diff --git a/.github/workflows/ansible-apply.yaml b/.github/workflows/ansible-apply.yaml
index 0de8c31..5180edf 100644
--- a/.github/workflows/ansible-apply.yaml
+++ b/.github/workflows/ansible-apply.yaml
@@ -80,9 +80,10 @@ jobs:
           SSH_AUTH_SOCK: /tmp/ssh_agent.sock
         run: |
           cd ansible
-          sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_hardening.yml --skip-tags roles::cis::suid
-          sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_microk8s.yml
-          sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_gitea.yml
-          sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_nextcloud.yml
-          sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_wordpress.yml
-          sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_m3uproxy.yml
+          sectool exec ansible-playbook -u $ANSIBLE_USER playbook_cis.yml --skip-tags roles::cis::suid
+          sectool exec ansible-playbook -u $ANSIBLE_USER playbook_encryption.yml
+          sectool exec ansible-playbook -u $ANSIBLE_USER playbook_microk8s.yml
+          sectool exec ansible-playbook -u $ANSIBLE_USER playbook_gitea.yml
+          sectool exec ansible-playbook -u $ANSIBLE_USER playbook_nextcloud.yml
+          sectool exec ansible-playbook -u $ANSIBLE_USER playbook_wordpress.yml
+          sectool exec ansible-playbook -u $ANSIBLE_USER playbook_m3uproxy.yml
diff --git a/.github/workflows/terraform-iac-apply.yaml b/.github/workflows/terraform-iac-apply.yaml
new file mode 100644
index 0000000..c02c8c5
--- /dev/null
+++ b/.github/workflows/terraform-iac-apply.yaml
@@ -0,0 +1,41 @@
+name: Terraform Apply
+
+on:
+  schedule:
+    - cron: "0 1 * * 0"
+  push:
+    branches:
+      - main
+    paths:
+      - "terraform/iac/**"
+      - .github/workflows/terraform-iac-apply.yaml
+
+jobs:
+  terraform-apply:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v2
+
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v1
+        with:
+          terraform_version: 1.9.6
+
+      - name: Setup Sectool
+        uses: a13labs/setup-sectool@v1
+
+      - name: Terraform Init
+        env:
+          VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
+        run: |
+          cd terraform/iac
+          sectool exec terraform init
+
+      - name: Terraform Apply
+        env:
+          VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
+        run: |
+          cd terraform/iac
+          sectool exec terraform apply --auto-approve
diff --git a/.github/workflows/terraform-iac-validate.yaml b/.github/workflows/terraform-iac-validate.yaml
new file mode 100644
index 0000000..8cfe460
--- /dev/null
+++ b/.github/workflows/terraform-iac-validate.yaml
@@ -0,0 +1,36 @@
+name: Terraform Validate
+
+on:
+  pull_request:
+    branches:
+      - main
+    paths:
+      - "terraform/iac/**"
+      - .github/workflows/terraform-iac-validate.yaml
+    types:
+      - opened
+      - synchronize
+      - reopened
+jobs:
+  terraform-validate:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v2
+
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v1
+        with:
+          terraform_version: 1.9.6
+
+      - name: Setup Sectool
+        uses: a13labs/setup-sectool@v1
+
+      - name: Terraform Init and Validate
+        env:
+          VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
+        run: |
+          cd terraform/iac
+          sectool exec terraform init
+          terraform validate
diff --git a/.github/workflows/terraform-k8apps-validate.yaml b/.github/workflows/terraform-k8apps-validate.yaml
index 51c5bc8..55f1493 100644
--- a/.github/workflows/terraform-k8apps-validate.yaml
+++ b/.github/workflows/terraform-k8apps-validate.yaml
@@ -82,21 +82,10 @@ jobs:
           mkdir -p ~/.kube
           ansible -i ansible/inventory/hosts -u $ANSIBLE_USER -m fetch -a "src=/home/$ANSIBLE_USER/.kube/config dest=~/.kube/config flat=yes" microk8s
 
-      - name: Terraform Init
+      - name: Terraform Init and Validate
         env:
           VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
         run: |
           cd terraform/k8sapps
           sectool exec terraform init
-
-      - name: Terraform Plan
-        env:
-          VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
-        run: |
-          cd terraform/k8sapps
-          sectool exec -n terraform plan -out=tfplan
-
-      - name: Show Terraform Plan
-        run: |
-          cd terraform/k8sapps
-          terraform show tfplan
+          terraform validate
diff --git a/ansible/.ansible-lint b/ansible/.ansible-lint
index ef6405d..181f3a7 100644
--- a/ansible/.ansible-lint
+++ b/ansible/.ansible-lint
@@ -4,7 +4,8 @@ exclude_paths:
   - .github/
   - tests/
 enable_list:
-  - fqcn-builtins  # opt-in
+  - fqcn-builtins # opt-in
 warn_list:
   - line-length
   - yaml[line-length]
+  - var-naming[no-role-prefix]
diff --git a/ansible/host_vars/contabo01.a13labs.pt.yaml b/ansible/host_vars/contabo01.a13labs.pt.yaml
index 87eeb8f..41c6882 100644
--- a/ansible/host_vars/contabo01.a13labs.pt.yaml
+++ b/ansible/host_vars/contabo01.a13labs.pt.yaml
@@ -11,7 +11,7 @@ sshd_permit_root_login: "no"
 sshd_password_authentication: "no"
 sshd_allow_tcp_forwarding: "yes"
 ansible_user: "{{ lookup('env', 'ANSIBLE_USER') }}"
-ssh_users:
+login_users:
   - username: operator
     comment: "Managed by Ansible"
     sudoer: true
@@ -57,9 +57,11 @@ custom_hosts_acls: true
 
 # GeoIP subscription
 geoip_sshd_enabled: true
-ssh_allowed_zones:
+geoip_ssh_allowed_zones:
   - "BE"
   - "PT"
+geoip_ssh_allowed_networks:
+  - "0.0.0.0/0"
 
 # fail2ban
 fail2ban_jails:
@@ -77,20 +79,22 @@ unattended_reboot: true
 unattended_reboot_time: "04:30"
 
 # Kubernetes specific settings
-microk8s_alt_names: "{{ hostname }}"
-k8s_version: 1.29
-k8s_allowed_hosts:
+microk8s_version: 1.29
+microk8s_allowed_hosts:
   - 87.67.163.177
+microk8s_alt_names: "{{ hostname }}"
 
-k8s_users:
+# Let's encrypt issuer
+microk8s_issuer_email: c.alexandre.pires@alexpires.me
+microk8s_encryption_cfg: /a13labs/microk8s_encryption.yaml
+microk8s_encryption_secret: "{{ lookup('env', 'MICROK8S_ENCRYPTION_SECRET') }}"
+microk8s_users:
   - username: operator
     enabled: true
   - username: git
     namespace: "gitea"
     enabled: true
 
-# Let's encrypt issuer
-issuer_email: c.alexandre.pires@alexpires.me
-
+# Duo Security
 duo_users: ["*", "!provision", "!git"]
 duo_api_hostname: api-7cda1654.duosecurity.com
diff --git a/ansible/playbook_hardening.yml b/ansible/playbook_cis.yml
similarity index 74%
rename from ansible/playbook_hardening.yml
rename to ansible/playbook_cis.yml
index 985c785..f10119e 100644
--- a/ansible/playbook_hardening.yml
+++ b/ansible/playbook_cis.yml
@@ -8,14 +8,11 @@
       tags:
         - roles
         - roles::bootstrap
-    - role: "manage_users"
+    - role: "login"
       tags:
         - roles
         - roles::users
-    - role: "cis_hardening"
-      vars:
-        # currently aide is failing
-        install_aide: false
+    - role: "cis"
       tags:
         - roles
         - roles::cis
@@ -27,8 +24,7 @@
       tags:
         - roles
         - roles::geoip
-    - role: "duo_security"
+    - role: "duo"
       tags:
         - roles
         - roles::duosecurity
-
diff --git a/ansible/playbook_encryption.yml b/ansible/playbook_encryption.yml
new file mode 100644
index 0000000..7cdbcae
--- /dev/null
+++ b/ansible/playbook_encryption.yml
@@ -0,0 +1,151 @@
+---
+- name: Setup encrypted volume for a13labs
+  hosts: contabo
+  become: true
+  vars:
+    disk_image_path: /a13labs.img
+    disk_image_size: 1G
+    luks_device_name: a13labs
+    mount_point: /a13labs
+    key_file_path: /root/a13labs.key
+    key_file_url: https://a13labs-infra-{{ lookup('env','BUCKET_SUFFIX') }}.s3.fr-par.scw.cloud
+    key_fetch_service: a13labs-key.service
+
+  tasks:
+    - name: Install cryptsetup and curl
+      ansible.builtin.apt:
+        name:
+          - cryptsetup
+          - curl
+        state: present
+      when: ansible_os_family == 'Debian'
+
+    - name: Get mac address
+      ansible.builtin.shell: |
+        set -o pipefail
+        ip link show eth0 | awk '/ether/ {print $2}'
+      args:
+        executable: /bin/bash
+      register: mac_address
+      changed_when: false
+
+    - name: Sanitize mac address
+      ansible.builtin.set_fact:
+        mac_address_sanitized: "{{ mac_address.stdout | regex_replace('[:]', '_') }}"
+      changed_when: false
+
+    - name: Create disk image
+      ansible.builtin.command: fallocate -l {{ disk_image_size }} {{ disk_image_path }}
+      args:
+        creates: "{{ disk_image_path }}"
+      register: disk_image
+
+    - name: Create bucket URL
+      ansible.builtin.set_fact:
+        key_file_url: "{{ key_file_url }}/keys/{{ mac_address_sanitized }}.key"
+      changed_when: false
+
+    - name: Create encrypted volume # noqa no-handler
+      when: disk_image is changed
+      block:
+
+        - name: Download key file from Key server
+          ansible.builtin.uri:
+            url: "{{ key_file_url }}"
+            dest: "{{ key_file_path }}"
+            mode: '0600'
+          args:
+            creates: "{{ key_file_path }}"
+
+        - name: Set up LUKS encryption with key file
+          ansible.builtin.command: cryptsetup -q luksFormat {{ disk_image_path }} {{ key_file_path }}
+          changed_when: false
+
+        - name: Open LUKS device with key file
+          ansible.builtin.command: cryptsetup luksOpen {{ disk_image_path }} {{ luks_device_name }} -d {{ key_file_path }}
+          register: luks_device
+          changed_when: false
+
+        - name: Create file system
+          ansible.builtin.command: mkfs.ext4 /dev/mapper/{{ luks_device_name }}
+          changed_when: false
+
+        - name: Close LUKS device
+          ansible.builtin.command: cryptsetup close {{ luks_device_name }}
+          changed_when: false
+
+        - name: Delete key file
+          ansible.builtin.file:
+            path: "{{ key_file_path }}"
+            state: absent
+
+    - name: Create mount point
+      ansible.builtin.file:
+        path: "{{ mount_point }}"
+        state: directory
+        mode: "0750"
+
+    - name: Create systemd service to fetch key file and open LUKS device
+      ansible.builtin.copy:
+        dest: /etc/systemd/system/{{ key_fetch_service }}
+        mode: '0644'
+        content: |
+          [Unit]
+          Description=Open LUKS device
+          After=network-online.target
+          Before=snap.microk8s.daemon-kubelite.service
+
+          [Service]
+          Type=oneshot
+          RemainAfterExit=true
+          ExecStartPre=/usr/bin/curl -o {{ key_file_path }} "{{ key_file_url }}"
+          ExecStart=/usr/sbin/cryptsetup luksOpen {{ disk_image_path }} {{ luks_device_name }} -d {{ key_file_path }}
+          ExecStartPost=/bin/rm -f {{ key_file_path }}
+          ExecStop=/usr/sbin/cryptsetup close {{ luks_device_name }}
+
+          [Install]
+          WantedBy=snap.microk8s.daemon-kubelite.service
+
+    - name: Create systemd service to mount the file system
+      ansible.builtin.copy:
+        dest: /etc/systemd/system/{{ mount_point | basename }}.mount
+        mode: '0644'
+        content: |
+          [Unit]
+          Description=Mount LUKS device
+          After={{ key_fetch_service }}
+          Requires={{ key_fetch_service }}
+          Before=snap.microk8s.daemon-kubelite.service
+
+          [Mount]
+          What=/dev/mapper/{{ luks_device_name }}
+          Where={{ mount_point }}
+          Type=ext4
+          Options=defaults
+
+          [Install]
+          WantedBy=snap.microk8s.daemon-kubelite.service
+
+    - name: Reload systemd daemon
+      ansible.builtin.systemd:
+        daemon_reload: true
+
+    - name: Enable the key fetch service
+      ansible.builtin.systemd:
+        name: "{{ key_fetch_service }}"
+        enabled: true
+
+    - name: Enable the mount device
+      ansible.builtin.systemd:
+        name: "{{ mount_point | basename }}.mount"
+        enabled: true
+
+    - name: Start the key fetch service
+      ansible.builtin.systemd:
+        name: "{{ key_fetch_service }}"
+        state: started
+
+    - name: Start the mount device
+      ansible.builtin.systemd:
+        name: "{{ mount_point | basename }}.mount"
+        state: started
diff --git a/ansible/playbook_gitea.yml b/ansible/playbook_gitea.yml
index 478c84a..c1e5fa9 100644
--- a/ansible/playbook_gitea.yml
+++ b/ansible/playbook_gitea.yml
@@ -8,6 +8,7 @@
     - name: Set required facts
       ansible.builtin.set_fact:
         gitea_home: "/var/lib/gitea"
+        gitea_config_dir: "/a13labs/gitea"
         gitea_mysql_home: "/var/lib/mysql.gitea"
         gitea_user_id: 1000
         gitea_group_id: 1000
@@ -57,6 +58,18 @@
         - tasks
         - tasks::folders
 
+    - name: Create required gitea config folder
+      become: true
+      ansible.builtin.file:
+        state: directory
+        path: "{{ gitea_config_dir }}"
+        mode: "0750"
+        owner: "{{ gitea_user_id }}"
+        group: "{{ gitea_group_id }}"
+      tags:
+        - tasks
+        - tasks::folders
+
     - name: Create required mysql data folder
       become: true
       ansible.builtin.file:
diff --git a/ansible/playbook_kvm.yml b/ansible/playbook_kvm.yml
deleted file mode 100644
index 1d4f932..0000000
--- a/ansible/playbook_kvm.yml
+++ /dev/null
@@ -1,36 +0,0 @@
----
-- name: Virtualization Server
-  hosts: kvm
-  gather_facts: true
-
-  roles:
-    - role: "bootstrap"
-      tags:
-        - roles
-        - roles::bootstrap
-    - role: "manage_users"
-      tags:
-        - roles
-        - roles::users
-    - role: "cis_hardening"
-      vars:
-        # currently aide is failing
-        install_aide: false
-      tags:
-        - roles
-        - roles::cis
-    - role: "fail2ban"
-      tags:
-        - roles
-        - roles::fail2ban
-    - role: "geoip"
-      tags:
-        - roles
-        - roles::geoip
-    - role: "duo_security"
-      tags:
-        - roles
-        - roles::duosecurity
-    - role: "virtualization"
-      tags:
-        - role::virtualization
diff --git a/ansible/playbook_microk8s.yml b/ansible/playbook_microk8s.yml
index 19beff6..0fe2045 100644
--- a/ansible/playbook_microk8s.yml
+++ b/ansible/playbook_microk8s.yml
@@ -1,13 +1,9 @@
 ---
-- name: Microk8s Setup 
-  hosts: microk8s 
+- name: Microk8s Setup
+  hosts: microk8s
   gather_facts: true
 
   roles:
-    - role: "manage_users"
-      tags:
-        - roles
-        - roles::users
     - role: "microk8s"
       tags:
         - role::microk8s
diff --git a/ansible/requirements.yml b/ansible/requirements.yml
index 115ff93..a6b0fd8 100644
--- a/ansible/requirements.yml
+++ b/ansible/requirements.yml
@@ -2,4 +2,3 @@
 collections:
   - ansible.posix
   - community.general
-  - community.libvirt
diff --git a/ansible/roles/cis_hardening/.ansible-lint b/ansible/roles/cis/.ansible-lint
similarity index 71%
rename from ansible/roles/cis_hardening/.ansible-lint
rename to ansible/roles/cis/.ansible-lint
index cbb696b..241659f 100644
--- a/ansible/roles/cis_hardening/.ansible-lint
+++ b/ansible/roles/cis/.ansible-lint
@@ -4,9 +4,10 @@ exclude_paths:
   - .github/
   - tests/
 enable_list:
-  - fqcn-builtins  # opt-in
+  - fqcn-builtins # opt-in
 warn_list:
   - line-length
   - yaml[line-length]
 skip_list:
   - yaml[comments]
+  - var-naming[no-role-prefix]
diff --git a/ansible/roles/cis_hardening/.yamllint.yml b/ansible/roles/cis/.yamllint.yml
similarity index 100%
rename from ansible/roles/cis_hardening/.yamllint.yml
rename to ansible/roles/cis/.yamllint.yml
diff --git a/ansible/roles/cis_hardening/defaults/main/auditd.yml b/ansible/roles/cis/defaults/main/auditd.yml
similarity index 100%
rename from ansible/roles/cis_hardening/defaults/main/auditd.yml
rename to ansible/roles/cis/defaults/main/auditd.yml
diff --git a/ansible/roles/cis_hardening/defaults/main/compilers.yml b/ansible/roles/cis/defaults/main/compilers.yml
similarity index 100%
rename from ansible/roles/cis_hardening/defaults/main/compilers.yml
rename to ansible/roles/cis/defaults/main/compilers.yml
diff --git a/ansible/roles/cis_hardening/defaults/main/disablewireless.yml b/ansible/roles/cis/defaults/main/disablewireless.yml
similarity index 100%
rename from ansible/roles/cis_hardening/defaults/main/disablewireless.yml
rename to ansible/roles/cis/defaults/main/disablewireless.yml
diff --git a/ansible/roles/cis_hardening/defaults/main/dns.yml b/ansible/roles/cis/defaults/main/dns.yml
similarity index 100%
rename from ansible/roles/cis_hardening/defaults/main/dns.yml
rename to ansible/roles/cis/defaults/main/dns.yml
diff --git a/ansible/roles/cis_hardening/defaults/main/ipv6.yml b/ansible/roles/cis/defaults/main/ipv6.yml
similarity index 100%
rename from ansible/roles/cis_hardening/defaults/main/ipv6.yml
rename to ansible/roles/cis/defaults/main/ipv6.yml
diff --git a/ansible/roles/cis_hardening/defaults/main/limits.yml b/ansible/roles/cis/defaults/main/limits.yml
similarity index 100%
rename from ansible/roles/cis_hardening/defaults/main/limits.yml
rename to ansible/roles/cis/defaults/main/limits.yml
diff --git a/ansible/roles/cis_hardening/defaults/main/misc.yml b/ansible/roles/cis/defaults/main/misc.yml
similarity index 93%
rename from ansible/roles/cis_hardening/defaults/main/misc.yml
rename to ansible/roles/cis/defaults/main/misc.yml
index 55e3389..1b8cc82 100644
--- a/ansible/roles/cis_hardening/defaults/main/misc.yml
+++ b/ansible/roles/cis/defaults/main/misc.yml
@@ -1,5 +1,5 @@
 ---
-install_aide: true
+install_aide: false
 reboot_ubuntu: false
 redhat_signing_keys:
   - 567E347AD0044ADE55BA8A5F199E2F91FD431D51
@@ -10,4 +10,3 @@ epel8_signing_keys:
   - 94E279EB8D8F25B21810ADF121EA45AB2F86D6A1
 epel9_signing_keys:
   - FF8AD1344597106ECE813B918A3872BF3228467C
-...
diff --git a/ansible/roles/cis_hardening/defaults/main/module_blocklists.yml b/ansible/roles/cis/defaults/main/module_blocklists.yml
similarity index 100%
rename from ansible/roles/cis_hardening/defaults/main/module_blocklists.yml
rename to ansible/roles/cis/defaults/main/module_blocklists.yml
diff --git a/ansible/roles/cis_hardening/defaults/main/mount.yml b/ansible/roles/cis/defaults/main/mount.yml
similarity index 100%
rename from ansible/roles/cis_hardening/defaults/main/mount.yml
rename to ansible/roles/cis/defaults/main/mount.yml
diff --git a/ansible/roles/cis_hardening/defaults/main/ntp.yml b/ansible/roles/cis/defaults/main/ntp.yml
similarity index 100%
rename from ansible/roles/cis_hardening/defaults/main/ntp.yml
rename to ansible/roles/cis/defaults/main/ntp.yml
diff --git a/ansible/roles/cis_hardening/defaults/main/packages.yml b/ansible/roles/cis/defaults/main/packages.yml
similarity index 100%
rename from ansible/roles/cis_hardening/defaults/main/packages.yml
rename to ansible/roles/cis/defaults/main/packages.yml
diff --git a/ansible/roles/cis_hardening/defaults/main/password.yml b/ansible/roles/cis/defaults/main/password.yml
similarity index 100%
rename from ansible/roles/cis_hardening/defaults/main/password.yml
rename to ansible/roles/cis/defaults/main/password.yml
diff --git a/ansible/roles/cis_hardening/defaults/main/sshd.yml b/ansible/roles/cis/defaults/main/sshd.yml
similarity index 100%
rename from ansible/roles/cis_hardening/defaults/main/sshd.yml
rename to ansible/roles/cis/defaults/main/sshd.yml
diff --git a/ansible/roles/cis_hardening/defaults/main/suid_sgid_blocklist.yml b/ansible/roles/cis/defaults/main/suid_sgid_blocklist.yml
similarity index 100%
rename from ansible/roles/cis_hardening/defaults/main/suid_sgid_blocklist.yml
rename to ansible/roles/cis/defaults/main/suid_sgid_blocklist.yml
diff --git a/ansible/roles/cis_hardening/defaults/main/sysctl.yml b/ansible/roles/cis/defaults/main/sysctl.yml
similarity index 100%
rename from ansible/roles/cis_hardening/defaults/main/sysctl.yml
rename to ansible/roles/cis/defaults/main/sysctl.yml
diff --git a/ansible/roles/cis_hardening/defaults/main/ufw.yml b/ansible/roles/cis/defaults/main/ufw.yml
similarity index 100%
rename from ansible/roles/cis_hardening/defaults/main/ufw.yml
rename to ansible/roles/cis/defaults/main/ufw.yml
diff --git a/ansible/roles/cis_hardening/defaults/main/umask.yml b/ansible/roles/cis/defaults/main/umask.yml
similarity index 100%
rename from ansible/roles/cis_hardening/defaults/main/umask.yml
rename to ansible/roles/cis/defaults/main/umask.yml
diff --git a/ansible/roles/cis_hardening/defaults/main/users.yml b/ansible/roles/cis/defaults/main/users.yml
similarity index 100%
rename from ansible/roles/cis_hardening/defaults/main/users.yml
rename to ansible/roles/cis/defaults/main/users.yml
diff --git a/ansible/roles/cis_hardening/files/usr/share/dict/passwords.list b/ansible/roles/cis/files/usr/share/dict/passwords.list
similarity index 100%
rename from ansible/roles/cis_hardening/files/usr/share/dict/passwords.list
rename to ansible/roles/cis/files/usr/share/dict/passwords.list
diff --git a/ansible/roles/cis_hardening/handlers/main.yml b/ansible/roles/cis/handlers/main.yml
similarity index 100%
rename from ansible/roles/cis_hardening/handlers/main.yml
rename to ansible/roles/cis/handlers/main.yml
diff --git a/ansible/roles/cis_hardening/molecule/default/converge.yml b/ansible/roles/cis/molecule/default/converge.yml
similarity index 100%
rename from ansible/roles/cis_hardening/molecule/default/converge.yml
rename to ansible/roles/cis/molecule/default/converge.yml
diff --git a/ansible/roles/cis_hardening/molecule/default/molecule.yml b/ansible/roles/cis/molecule/default/molecule.yml
similarity index 100%
rename from ansible/roles/cis_hardening/molecule/default/molecule.yml
rename to ansible/roles/cis/molecule/default/molecule.yml
diff --git a/ansible/roles/cis_hardening/molecule/default/verify.yml b/ansible/roles/cis/molecule/default/verify.yml
similarity index 100%
rename from ansible/roles/cis_hardening/molecule/default/verify.yml
rename to ansible/roles/cis/molecule/default/verify.yml
diff --git a/ansible/roles/cis_hardening/molecule/redhat/molecule.yml b/ansible/roles/cis/molecule/redhat/molecule.yml
similarity index 100%
rename from ansible/roles/cis_hardening/molecule/redhat/molecule.yml
rename to ansible/roles/cis/molecule/redhat/molecule.yml
diff --git a/ansible/roles/cis_hardening/molecule/ubuntu/molecule.yml b/ansible/roles/cis/molecule/ubuntu/molecule.yml
similarity index 100%
rename from ansible/roles/cis_hardening/molecule/ubuntu/molecule.yml
rename to ansible/roles/cis/molecule/ubuntu/molecule.yml
diff --git a/ansible/roles/cis_hardening/requirements.yml b/ansible/roles/cis/requirements.yml
similarity index 100%
rename from ansible/roles/cis_hardening/requirements.yml
rename to ansible/roles/cis/requirements.yml
diff --git a/ansible/roles/cis_hardening/tasks/adduser.yml b/ansible/roles/cis/tasks/adduser.yml
similarity index 100%
rename from ansible/roles/cis_hardening/tasks/adduser.yml
rename to ansible/roles/cis/tasks/adduser.yml
diff --git a/ansible/roles/cis_hardening/tasks/aide.yml b/ansible/roles/cis/tasks/aide.yml
similarity index 100%
rename from ansible/roles/cis_hardening/tasks/aide.yml
rename to ansible/roles/cis/tasks/aide.yml
diff --git a/ansible/roles/cis_hardening/tasks/apparmor.yml b/ansible/roles/cis/tasks/apparmor.yml
similarity index 100%
rename from ansible/roles/cis_hardening/tasks/apparmor.yml
rename to ansible/roles/cis/tasks/apparmor.yml
diff --git a/ansible/roles/cis_hardening/tasks/apport.yml b/ansible/roles/cis/tasks/apport.yml
similarity index 100%
rename from ansible/roles/cis_hardening/tasks/apport.yml
rename to ansible/roles/cis/tasks/apport.yml
diff --git a/ansible/roles/cis_hardening/tasks/auditd.yml b/ansible/roles/cis/tasks/auditd.yml
similarity index 100%
rename from ansible/roles/cis_hardening/tasks/auditd.yml
rename to ansible/roles/cis/tasks/auditd.yml
diff --git a/ansible/roles/cis_hardening/tasks/compilers.yml b/ansible/roles/cis/tasks/compilers.yml
similarity index 100%
rename from ansible/roles/cis_hardening/tasks/compilers.yml
rename to ansible/roles/cis/tasks/compilers.yml
diff --git a/ansible/roles/cis_hardening/tasks/cron.yml b/ansible/roles/cis/tasks/cron.yml
similarity index 100%
rename from ansible/roles/cis_hardening/tasks/cron.yml
rename to ansible/roles/cis/tasks/cron.yml
diff --git a/ansible/roles/cis_hardening/tasks/ctrlaltdel.yml b/ansible/roles/cis/tasks/ctrlaltdel.yml
similarity index 100%
rename from ansible/roles/cis_hardening/tasks/ctrlaltdel.yml
rename to ansible/roles/cis/tasks/ctrlaltdel.yml
diff --git a/ansible/roles/cis_hardening/tasks/disablefs.yml b/ansible/roles/cis/tasks/disablefs.yml
similarity index 100%
rename from ansible/roles/cis_hardening/tasks/disablefs.yml
rename to ansible/roles/cis/tasks/disablefs.yml
diff --git a/ansible/roles/cis_hardening/tasks/disablemod.yml b/ansible/roles/cis/tasks/disablemod.yml
similarity index 100%
rename from ansible/roles/cis_hardening/tasks/disablemod.yml
rename to ansible/roles/cis/tasks/disablemod.yml
diff --git a/ansible/roles/cis_hardening/tasks/disablenet.yml b/ansible/roles/cis/tasks/disablenet.yml
similarity index 100%
rename from ansible/roles/cis_hardening/tasks/disablenet.yml
rename to ansible/roles/cis/tasks/disablenet.yml
diff --git a/ansible/roles/cis_hardening/tasks/disablewireless.yml b/ansible/roles/cis/tasks/disablewireless.yml
similarity index 100%
rename from ansible/roles/cis_hardening/tasks/disablewireless.yml
rename to ansible/roles/cis/tasks/disablewireless.yml
diff --git a/ansible/roles/cis_hardening/tasks/extras.yml b/ansible/roles/cis/tasks/extras.yml
similarity index 100%
rename from ansible/roles/cis_hardening/tasks/extras.yml
rename to ansible/roles/cis/tasks/extras.yml
diff --git a/ansible/roles/cis_hardening/tasks/facts.yml b/ansible/roles/cis/tasks/facts.yml
similarity index 100%
rename from ansible/roles/cis_hardening/tasks/facts.yml
rename to ansible/roles/cis/tasks/facts.yml
diff --git a/ansible/roles/cis_hardening/tasks/fstab.yml b/ansible/roles/cis/tasks/fstab.yml
similarity index 100%
rename from ansible/roles/cis_hardening/tasks/fstab.yml
rename to ansible/roles/cis/tasks/fstab.yml
diff --git a/ansible/roles/cis_hardening/tasks/hosts.yml b/ansible/roles/cis/tasks/hosts.yml
similarity index 100%
rename from ansible/roles/cis_hardening/tasks/hosts.yml
rename to ansible/roles/cis/tasks/hosts.yml
diff --git a/ansible/roles/cis_hardening/tasks/ipv6.yml b/ansible/roles/cis/tasks/ipv6.yml
similarity index 100%
rename from ansible/roles/cis_hardening/tasks/ipv6.yml
rename to ansible/roles/cis/tasks/ipv6.yml
diff --git a/ansible/roles/cis_hardening/tasks/issue.yml b/ansible/roles/cis/tasks/issue.yml
similarity index 100%
rename from ansible/roles/cis_hardening/tasks/issue.yml
rename to ansible/roles/cis/tasks/issue.yml
diff --git a/ansible/roles/cis_hardening/tasks/journalconf.yml b/ansible/roles/cis/tasks/journalconf.yml
similarity index 100%
rename from ansible/roles/cis_hardening/tasks/journalconf.yml
rename to ansible/roles/cis/tasks/journalconf.yml
diff --git a/ansible/roles/cis_hardening/tasks/limits.yml b/ansible/roles/cis/tasks/limits.yml
similarity index 100%
rename from ansible/roles/cis_hardening/tasks/limits.yml
rename to ansible/roles/cis/tasks/limits.yml
diff --git a/ansible/roles/cis_hardening/tasks/lockroot.yml b/ansible/roles/cis/tasks/lockroot.yml
similarity index 100%
rename from ansible/roles/cis_hardening/tasks/lockroot.yml
rename to ansible/roles/cis/tasks/lockroot.yml
diff --git a/ansible/roles/cis_hardening/tasks/logindconf.yml b/ansible/roles/cis/tasks/logindconf.yml
similarity index 100%
rename from ansible/roles/cis_hardening/tasks/logindconf.yml
rename to ansible/roles/cis/tasks/logindconf.yml
diff --git a/ansible/roles/cis_hardening/tasks/logindefs.yml b/ansible/roles/cis/tasks/logindefs.yml
similarity index 100%
rename from ansible/roles/cis_hardening/tasks/logindefs.yml
rename to ansible/roles/cis/tasks/logindefs.yml
diff --git a/ansible/roles/cis_hardening/tasks/main.yml b/ansible/roles/cis/tasks/main.yml
similarity index 100%
rename from ansible/roles/cis_hardening/tasks/main.yml
rename to ansible/roles/cis/tasks/main.yml
diff --git a/ansible/roles/cis_hardening/tasks/motdnews.yml b/ansible/roles/cis/tasks/motdnews.yml
similarity index 100%
rename from ansible/roles/cis_hardening/tasks/motdnews.yml
rename to ansible/roles/cis/tasks/motdnews.yml
diff --git a/ansible/roles/cis_hardening/tasks/mount.yml b/ansible/roles/cis/tasks/mount.yml
similarity index 100%
rename from ansible/roles/cis_hardening/tasks/mount.yml
rename to ansible/roles/cis/tasks/mount.yml
diff --git a/ansible/roles/cis_hardening/tasks/packagemgmt.yml b/ansible/roles/cis/tasks/packagemgmt.yml
similarity index 100%
rename from ansible/roles/cis_hardening/tasks/packagemgmt.yml
rename to ansible/roles/cis/tasks/packagemgmt.yml
diff --git a/ansible/roles/cis_hardening/tasks/packages.yml b/ansible/roles/cis/tasks/packages.yml
similarity index 100%
rename from ansible/roles/cis_hardening/tasks/packages.yml
rename to ansible/roles/cis/tasks/packages.yml
diff --git a/ansible/roles/cis_hardening/tasks/password.yml b/ansible/roles/cis/tasks/password.yml
similarity index 100%
rename from ansible/roles/cis_hardening/tasks/password.yml
rename to ansible/roles/cis/tasks/password.yml
diff --git a/ansible/roles/cis_hardening/tasks/path.yml b/ansible/roles/cis/tasks/path.yml
similarity index 100%
rename from ansible/roles/cis_hardening/tasks/path.yml
rename to ansible/roles/cis/tasks/path.yml
diff --git a/ansible/roles/cis_hardening/tasks/post.yml b/ansible/roles/cis/tasks/post.yml
similarity index 100%
rename from ansible/roles/cis_hardening/tasks/post.yml
rename to ansible/roles/cis/tasks/post.yml
diff --git a/ansible/roles/cis_hardening/tasks/postfix.yml b/ansible/roles/cis/tasks/postfix.yml
similarity index 100%
rename from ansible/roles/cis_hardening/tasks/postfix.yml
rename to ansible/roles/cis/tasks/postfix.yml
diff --git a/ansible/roles/cis_hardening/tasks/pre.yml b/ansible/roles/cis/tasks/pre.yml
similarity index 100%
rename from ansible/roles/cis_hardening/tasks/pre.yml
rename to ansible/roles/cis/tasks/pre.yml
diff --git a/ansible/roles/cis_hardening/tasks/prelink.yml b/ansible/roles/cis/tasks/prelink.yml
similarity index 100%
rename from ansible/roles/cis_hardening/tasks/prelink.yml
rename to ansible/roles/cis/tasks/prelink.yml
diff --git a/ansible/roles/cis_hardening/tasks/resolvedconf.yml b/ansible/roles/cis/tasks/resolvedconf.yml
similarity index 100%
rename from ansible/roles/cis_hardening/tasks/resolvedconf.yml
rename to ansible/roles/cis/tasks/resolvedconf.yml
diff --git a/ansible/roles/cis_hardening/tasks/rkhunter.yml b/ansible/roles/cis/tasks/rkhunter.yml
similarity index 100%
rename from ansible/roles/cis_hardening/tasks/rkhunter.yml
rename to ansible/roles/cis/tasks/rkhunter.yml
diff --git a/ansible/roles/cis_hardening/tasks/rootaccess.yml b/ansible/roles/cis/tasks/rootaccess.yml
similarity index 100%
rename from ansible/roles/cis_hardening/tasks/rootaccess.yml
rename to ansible/roles/cis/tasks/rootaccess.yml
diff --git a/ansible/roles/cis_hardening/tasks/sshconfig.yml b/ansible/roles/cis/tasks/sshconfig.yml
similarity index 99%
rename from ansible/roles/cis_hardening/tasks/sshconfig.yml
rename to ansible/roles/cis/tasks/sshconfig.yml
index 1e2fa03..c3dd06d 100644
--- a/ansible/roles/cis_hardening/tasks/sshconfig.yml
+++ b/ansible/roles/cis/tasks/sshconfig.yml
@@ -13,6 +13,7 @@
 - name: Set ssh version as fact
   ansible.builtin.set_fact:
     ssh_installed_version: "{{ ssh_version.stderr | regex_search('^OpenSSH_([0-9+].[0-9]+)', '\\1') | join('.') | float }}" # noqa jinja[spacing]
+  when: ssh_version.stderr != ""
   tags:
     - roles::cis::sshd
     - sshd
diff --git a/ansible/roles/cis_hardening/tasks/sudo.yml b/ansible/roles/cis/tasks/sudo.yml
similarity index 100%
rename from ansible/roles/cis_hardening/tasks/sudo.yml
rename to ansible/roles/cis/tasks/sudo.yml
diff --git a/ansible/roles/cis_hardening/tasks/suid.yml b/ansible/roles/cis/tasks/suid.yml
similarity index 100%
rename from ansible/roles/cis_hardening/tasks/suid.yml
rename to ansible/roles/cis/tasks/suid.yml
diff --git a/ansible/roles/cis_hardening/tasks/sysctl.yml b/ansible/roles/cis/tasks/sysctl.yml
similarity index 100%
rename from ansible/roles/cis_hardening/tasks/sysctl.yml
rename to ansible/roles/cis/tasks/sysctl.yml
diff --git a/ansible/roles/cis_hardening/tasks/systemdconf.yml b/ansible/roles/cis/tasks/systemdconf.yml
similarity index 100%
rename from ansible/roles/cis_hardening/tasks/systemdconf.yml
rename to ansible/roles/cis/tasks/systemdconf.yml
diff --git a/ansible/roles/cis_hardening/tasks/timesyncd.yml b/ansible/roles/cis/tasks/timesyncd.yml
similarity index 100%
rename from ansible/roles/cis_hardening/tasks/timesyncd.yml
rename to ansible/roles/cis/tasks/timesyncd.yml
diff --git a/ansible/roles/cis_hardening/tasks/ufw.yml b/ansible/roles/cis/tasks/ufw.yml
similarity index 100%
rename from ansible/roles/cis_hardening/tasks/ufw.yml
rename to ansible/roles/cis/tasks/ufw.yml
diff --git a/ansible/roles/cis_hardening/tasks/umask.yml b/ansible/roles/cis/tasks/umask.yml
similarity index 100%
rename from ansible/roles/cis_hardening/tasks/umask.yml
rename to ansible/roles/cis/tasks/umask.yml
diff --git a/ansible/roles/cis_hardening/tasks/users.yml b/ansible/roles/cis/tasks/users.yml
similarity index 100%
rename from ansible/roles/cis_hardening/tasks/users.yml
rename to ansible/roles/cis/tasks/users.yml
diff --git a/ansible/roles/cis_hardening/templates/etc/adduser.conf.j2 b/ansible/roles/cis/templates/etc/adduser.conf.j2
similarity index 100%
rename from ansible/roles/cis_hardening/templates/etc/adduser.conf.j2
rename to ansible/roles/cis/templates/etc/adduser.conf.j2
diff --git a/ansible/roles/cis_hardening/templates/etc/ansible/facts.d/cpuinfo.fact b/ansible/roles/cis/templates/etc/ansible/facts.d/cpuinfo.fact
similarity index 100%
rename from ansible/roles/cis_hardening/templates/etc/ansible/facts.d/cpuinfo.fact
rename to ansible/roles/cis/templates/etc/ansible/facts.d/cpuinfo.fact
diff --git a/ansible/roles/cis_hardening/templates/etc/ansible/facts.d/sshkeys.fact b/ansible/roles/cis/templates/etc/ansible/facts.d/sshkeys.fact
similarity index 100%
rename from ansible/roles/cis_hardening/templates/etc/ansible/facts.d/sshkeys.fact
rename to ansible/roles/cis/templates/etc/ansible/facts.d/sshkeys.fact
diff --git a/ansible/roles/cis_hardening/templates/etc/ansible/facts.d/systemd.fact b/ansible/roles/cis/templates/etc/ansible/facts.d/systemd.fact
similarity index 100%
rename from ansible/roles/cis_hardening/templates/etc/ansible/facts.d/systemd.fact
rename to ansible/roles/cis/templates/etc/ansible/facts.d/systemd.fact
diff --git a/ansible/roles/cis_hardening/templates/etc/audit/rules.d/hardening.rules.j2 b/ansible/roles/cis/templates/etc/audit/rules.d/hardening.rules.j2
similarity index 100%
rename from ansible/roles/cis_hardening/templates/etc/audit/rules.d/hardening.rules.j2
rename to ansible/roles/cis/templates/etc/audit/rules.d/hardening.rules.j2
diff --git a/ansible/roles/cis_hardening/templates/etc/default/rkhunter.j2 b/ansible/roles/cis/templates/etc/default/rkhunter.j2
similarity index 100%
rename from ansible/roles/cis_hardening/templates/etc/default/rkhunter.j2
rename to ansible/roles/cis/templates/etc/default/rkhunter.j2
diff --git a/ansible/roles/cis_hardening/templates/etc/default/useradd.j2 b/ansible/roles/cis/templates/etc/default/useradd.j2
similarity index 100%
rename from ansible/roles/cis_hardening/templates/etc/default/useradd.j2
rename to ansible/roles/cis/templates/etc/default/useradd.j2
diff --git a/ansible/roles/cis_hardening/templates/etc/hosts.allow.j2 b/ansible/roles/cis/templates/etc/hosts.allow.j2
similarity index 100%
rename from ansible/roles/cis_hardening/templates/etc/hosts.allow.j2
rename to ansible/roles/cis/templates/etc/hosts.allow.j2
diff --git a/ansible/roles/cis_hardening/templates/etc/hosts.deny.j2 b/ansible/roles/cis/templates/etc/hosts.deny.j2
similarity index 100%
rename from ansible/roles/cis_hardening/templates/etc/hosts.deny.j2
rename to ansible/roles/cis/templates/etc/hosts.deny.j2
diff --git a/ansible/roles/cis_hardening/templates/etc/issue.j2 b/ansible/roles/cis/templates/etc/issue.j2
similarity index 100%
rename from ansible/roles/cis_hardening/templates/etc/issue.j2
rename to ansible/roles/cis/templates/etc/issue.j2
diff --git a/ansible/roles/cis_hardening/templates/etc/login.defs.j2 b/ansible/roles/cis/templates/etc/login.defs.j2
similarity index 100%
rename from ansible/roles/cis_hardening/templates/etc/login.defs.j2
rename to ansible/roles/cis/templates/etc/login.defs.j2
diff --git a/ansible/roles/cis_hardening/templates/etc/logrotate.conf.j2 b/ansible/roles/cis/templates/etc/logrotate.conf.j2
similarity index 100%
rename from ansible/roles/cis_hardening/templates/etc/logrotate.conf.j2
rename to ansible/roles/cis/templates/etc/logrotate.conf.j2
diff --git a/ansible/roles/cis_hardening/templates/etc/motd.j2 b/ansible/roles/cis/templates/etc/motd.j2
similarity index 100%
rename from ansible/roles/cis_hardening/templates/etc/motd.j2
rename to ansible/roles/cis/templates/etc/motd.j2
diff --git a/ansible/roles/cis_hardening/templates/etc/pam.d/common-account.j2 b/ansible/roles/cis/templates/etc/pam.d/common-account.j2
similarity index 100%
rename from ansible/roles/cis_hardening/templates/etc/pam.d/common-account.j2
rename to ansible/roles/cis/templates/etc/pam.d/common-account.j2
diff --git a/ansible/roles/cis_hardening/templates/etc/pam.d/common-auth.j2 b/ansible/roles/cis/templates/etc/pam.d/common-auth.j2
similarity index 100%
rename from ansible/roles/cis_hardening/templates/etc/pam.d/common-auth.j2
rename to ansible/roles/cis/templates/etc/pam.d/common-auth.j2
diff --git a/ansible/roles/cis_hardening/templates/etc/pam.d/common-password.j2 b/ansible/roles/cis/templates/etc/pam.d/common-password.j2
similarity index 100%
rename from ansible/roles/cis_hardening/templates/etc/pam.d/common-password.j2
rename to ansible/roles/cis/templates/etc/pam.d/common-password.j2
diff --git a/ansible/roles/cis_hardening/templates/etc/pam.d/login.j2 b/ansible/roles/cis/templates/etc/pam.d/login.j2
similarity index 100%
rename from ansible/roles/cis_hardening/templates/etc/pam.d/login.j2
rename to ansible/roles/cis/templates/etc/pam.d/login.j2
diff --git a/ansible/roles/cis_hardening/templates/etc/profile.d/initpath.sh.j2 b/ansible/roles/cis/templates/etc/profile.d/initpath.sh.j2
similarity index 100%
rename from ansible/roles/cis_hardening/templates/etc/profile.d/initpath.sh.j2
rename to ansible/roles/cis/templates/etc/profile.d/initpath.sh.j2
diff --git a/ansible/roles/cis_hardening/templates/etc/security/limits.conf.j2 b/ansible/roles/cis/templates/etc/security/limits.conf.j2
similarity index 100%
rename from ansible/roles/cis_hardening/templates/etc/security/limits.conf.j2
rename to ansible/roles/cis/templates/etc/security/limits.conf.j2
diff --git a/ansible/roles/cis_hardening/templates/etc/ssh/ssh_config.j2 b/ansible/roles/cis/templates/etc/ssh/ssh_config.j2
similarity index 100%
rename from ansible/roles/cis_hardening/templates/etc/ssh/ssh_config.j2
rename to ansible/roles/cis/templates/etc/ssh/ssh_config.j2
diff --git a/ansible/roles/cis_hardening/templates/etc/ssh/sshd_config.j2 b/ansible/roles/cis/templates/etc/ssh/sshd_config.j2
similarity index 100%
rename from ansible/roles/cis_hardening/templates/etc/ssh/sshd_config.j2
rename to ansible/roles/cis/templates/etc/ssh/sshd_config.j2
diff --git a/ansible/roles/cis_hardening/templates/etc/systemd/coredump.conf.j2 b/ansible/roles/cis/templates/etc/systemd/coredump.conf.j2
similarity index 100%
rename from ansible/roles/cis_hardening/templates/etc/systemd/coredump.conf.j2
rename to ansible/roles/cis/templates/etc/systemd/coredump.conf.j2
diff --git a/ansible/roles/cis_hardening/templates/etc/systemd/journald.conf.j2 b/ansible/roles/cis/templates/etc/systemd/journald.conf.j2
similarity index 100%
rename from ansible/roles/cis_hardening/templates/etc/systemd/journald.conf.j2
rename to ansible/roles/cis/templates/etc/systemd/journald.conf.j2
diff --git a/ansible/roles/cis_hardening/templates/etc/systemd/logind.conf.j2 b/ansible/roles/cis/templates/etc/systemd/logind.conf.j2
similarity index 100%
rename from ansible/roles/cis_hardening/templates/etc/systemd/logind.conf.j2
rename to ansible/roles/cis/templates/etc/systemd/logind.conf.j2
diff --git a/ansible/roles/cis_hardening/templates/etc/systemd/resolved.conf.j2 b/ansible/roles/cis/templates/etc/systemd/resolved.conf.j2
similarity index 100%
rename from ansible/roles/cis_hardening/templates/etc/systemd/resolved.conf.j2
rename to ansible/roles/cis/templates/etc/systemd/resolved.conf.j2
diff --git a/ansible/roles/cis_hardening/templates/etc/systemd/system.conf.j2 b/ansible/roles/cis/templates/etc/systemd/system.conf.j2
similarity index 100%
rename from ansible/roles/cis_hardening/templates/etc/systemd/system.conf.j2
rename to ansible/roles/cis/templates/etc/systemd/system.conf.j2
diff --git a/ansible/roles/cis_hardening/templates/etc/systemd/timesyncd.conf.j2 b/ansible/roles/cis/templates/etc/systemd/timesyncd.conf.j2
similarity index 100%
rename from ansible/roles/cis_hardening/templates/etc/systemd/timesyncd.conf.j2
rename to ansible/roles/cis/templates/etc/systemd/timesyncd.conf.j2
diff --git a/ansible/roles/cis_hardening/templates/etc/systemd/tmp.mount.j2 b/ansible/roles/cis/templates/etc/systemd/tmp.mount.j2
similarity index 100%
rename from ansible/roles/cis_hardening/templates/etc/systemd/tmp.mount.j2
rename to ansible/roles/cis/templates/etc/systemd/tmp.mount.j2
diff --git a/ansible/roles/cis_hardening/templates/etc/systemd/user.conf.j2 b/ansible/roles/cis/templates/etc/systemd/user.conf.j2
similarity index 100%
rename from ansible/roles/cis_hardening/templates/etc/systemd/user.conf.j2
rename to ansible/roles/cis/templates/etc/systemd/user.conf.j2
diff --git a/ansible/roles/cis_hardening/templates/lib/systemd/system/aidecheck.service.j2 b/ansible/roles/cis/templates/lib/systemd/system/aidecheck.service.j2
similarity index 100%
rename from ansible/roles/cis_hardening/templates/lib/systemd/system/aidecheck.service.j2
rename to ansible/roles/cis/templates/lib/systemd/system/aidecheck.service.j2
diff --git a/ansible/roles/cis_hardening/templates/lib/systemd/system/aidecheck.timer.j2 b/ansible/roles/cis/templates/lib/systemd/system/aidecheck.timer.j2
similarity index 100%
rename from ansible/roles/cis_hardening/templates/lib/systemd/system/aidecheck.timer.j2
rename to ansible/roles/cis/templates/lib/systemd/system/aidecheck.timer.j2
diff --git a/ansible/roles/cis_hardening/tests/debug_facts.yml b/ansible/roles/cis/tests/debug_facts.yml
similarity index 100%
rename from ansible/roles/cis_hardening/tests/debug_facts.yml
rename to ansible/roles/cis/tests/debug_facts.yml
diff --git a/ansible/roles/cis_hardening/tests/inventory b/ansible/roles/cis/tests/inventory
similarity index 100%
rename from ansible/roles/cis_hardening/tests/inventory
rename to ansible/roles/cis/tests/inventory
diff --git a/ansible/roles/cis_hardening/tests/test.yml b/ansible/roles/cis/tests/test.yml
similarity index 100%
rename from ansible/roles/cis_hardening/tests/test.yml
rename to ansible/roles/cis/tests/test.yml
diff --git a/ansible/roles/duo_security/.ansible-lint b/ansible/roles/duo/.ansible-lint
similarity index 100%
rename from ansible/roles/duo_security/.ansible-lint
rename to ansible/roles/duo/.ansible-lint
diff --git a/ansible/roles/duo_security/.yamllint.yml b/ansible/roles/duo/.yamllint.yml
similarity index 100%
rename from ansible/roles/duo_security/.yamllint.yml
rename to ansible/roles/duo/.yamllint.yml
diff --git a/ansible/roles/duo_security/README.md b/ansible/roles/duo/README.md
similarity index 100%
rename from ansible/roles/duo_security/README.md
rename to ansible/roles/duo/README.md
diff --git a/ansible/roles/duo_security/defaults/main.yml b/ansible/roles/duo/defaults/main.yml
similarity index 100%
rename from ansible/roles/duo_security/defaults/main.yml
rename to ansible/roles/duo/defaults/main.yml
diff --git a/ansible/roles/duo_security/handlers/main.yml b/ansible/roles/duo/handlers/main.yml
similarity index 100%
rename from ansible/roles/duo_security/handlers/main.yml
rename to ansible/roles/duo/handlers/main.yml
diff --git a/ansible/roles/duo_security/meta/main.yml b/ansible/roles/duo/meta/main.yml
similarity index 100%
rename from ansible/roles/duo_security/meta/main.yml
rename to ansible/roles/duo/meta/main.yml
diff --git a/ansible/roles/duo_security/molecule/default/converge.yml b/ansible/roles/duo/molecule/default/converge.yml
similarity index 100%
rename from ansible/roles/duo_security/molecule/default/converge.yml
rename to ansible/roles/duo/molecule/default/converge.yml
diff --git a/ansible/roles/duo_security/molecule/default/molecule.yml b/ansible/roles/duo/molecule/default/molecule.yml
similarity index 100%
rename from ansible/roles/duo_security/molecule/default/molecule.yml
rename to ansible/roles/duo/molecule/default/molecule.yml
diff --git a/ansible/roles/duo_security/molecule/default/prepare.yml b/ansible/roles/duo/molecule/default/prepare.yml
similarity index 100%
rename from ansible/roles/duo_security/molecule/default/prepare.yml
rename to ansible/roles/duo/molecule/default/prepare.yml
diff --git a/ansible/roles/duo_security/molecule/default/verify.yml b/ansible/roles/duo/molecule/default/verify.yml
similarity index 100%
rename from ansible/roles/duo_security/molecule/default/verify.yml
rename to ansible/roles/duo/molecule/default/verify.yml
diff --git a/ansible/roles/duo_security/tasks/main.yml b/ansible/roles/duo/tasks/main.yml
similarity index 100%
rename from ansible/roles/duo_security/tasks/main.yml
rename to ansible/roles/duo/tasks/main.yml
diff --git a/ansible/roles/duo_security/templates/duo-security.conf.j2 b/ansible/roles/duo/templates/duo-security.conf.j2
similarity index 100%
rename from ansible/roles/duo_security/templates/duo-security.conf.j2
rename to ansible/roles/duo/templates/duo-security.conf.j2
diff --git a/ansible/roles/duo_security/templates/login_duo.conf.j2 b/ansible/roles/duo/templates/login_duo.conf.j2
similarity index 100%
rename from ansible/roles/duo_security/templates/login_duo.conf.j2
rename to ansible/roles/duo/templates/login_duo.conf.j2
diff --git a/ansible/roles/duo_security/tests/inventory b/ansible/roles/duo/tests/inventory
similarity index 100%
rename from ansible/roles/duo_security/tests/inventory
rename to ansible/roles/duo/tests/inventory
diff --git a/ansible/roles/duo_security/tests/test.yml b/ansible/roles/duo/tests/test.yml
similarity index 100%
rename from ansible/roles/duo_security/tests/test.yml
rename to ansible/roles/duo/tests/test.yml
diff --git a/ansible/roles/duo_security/vars/main.yml b/ansible/roles/duo/vars/main.yml
similarity index 100%
rename from ansible/roles/duo_security/vars/main.yml
rename to ansible/roles/duo/vars/main.yml
diff --git a/ansible/roles/geoip/defaults/main.yml b/ansible/roles/geoip/defaults/main.yml
index ba2f186..c8e6760 100644
--- a/ansible/roles/geoip/defaults/main.yml
+++ b/ansible/roles/geoip/defaults/main.yml
@@ -6,8 +6,8 @@ geoip_editions_ids:
   - GeoLite2-ASN
   - GeoLite2-City
   - GeoLite2-Country
-ssh_allowed_zones:
+geoip_ssh_allowed_zones:
   - "ALL"
-ssh_allowed_networks:
+geoip_ssh_allowed_networks:
   - "0.0.0.0/0"
 geoip_sshd_enabled: true
diff --git a/ansible/roles/geoip/molecule/default/molecule.yml b/ansible/roles/geoip/molecule/default/molecule.yml
index cdb2d6a..170746e 100644
--- a/ansible/roles/geoip/molecule/default/molecule.yml
+++ b/ansible/roles/geoip/molecule/default/molecule.yml
@@ -20,9 +20,9 @@ provisioner:
   inventory:
     group_vars:
       all:
-        ssh_allowed_zones:
+        geoip_ssh_allowed_zones:
           - "ALL"
-        ssh_allowed_networks:
+        geoip_ssh_allowed_networks:
           - "0.0.0.0/0"
         geoip_ufw_enabled: true
         geoip_sshd_enabled: true
diff --git a/ansible/roles/geoip/templates/usr/bin/sshfilter.sh.j2 b/ansible/roles/geoip/templates/usr/bin/sshfilter.sh.j2
index 92b7d5e..eca979a 100644
--- a/ansible/roles/geoip/templates/usr/bin/sshfilter.sh.j2
+++ b/ansible/roles/geoip/templates/usr/bin/sshfilter.sh.j2
@@ -6,8 +6,8 @@ if [ $# -ne 1 ]; then
   exit 0 # return true in case of config issue
 fi
 
-NETWORKS="{{ ssh_allowed_networks | join(" ") }}"
-ALLOW_COUNTRIES="{{ ssh_allowed_zones | join(" ") }}"
+NETWORKS="{{ geoip_ssh_allowed_networks | join(" ") }}"
+ALLOW_COUNTRIES="{{ geoip_ssh_allowed_zones | join(" ") }}"
 GEOIPTOOL=$(which geoiplookup)
 
 # Fetch the GitHub runner IP ranges
diff --git a/ansible/roles/manage_users/.ansible-lint b/ansible/roles/login/.ansible-lint
similarity index 100%
rename from ansible/roles/manage_users/.ansible-lint
rename to ansible/roles/login/.ansible-lint
diff --git a/ansible/roles/manage_users/.yamllint.yml b/ansible/roles/login/.yamllint.yml
similarity index 100%
rename from ansible/roles/manage_users/.yamllint.yml
rename to ansible/roles/login/.yamllint.yml
diff --git a/ansible/roles/manage_users/README.md b/ansible/roles/login/README.md
similarity index 100%
rename from ansible/roles/manage_users/README.md
rename to ansible/roles/login/README.md
diff --git a/ansible/roles/login/defaults/main.yml b/ansible/roles/login/defaults/main.yml
new file mode 100644
index 0000000..bc3a5f5
--- /dev/null
+++ b/ansible/roles/login/defaults/main.yml
@@ -0,0 +1,2 @@
+---
+login_users: []
diff --git a/ansible/roles/manage_users/handlers/main.yml b/ansible/roles/login/handlers/main.yml
similarity index 100%
rename from ansible/roles/manage_users/handlers/main.yml
rename to ansible/roles/login/handlers/main.yml
diff --git a/ansible/roles/manage_users/meta/main.yml b/ansible/roles/login/meta/main.yml
similarity index 100%
rename from ansible/roles/manage_users/meta/main.yml
rename to ansible/roles/login/meta/main.yml
diff --git a/ansible/roles/manage_users/molecule/default/converge.yml b/ansible/roles/login/molecule/default/converge.yml
similarity index 100%
rename from ansible/roles/manage_users/molecule/default/converge.yml
rename to ansible/roles/login/molecule/default/converge.yml
diff --git a/ansible/roles/manage_users/molecule/default/molecule.yml b/ansible/roles/login/molecule/default/molecule.yml
similarity index 96%
rename from ansible/roles/manage_users/molecule/default/molecule.yml
rename to ansible/roles/login/molecule/default/molecule.yml
index 5dece31..484c4fd 100644
--- a/ansible/roles/manage_users/molecule/default/molecule.yml
+++ b/ansible/roles/login/molecule/default/molecule.yml
@@ -16,7 +16,7 @@ provisioner:
   inventory:
     host_vars:
       instance:
-        ssh_users:
+        login_users:
           - username: testuser
             comment: Test User
             enabled: true
diff --git a/ansible/roles/manage_users/molecule/default/prepare.yml b/ansible/roles/login/molecule/default/prepare.yml
similarity index 100%
rename from ansible/roles/manage_users/molecule/default/prepare.yml
rename to ansible/roles/login/molecule/default/prepare.yml
diff --git a/ansible/roles/manage_users/molecule/default/verify.yml b/ansible/roles/login/molecule/default/verify.yml
similarity index 100%
rename from ansible/roles/manage_users/molecule/default/verify.yml
rename to ansible/roles/login/molecule/default/verify.yml
diff --git a/ansible/roles/manage_users/tasks/main.yml b/ansible/roles/login/tasks/main.yml
similarity index 93%
rename from ansible/roles/manage_users/tasks/main.yml
rename to ansible/roles/login/tasks/main.yml
index e62c852..23de699 100644
--- a/ansible/roles/manage_users/tasks/main.yml
+++ b/ansible/roles/login/tasks/main.yml
@@ -11,7 +11,7 @@
     password: "{{ lookup('env', 'USER_PASSWORD_' + (item.username | upper)) | password_hash('sha512', user_password_salt) }}"
     state: "{{ 'absent' if item.enabled is defined and not item.enabled else 'present' }}"
     shell: "{{ item.shell if item.shell is defined else '/bin/bash' }}"
-  loop: "{{ ssh_users }}"
+  loop: "{{ login_users }}"
 
 - name: "Add SSH Authorized key"
   become: true
@@ -20,7 +20,7 @@
     key: "{{ item.pubkey }}"
     state: "{{ 'present' if item.pubkey is defined else 'absent' }}"
   when: item.pubkey is defined
-  loop: "{{ ssh_users }}"
+  loop: "{{ login_users }}"
 
 - name: Create sudoers.d entry if user allowed
   become: true
@@ -32,4 +32,4 @@
     group: root
     mode: "0600"
   when: item.sudoer is defined and item.sudoer
-  loop: "{{ ssh_users }}"
+  loop: "{{ login_users }}"
diff --git a/ansible/roles/manage_users/tests/inventory b/ansible/roles/login/tests/inventory
similarity index 100%
rename from ansible/roles/manage_users/tests/inventory
rename to ansible/roles/login/tests/inventory
diff --git a/ansible/roles/manage_users/tests/test.yml b/ansible/roles/login/tests/test.yml
similarity index 100%
rename from ansible/roles/manage_users/tests/test.yml
rename to ansible/roles/login/tests/test.yml
diff --git a/ansible/roles/manage_users/vars/main.yml b/ansible/roles/login/vars/main.yml
similarity index 100%
rename from ansible/roles/manage_users/vars/main.yml
rename to ansible/roles/login/vars/main.yml
diff --git a/ansible/roles/manage_users/defaults/main.yml b/ansible/roles/manage_users/defaults/main.yml
deleted file mode 100644
index ca90990..0000000
--- a/ansible/roles/manage_users/defaults/main.yml
+++ /dev/null
@@ -1,3 +0,0 @@
----
-# defaults file for manage_users
-ssh_users: []
diff --git a/ansible/roles/microk8s/defaults/main.yml b/ansible/roles/microk8s/defaults/main.yml
index 25b1682..1ddd90c 100644
--- a/ansible/roles/microk8s/defaults/main.yml
+++ b/ansible/roles/microk8s/defaults/main.yml
@@ -1,38 +1,41 @@
-k8s_version: "1.29"
-kubectl_version: "1.29.0"
+microk8s_k8s_version: "1.29"
+microk8s_kubectl_version: "1.29.0"
 
 # load balancer configuration
-lb_provider: "metallb"
-lb_ips: "10.2.0.40-10.2.0.49"
-lb_http_port: 80
-lb_https_port: 443
-metallb_version: 0.14.5
+microk8s_lb_provider: "metallb"
+microk8s_lb_ips: "10.2.0.40-10.2.0.49"
+microk8s_lb_http_port: 80
+microk8s_lb_https_port: 443
+microk8s_metallb_version: 0.14.5
 
 # certificate manager
-issuer_email: webmaster@localhost.localdomain
-certmgr_version: 1.14.5
+microk8s_issuer_email: webmaster@localhost.localdomain
+microk8s_certmgr_version: 1.14.5
 
 # microk8s specific
-microk8s_channel: "{{ k8s_version }}/stable"
+microk8s_channel: "{{ microk8s_k8s_version }}/stable"
 microk8s_privileged: true
 microk8s_alt_names: "localhost.localdomain"
 microk8s_status_timeout: 300
 
-k8s_users: []
+microk8s_users: []
 
-k8s_host_public_ip: "{{ ansible_default_ipv4.address }}"
+microk8s_host_public_ip: "{{ ansible_default_ipv4.address }}"
 
-k8s_net_devices:
+microk8s_net_devices:
   - "cni+"
   - "flannel+"
 
-k8s_incoming_traffic:
+microk8s_incoming_traffic:
   - { rule: "allow", port: "16443", proto: "tcp", from: "10.1.0.0/16" }
   - { rule: "allow", port: "10254", proto: "tcp", from: "10.1.0.0/16" }
-  - { rule: "allow", port: "10254", proto: "tcp", from: "{{ k8s_host_public_ip }}" }
+  - { rule: "allow", port: "10254", proto: "tcp", from: "{{ microk8s_host_public_ip }}" }
 
-k8s_outgoing_traffic: []
+microk8s_outgoing_traffic: []
 
-k8s_allowed_hosts: []
+microk8s_allowed_hosts: []
 
-k8s_iac_user: "provision"
\ No newline at end of file
+microk8s_iac_user: "provision"
+
+microk8s_encryption_secret: "a13labs"
+microk8s_encryption_cfg: "/etc/microk8s_encryption.yaml"
diff --git a/ansible/roles/microk8s/tasks/certmanager.yml b/ansible/roles/microk8s/tasks/certmanager.yml
index ad3aa96..84f75ec 100644
--- a/ansible/roles/microk8s/tasks/certmanager.yml
+++ b/ansible/roles/microk8s/tasks/certmanager.yml
@@ -1,6 +1,6 @@
 - name: CertManager | Copy latest manifest
   ansible.builtin.get_url:
-    url: "https://github.com/cert-manager/cert-manager/releases/download/v{{ certmgr_version }}/cert-manager.yaml"
+    url: "https://github.com/cert-manager/cert-manager/releases/download/v{{ microk8s_certmgr_version }}/cert-manager.yaml"
     dest: "{{ k8s_etc }}/k8s-certmanager.yaml"
     mode: "0600"
 
@@ -35,7 +35,7 @@
           # The ACME server URL
           server: https://acme-v02.api.letsencrypt.org/directory
           # Email address used for ACME registration
-          email: "{{ issuer_email }}"
+          email: "{{ microk8s_issuer_email }}"
           # Name of a secret used to store the ACME account private key
           privateKeySecretRef:
             name: letsencrypt-prod
@@ -65,7 +65,7 @@
           # The ACME server URL
           server: https://acme-staging-v02.api.letsencrypt.org/directory
           # Email address used for ACME registration
-          email: "{{ issuer_email }}"
+          email: "{{ microk8s_issuer_email }}"
           # Name of a secret used to store the ACME account private key
           privateKeySecretRef:
             name: letsencrypt-staging
diff --git a/ansible/roles/microk8s/tasks/iac.yml b/ansible/roles/microk8s/tasks/iac.yml
index c9c5448..a71e7f6 100644
--- a/ansible/roles/microk8s/tasks/iac.yml
+++ b/ansible/roles/microk8s/tasks/iac.yml
@@ -11,7 +11,7 @@
       apiVersion: v1
       kind: ServiceAccount
       metadata:
-        name: "{{ k8s_iac_user }}"
+        name: "{{ microk8s_iac_user }}"
         namespace: default
   tags:
     - k8s::iac
@@ -29,10 +29,10 @@
       apiVersion: v1
       kind: Secret
       metadata:
-        name: "{{ k8s_iac_user }}-token"
+        name: "{{ microk8s_iac_user }}-token"
         namespace: default
         annotations:
-          kubernetes.io/service-account.name: "{{ k8s_iac_user }}"
+          kubernetes.io/service-account.name: "{{ microk8s_iac_user }}"
       type: kubernetes.io/service-account-token
   tags:
     - k8s::iac
@@ -58,14 +58,14 @@
       subjects:
         - kind: ServiceAccount
           namespace: default
-          name: "{{ k8s_iac_user }}"
+          name: "{{ microk8s_iac_user }}"
   tags:
     - k8s::iac
 
 - name: Get the secret name
   ansible.builtin.shell: |
     set -o pipefail
-    microk8s.kubectl -n default get secret | grep {{ k8s_iac_user }} | awk '{ print $1 }'
+    microk8s.kubectl -n default get secret | grep {{ microk8s_iac_user }} | awk '{ print $1 }'
   args:
     executable: /bin/bash
   register: secret_name
@@ -98,44 +98,48 @@
   tags:
     - k8s::iac
 
-- name: Patch kubeconfig with user token
-  ansible.builtin.set_fact:
-    patched_kubeconfig_yaml: "{{ kubeconfig_yaml | combine(new_kubeconfig, recursive=True) }}"
-  vars:
-    new_kubeconfig:
-      contexts:
-        - context:
-            cluster: microk8s-cluster
-            user: "{{ k8s_iac_user }}"
-          name: microk8s
-      users:
-        - name: "{{ k8s_iac_user }}"
-          user:
-            token: "{{ token.stdout }}"
-  tags:
-    - k8s::iac
+- name: Render kubeconfig
+  when: kubeconfig.stdout != ""
+  block:
+    - name: Patch kubeconfig with user token
+      ansible.builtin.set_fact:
+        patched_kubeconfig_yaml: "{{ kubeconfig_yaml | combine(new_kubeconfig, recursive=True) }}"
+      vars:
+        new_kubeconfig:
+          contexts:
+            - context:
+                cluster: microk8s-cluster
+                user: "{{ microk8s_iac_user }}"
+              name: microk8s
+          users:
+            - name: "{{ microk8s_iac_user }}"
+              user:
+                token: "{{ token.stdout }}"
+      tags:
+        - k8s::iac
 
-- name: Check if a config already exists and its SHA1
-  become: true
-  ansible.builtin.stat:
-    path: "{{ k8s_kubeconfig }}"
-  register: kubeconfig_exists
-  tags:
-    - k8s::iac
+    - name: Check if a config already exists and its SHA1
+      become: true
+      ansible.builtin.stat:
+        path: "{{ k8s_kubeconfig }}"
+      register: kubeconfig_exists
+      tags:
+        - k8s::iac
 
-- name: Get new config SHA1
-  set_fact:
-    patched_kubeconfig_sha1: "{{ patched_kubeconfig_yaml | to_nice_yaml | sha1 }}"
-  tags:
-    - k8s::iac
+    - name: Get new config SHA1
+      ansible.builtin.set_fact:
+        patched_kubeconfig_sha1: "{{ patched_kubeconfig_yaml | to_nice_yaml | sha1 }}"
+      tags:
+        - k8s::iac
 
-- name: Write kubeconfig
-  become: true
-  ansible.builtin.copy:
-    content: "{{ patched_kubeconfig_yaml | to_nice_yaml }}"
-    dest: "{{ k8s_kubeconfig }}"
-    owner: "{{ k8s_iac_user }}"
-    mode: "0600"
-  when: kubeconfig_exists.stat.exists == false or patched_kubeconfig_sha1 != kubeconfig_exists.stat.checksum
-  tags:
-    - k8s::iac
\ No newline at end of file
+    - name: Write kubeconfig
+      become: true
+      ansible.builtin.copy:
+        content: "{{ patched_kubeconfig_yaml | to_nice_yaml }}"
+        dest: "{{ k8s_kubeconfig }}"
+        owner: "{{ microk8s_iac_user }}"
+        mode: "0600"
+      when:
+        - not kubeconfig_exists.stat.exists or patched_kubeconfig_sha1 != kubeconfig_exists.stat.checksum
+      tags:
+        - k8s::iac
diff --git a/ansible/roles/microk8s/tasks/loadbalancer.yml b/ansible/roles/microk8s/tasks/loadbalancer.yml
index 35dad36..18d70ac 100644
--- a/ansible/roles/microk8s/tasks/loadbalancer.yml
+++ b/ansible/roles/microk8s/tasks/loadbalancer.yml
@@ -1,5 +1,5 @@
-- name: Loadbalancer | Setup '{{ lb_provider }}'
-  ansible.builtin.include_tasks: "loadbalancer/{{ lb_provider }}.yaml"
+- name: Loadbalancer | Setup '{{ microk8s_lb_provider }}'
+  ansible.builtin.include_tasks: "loadbalancer/{{ microk8s_lb_provider }}.yaml"
 
 - name: Loadbalancer | Create Loadbalancer for Nginx ingress
   environment:
@@ -23,9 +23,9 @@
         ports:
           - name: http
             protocol: TCP
-            port: "{{ lb_http_port }}"
+            port: "{{ microk8s_lb_http_port }}"
             targetPort: 80
           - name: https
             protocol: TCP
-            port: "{{ lb_https_port }}"
+            port: "{{ microk8s_lb_https_port }}"
             targetPort: 443
diff --git a/ansible/roles/microk8s/tasks/loadbalancer/metallb.yaml b/ansible/roles/microk8s/tasks/loadbalancer/metallb.yaml
index f7a369c..f8505b5 100644
--- a/ansible/roles/microk8s/tasks/loadbalancer/metallb.yaml
+++ b/ansible/roles/microk8s/tasks/loadbalancer/metallb.yaml
@@ -1,6 +1,6 @@
 - name: MetalLB | Copy manifest files to host
   ansible.builtin.get_url:
-    url: "https://raw.githubusercontent.com/metallb/metallb/v{{ metallb_version }}/config/manifests/metallb-native.yaml"
+    url: "https://raw.githubusercontent.com/metallb/metallb/v{{ microk8s_metallb_version }}/config/manifests/metallb-native.yaml"
     dest: "{{ k8s_etc }}/metallb.yaml"
     mode: "0600"
 
@@ -32,7 +32,7 @@
         namespace: metallb-system
       spec:
         addresses:
-          - "{{ lb_ips }}"
+          - "{{ microk8s_lb_ips }}"
 
 - name: MetalLB | Create L2Advertisement
   environment:
diff --git a/ansible/roles/microk8s/tasks/main.yml b/ansible/roles/microk8s/tasks/main.yml
index 22fe283..5dc060c 100644
--- a/ansible/roles/microk8s/tasks/main.yml
+++ b/ansible/roles/microk8s/tasks/main.yml
@@ -53,7 +53,7 @@
 - name: Download kubectl
   become: true
   ansible.builtin.get_url:
-    url: "https://dl.k8s.io/release/v{{ kubectl_version }}/bin/linux/amd64/kubectl"
+    url: "https://dl.k8s.io/release/v{{ microk8s_kubectl_version }}/bin/linux/amd64/kubectl"
     dest: "/usr/local/bin/kubectl"
     mode: "0755"
     owner: "root"
@@ -78,7 +78,7 @@
 
 - name: "Setup local user access to k8s - {{ item.username }}"
   ansible.builtin.include_tasks: "setupenv/main.yml"
-  loop: "{{ k8s_users }}"
-  when: k8s_users is defined
+  loop: "{{ microk8s_users }}"
+  when: microk8s_users is defined
   tags:
     - k8s::users
diff --git a/ansible/roles/microk8s/tasks/microk8s/install.yml b/ansible/roles/microk8s/tasks/microk8s/install.yml
index 0f40dcf..0977b47 100644
--- a/ansible/roles/microk8s/tasks/microk8s/install.yml
+++ b/ansible/roles/microk8s/tasks/microk8s/install.yml
@@ -1,4 +1,3 @@
-# Install a snap with classic confinement
 - name: Microk8s | Installing microk8s from channel '{{ microk8s_channel }}'
   become: true
   community.general.snap:
@@ -6,6 +5,25 @@
     channel: "{{ microk8s_channel }}"
     classic: true
 
+- name: Create encryption configuration
+  become: true
+  ansible.builtin.copy:
+    content: |
+      ---
+      apiVersion: apiserver.config.k8s.io/v1
+      kind: EncryptionConfiguration
+      resources:
+        - resources:
+          - secrets
+          providers:
+          - aescbc:
+              keys:
+              - name: k8s-crypto
+                secret: {{ microk8s_encryption_secret }}
+          - identity: {}
+    dest: "{{ microk8s_encryption_cfg }}"
+    mode: "0600"
+
 - name: Microk8s | Patch microk8s configuration
   notify: ["Restart microk8s"]
   block:
@@ -16,6 +34,13 @@
         line: "--allow-privileged=true"
         insertafter: "^--insecure-port=0$"
 
+    - name: Microk8s | Enable encryption provider
+      become: true
+      ansible.builtin.lineinfile:
+        path: /var/snap/microk8s/current/args/kube-apiserver
+        line: "--encryption-provider-config=/a13labs/microk8s/encryption.yaml"
+        insertafter: "^--insecure-port=0$"
+
     - name: Microk8s | Fixing Disk Pressure
       become: true
       ansible.builtin.lineinfile:
@@ -64,17 +89,8 @@
     - { plugin: "ingress", wait: 60, args: "", enabled: true }
     - { plugin: "hostpath-storage", wait: 10, args: "", enabled: true }
 
-- name: Microk8s | Check if ufw is enabled
-  become: true
-  ansible.builtin.shell:
-    cmd: "ufw status"
-  register: ufw_status
-  changed_when: false
-
 - name: Microk8s | Configure required ufw rules
   ansible.builtin.include_tasks: microk8s/ufw.yml
-  when:
-    - ufw_status.stdout.find("Status: active") != -1
 
 - name: Microk8s | Store kubeconfig
   ansible.builtin.shell:
diff --git a/ansible/roles/microk8s/tasks/microk8s/ufw.yml b/ansible/roles/microk8s/tasks/microk8s/ufw.yml
index b7c7527..d55a81b 100644
--- a/ansible/roles/microk8s/tasks/microk8s/ufw.yml
+++ b/ansible/roles/microk8s/tasks/microk8s/ufw.yml
@@ -6,7 +6,7 @@
     interface: "{{ item }}"
     comment: ansible managed
   with_items:
-    - "{{ k8s_net_devices }}"
+    - "{{ microk8s_net_devices }}"
   retries: 5
   delay: 10
 
@@ -18,7 +18,7 @@
     interface: "{{ item }}"
     comment: ansible managed
   with_items:
-    - "{{ k8s_net_devices }}"
+    - "{{ microk8s_net_devices }}"
   retries: 5
   delay: 10
 
@@ -31,7 +31,7 @@
     proto: "{{ item.proto }}"
     comment: ansible managed
   with_items:
-    - "{{ k8s_incoming_traffic }}"
+    - "{{ microk8s_incoming_traffic }}"
   retries: 5
   delay: 10
 
@@ -43,7 +43,7 @@
     direction: out
     comment: ansible managed
   with_items:
-    - "{{ k8s_outgoing_traffic }}"
+    - "{{ microk8s_outgoing_traffic }}"
   retries: 5
   delay: 10
 
@@ -56,6 +56,6 @@
     proto: tcp
     comment: ansible managed
   with_items:
-    - "{{ k8s_allowed_hosts }}"
+    - "{{ microk8s_allowed_hosts }}"
   retries: 5
   delay: 10
diff --git a/ansible/roles/microk8s/tasks/setupenv/main.yml b/ansible/roles/microk8s/tasks/setupenv/main.yml
index 3a29c3b..78aa1a8 100644
--- a/ansible/roles/microk8s/tasks/setupenv/main.yml
+++ b/ansible/roles/microk8s/tasks/setupenv/main.yml
@@ -25,7 +25,7 @@
 - name: Check if secret exists
   ansible.builtin.shell: |
     set -o pipefail
-    microk8s.kubectl -n {{ item.namespace  | default('default') }} get secret | grep {{ item.username }}-token | wc -l | awk '{ print $1 }'
+    microk8s.kubectl -n {{ item.namespace | default('default') }} get secret | grep {{ item.username }}-token | wc -l | awk '{ print $1 }'
   args:
     executable: /bin/bash
   register: secret_exists
@@ -36,12 +36,12 @@
   ignore_errors: true
 
 - name: Configure user access
-  when: item.enabled and secret_exists.stdout != "0"
+  when: item.enabled and secret_exists.stdout != "0" and secret_exists.stdout != ""
   block:
     - name: Get the secret name
       ansible.builtin.shell: |
         set -o pipefail
-        microk8s.kubectl -n {{ item.namespace  | default('default') }} get secret | grep {{ item.username }}-token | awk '{ print $1 }'
+        microk8s.kubectl -n {{ item.namespace | default('default') }} get secret | grep {{ item.username }}-token | awk '{ print $1 }'
       args:
         executable: /bin/bash
       register: secret_name
@@ -53,7 +53,7 @@
     - name: Describe the secret and extract the token
       ansible.builtin.shell: |
         set -o pipefail
-        microk8s.kubectl -n {{ item.namespace  | default('default') }} describe secret {{ secret_name.stdout }} | grep token: | awk '{ print $2 }'
+        microk8s.kubectl -n {{ item.namespace | default('default') }} describe secret {{ secret_name.stdout }} | grep token: | awk '{ print $2 }'
       args:
         executable: /bin/bash
       register: token
@@ -103,7 +103,7 @@
         - k8s::users
 
     - name: Get new config SHA1
-      set_fact:
+      ansible.builtin.set_fact:
         patched_kubeconfig_sha1: "{{ patched_kubeconfig_yaml | to_nice_yaml | sha1 }}"
       tags:
         - k8s::users
@@ -115,6 +115,6 @@
         dest: "{{ user_registered.home }}/.kube/config"
         owner: "{{ item.username }}"
         mode: "0600"
-      when: kubeconfig_exists.stat.exists == false or patched_kubeconfig_sha1 != kubeconfig_exists.stat.checksum
+      when: not kubeconfig_exists.stat.exists or patched_kubeconfig_sha1 != kubeconfig_exists.stat.checksum
       tags:
         - k8s::users
diff --git a/ansible/roles/virtualization/.ansible-lint b/ansible/roles/virtualization/.ansible-lint
deleted file mode 100644
index ef6405d..0000000
--- a/ansible/roles/virtualization/.ansible-lint
+++ /dev/null
@@ -1,10 +0,0 @@
----
-exclude_paths:
-  - .git/
-  - .github/
-  - tests/
-enable_list:
-  - fqcn-builtins  # opt-in
-warn_list:
-  - line-length
-  - yaml[line-length]
diff --git a/ansible/roles/virtualization/.yamllint b/ansible/roles/virtualization/.yamllint
deleted file mode 100644
index 8827676..0000000
--- a/ansible/roles/virtualization/.yamllint
+++ /dev/null
@@ -1,33 +0,0 @@
----
-# Based on ansible-lint config
-extends: default
-
-rules:
-  braces:
-    max-spaces-inside: 1
-    level: error
-  brackets:
-    max-spaces-inside: 1
-    level: error
-  colons:
-    max-spaces-after: -1
-    level: error
-  commas:
-    max-spaces-after: -1
-    level: error
-  comments: disable
-  comments-indentation: disable
-  document-start: disable
-  empty-lines:
-    max: 3
-    level: error
-  hyphens:
-    level: error
-  indentation: disable
-  key-duplicates: enable
-  line-length: disable
-  new-line-at-end-of-file: disable
-  new-lines:
-    type: unix
-  trailing-spaces: disable
-  truthy: disable
diff --git a/ansible/roles/virtualization/defaults/main.yml b/ansible/roles/virtualization/defaults/main.yml
deleted file mode 100644
index e0ed417..0000000
--- a/ansible/roles/virtualization/defaults/main.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-# Copyright 2019 Alexandre Pires ( c.alexandre.pires@gmail.com )
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#  http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-libvirt_users: ["{{ ansible_env.SUDO_USER | d('root') }}"]
-libvirt_pool__dir: "/srv/pools"
-libvirt_ansible__pool__name: "default"
diff --git a/ansible/roles/virtualization/molecule/default/INSTALL.rst b/ansible/roles/virtualization/molecule/default/INSTALL.rst
deleted file mode 100644
index 0c4bf5c..0000000
--- a/ansible/roles/virtualization/molecule/default/INSTALL.rst
+++ /dev/null
@@ -1,23 +0,0 @@
-*********************************
-Vagrant driver installation guide
-*********************************
-
-Requirements
-============
-
-* Vagrant
-* Virtualbox, Parallels, VMware Fusion, VMware Workstation or VMware Desktop
-
-Install
-=======
-
-Please refer to the `Virtual environment`_ documentation for installation best
-practices. If not using a virtual environment, please consider passing the
-widely recommended `'--user' flag`_ when invoking ``pip``.
-
-.. _Virtual environment: https://virtualenv.pypa.io/en/latest/
-.. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site
-
-.. code-block:: bash
-
-    $ pip install 'molecule_vagrant'
diff --git a/ansible/roles/virtualization/molecule/default/converge.yml b/ansible/roles/virtualization/molecule/default/converge.yml
deleted file mode 100644
index 8d52260..0000000
--- a/ansible/roles/virtualization/molecule/default/converge.yml
+++ /dev/null
@@ -1,28 +0,0 @@
----
-- name: Converge
-  hosts: all
-  tasks:
-    - name: Update Package Cache (apt/Ubuntu)
-      become: true
-      ansible.builtin.apt:
-        update_cache: yes
-      changed_when: false
-      when: ansible_distribution == "Ubuntu"
-
-    - name: Update Package Cache (dnf/CentOS)
-      become: true
-      ansible.builtin.dnf:
-        update_cache: yes
-      changed_when: false
-      when: ansible_distribution == "CentOS"
-
-    - name: Update Package Cache (yum/Amazon)
-      become: true
-      ansible.builtin.yum:
-        update_cache: yes
-      changed_when: false  
-      when: ansible_distribution == "Amazon"  
-
-    - name: "Include virtualization"
-      ansible.builtin.include_role:
-        name: "virtualization"
diff --git a/ansible/roles/virtualization/molecule/default/molecule.yml b/ansible/roles/virtualization/molecule/default/molecule.yml
deleted file mode 100644
index f9d54f3..0000000
--- a/ansible/roles/virtualization/molecule/default/molecule.yml
+++ /dev/null
@@ -1,55 +0,0 @@
----
-dependency:
-  name: galaxy
-  enabled: true
-driver:
-  name: vagrant
-  provider:
-    name: libvirt
-provisioner:
-  name: ansible
-  config_options:
-    defaults:
-      callbacks_enabled: profile_tasks
-  log: true
-  inventory:
-    group_vars:
-      all:
-        ssh_allowed_zones: 
-          - "ALL"
-        ssh_allowed_networks: 
-          - "0.0.0.0/0"
-    host_vars: {}              
-platforms:
-  - name: jammy
-    box: "jaredeh/ubuntu2204-server"
-    box_version: "0.1.1"
-    interfaces:
-      - auto_config: true
-        network_name: private_network
-        type: dhcp
-    instance_raw_config_args:
-      # use single quotes to avoid YAML parsing as dict due to ':'
-      - 'vm.synced_folder ".", "/vagrant", type: "rsync"'
-      # Run 'uname' a provisionning step **needs 'provision: true' to work**
-      - 'vm.provision :shell, inline: "uname"'
-    # Dictionary of `config` options. Note that string values need to be
-    # explicitly enclosed in quotes.
-    config_options:
-      vm.boot_timeout: 600
-      ssh.keep_alive: yes
-      ssh.remote_user: 'ansible'
-      synced_folder: true
-    provider_options:
-      video_type: 'vga'
-      host: 'localhost'
-      uri: 'qemu:///system'
-      nested: true
-    memory: 4096
-verifier:
-  name: ansible
-lint: |
-  set -e
-  ansible-lint
-scenario:
-  name: default
\ No newline at end of file
diff --git a/ansible/roles/virtualization/molecule/default/verify.yml b/ansible/roles/virtualization/molecule/default/verify.yml
deleted file mode 100644
index e707420..0000000
--- a/ansible/roles/virtualization/molecule/default/verify.yml
+++ /dev/null
@@ -1,10 +0,0 @@
----
-# This is an example playbook to execute Ansible tests.
-
-- name: Verify
-  hosts: all
-  gather_facts: false
-  tasks:
-  - name: Example assertion
-    ansible.builtin.assert:
-      that: true
diff --git a/ansible/roles/virtualization/requirements.yml b/ansible/roles/virtualization/requirements.yml
deleted file mode 100644
index 04fb28e..0000000
--- a/ansible/roles/virtualization/requirements.yml
+++ /dev/null
@@ -1,4 +0,0 @@
----
-collections:
-  - community.general
-  - community.libvirt
diff --git a/ansible/roles/virtualization/tasks/init.yml b/ansible/roles/virtualization/tasks/init.yml
deleted file mode 100644
index cba6e55..0000000
--- a/ansible/roles/virtualization/tasks/init.yml
+++ /dev/null
@@ -1,14 +0,0 @@
-- name: Ubuntu specific tasks
-  when: ansible_distribution == 'Ubuntu'
-  block:
-  - name: Update APT cache
-    become: true
-    ansible.builtin.apt:
-      update_cache: yes
-      cache_valid_time: 3600
-
-  - name: Install Dependencies
-    become: true
-    ansible.builtin.package:
-      pkg: "python3-pip"
-      state: present
diff --git a/ansible/roles/virtualization/tasks/install.yml b/ansible/roles/virtualization/tasks/install.yml
deleted file mode 100644
index bf85f25..0000000
--- a/ansible/roles/virtualization/tasks/install.yml
+++ /dev/null
@@ -1,25 +0,0 @@
-
-- name: Install system packages for virtualization
-  become: true
-  ansible.builtin.package:
-    pkg: "{{ item }}"
-    state: present
-  loop: 
-    - qemu-kvm
-    - libvirt-daemon-system 
-    - virtinst 
-    - libvirt-clients 
-    - bridge-utils
-    - python3-libvirt
-    - dnsmasq
-    - qemu-utils
-    - bzip2
-    - libxml2-utils
-
-- name: Install PIP packages for virtualization
-  become: true
-  ansible.builtin.pip:
-    name: "{{ item }}"
-    state: present
-  loop: 
-    - lxml
diff --git a/ansible/roles/virtualization/tasks/main.yml b/ansible/roles/virtualization/tasks/main.yml
deleted file mode 100644
index 77bb48b..0000000
--- a/ansible/roles/virtualization/tasks/main.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: 'Install required packages for virtualization'
-  ansible.builtin.include_tasks: "{{ role_path }}/tasks/install.yml"
-  tags:
-    - 'role::virtualization'
-    - 'role::virtualization::install'
-
-- name: 'Config virtualization support on host'
-  ansible.builtin.import_tasks: "{{ role_path }}/tasks/manage_config.yml"
-  tags:
-    - 'role::virtualization'
-    - 'role::virtualization::config'
-
-- name: 'Restart and enable/disable virtualization service'
-  ansible.builtin.import_tasks: "{{ role_path }}/tasks/manage_service.yml"
-  tags:
-    - 'role::virtualization'
-    - 'role::virtualization::install'
-    - 'role::virtualization::service'
diff --git a/ansible/roles/virtualization/tasks/manage_config.yml b/ansible/roles/virtualization/tasks/manage_config.yml
deleted file mode 100644
index 6cc792e..0000000
--- a/ansible/roles/virtualization/tasks/manage_config.yml
+++ /dev/null
@@ -1,16 +0,0 @@
-- name: Adding required users to group libvirt
-  become: true
-  ansible.builtin.user:
-    name: "{{ item }}"
-    groups:
-      - libvirt
-    append: true
-  loop: "{{ libvirt_users }}"
-
-- name: Fix qemu.conf SE Linux driver
-  when: ansible_distribution == 'Ubuntu'
-  become: true
-  ansible.builtin.lineinfile:
-    dest: /etc/libvirt/qemu.conf
-    line: 'security_driver = "none"'
-    state: present
diff --git a/ansible/roles/virtualization/tasks/manage_service.yml b/ansible/roles/virtualization/tasks/manage_service.yml
deleted file mode 100644
index b070a67..0000000
--- a/ansible/roles/virtualization/tasks/manage_service.yml
+++ /dev/null
@@ -1,6 +0,0 @@
-- name: Service enable/disable
-  become: true
-  ansible.builtin.service:
-    name: libvirtd
-    enabled: yes
-    state: started
\ No newline at end of file
diff --git a/ansible/sectool.env b/ansible/sectool.env
index f960350..766eecb 100644
--- a/ansible/sectool.env
+++ b/ansible/sectool.env
@@ -5,3 +5,5 @@ MAXMIND_LICENSE_KEY=$MAXMIND_LICENSE_KEY
 USER_PASSWORD_SALT=$USER_PASSWORD_SALT
 USER_PASSWORD_OPERATOR=$USER_PASSWORD_OPERATOR
 ANSIBLE_FORCE_COLOR=True
+BUCKET_SUFFIX=$BUCKET_SUFFIX
+MICROK8S_ENCRYPTION_SECRET=$MICROK8S_ENCRYPTION_SECRET
diff --git a/repository.vault b/repository.vault
index 66be9f3..d4b7b89 100644
--- a/repository.vault
+++ b/repository.vault
@@ -1 +1 @@
-lZE/F/Ng+kqQG65u5afRAODt626sHUV/sS13AsWpx6AlWOf40hrq9QNnkjAq1fF8FVctnyY+ltBjwc7fAmvqlwWmbVclahnwQFbgjQ24c6IYuMMmULEy9PN6iPBFH1EstA8lrSVNCz+AN1NR0yxctAMMv7/XoAo6e6nOsn3Ko5F4M57L8QSdoEI/Giz2UvVm46teibFDivnfgjKji3oWO5xIcy7ggZsDF4pYZLci3THfgonoBPZUxyehVl/uyarT0k0LIUD6QUCNXaxxQXa2rDsgyoglLOUZRvitdoThXJsW4VjKYD/joJdR1bELwJ41Nh6IPcWsUSJrEJHhr3IEBMk6DKkC96Ie1kOvW8GkHOKkmFdZkhr2gj9ol6xB8XD/x6K6hZnW/BdJnD3F1JX05km3UHW4uSgvrN1l4x1nNZ5w84BQ/mw1M90ZoiCDjFBtQUOIYciFMQTkbUNnnvDigRXzLhcqxEMJnZ1saz6YXA86WDTxNU5AlOAiwtn4MpO7obXOaiclscB1smpFosjVUqKPpuJrNC5RehhXYVsSdqLk5nRYokv866/RQmXOXzNeig9DrJvj0+Da5kcQ12gWEKr6gSG4O8QLcUcP+YnDtPOaq6OpzEzVmYB9XboOZQyumiUn3QL0jwINBwbNM2GLvXHt5Mmhd16dcHbabZAqLzHRy5T2bh8jhcgRVORem9IOVOSIhCnv7szt+mfEzem5ipUx8dQljOFodNRf5YiJHuWS4yEsbsvV4dLdIqWwMasA1YsOjzRnu5w0AJjd5mo3v9zFW/1kop+tFcsPbglr/Tm9uH9a7D1gZnkZLlUILhC+edRPde5upIyQkrdm7WLECkXsBqQz3QhbcD9BW2krFgvdjyDJYGSpFnXXtsOoo/+NnQd+IRiSe2aevVQH6MrUqfeQ0l/Wxi2cpxTIMLhKnmkRkrSqOn3/EpVL62eJPCmW4OSyCISexIxVvsx72WhvlAMLDXfPxC7zTObUtlrd3w+kzIF8K3ZduRUHWwtCSSekhzTJ3JZyGxKZ88sPfUtk7n1J/lmFVCmHmkuU+Rw21PEVPepPL1tkBURk12uH/+uyRFfR7zFEXXC39nXyKN/Yxa+z0Tdhj2mynLbuZ6ygwfEqXM1hyScqTh1J4z6CDLMelE+kEgvNxG1n8fXC75KPsaxzsqwqlo90CDNNrs2loJrxm3kQcqXxowy/sLtupHpdufEPP6hHnPptqsndmiNiqZjLgmCGuMR3KZBxrv2nsmwdnT4V/aDf80m3lRSuhjZD4zhRIhxsIRKlMjjAi7qgeHFBrOS61J/VVwtzxgLZFfEnPM8M3nf3wh/gAEzTa1uWiJxO26UDUymoW18YWOoIQDn0vjN3acLtGcy+mbjHYWHoJ2So0hjuDJ6ItGKfvrqDwjKX6grGXi955JhVPdR4wh6K+zoYqNS0uFVXc4hJZnr9R7xfPE5QjjNQqJLCZzgkX0sA28qL/5lzzr7XNkfotz0muyvO5OvfBJdcYyjTg5A7fZT0OvbM1dc8pmXzU1+dZnf/ByVemm81rBGBxhlcLIszqGhQzL9Is6dWzHChLA5moQSlKDvcjgUhuB/nV2FKi6kXqp5xU07i1kcbG6b4JL2fA4+ad71odxmE8SYmXt3PZFqJJIAmdVIAXdHeUQZlaA/wEbB9RdlD7XrGVc30BnYg2UA5AO2ijPECuScsZ+QmGBU/pzgp5mLZ691CyvnS9YtDuK3t1c1aNAOMpw9ZLmY5DINzmXuKtLHCw/HCUAH8+Zj94IXJKWYl1CmcxWH2prTDdbjOv5FpckQq04YCykx9qEr8tlq+LBkYB5r7DzzZfemb9YPKapqDXOTJVYBZP35QWPd2xHJVSE9KnYUpgfPxrYpEeJRBvPODOt1pxu+HOiiljSB3H5WBPlS91w1TcQZCE0g9VL+ERmoCOOso0PSI9F2LquLPA6sVlcxMXP9ouZ5BkkSxrOkc/3iLrINHaXRHirfNJLzDePe+xxLJCzXVDeFqUzd8iZO71E5fiGBzwpefnBnfa/bEF/SXfiFl491rYx8Wrur11QmaiHpMPdTsF1YknrE9HU4eYu3wT+7GgeIpX0KN3iT2RFPj9BztT5JBj8LefK3KSzRqc4E3Oak6WEfulkAOguOPJI3FOoXod/trve2kiReSTJlCEcK1FtOStE9yN0vRLM8=
\ No newline at end of file
+FRbk2McaxArlE39vc3B7gyVWhqe8ejiDkZEWShEHC6YXLFYeGWE4EybXOntql6B9RWt3xhqKvpSOoEBlkXW9uB/efH2G1Wv4g5BhG1uwQsFIIfp5oRe2wYVT1p8EcQ59nESaJhk8KrUNFg2pUTyBXmMzMMIJOaO2NDwXX6j+y0fWH+hgjhI5putRK8I5tbMRLLpLH97Q90Ot11XUZPouiQm5wr1emOIZ3626oxAwCO4e6X8YnhuIhLXJgRuSvLnJCq1ClQCwvspPcwHzUZ2/p11eMhsjwbxAr2crUBj3MX1iSllAkA5HAIOkI2XOW58gWMZgHxDhfC/kkKYraEEMeSyVvmpZKnnn7A5xKQV699+TaEpI6sKSqIZbMRjYTuzlDGJRvlg8d5H8JxjLJ1l0wHTIEE0sdLGObaEjL8cRsOeoxBsRnqwwvDo/tS9OfLTt39Py4vylWJeEqLDJXvxKHJ5Dp35gxdEE+DDmS5WzhBUTVivke6pRbD9hHDC6VhwFjnCxh1gSVAsTK6gdn1MHglvAVyQwD1VyTa3+po0gXtVsyCpLv/o1FA/CTeZvc+xY5At2KjlZbo/huhJ96sUPDMlznNDgXJsviM19FH1eNPmCxLnPFx+2a9JPvRUeIrhuizHucBJPdXjyEnaowU/yjBXHh05dUuhClV9i/7dCuohR6kN7tm1RaQtUfjp6yWb9Y6+gZXQI+s0b7ePprrsjRFF8l84Ahvyn503esYAYy6/c/4400N3bIxaZ6AGoYpMuNItQZZsCC6s3hmhXL745AUOmkhwBS5VqXO1iQl71h0FGgPA/XD2ftUSpdH9on9xCCdPooGzR1L+fGLlVQIotb4kdXYJg8uC9nHtHWvQ7cfwBXORHUAQCOO1Qv3vk4G48JVjWvr5G03wtUn7Ph8DLUp2orjzzK4o8pCmHTy2allkYCOEeGZ9GXRKGNPZpjxhi5/lB6oM06urIPWFeQgZGQtt1xWrhmvZnwVEDIcdlWdz68imCBnimrV1eNBpGRiZzW7mKQ2seFWdwCZ3Gpvdco355jbMj7xetAISfaT2dMUH0YSJAp80d7XPXl7eB5nXUIRnqFnQGg5yCeSqpg/5YeLthwMhgylanJN72eVl5yiuWc7fJbJRu2r7cUcXS0WT6yYKcdDjVF0dIj/W44Y7jRjaoZ0zcMaFXlteNlKYpaSLknZ6PaF15G63YifGjHsHreZsXrUrhASBMBWcAiicAoTpEoC9yleZi+pzys8xW3q+zOl2WFOVo9wk3NNrblvL65yjKl0r/A/DMP8k8N7v2+KFeT5qNCKfSaCw1VxKvjPVMQcKnqdE9a7VZVAAQjm35pSA9jKUBJ6rJeNY/xUrvjtfQslKOVlBRQFHEl6mcfSc23fOAqx76AUFdfQWsWG+rrOFrr6Y3HERH/+kEOWHuF6U+vxIrGrJYhF2hkz0wvXE0tni5oi3UZB5b58gd9jQShQIaOwLHco/iJIo1z9aa3rl/wkdjM3OGvubC2gbVeQ1YVgKREH83NaHWxUNDEamuxBHzEL+uNj79uWGLvD9s0wJMD/OD2HXGaUD+yUj3vS11V9XqZ71aNG6qg9I5Pwx50togX9LOfiMemkPuGuN1HscXnVFca+tQ1z+oGrPT4BLVW6LF0DnpooQZmdbYytvMi3O1ZYktvxPQY8UB2Om6fwDwWE5q3Hbyv3ji1c3m4Cnr5SHUeZYl2jujKl5E0Remjz3B3LNGTKncdUq4pW/8qZ8Obz4KXsEgkpNBVJhK1W/8gy/lLEl/Rkr2ustuZnRx8QiGkW13MSRr0r3U/Y94UdzmKrvldsdA1D19EDj+RSHdMzrJd6AHwBIzrqM33gF4SF1nF6tSUqBj2ylnHebU3ynUI5axaU5yfqSduiCPCTylnmYb/AqaMk/hlIIx2M9BTCgfbMNSeDdLDerPSmptM7cQ6GU0W4dZvJSvAy3oloyG9bwTpRMhHzWW059nicJyCCCJMUrpKSRTqJypw8iSa71TtjT9Du5gGsgZHS9ATNOutQ60+9lAEtK6UPEcMU2MNfN+em3m9GxAJ/zorfrdg131Tqu6csZ2lN9M+WxrRaRlGHIS89xgWsOZ3E7EKjGm0RY0yj4e2Z6JPT6KvEMVZS0y23/33GW4SSysfvGKEA4/62IuueyPllrQZZS1qB3BiWHZjUUf+GSFRQlMapOTaEsOUMeny5K9Wgdm0utlrmbTlFdGMCdv/dJ4lb/vUynSVq6BopJ3nUfetxTjOoT/B0fmhvwy6ddYibh3AgCfZD9UHPGbiFum1/9Tbb2MvMM1M6LQ988bcqbFGio9exzgySaWL5lYjQTqCICPn7I4uQRf+rZHUeMfHYXzQbWsfNyRH75NSPakhdVSss1dFtl/d3jGzlb83I5CdbttznSKsGd3bmHimfCodlyJuIjI2XhW7WK6RbeUoRnqKnRNANFTa2BaXDZUCVhpZB4DcMboNisIxNF/QiH+3u+b6ba0xAXtLXNl1gITmA04UG3yTfx44jF9s6Xpt60nEH/oMeW1kiL02oV26BYT9MTx9neh5WMMNLBHhWw/98v0LeJX3imlM7tTjPgF/eE6z12ndeFQrQiFILN3jClbkKwS+yliXCpeO6+akKraSTGUcrUXxWMrfc9xkvR2fjUzWHBSqXSQMFPoJBrYfQbtFuNcGebQwwYmorTpa96p5uE2Ro9goOoeElG1bkCBcyBiXlQJo10/d84YAMQMsDLb2q19GGFT/itiO2scxTwec+8APRE9oL8bMdhOeDA5kOeC/HQaeOKkPEt8K5qALAWTjWHVQTEAOoHdv+HE5g7yacuAAecIodmJQbynQTXi8u27KJJBQOdUblJ8c3u4b5/HnkQLGe2/RYnVv5qhvT/KQNzwXPdXKVfcsE+gyye4Th2WqmI=
\ No newline at end of file
diff --git a/resources/iac_user,yaml b/resources/iac_user,yaml
deleted file mode 100644
index a0486d2..0000000
--- a/resources/iac_user,yaml
+++ /dev/null
@@ -1,141 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  namespace: collabora
-  name: admin-collabora
-rules:
-  - apiGroups: ["*"]
-    resources: ["*"]
-    verbs: ["*"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  namespace: gitea
-  name: admin-gitea
-rules:
-  - apiGroups: ["*"]
-    resources: ["*"]
-    verbs: ["*"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  namespace: m3uproxy
-  name: admin-m3uproxy
-rules:
-  - apiGroups: ["*"]
-    resources: ["*"]
-    verbs: ["*"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  namespace: nextcloud
-  name: admin-nextcloud
-rules:
-  - apiGroups: ["*"]
-    resources: ["*"]
-    verbs: ["*"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  namespace: wordpress
-  name: admin-wordpress
-rules:
-  - apiGroups: ["*"]
-    resources: ["*"]
-    verbs: ["*"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: namespace-creator
-rules:
-  - apiGroups: [""]
-    resources: ["namespaces"]
-    verbs: ["create", "get", "list"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: admin-collabora-binding
-  namespace: collabora
-subjects:
-  - kind: User
-    name: iac
-    apiGroup: rbac.authorization.k8s.io
-roleRef:
-  kind: Role
-  name: admin-collabora
-  apiGroup: rbac.authorization.k8s.io
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: admin-gitea-binding
-  namespace: gitea
-subjects:
-  - kind: User
-    name: iac
-    apiGroup: rbac.authorization.k8s.io
-roleRef:
-  kind: Role
-  name: admin-gitea
-  apiGroup: rbac.authorization.k8s.io
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: admin-m3uproxy-binding
-  namespace: m3uproxy
-subjects:
-  - kind: User
-    name: iac
-    apiGroup: rbac.authorization.k8s.io
-roleRef:
-  kind: Role
-  name: admin-m3uproxy
-  apiGroup: rbac.authorization.k8s.io
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: admin-nextcloud-binding
-  namespace: nextcloud
-subjects:
-  - kind: User
-    name: iac
-    apiGroup: rbac.authorization.k8s.io
-roleRef:
-  kind: Role
-  name: admin-nextcloud
-  apiGroup: rbac.authorization.k8s.io
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: admin-wordpress-binding
-  namespace: wordpress
-subjects:
-  - kind: User
-    name: iac
-    apiGroup: rbac.authorization.k8s.io
-roleRef:
-  kind: Role
-  name: admin-wordpress
-  apiGroup: rbac.authorization.k8s.io
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: namespace-creator-binding
-subjects:
-  - kind: User
-    name: iac
-    apiGroup: rbac.authorization.k8s.io
-roleRef:
-  kind: ClusterRole
-  name: namespace-creator
-  apiGroup: rbac.authorization.k8s.io
diff --git a/terraform/iac/.vault b/terraform/iac/.vault
new file mode 100644
index 0000000..7007d14
--- /dev/null
+++ b/terraform/iac/.vault
@@ -0,0 +1 @@
+../../repository.vault
\ No newline at end of file
diff --git a/terraform/iac/backend.tf b/terraform/iac/backend.tf
new file mode 100644
index 0000000..9848ece
--- /dev/null
+++ b/terraform/iac/backend.tf
@@ -0,0 +1,7 @@
+terraform {
+  backend "s3" {
+    bucket = "a13labs.infra"
+    key    = "a13labs-iac.tfstate"
+    region = "us-east-1"
+  }
+}
diff --git a/terraform/iac/buckets.tf b/terraform/iac/buckets.tf
new file mode 100644
index 0000000..9ab2533
--- /dev/null
+++ b/terraform/iac/buckets.tf
@@ -0,0 +1,52 @@
+resource "scaleway_object_bucket" "infra_assets" {
+  name       = "a13labs-infra-${var.bucket_suffix}"
+  project_id = var.scaleway_project_id
+  region     = "fr-par"
+}
+
+resource "scaleway_object_bucket_policy" "policy" {
+  bucket = scaleway_object_bucket.infra_assets.name
+  policy = jsonencode({
+    Version = "2023-04-17",
+    Id      = "AllowMachineDownload",
+    Statement = [
+      {
+        Effect = "Allow"
+        Action = [
+          "s3:ListBucket",
+          "s3:GetObject",
+        ]
+        Principal = "*"
+        Resource = [
+          scaleway_object_bucket.infra_assets.name,
+          "${scaleway_object_bucket.infra_assets.name}/*",
+        ]
+        Condition = {
+          IpAddress = {
+            "aws:SourceIp" = local.instance_ips
+          }
+        },
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          "s3:*",
+        ]
+        Principal = {
+          SCW = "user_id:${var.scaleway_user_id}"
+        }
+        Resource = [
+          scaleway_object_bucket.infra_assets.name,
+          "${scaleway_object_bucket.infra_assets.name}/*",
+        ]
+      },
+    ]
+  })
+}
+
+resource "scaleway_object" "encryption_key" {
+  bucket = scaleway_object_bucket.infra_assets.id
+  key    = "keys/${replace(data.contabo_instance.microk8s.mac_address, ":", "_")}.key"
+
+  content_base64 = base64encode(var.encryption_key)
+}
diff --git a/terraform/iac/config.tf b/terraform/iac/config.tf
new file mode 100644
index 0000000..e6e8092
--- /dev/null
+++ b/terraform/iac/config.tf
@@ -0,0 +1,5 @@
+locals {
+  instance_ips = [
+    "${data.contabo_instance.microk8s.ip_config[0].v4[0].ip}/32",
+  ]
+}
diff --git a/terraform/iac/contabo.tf b/terraform/iac/contabo.tf
new file mode 100644
index 0000000..a284a36
--- /dev/null
+++ b/terraform/iac/contabo.tf
@@ -0,0 +1,3 @@
+data "contabo_instance" "microk8s" {
+  id = "201912751"
+}
diff --git a/terraform/iac/provider.tf b/terraform/iac/provider.tf
new file mode 100644
index 0000000..3a163b7
--- /dev/null
+++ b/terraform/iac/provider.tf
@@ -0,0 +1,52 @@
+
+terraform {
+  required_version = "~>1.8"
+  required_providers {
+    random = {
+      source  = "hashicorp/random"
+      version = "~>3.4"
+    }
+    null = {
+      source  = "hashicorp/null"
+      version = "~>3.2"
+    }
+    external = {
+      source  = "hashicorp/external"
+      version = "~>2.2"
+    }
+    time = {
+      source  = "hashicorp/time"
+      version = "~>0.9"
+    }
+    kubernetes = {
+      source  = "hashicorp/kubernetes"
+      version = "~>2.18"
+    }
+    scaleway = {
+      source  = "scaleway/scaleway"
+      version = "~>2.13"
+    }
+    contabo = {
+      source  = "contabo/contabo"
+      version = "~>0.1"
+    }
+  }
+}
+
+
+provider "scaleway" {
+  zone            = "fr-par-2"
+  region          = "fr-par"
+  access_key      = var.scaleway_access_key
+  secret_key      = var.scaleway_secret_key
+  organization_id = var.scaleway_organization_id
+}
+
+
+# Configure your Contabo API credentials
+provider "contabo" {
+  oauth2_client_id     = var.contabo_client_id
+  oauth2_client_secret = var.contabo_client_secret
+  oauth2_user          = var.contabo_api_user
+  oauth2_pass          = var.contabo_api_password
+}
diff --git a/terraform/iac/sectool.env b/terraform/iac/sectool.env
new file mode 100644
index 0000000..cf59094
--- /dev/null
+++ b/terraform/iac/sectool.env
@@ -0,0 +1,13 @@
+AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY
+AWS_SECRET_ACCESS_KEY=$AWS_SECRET_KEY
+TF_VAR_scaleway_access_key=$SCALEWAY_ACCESS_KEY
+TF_VAR_scaleway_secret_key=$SCALEWAY_SECRET_KEY
+TF_VAR_scaleway_project_id=$SCALEWAY_PROJECT_ID
+TF_VAR_scaleway_organization_id=$SCALEWAY_ORGANIZATION_ID
+TF_VAR_scaleway_user_id=$SCALEWAY_USER_ID
+TF_VAR_contabo_client_id=$CONTABO_CLIENT_ID
+TF_VAR_contabo_client_secret=$CONTABO_CLIENT_SECRET
+TF_VAR_contabo_api_password=$CONTABO_API_PASSWORD
+TF_VAR_contabo_api_user=$CONTABO_USER_NAME
+TF_VAR_bucket_suffix=$BUCKET_SUFFIX
+TF_VAR_encryption_key=$ENCRYPT_KEY
diff --git a/terraform/iac/terraform.rc b/terraform/iac/terraform.rc
new file mode 100644
index 0000000..e69de29
diff --git a/terraform/iac/variables.tf b/terraform/iac/variables.tf
new file mode 100644
index 0000000..582068b
--- /dev/null
+++ b/terraform/iac/variables.tf
@@ -0,0 +1,65 @@
+variable "scaleway_access_key" {
+  description = "Scaleway Access key"
+  type        = string
+  sensitive   = true
+}
+
+variable "scaleway_secret_key" {
+  description = "Scaleway Secret key"
+  type        = string
+  sensitive   = true
+}
+
+variable "scaleway_project_id" {
+  description = "Scaleway Project Id"
+  type        = string
+  sensitive   = true
+}
+
+variable "scaleway_organization_id" {
+  description = "Scaleway Organization Id"
+  type        = string
+  sensitive   = true
+}
+
+variable "scaleway_user_id" {
+  description = "Scaleway User Id"
+  type        = string
+  sensitive   = true
+}
+
+
+variable "contabo_client_id" {
+  description = "Contabo Client ID"
+  type        = string
+  sensitive   = true
+}
+
+variable "contabo_client_secret" {
+  description = "Contabo Client Secret"
+  type        = string
+  sensitive   = true
+}
+
+variable "contabo_api_password" {
+  description = "Contabo API Password"
+  type        = string
+  sensitive   = true
+}
+
+variable "contabo_api_user" {
+  description = "Contabo API User"
+  type        = string
+}
+
+variable "encryption_key" {
+  description = "Encryption key for sensitive data"
+  type        = string
+  sensitive   = true
+}
+
+variable "bucket_suffix" {
+  description = "Suffix for bucket names"
+  type        = string
+  sensitive   = true
+}
diff --git a/terraform/k8sapps/backend.tf b/terraform/k8sapps/backend.tf
index 38df914..5f133c7 100644
--- a/terraform/k8sapps/backend.tf
+++ b/terraform/k8sapps/backend.tf
@@ -1,24 +1,7 @@
-# 
-# Copyright 2019 Alexandre Pires (alexandre.pires@mov.ai)
-# 
-#    Licensed under the Apache License, Version 2.0 (the "License");
-#    you may not use this file except in compliance with the License.
-#    You may obtain a copy of the License at
-# 
-#        http://www.apache.org/licenses/LICENSE-2.0
-# 
-#    Unless required by applicable law or agreed to in writing, software
-#    distributed under the License is distributed on an "AS IS" BASIS,
-#    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-#    See the License for the specific language governing permissions and
-#    limitations under the License.
-# 
-# File: backend.tf
-
 terraform {
   backend "s3" {
-    bucket                      = "a13labs.infra"
-    key                         = "scaleway-apps.tfstate"
-    region                      = "us-east-1"
+    bucket = "a13labs.infra"
+    key    = "scaleway-apps.tfstate"
+    region = "us-east-1"
   }
 }