diff --git a/deploy.yml b/deploy.yml
index cfe2681..e2c141a 100644
--- a/deploy.yml
+++ b/deploy.yml
@@ -8,6 +8,19 @@
     - name: mount rw
       command: /usr/local/bin/rw
 
+- name: basic roles
+  hosts:
+    - caladan
+    - fugu
+    - narwhal
+    - snitch
+    - suricata
+    # - pikvm
+  become: true
+  roles:
+    - repos
+    - basic
+
 - name: cryptoraid
   hosts:
     - suricata
@@ -30,13 +43,6 @@
   roles:
     - usercfg
 
-- name: pi_fan_hwpwm
-  hosts:
-    - suricata
-  become: true
-  roles:
-    - pi_fan_hwpwm
-
 - name: docker
   hosts:
     - caladan
@@ -45,14 +51,6 @@
   roles:
     - docker
 
-- name: podman
-  hosts:
-    - suricata
-  become: true
-  roles:
-    - podman
-  tags: podman
-
 - name: common roles
   hosts:
     - caladan
@@ -63,9 +61,7 @@
     # - pikvm
   become: true
   roles:
-    - basic
     - users
-    - repos
     - sshd
   vars:
     users:
@@ -75,7 +71,6 @@
       - gopass
       - woodpecker
 
-
 - name: quality of life tools
   hosts:
     - caladan
@@ -86,6 +81,21 @@
   roles:
     - quality_of_life
 
+- name: pi_fan_hwpwm
+  hosts:
+    - suricata
+  become: true
+  roles:
+    - pi_fan_hwpwm
+
+- name: podman
+  hosts:
+    - suricata
+  become: true
+  roles:
+    - podman
+  tags: podman
+
 - name: wifi setup
   hosts: snitch
   become: true
@@ -150,8 +160,6 @@
       # doesn't seem to work with encryption
       shell:
         cmd: lbu commit
-      environment:
-        PASSWORD: '{{ lbu_password }}'
       when: ansible_distribution == "Alpine" and alpine_mode in ["diskless", "data"]
 
 - name: mount ro