- mv common vault to group_vars/all/vault_common.yml - conclude timesyncing setup - enable cronie/chrony for systems - set up dnscrypt properly, including replacing /etc/resolv.conf and validating the config - fix privileges (become)