\ No newline at end of file
diff --git a/roles/basic_postinstall/files/.vimrc b/roles/basic_postinstall/files/.vimrc
new file mode 100644
index 0000000..70d5a79
--- /dev/null
+++ b/roles/basic_postinstall/files/.vimrc
@@ -0,0 +1,16 @@
+set number
+set tabstop=2
+" Disable compatibility with vi which can cause unexpected issues.
+set nocompatible
+
+" Enable type file detection. Vim will be able to try to detect the type of file in use.
+filetype on
+
+" Enable plugins and load plugin for the detected file type.
+filetype plugin on
+
+" Load an indent file for the detected file type.
+filetype indent on
+
+" Turn syntax highlighting on.
+syntax on
diff --git a/roles/basic_postinstall/files/.zshrc b/roles/basic_postinstall/files/.zshrc
new file mode 100644
index 0000000..4423d1f
--- /dev/null
+++ b/roles/basic_postinstall/files/.zshrc
@@ -0,0 +1,105 @@
+export PATH=$HOME/bin:$HOME/.local/bin:/usr/local/bin:/home/max/soft/gnu_linux:$PATH
+
+# Path to your Oh My Zsh installation.
+export ZSH="$HOME/.oh-my-zsh"
+
+export GTK_THEME=Adwaita-dark
+
+# Set name of the theme to load --- if set to "random", it will
+# load a random theme each time Oh My Zsh is loaded, in which case,
+# to know which specific one was loaded, run: echo $RANDOM_THEME
+# See https://github.com/ohmyzsh/ohmyzsh/wiki/Themes
+ZSH_THEME="gnzh"
+
+# Set list of themes to pick from when loading at random
+# Setting this variable when ZSH_THEME=random will cause zsh to load
+# a theme from this variable instead of looking in $ZSH/themes/
+# If set to an empty array, this variable will have no effect.
+# ZSH_THEME_RANDOM_CANDIDATES=( "robbyrussell" "agnoster" )
+
+# Uncomment the following line to use case-sensitive completion.
+# CASE_SENSITIVE="true"
+
+# Uncomment the following line to use hyphen-insensitive completion.
+# Case-sensitive completion must be off. _ and - will be interchangeable.
+# HYPHEN_INSENSITIVE="true"
+
+# Uncomment one of the following lines to change the auto-update behavior
+# zstyle ':omz:update' mode disabled  # disable automatic updates
+# zstyle ':omz:update' mode auto      # update automatically without asking
+# zstyle ':omz:update' mode reminder  # just remind me to update when it's time
+
+# Uncomment the following line to change how often to auto-update (in days).
+# zstyle ':omz:update' frequency 13
+
+# Uncomment the following line if pasting URLs and other text is messed up.
+# DISABLE_MAGIC_FUNCTIONS="true"
+
+# Uncomment the following line to disable colors in ls.
+# DISABLE_LS_COLORS="true"
+
+# Uncomment the following line to disable auto-setting terminal title.
+# DISABLE_AUTO_TITLE="true"
+
+# Uncomment the following line to enable command auto-correction.
+# ENABLE_CORRECTION="true"
+
+# Uncomment the following line to display red dots whilst waiting for completion.
+# You can also set it to another string to have that shown instead of the default red dots.
+# e.g. COMPLETION_WAITING_DOTS="%F{yellow}waiting...%f"
+# Caution: this setting can cause issues with multiline prompts in zsh < 5.7.1 (see #5765)
+# COMPLETION_WAITING_DOTS="true"
+
+# Uncomment the following line if you want to disable marking untracked files
+# under VCS as dirty. This makes repository status check for large repositories
+# much, much faster.
+# DISABLE_UNTRACKED_FILES_DIRTY="true"
+
+# Uncomment the following line if you want to change the command execution time
+# stamp shown in the history command output.
+# You can set one of the optional three formats:
+# "mm/dd/yyyy"|"dd.mm.yyyy"|"yyyy-mm-dd"
+# or set a custom format using the strftime function format specifications,
+# see 'man strftime' for details.
+# HIST_STAMPS="mm/dd/yyyy"
+
+# Would you like to use another custom folder than $ZSH/custom?
+# ZSH_CUSTOM=/path/to/new-custom-folder
+
+# Which plugins would you like to load?
+# Standard plugins can be found in $ZSH/plugins/
+# Custom plugins may be added to $ZSH_CUSTOM/plugins/
+# Example format: plugins=(rails git textmate ruby lighthouse)
+# Add wisely, as too many plugins slow down shell startup.
+#plugins=(git)
+
+source $ZSH/oh-my-zsh.sh
+
+# User configuration
+
+# export MANPATH="/usr/local/man:$MANPATH"
+
+# You may need to manually set your language environment
+# export LANG=en_US.UTF-8
+
+# Preferred editor for local and remote sessions
+# if [[ -n $SSH_CONNECTION ]]; then
+#   export EDITOR='vim'
+# else
+#   export EDITOR='nvim'
+# fi
+
+# Compilation flags
+# export ARCHFLAGS="-arch $(uname -m)"
+
+# Set personal aliases, overriding those provided by Oh My Zsh libs,
+# plugins, and themes. Aliases can be placed here, though Oh My Zsh
+# users are encouraged to define aliases within a top-level file in
+# the $ZSH_CUSTOM folder, with .zsh extension. Examples:
+# - $ZSH_CUSTOM/aliases.zsh
+# - $ZSH_CUSTOM/macos.zsh
+# For a full list of active aliases, run `alias`.
+#
+# Example aliases
+# alias zshconfig="mate ~/.zshrc"
+# alias ohmyzsh="mate ~/.oh-my-zsh"
diff --git a/roles/0_basic_postinstall/files/hardened_ssh.conf b/roles/basic_postinstall/files/hardened_ssh.conf
similarity index 100%
rename from roles/0_basic_postinstall/files/hardened_ssh.conf
rename to roles/basic_postinstall/files/hardened_ssh.conf
diff --git a/roles/0_basic_postinstall/files/hardened_sshd.conf b/roles/basic_postinstall/files/hardened_sshd.conf
similarity index 73%
rename from roles/0_basic_postinstall/files/hardened_sshd.conf
rename to roles/basic_postinstall/files/hardened_sshd.conf
index b28a15a..21f4436 100644
--- a/roles/0_basic_postinstall/files/hardened_sshd.conf
+++ b/roles/basic_postinstall/files/hardened_sshd.conf
@@ -1,23 +1,29 @@
-# Disable root login entirely
-PermitRootLogin no
-
+PubkeyAuthentication yes
+AuthorizedKeysFile	.ssh/authorized_keys
+PasswordAuthentication no
+KbdInteractiveAuthentication no
+UsePAM no
 # Disable password authentication — keys only
 PasswordAuthentication no
 ChallengeResponseAuthentication no
-UsePAM no
+
+
+AllowGroups sshusers
+PrintMotd no
+AcceptEnv LANG LC_*
+ClientAliveCountMax 0
+ClientAliveInterval 300
+Port 22
+
+
+# Disable root login entirely
+PermitRootLogin no
 
 # Limit authentication attempts
 MaxAuthTries 3
-MaxSessions 2
-
-# Allow only your specific user
-AllowUsers deploy
+MaxSessions 3
 
 # Use modern key exchange and ciphers, prioritize post-quantum algorithms (mlkem and sntrup)
 KexAlgorithms mlkem768x25519-sha256,sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org
 Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com
-MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
-
-# Connection timeout
-ClientAliveInterval 300
-ClientAliveCountMax 2
\ No newline at end of file
+MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
\ No newline at end of file
diff --git a/roles/basic_postinstall/files/install_omz.sh b/roles/basic_postinstall/files/install_omz.sh
new file mode 100644
index 0000000..e0e5f8d
--- /dev/null
+++ b/roles/basic_postinstall/files/install_omz.sh
@@ -0,0 +1,15 @@
+#!/bin/sh
+
+FILE=/home/$USER/.oh-my-zsh/oh-my-zsh.sh
+if [ -f "$FILE" ]; then
+    echo "$FILE exists and we not installing ohmyzsh"
+    exit 0
+else 
+    echo "$FILE does not exist and we install ohmyzsh"
+		cd /home/max
+    wget https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh
+		chmod +x /home/max/install.sh
+		timeout -s 15 -k 30s 20s /home/max/install.sh --unattendend --keep-zshrc || exit 0
+    exit 0
+fi
+
diff --git a/roles/basic_postinstall/tasks/create_new_user.yaml b/roles/basic_postinstall/tasks/create_new_user.yaml
new file mode 100644
index 0000000..8ba891b
--- /dev/null
+++ b/roles/basic_postinstall/tasks/create_new_user.yaml
@@ -0,0 +1,66 @@
+---
+- name: Create a new user with a password, set shell
+  remote_user: ansible
+  ansible.builtin.user:
+    name: max
+    groups: sshusers,sudo
+    password: "{{ user_passwd_hash }}"
+    shell: /bin/zsh
+
+- name: Set authorized key taken from file
+  remote_user: ansible
+  ansible.posix.authorized_key:
+    user: max
+    state: present
+    key: "{{ lookup('file', lookup('env', 'HOME') + '/.ssh/ansible_key.pub') }}"
+
+- name: Copy omz installation wrapper script to the target machine
+  remote_user: ansible
+  ansible.builtin.copy:
+    src: "{{ role_path }}/files/install_omz.sh"
+    dest: /home/max/install_omz.sh
+    owner: max
+    group: max
+    mode: u=rwx,g=r,o-rwx
+
+# WARNING: UNPRIVILEGED USER (not ansible) COMMANDS
+- name: Install oh my zsh
+  remote_user: max
+  become: false
+  ansible.builtin.command: /home/max/install_omz.sh
+  changed_when: true
+
+- name: Configure oh my zsh, by pushing the config file
+  remote_user: ansible
+  ansible.builtin.copy:
+    src: "{{ role_path }}/files/.zshrc"
+    dest: /home/max/.zshrc
+    owner: max
+    group: max
+    mode: u=rw,g=r,o-rwx
+
+- name: Configure vim, by pushing the config
+  remote_user: ansible
+  ansible.builtin.copy:
+    src: "{{ role_path }}/files/.vimrc"
+    dest: /home/max/.vimrc
+    owner: max
+    group: max
+    mode: u=rw,g=r,o-rwx
+
+
+# WARNING: we've finished with the initial setup, drop ansible key
+# Push regular user key
+- name: Set authorized key taken from file
+  remote_user: ansible
+  ansible.posix.authorized_key:
+    user: max
+    state: absent
+    key: "{{ lookup('file', lookup('env', 'HOME') + '/.ssh/ansible_key.pub') }}"
+
+- name: Set authorized key taken from file
+  remote_user: ansible
+  ansible.posix.authorized_key:
+    user: max
+    state: present
+    key: "{{ lookup('file', lookup('env', 'HOME') + '/.ssh/max_regular_key.pub') }}"
diff --git a/roles/basic_postinstall/tasks/harden_ssh.yaml b/roles/basic_postinstall/tasks/harden_ssh.yaml
new file mode 100644
index 0000000..a1486dd
--- /dev/null
+++ b/roles/basic_postinstall/tasks/harden_ssh.yaml
@@ -0,0 +1,36 @@
+---
+
+- name: Configure ssh-server daemon
+  ansible.builtin.copy:
+    src: "{{ role_path }}/files/hardened_sshd.conf"
+    dest: /etc/ssh/sshd_config.d/hardened_sshd.conf
+    mode: u=rw,g=r,o=r
+  when: ansible_facts['distribution'] == 'Ubuntu'
+
+- name: Configure ssh-server daemon
+  ansible.builtin.copy:
+    src: "{{ role_path }}/files/hardened_sshd.conf"
+    dest: /etc/ssh/sshd_config.d/hardened_sshd.conf
+    mode: u=rw,g=r,o=r
+  when: ansible_facts['distribution'] == 'Debian'
+
+- name: Configure ssh client
+  remote_user: ansible
+  ansible.builtin.copy:
+    src: "{{ role_path }}/files/hardened_ssh.conf"
+    dest: /etc/ssh/ssh_config.d/hardened_ssh.conf
+    mode: u=rw,g=r,o=r
+
+- name: Restart ssh-server Debian
+  remote_user: ansible
+  ansible.builtin.service:
+    name: sshd
+    state: restarted
+  when: ansible_facts['distribution'] == 'Debian'
+
+- name: Restart ssh-server Ubuntu
+  remote_user: ansible
+  ansible.builtin.service:
+    name: ssh
+    state: restarted
+  when: ansible_facts['distribution'] == 'Ubuntu'
diff --git a/roles/basic_postinstall/tasks/install_basic_utils.yaml b/roles/basic_postinstall/tasks/install_basic_utils.yaml
new file mode 100644
index 0000000..5a6ed89
--- /dev/null
+++ b/roles/basic_postinstall/tasks/install_basic_utils.yaml
@@ -0,0 +1,42 @@
+---
+- name: Installing basic utils for comfort work (apt-based system)
+  when: (ansible_facts['distribution'] == "Debian") or
+        (ansible_facts['distribution'] == "Ubuntu")
+  ansible.builtin.apt:
+    name:
+      - vim
+      - ranger
+      - zsh
+      - rsync
+      - git
+      - curl
+      - kitty
+      - unattended-upgrades
+      - ssh
+      - openssh-server
+    update-cache: true # Run apt update before installation
+  become: true
+  remote_user: ansible
+
+- name: Install qemu-guest-agent on VM
+  when:
+    - ansible_facts['os_family'] == "Debian"
+    - ansible_facts['virtualization_type'] == "kvm"
+  ansible.builtin.apt:
+    name: qemu-guest-agent
+    state: present
+    update-cache: true # Run apt update before installation
+  become: true
+  remote_user: ansible
+  tags:
+    - kvm-guests
+    - packages
+
+
+# The same commands for Alpine
+- name: Update and install packages on Alpine
+  when: (ansible_facts['distribution'] == "Alpine")
+  community.general.apk:
+    name: vim ranger zsh rsync git curl kitty openssh
+    update_cache: true
+  remote_user: ansible
diff --git a/roles/basic_postinstall/tasks/main.yaml b/roles/basic_postinstall/tasks/main.yaml
new file mode 100644
index 0000000..b886049
--- /dev/null
+++ b/roles/basic_postinstall/tasks/main.yaml
@@ -0,0 +1,18 @@
+---
+- name: Create and set up Ansible user and environment
+  ansible.builtin.include_tasks: prepare_ansible_user.yaml
+
+- name: Improve SSH configuration
+  ansible.builtin.include_tasks: harden_ssh.yaml
+
+- name: Install basic utils
+  ansible.builtin.include_tasks: install_basic_utils.yaml
+
+- name: Remove unnecessary packages
+  ansible.builtin.include_tasks: remove_packages.yaml
+
+- name: Create and set up a new user
+  ansible.builtin.include_tasks: create_new_user.yaml
+
+- name: Set locale and time
+  ansible.builtin.include_tasks: set_locale_and_time.yaml
diff --git a/roles/0_basic_postinstall/tasks/prepare_ansible_user.yaml b/roles/basic_postinstall/tasks/prepare_ansible_user.yaml
similarity index 68%
rename from roles/0_basic_postinstall/tasks/prepare_ansible_user.yaml
rename to roles/basic_postinstall/tasks/prepare_ansible_user.yaml
index b44f405..2097ae9 100644
--- a/roles/0_basic_postinstall/tasks/prepare_ansible_user.yaml
+++ b/roles/basic_postinstall/tasks/prepare_ansible_user.yaml
@@ -1,20 +1,20 @@
 ---
 ## Installing packages
 - name: Install sudo on apt systems
-  when: (ansible_facts['distribution'] == "Debian") or 
+  when: (ansible_facts['distribution'] == "Debian") or
         (ansible_facts['distribution'] == "Ubuntu")
-  apt:
+  ansible.builtin.apt:
     name:
       - sudo
-    update-cache: yes
+    update-cache: true
 
-- name: Update Alpine packages
+# The same commands for Alpine
+- name: Update and install packages on Alpine
   when: (ansible_facts['distribution'] == "Alpine")
-  command: /sbin/apk update
-
-- name: Install sudo package on Alpine
-  when: (ansible_facts['distribution'] == "Alpine")
-  command: /sbin/apk add sudo
+  community.general.apk:
+    name: sudo
+    update_cache: true
+  remote_user: ansible
 
 
 ## Creating and setting up the ansible user
@@ -26,16 +26,16 @@
 
 ## Add the user to sshusers (for ssh access) and sudo (gain root access)
 - name: Create a new user with a password for Ansible
-  user: 
+  ansible.builtin.user:
     name: ansible
     password: "{{ ansible_user_passwd_hash }}"
 
     groups: sshusers,sudo
-    append: yes
+    append: true
 
-## Since password authentication in SSH will be disabled, we need to add an authorized key 
+## Since password authentication in SSH will be disabled, we need to add an authorized key
 - name: Set authorized key taken from file
   ansible.posix.authorized_key:
     user: ansible
     state: present
-    key: "{{ ansible_ssh_key }}"
\ No newline at end of file
+    key: "{{ ansible_ssh_key }}"
diff --git a/roles/basic_postinstall/tasks/remove_packages.yaml b/roles/basic_postinstall/tasks/remove_packages.yaml
new file mode 100644
index 0000000..c0116fd
--- /dev/null
+++ b/roles/basic_postinstall/tasks/remove_packages.yaml
@@ -0,0 +1,31 @@
+---
+# Remove multiple packages at once
+- name: Remove unnecessary packages
+  remote_user: ansible
+  when: (ansible_facts['distribution'] == "Debian") or
+        (ansible_facts['distribution'] == "Ubuntu")
+  ansible.builtin.apt:
+    name:
+      - nano
+    state: absent
+  become: true
+
+
+# Clean up all orphaned packages
+- name: Remove all orphaned dependencies
+  remote_user: ansible
+  when: (ansible_facts['distribution'] == "Debian") or
+        (ansible_facts['distribution'] == "Ubuntu")
+  ansible.builtin.apt:
+    autoremove: true
+    purge: true
+
+
+- name: Install sudo package on Alpine
+  remote_user: ansible
+  when: (ansible_facts['distribution'] == "Alpine")
+  community.general.apk:
+    name:
+      - nano
+    state: absent
+  become: true
diff --git a/roles/basic_postinstall/tasks/set_locale_and_time.yaml b/roles/basic_postinstall/tasks/set_locale_and_time.yaml
new file mode 100644
index 0000000..37eb4f6
--- /dev/null
+++ b/roles/basic_postinstall/tasks/set_locale_and_time.yaml
@@ -0,0 +1,19 @@
+---
+- name: Generate locales
+  community.general.locale_gen:
+    name:
+      - en_US.UTF-8
+      - ru_RU.UTF-8
+    state: present
+
+- name: Set locale
+  ansible.builtin.copy:
+    dest: /etc/locale.conf
+    mode: '0644'
+    content: |
+      LANG=en_US.UTF-8
+      LC_ALL=en_US.UTF-8
+
+- name: Set time
+  community.general.timezone:
+    name: Europe/Samara
diff --git a/roles/basic_proxmox_lxc/tasks/main.yaml b/roles/basic_proxmox_lxc/tasks/main.yaml
new file mode 100644
index 0000000..f5a96d6
--- /dev/null
+++ b/roles/basic_proxmox_lxc/tasks/main.yaml
@@ -0,0 +1,47 @@
+---
+
+- name: Create new container with minimal options defining network interface with static ip
+  become: false
+  community.proxmox.proxmox:
+    validate_certs: false
+    node: proxmox-server
+    api_user: root@pam
+    api_host: 192.168.0.2
+    api_token_id: ansible
+    api_token_secret: "{{ proxmox_token_secret }}"
+
+    cmode: "shell"
+    vmid: 1040
+    password: ansible-test
+    hostname: "ansible-test"
+    # ostemplate: 'main:vztmpl/debian-13-standard_13.1-2_amd64.tar.zst'
+    ostemplate: 'main:vztmpl/debian-13-golden-image.tar.gz'
+    memory: 2048
+    cores: 5
+    state: present
+    disk_volume:
+      size: 2 # 2GB rootfs
+      storage: local
+    pubkey: "{{ lookup('file', lookup('env', 'HOME') + '/.ssh/ansible_key.pub') }}"
+    netif:
+      net0: "name=eth0,gw=192.168.0.1,ip=192.168.0.40/24,bridge=vmbr0"
+
+- name: Make sure the container has started
+  become: false
+  community.proxmox.proxmox:
+    validate_certs: false
+    node: proxmox-server
+    api_user: root@pam
+    api_host: 192.168.0.2
+    api_token_id: ansible
+    api_token_secret: "{{ proxmox_token_secret }}"
+
+    vmid: 1040
+    state: started
+
+- name: Sleep for a minute to ensure that ssh is ready
+  become: false
+  ansible.builtin.wait_for:
+    timeout: 60
+  delegate_to: localhost
+  changed_when: false
diff --git a/roles/basic_proxmox_vm/tasks/main.yaml b/roles/basic_proxmox_vm/tasks/main.yaml
new file mode 100644
index 0000000..990fec3
--- /dev/null
+++ b/roles/basic_proxmox_vm/tasks/main.yaml
@@ -0,0 +1,53 @@
+---
+- name: Create a new VM with minimal options
+  become: false
+  community.proxmox.proxmox_kvm:
+    validate_certs: false
+    node: proxmox-server
+    api_user: root@pam
+    api_host: 192.168.0.2
+    api_token_id: ansible
+    api_token_secret: "{{ proxmox_token_secret }}"
+
+    clone: debian-13-cloud-init-template
+    newid: 1041
+    name: ansible-ci-test
+    storage: main
+    format: qcow2
+    full: true
+    timeout: 500
+
+- name: Tweak the hardware settings
+  become: false
+  community.proxmox.proxmox_kvm:
+    validate_certs: false
+    node: proxmox-server
+    api_user: root@pam
+    api_host: 192.168.0.2
+    api_token_id: ansible
+    api_token_secret: "{{ proxmox_token_secret }}"
+
+    vmid: 1041
+    cores: 4
+    memory: 4096 # Minimal value for debian based OS for smooth workflow
+    update: true
+
+- name: Make sure the VM has started
+  become: false
+  community.proxmox.proxmox_kvm:
+    validate_certs: false
+    node: proxmox-server
+    api_user: root@pam
+    api_host: 192.168.0.2
+    api_token_id: ansible
+    api_token_secret: "{{ proxmox_token_secret }}"
+
+    vmid: 1041
+    state: started
+
+- name: Sleep for 3 minutes to ensure that cloud-init's done its thing
+  become: false
+  ansible.builtin.wait_for:
+    timeout: 180
+  delegate_to: localhost
+  changed_when: false
diff --git a/roles/common_healthcheck/files/ca.pem b/roles/common_healthcheck/files/ca.pem
new file mode 100644
index 0000000..3f23b8e
--- /dev/null
+++ b/roles/common_healthcheck/files/ca.pem
@@ -0,0 +1,31 @@
+-----BEGIN CERTIFICATE-----
+MIIFRTCCAy2gAwIBAgIUEYfbZs1nFB1sEyTb/W2AcKn9whwwDQYJKoZIhvcNAQEL
+BQAwMTEQMA4GA1UEAwwHaG9tZS5jYTELMAkGA1UEBhMCUlUxEDAOBgNVBAcMB25v
+d2hlcmUwIBcNMjYwMjAzMTg0NTA3WhgPMjA1MzA2MjAxODQ1MDdaMDExEDAOBgNV
+BAMMB2hvbWUuY2ExCzAJBgNVBAYTAlJVMRAwDgYDVQQHDAdub3doZXJlMIICIjAN
+BgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAhZJPmln1+iZ5b35U1KBPxGdfd2ra
+V55vzjBA+9EeVJ7SgHqwvE6T7uXc/ZOpum/TiGAeU1bBtqilCwxXLLiL4Mkn6p1m
+/ePosqE4lb7vMaZmAwxTcjmvekqnrcme+V1DSY5PtQljp+YBn/npOCHWe3WHNppc
+3dUW6Y06hWk26C5xq4xdcIbs5LohMcJmMYI1kcaJPtys7RyW13Wy5dH8wF4Efdco
+J4CU0yWBhF0Ys56YPbkWu1u2DqrFRiJr53LfJ90P88R4sSeBtLZVvEzWj+kWZEfJ
+Oke7B1jXVJ40yBJ+brGQoFsD9o2x9JyNXHOUVcx1XH3a+NUFVKMJRCYPa5uaxq9h
+B2gCBD4rBlOADchwSdNk1oGmtDg8xs3fcLxUqsO2jVA2T7w9iP4arvzqHuIWwVss
+WdtcyQ/x8tjVC6cp8I8WH5CV8iWptH9exGnKbVjAWEkL6xbT7f09WDAheaXY1b59
+Opuw9KAGIvqj4NCPpdd7zwDivNFJWYfz7SkEiM9I6NMDP9BoYBVMIyxJR83NOgl0
+0gUPoEFT81k5w8k4S7kqa7YdMj3PLxGowIQb9xoQuXyAFtPhbXbHn/igKx62H/Lq
+IOBvm55+GOaSnWAlVoze6rE+qCRWr6fS4bTcGEDb8INHPriwxX+YehqxLdqcGRLG
+n8fd6ldOvS/BfXkCAwEAAaNTMFEwHQYDVR0OBBYEFBehubXS/4xlJz1AA6iVi2HA
+HPfFMB8GA1UdIwQYMBaAFBehubXS/4xlJz1AA6iVi2HAHPfFMA8GA1UdEwEB/wQF
+MAMBAf8wDQYJKoZIhvcNAQELBQADggIBACH/M9xbPuKmluznwtwofLod+4w5nTtU
+bFpGmqSRNRjnL4j0aL+Gr/lcD2tGQXf01dOVdSbBjmBmW1p/2trVdVPxTLTaIhCw
+Q8QuVmQJUkwnG1uv7W9Of9akJ4TadPKc5GfzYJJ+e71Z8sFXxFqfr0nF1fPdpPp8
+xkKsIwZopcjqLEzJydGOcHUbDWvR2fkG01DjgSevP34ZJQBm/bSAwlSs6b1119jw
+ofQD462YLtXfavSz/MzRNNgCZlEAGVNt42CDOES6aZvOIt1pCKo8hIhptKgU4GpQ
+vTE0kdekJWTUNQzbfWSF42FwllxVa4LJYXzmW7Jf30Q5xCZICH1Ofdk3qLK/B7tf
+Fo/bNP3aLU4qBWShmCzYAyW4LPKL6AfODL5X45nESQDoAlfcdfeSXrbdG7P0NAcN
+g4nROb5NNy/CgLNq2zDnq/JKdW3xvvNKT2FsNvOf3+9a99gB/L2dt8nX5SSLiWlN
+50ynzOK21Z/YHCXutLiK2ugQf9dqj2rw7/C9oktoyvqwoVILhcsA0mhpN4343zI4
+PK2/zIjd0nZWaZLpJCj0yREnhhqgV3Par9d5biRfgFUuIoBnXIh4fr75xdkxqECX
+pKu2rt3D0YGkPsP5lausvPbUy4nYcT1UkMwtdi0JZLNx04m22ZTzXpATo96LoWob
+9eRPR6uW/Kmp
+-----END CERTIFICATE-----
diff --git a/roles/common_healthcheck/tasks/main.yaml b/roles/common_healthcheck/tasks/main.yaml
new file mode 100644
index 0000000..6a08e66
--- /dev/null
+++ b/roles/common_healthcheck/tasks/main.yaml
@@ -0,0 +1,44 @@
+---
+- name: Internet connection test block
+  block:
+    - name: Test reachability to ya.ru
+      become: true # Usually it's not necessary, but sometimes there are some wierd issues with ping, especially on Alpine
+      ansible.builtin.shell: ping -c 5 ya.ru > /dev/null
+      changed_when: false   # This task does not change the system
+
+  rescue:
+    # This won't work for now. CA certificate reissuing is required!
+    - name: Create a test file
+      become: false
+      ansible.builtin.uri:
+        url: "{{ ha_addr }}/api/webhook/{{ ha_webhook_token }}"
+        ca_path: ../files/ca.pem
+      delegate_to: 127.0.0.1
+      # TODO: REMOVE THIS AFTER REISSUING CA CERTIFICATE!
+      failed_when: false
+
+- name: Disk free space test block
+  block:
+    - name: Test free disk space in root
+      become: false
+      ansible.builtin.shell: set -o pipefail && df -h / | tail -1 | awk '{gsub(/%/, "", $5); print $5}'
+      register: common_healthcheck_result
+      failed_when: common_healthcheck_result.stdout | int > 85
+      changed_when: false   # This task does not change the system
+
+  rescue:
+    - name: Notify with ntfy
+      become: false
+      ansible.builtin.uri:
+        url: "{{ ntfy_topic }}"
+        method: POST
+        body_format: json
+        status_code: [200, 202]
+        return_content: true
+        headers:
+          Authorization: "Bearer {{ ntfy_topic_token }}"
+        body:
+          - "{{ ansible_facts['hostname'] }}: Disk space is low"
+      delegate_to: 127.0.0.1
+      failed_when: false
+      changed_when: false   # This task does not change the system
diff --git a/run_playbook.sh b/run_playbook.sh
index edd598b..8fd8521 100755
--- a/run_playbook.sh
+++ b/run_playbook.sh
@@ -1,4 +1,4 @@
 #!/bin/sh
-ansible-playbook -i inventory/hosts.yaml playbooks/deploy.yaml \
+ansible-playbook -i inventory/hosts.yaml $1 \
     --private-key inventory/group_vars/secret/ansible_key \
     --vault-password-file inventory/group_vars/secret/.vault_pass
\ No newline at end of file
diff --git a/systemd/ansible-maintenance.service b/systemd/ansible-maintenance.service
new file mode 100644
index 0000000..2717b2b
--- /dev/null
+++ b/systemd/ansible-maintenance.service
@@ -0,0 +1,19 @@
+[Unit]
+Description=Run Ansible playbook for daily maintenance
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+# CAHNGE TO MATCH YOUR REQUIREMENTS
+User=max
+Group=max
+WorkingDirectory=/home/max/projects/ansible_home
+ExecStart=/home/max/projects/ansible_home/run_playbook.sh /home/max/projects/ansible_home/playbooks/maintain.yaml 
+StandardOutput=journal
+StandardError=journal
+# Optional: prevent runaway if the playbook hangs
+TimeoutStopSec=3600
+
+[Install]
+WantedBy=multi-user.target
diff --git a/systemd/ansible-maintenance.timer b/systemd/ansible-maintenance.timer
new file mode 100644
index 0000000..6e606e0
--- /dev/null
+++ b/systemd/ansible-maintenance.timer
@@ -0,0 +1,11 @@
+[Unit]
+Description=Timer for Ansible maintenance playbook, runs every 10 minutes
+Requires=ansible-maintenance.service
+
+[Timer]
+OnUnitActiveSec=10min
+Persistent=true
+Unit=ansible-maintenance.service
+
+[Install]
+WantedBy=timers.target