diff --git a/roles/system_config/files/aliases b/roles/system_config/files/aliases
new file mode 100644
index 0000000..799fcb9
--- /dev/null
+++ b/roles/system_config/files/aliases
@@ -0,0 +1,3 @@
+# See man 5 aliases for format
+postmaster:    root
+root: coo@turnsys.com
diff --git a/roles/system_config/files/disallowed-users b/roles/system_config/files/disallowed-users
new file mode 100644
index 0000000..7c07810
--- /dev/null
+++ b/roles/system_config/files/disallowed-users
@@ -0,0 +1,2 @@
+#/etc/cockpit/disallowed-users
+# List of users which are not allowed to login to Cockpit
diff --git a/roles/system_config/files/lldpd b/roles/system_config/files/lldpd
new file mode 100644
index 0000000..b98df83
--- /dev/null
+++ b/roles/system_config/files/lldpd
@@ -0,0 +1,2 @@
+# Uncomment to start SNMP subagent and enable CDP, SONMP and EDP protocol
+DAEMON_ARGS="-x -c -s -e"
diff --git a/roles/system_config/files/postfix_generic b/roles/system_config/files/postfix_generic
new file mode 100644
index 0000000..996fa4f
--- /dev/null
+++ b/roles/system_config/files/postfix_generic
@@ -0,0 +1 @@
+/.*/    tsysrootaccount@knel.net
diff --git a/roles/system_config/files/snmp-sudo.conf b/roles/system_config/files/snmp-sudo.conf
new file mode 100644
index 0000000..3ce5fd3
--- /dev/null
+++ b/roles/system_config/files/snmp-sudo.conf
@@ -0,0 +1 @@
+Debian-snmp ALL = NOPASSWD: /bin/cat
diff --git a/roles/system_config/files/snmpd-physicalhost.conf b/roles/system_config/files/snmpd-physicalhost.conf
new file mode 100644
index 0000000..b8cb71f
--- /dev/null
+++ b/roles/system_config/files/snmpd-physicalhost.conf
@@ -0,0 +1,46 @@
+##########################################################################
+# snmpd.conf
+# Created by CNW on 11/3/2018 via snmpconf wizard and manual post tweaks
+###########################################################################
+# SECTION: Monitor Various Aspects of the Running Host
+#
+
+# disk: Check for disk space usage of a partition.
+#   The agent can check the amount of available disk space, and make
+#   sure it is above a set limit.
+#
+load  3 3 3
+rocommunity  kn3lmgmt
+sysservices 76
+
+#syslocation Rack, Room, Building, City, Country [Lat, Lon]
+syslocation R4, Server Room, SITER, Pflugerville, United States
+syscontact  coo@turnsys.com
+
+#NTP
+extend ntp-client /usr/lib/check_mk_agent/local/ntp-client
+
+#SMTP
+extend mailq /usr/lib/check_mk_agent/local/postfix-queues
+extend postfixdetailed /usr/lib/check_mk_agent/local/postfixdetailed
+
+#OS Distribution Detection
+extend distro /usr/local/bin/distro
+extend osupdate /usr/lib/check_mk_agent/local/os-updates.sh
+
+#Hardware Detection
+extend manufacturer /usr/bin/sudo /usr/bin/cat /sys/devices/virtual/dmi/id/sys_vendor
+extend hardware /usr/bin/sudo /usr/bin/cat /sys/devices/virtual/dmi/id/product_name
+extend serial /usr/bin/sudo /usr/bin/cat /sys/devices/virtual/dmi/id/product_serial
+
+#SMART
+extend smart /usr/lib/check_mk_agent/local/smart
+
+#Temperature
+pass_persist    .1.3.6.1.4.1.9.9.13.1.3 /usr/local/bin/temper-snmp
+
+# Allow Systems Management Data Engine SNMP to connect to snmpd using SMUX
+# smuxpeer .1.3.6.1.4.1.674.10892.1
+
+# LLDP collection
+master agentx
diff --git a/roles/system_config/files/snmpd-rpi.conf b/roles/system_config/files/snmpd-rpi.conf
new file mode 100644
index 0000000..4e98bf8
--- /dev/null
+++ b/roles/system_config/files/snmpd-rpi.conf
@@ -0,0 +1,40 @@
+##########################################################################
+# snmpd.conf
+# Created by CNW on 11/3/2018 via snmpconf wizard and manual post tweaks
+###########################################################################
+# SECTION: Monitor Various Aspects of the Running Host
+#
+
+# disk: Check for disk space usage of a partition.
+#   The agent can check the amount of available disk space, and make
+#   sure it is above a set limit.
+#
+load  3 3 3
+rocommunity  kn3lmgmt
+sysservices 76
+
+#syslocation Rack, Room, Building, City, Country [Lat, Lon]
+syslocation SITER, Pflugerville, United States
+syscontact  coo@turnsys.com
+
+#NTP
+extend ntp-client /usr/lib/check_mk_agent/local/ntp-client
+
+#SMTP
+extend mailq /usr/lib/check_mk_agent/local/postfix-queues
+extend postfixdetailed /usr/lib/check_mk_agent/local/postfixdetailed
+
+#OS Distribution Detection
+extend distro /usr/local/bin/distro
+extend osupdate /usr/lib/check_mk_agent/local/os-updates.sh
+
+
+#Hardware Detection
+extend hardware /usr/bin/sudo /usr/bin/cat /sys/firmware/devicetree/base/model 
+extend serial /usr/bin/sudo /usr/bin/cat /sys/firmware/devicetree/base/serial-number
+
+# Allow Systems Management Data Engine SNMP to connect to snmpd using SMUX
+# smuxpeer .1.3.6.1.4.1.674.10892.1
+
+# LLDP collection
+master agentx
diff --git a/roles/system_config/files/snmpd.conf b/roles/system_config/files/snmpd.conf
new file mode 100644
index 0000000..8ae8ab4
--- /dev/null
+++ b/roles/system_config/files/snmpd.conf
@@ -0,0 +1,44 @@
+##########################################################################
+# snmpd.conf
+# Created by CNW on 11/3/2018 via snmpconf wizard and manual post tweaks
+###########################################################################
+# SECTION: Monitor Various Aspects of the Running Host
+#
+
+# disk: Check for disk space usage of a partition.
+#   The agent can check the amount of available disk space, and make
+#   sure it is above a set limit.
+#
+load  3 3 3
+rocommunity  kn3lmgmt
+sysservices 76
+
+#syslocation Rack, Room, Building, City, Country [Lat, Lon]
+syslocation R4, Server Room, SITER, Pflugerville, United States
+syscontact  coo@turnsys.com
+
+#NTP
+extend ntp-client /usr/lib/check_mk_agent/local/ntp-client
+
+#SMTP
+extend mailq /usr/lib/check_mk_agent/local/postfix-queues
+extend postfixdetailed /usr/lib/check_mk_agent/local/postfixdetailed
+
+#OS Distribution Detection
+extend distro /usr/local/bin/distro
+extend osupdate /usr/lib/check_mk_agent/local/os-updates.sh
+
+# Socket statistics
+extend ss /usr/lib/check_mk_agent/local/ss.py
+
+#Hardware Detection
+# (uncomment for x86 platforms)
+extend manufacturer /usr/bin/sudo /usr/bin/cat /sys/devices/virtual/dmi/id/sys_vendor
+extend hardware /usr/bin/sudo /usr/bin/cat /sys/devices/virtual/dmi/id/product_name
+extend serial /usr/bin/sudo /usr/bin/cat /sys/devices/virtual/dmi/id/product_serial
+
+# Allow Systems Management Data Engine SNMP to connect to snmpd using SMUX
+# smuxpeer .1.3.6.1.4.1.674.10892.1
+
+# LLDP collection
+master agentx
diff --git a/roles/system_config/files/zshrc b/roles/system_config/files/zshrc
new file mode 100644
index 0000000..66c6e8f
--- /dev/null
+++ b/roles/system_config/files/zshrc
@@ -0,0 +1,258 @@
+# ~/.zshrc file for zsh interactive shells.
+# see /usr/share/doc/zsh/examples/zshrc for examples
+
+setopt autocd              # change directory just by typing its name
+#setopt correct            # auto correct mistakes
+setopt interactivecomments # allow comments in interactive mode
+setopt magicequalsubst     # enable filename expansion for arguments of the form ‘anything=expression’
+setopt nonomatch           # hide error message if there is no match for the pattern
+setopt notify              # report the status of background jobs immediately
+setopt numericglobsort     # sort filenames numerically when it makes sense
+setopt promptsubst         # enable command substitution in prompt
+
+WORDCHARS=${WORDCHARS//\/} # Don't consider certain characters part of the word
+
+# hide EOL sign ('%')
+PROMPT_EOL_MARK=""
+
+# configure key keybindings
+bindkey -v                                        # emacs key bindings
+bindkey ' ' magic-space                           # do history expansion on space
+bindkey '^U' backward-kill-line                   # ctrl + U
+bindkey '^[[3;5~' kill-word                       # ctrl + Supr
+bindkey '^[[3~' delete-char                       # delete
+bindkey '^[[1;5C' forward-word                    # ctrl + ->
+bindkey '^[[1;5D' backward-word                   # ctrl + <-
+bindkey '^[[5~' beginning-of-buffer-or-history    # page up
+bindkey '^[[6~' end-of-buffer-or-history          # page down
+bindkey '^[[H' beginning-of-line                  # home
+bindkey '^[[F' end-of-line                        # end
+bindkey '^[[Z' undo                               # shift + tab undo last action
+
+# enable completion features
+autoload -Uz compinit
+compinit -d ~/.cache/zcompdump
+zstyle ':completion:*:*:*:*:*' menu select
+zstyle ':completion:*' auto-description 'specify: %d'
+zstyle ':completion:*' completer _expand _complete
+zstyle ':completion:*' format 'Completing %d'
+zstyle ':completion:*' group-name ''
+zstyle ':completion:*' list-colors ''
+zstyle ':completion:*' list-prompt %SAt %p: Hit TAB for more, or the character to insert%s
+zstyle ':completion:*' matcher-list 'm:{a-zA-Z}={A-Za-z}'
+zstyle ':completion:*' rehash true
+zstyle ':completion:*' select-prompt %SScrolling active: current selection at %p%s
+zstyle ':completion:*' use-compctl false
+zstyle ':completion:*' verbose true
+zstyle ':completion:*:kill:*' command 'ps -u $USER -o pid,%cpu,tty,cputime,cmd'
+
+# History configurations
+HISTFILE=~/.zsh_history
+HISTSIZE=10000
+SAVEHIST=200000
+setopt hist_expire_dups_first # delete duplicates first when HISTFILE size exceeds HISTSIZE
+setopt hist_ignore_dups       # ignore duplicated commands history list
+setopt hist_ignore_space      # ignore commands that start with space
+setopt hist_verify            # show command with history expansion to user before running it
+#setopt share_history         # share command history data
+
+# force zsh to show the complete history
+alias history="history 0"
+
+# configure `time` format
+TIMEFMT=$'\nreal\t%E\nuser\t%U\nsys\t%S\ncpu\t%P'
+
+# make less more friendly for non-text input files, see lesspipe(1)
+#[ -x /usr/bin/lesspipe ] && eval "$(SHELL=/bin/sh lesspipe)"
+
+# set variable identifying the chroot you work in (used in the prompt below)
+if [ -z "${debian_chroot:-}" ] && [ -r /etc/debian_chroot ]; then
+    debian_chroot=$(cat /etc/debian_chroot)
+fi
+
+# set a fancy prompt (non-color, unless we know we "want" color)
+case "$TERM" in
+    xterm-color|*-256color) color_prompt=yes;;
+esac
+
+# uncomment for a colored prompt, if the terminal has the capability; turned
+# off by default to not distract the user: the focus in a terminal window
+# should be on the output of commands, not on the prompt
+force_color_prompt=yes
+
+if [ -n "$force_color_prompt" ]; then
+    if [ -x /usr/bin/tput ] && tput setaf 1 >&/dev/null; then
+        # We have color support; assume it's compliant with Ecma-48
+        # (ISO/IEC-6429). (Lack of such support is extremely rare, and such
+        # a case would tend to support setf rather than setaf.)
+        color_prompt=yes
+    else
+        color_prompt=
+    fi
+fi
+
+configure_prompt() {
+    prompt_symbol=㉿
+    # Skull emoji for root terminal
+    #[ "$EUID" -eq 0 ] && prompt_symbol=💀
+    case "$PROMPT_ALTERNATIVE" in
+        twoline)
+            PROMPT=$'%F{%(#.blue.green)}┌──${debian_chroot:+($debian_chroot)─}${VIRTUAL_ENV:+($(basename $VIRTUAL_ENV))─}(%B%F{%(#.red.blue)}%n'$prompt_symbol$'%m%b%F{%(#.blue.green)})-[%B%F{reset}%(6~.%-1~/…/%4~.%5~)%b%F{%(#.blue.green)}]\n└─%B%(#.%F{red}#.%F{blue}$)%b%F{reset} '
+            # Right-side prompt with exit codes and background processes
+            #RPROMPT=$'%(?.. %? %F{red}%B⨯%b%F{reset})%(1j. %j %F{yellow}%B⚙%b%F{reset}.)'
+            ;;
+        oneline)
+            PROMPT=$'${debian_chroot:+($debian_chroot)}${VIRTUAL_ENV:+($(basename $VIRTUAL_ENV))}%B%F{%(#.red.blue)}%n@%m%b%F{reset}:%B%F{%(#.blue.green)}%~%b%F{reset}%(#.#.$) '
+            RPROMPT=
+            ;;
+        backtrack)
+            PROMPT=$'${debian_chroot:+($debian_chroot)}${VIRTUAL_ENV:+($(basename $VIRTUAL_ENV))}%B%F{red}%n@%m%b%F{reset}:%B%F{blue}%~%b%F{reset}%(#.#.$) '
+            RPROMPT=
+            ;;
+    esac
+    unset prompt_symbol
+}
+
+# The following block is surrounded by two delimiters.
+# These delimiters must not be modified. Thanks.
+# START KALI CONFIG VARIABLES
+PROMPT_ALTERNATIVE=twoline
+NEWLINE_BEFORE_PROMPT=yes
+# STOP KALI CONFIG VARIABLES
+
+if [ "$color_prompt" = yes ]; then
+    # override default virtualenv indicator in prompt
+    VIRTUAL_ENV_DISABLE_PROMPT=1
+
+    configure_prompt
+
+    # enable syntax-highlighting
+    if [ -f /usr/share/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh ]; then
+        . /usr/share/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh
+        ZSH_HIGHLIGHT_HIGHLIGHTERS=(main brackets pattern)
+        ZSH_HIGHLIGHT_STYLES[default]=none
+        ZSH_HIGHLIGHT_STYLES[unknown-token]=underline
+        ZSH_HIGHLIGHT_STYLES[reserved-word]=fg=cyan,bold
+        ZSH_HIGHLIGHT_STYLES[suffix-alias]=fg=green,underline
+        ZSH_HIGHLIGHT_STYLES[global-alias]=fg=green,bold
+        ZSH_HIGHLIGHT_STYLES[precommand]=fg=green,underline
+        ZSH_HIGHLIGHT_STYLES[commandseparator]=fg=blue,bold
+        ZSH_HIGHLIGHT_STYLES[autodirectory]=fg=green,underline
+        ZSH_HIGHLIGHT_STYLES[path]=bold
+        ZSH_HIGHLIGHT_STYLES[path_pathseparator]=
+        ZSH_HIGHLIGHT_STYLES[path_prefix_pathseparator]=
+        ZSH_HIGHLIGHT_STYLES[globbing]=fg=blue,bold
+        ZSH_HIGHLIGHT_STYLES[history-expansion]=fg=blue,bold
+        ZSH_HIGHLIGHT_STYLES[command-substitution]=none
+        ZSH_HIGHLIGHT_STYLES[command-substitution-delimiter]=fg=magenta,bold
+        ZSH_HIGHLIGHT_STYLES[process-substitution]=none
+        ZSH_HIGHLIGHT_STYLES[process-substitution-delimiter]=fg=magenta,bold
+        ZSH_HIGHLIGHT_STYLES[single-hyphen-option]=fg=green
+        ZSH_HIGHLIGHT_STYLES[double-hyphen-option]=fg=green
+        ZSH_HIGHLIGHT_STYLES[back-quoted-argument]=none
+        ZSH_HIGHLIGHT_STYLES[back-quoted-argument-delimiter]=fg=blue,bold
+        ZSH_HIGHLIGHT_STYLES[single-quoted-argument]=fg=yellow
+        ZSH_HIGHLIGHT_STYLES[double-quoted-argument]=fg=yellow
+        ZSH_HIGHLIGHT_STYLES[dollar-quoted-argument]=fg=yellow
+        ZSH_HIGHLIGHT_STYLES[rc-quote]=fg=magenta
+        ZSH_HIGHLIGHT_STYLES[dollar-double-quoted-argument]=fg=magenta,bold
+        ZSH_HIGHLIGHT_STYLES[back-double-quoted-argument]=fg=magenta,bold
+        ZSH_HIGHLIGHT_STYLES[back-dollar-quoted-argument]=fg=magenta,bold
+        ZSH_HIGHLIGHT_STYLES[assign]=none
+        ZSH_HIGHLIGHT_STYLES[redirection]=fg=blue,bold
+        ZSH_HIGHLIGHT_STYLES[comment]=fg=black,bold
+        ZSH_HIGHLIGHT_STYLES[named-fd]=none
+        ZSH_HIGHLIGHT_STYLES[numeric-fd]=none
+        ZSH_HIGHLIGHT_STYLES[arg0]=fg=cyan
+        ZSH_HIGHLIGHT_STYLES[bracket-error]=fg=red,bold
+        ZSH_HIGHLIGHT_STYLES[bracket-level-1]=fg=blue,bold
+        ZSH_HIGHLIGHT_STYLES[bracket-level-2]=fg=green,bold
+        ZSH_HIGHLIGHT_STYLES[bracket-level-3]=fg=magenta,bold
+        ZSH_HIGHLIGHT_STYLES[bracket-level-4]=fg=yellow,bold
+        ZSH_HIGHLIGHT_STYLES[bracket-level-5]=fg=cyan,bold
+        ZSH_HIGHLIGHT_STYLES[cursor-matchingbracket]=standout
+    fi
+else
+    PROMPT='${debian_chroot:+($debian_chroot)}%n@%m:%~%(#.#.$) '
+fi
+unset color_prompt force_color_prompt
+
+toggle_oneline_prompt(){
+    if [ "$PROMPT_ALTERNATIVE" = oneline ]; then
+        PROMPT_ALTERNATIVE=twoline
+    else
+        PROMPT_ALTERNATIVE=oneline
+    fi
+    configure_prompt
+    zle reset-prompt
+}
+zle -N toggle_oneline_prompt
+bindkey ^P toggle_oneline_prompt
+
+# If this is an xterm set the title to user@host:dir
+case "$TERM" in
+xterm*|rxvt*|Eterm|aterm|kterm|gnome*|alacritty)
+    TERM_TITLE=$'\e]0;${debian_chroot:+($debian_chroot)}${VIRTUAL_ENV:+($(basename $VIRTUAL_ENV))}%n@%m: %~\a'
+    ;;
+*)
+    ;;
+esac
+
+precmd() {
+    # Print the previously configured title
+    print -Pnr -- "$TERM_TITLE"
+
+    # Print a new line before the prompt, but only if it is not the first line
+    if [ "$NEWLINE_BEFORE_PROMPT" = yes ]; then
+        if [ -z "$_NEW_LINE_BEFORE_PROMPT" ]; then
+            _NEW_LINE_BEFORE_PROMPT=1
+        else
+            print ""
+        fi
+    fi
+}
+
+# enable color support of ls, less and man, and also add handy aliases
+if [ -x /usr/bin/dircolors ]; then
+    test -r ~/.dircolors && eval "$(dircolors -b ~/.dircolors)" || eval "$(dircolors -b)"
+    export LS_COLORS="$LS_COLORS:ow=30;44:" # fix ls color for folders with 777 permissions
+
+    alias ls='ls --color=auto'
+    #alias dir='dir --color=auto'
+    #alias vdir='vdir --color=auto'
+
+    alias grep='grep --color=auto'
+    alias fgrep='fgrep --color=auto'
+    alias egrep='egrep --color=auto'
+    alias diff='diff --color=auto'
+    alias ip='ip --color=auto'
+
+    export LESS_TERMCAP_mb=$'\E[1;31m'     # begin blink
+    export LESS_TERMCAP_md=$'\E[1;36m'     # begin bold
+    export LESS_TERMCAP_me=$'\E[0m'        # reset bold/blink
+    export LESS_TERMCAP_so=$'\E[01;33m'    # begin reverse video
+    export LESS_TERMCAP_se=$'\E[0m'        # reset reverse video
+    export LESS_TERMCAP_us=$'\E[1;32m'     # begin underline
+    export LESS_TERMCAP_ue=$'\E[0m'        # reset underline
+
+    # Take advantage of $LS_COLORS for completion as well
+    zstyle ':completion:*' list-colors "${(s.:.)LS_COLORS}"
+    zstyle ':completion:*:*:kill:*:processes' list-colors '=(#b) #([0-9]#)*=0=01;31'
+fi
+
+# some more ls aliases
+alias ll='ls -l'
+alias la='ls -A'
+alias l='ls -CF'
+
+# enable auto-suggestions based on the history
+if [ -f /usr/share/zsh-autosuggestions/zsh-autosuggestions.zsh ]; then
+    . /usr/share/zsh-autosuggestions/zsh-autosuggestions.zsh
+    # change suggestion color
+    ZSH_AUTOSUGGEST_HIGHLIGHT_STYLE='fg=#999'
+fi
+
+# enable command-not-found if installed
+if [ -f /etc/zsh_command_not_found ]; then
+    . /etc/zsh_command_not_found
+fi
diff --git a/roles/system_config/handlers/main.yml b/roles/system_config/handlers/main.yml
new file mode 100644
index 0000000..5035f63
--- /dev/null
+++ b/roles/system_config/handlers/main.yml
@@ -0,0 +1,43 @@
+---
+- name: Update aliases db
+  ansible.builtin.command: newaliases
+  changed_when: true
+
+- name: Restart rsyslog
+  ansible.builtin.systemd:
+    name: rsyslog
+    state: restarted
+
+- name: Postmap generic
+  ansible.builtin.command: postmap /etc/postfix/generic
+  changed_when: true
+
+- name: Restart postfix
+  ansible.builtin.systemd:
+    name: postfix
+    state: restarted
+
+- name: Restart snmpd
+  ansible.builtin.systemd:
+    name: snmpd
+    state: restarted
+    daemon_reload: true
+
+- name: Restart lldpd
+  ansible.builtin.systemd:
+    name: lldpd
+    state: restarted
+
+- name: Restart cockpit
+  ansible.builtin.systemd:
+    name: cockpit
+    state: restarted
+
+- name: Restart ntpsec
+  ansible.builtin.systemd:
+    name: ntpsec.service
+    state: restarted
+
+- name: Daemon reload
+  ansible.builtin.systemd:
+    daemon_reload: true
diff --git a/roles/system_config/tasks/main.yml b/roles/system_config/tasks/main.yml
new file mode 100644
index 0000000..d55a7f0
--- /dev/null
+++ b/roles/system_config/tasks/main.yml
@@ -0,0 +1,266 @@
+---
+# system_config combines the legacy global-systemServiceConfigurationFiles()
+# and global-postPackageConfiguration() functions.
+
+# ===========================================================================
+# Phase 1 — global-systemServiceConfigurationFiles
+# ===========================================================================
+
+- name: Deploy /etc/zshrc (global zsh config)
+  ansible.builtin.copy:
+    src: zshrc
+    dest: /etc/zshrc
+    owner: root
+    group: root
+    mode: "0644"
+    backup: true
+
+- name: Deploy /etc/aliases
+  ansible.builtin.copy:
+    src: aliases
+    dest: /etc/aliases
+    owner: root
+    group: root
+    mode: "0644"
+    backup: true
+  notify: Update aliases db
+
+- name: Deploy /etc/rsyslog.conf
+  ansible.builtin.template:
+    src: rsyslog.conf.j2
+    dest: /etc/rsyslog.conf
+    owner: root
+    group: root
+    mode: "0644"
+    backup: true
+  notify: Restart rsyslog
+
+# ===========================================================================
+# Phase 2 — global-postPackageConfiguration
+# ===========================================================================
+
+- name: Ensure auditd is enabled and running
+  ansible.builtin.systemd:
+    name: auditd
+    state: started
+    enabled: true
+
+# --- Postfix (local-only relay) ---
+- name: Deploy /etc/postfix/generic
+  ansible.builtin.copy:
+    src: postfix_generic
+    dest: /etc/postfix/generic
+    owner: root
+    group: root
+    mode: "0644"
+    backup: true
+  notify: Postmap generic
+
+- name: Configure postfix main.cf
+  ansible.builtin.command: "postconf -e \"{{ item }}\""
+  loop:
+    - "inet_protocols = ipv4"
+    - "inet_interfaces = 127.0.0.1"
+    - "mydestination = 127.0.0.1"
+    - "relayhost = {{ postfix_relayhost }}"
+    - "smtp_generic_maps = hash:/etc/postfix/generic"
+  changed_when: true
+  notify: Restart postfix
+
+- name: Flush postfix handlers before test mail
+  ansible.builtin.meta: flush_handlers
+
+- name: Send provisioning test mail to root  # noqa var-naming[no-role-prefix]
+  ansible.builtin.shell: |
+    echo "hi from root to root" | mail -s "hi directly to root from $(hostname)" root
+  register: _test_mail
+  changed_when: false
+  failed_when: false
+
+# --- Default shells (conditional on user existence, matching legacy checks) ---
+- name: Set root shell to zsh
+  ansible.builtin.user:
+    name: root
+    shell: /usr/bin/zsh
+
+- name: Set localuser shell to zsh (only if user exists)
+  ansible.builtin.user:
+    name: localuser
+    shell: /usr/bin/zsh
+  when: localuser_exists | bool
+
+- name: Set subodev shell to zsh (only if user exists)
+  ansible.builtin.user:
+    name: subodev
+    shell: /usr/bin/zsh
+  when: subodev_exists | bool
+
+# --- DHCP client config (skip on DHCP servers) ---
+# The legacy script deployed dhclient.conf unconditionally, but DHCP servers
+# (pfv-netinfra-01/02) should not have their client config overridden.
+- name: Deploy /etc/dhcp/dhclient.conf (DHCP clients only)
+  ansible.builtin.template:
+    src: dhclient.conf.j2
+    dest: /etc/dhcp/dhclient.conf
+    owner: root
+    group: root
+    mode: "0644"
+    backup: true
+  when: not (is_dhcp_server | bool)
+
+- name: Skip dhclient.conf deploy on DHCP server
+  ansible.builtin.debug:
+    msg: "Skipping dhclient.conf deploy — {{ inventory_hostname }} is a DHCP server."
+  when: is_dhcp_server | bool
+
+# --- DNS resolv.conf (static, replaces any symlink) ---
+- name: Remove existing /etc/resolv.conf (incl. systemd-resolved symlink)
+  ansible.builtin.file:
+    path: /etc/resolv.conf
+    state: absent
+
+- name: Deploy static /etc/resolv.conf
+  ansible.builtin.template:
+    src: resolv.conf.j2
+    dest: /etc/resolv.conf
+    owner: root
+    group: root
+    mode: "0644"
+
+# --- SNMP ---
+- name: Stop snmpd before reconfiguring
+  ansible.builtin.service:
+    name: snmpd
+    state: stopped
+  failed_when: false
+
+- name: Deploy sudoers entry for Debian-snmp
+  ansible.builtin.copy:
+    src: snmp-sudo.conf
+    dest: /etc/sudoers.d/Debian-snmp
+    owner: root
+    group: root
+    mode: "0440"
+    validate: /usr/sbin/visudo -csf %s
+
+- name: Quiet snmpd logging (replace -Lsd with -LS6d in unit)
+  ansible.builtin.replace:
+    path: /lib/systemd/system/snmpd.service
+    regexp: '-Lsd'
+    replace: '-LS6d'
+  notify: Daemon reload
+
+# snmpd.conf selection: Pi > physical/proxmox > virtual guest > default
+- name: Deploy snmpd.conf for Raspberry Pi
+  ansible.builtin.copy:
+    src: snmpd-rpi.conf
+    dest: /etc/snmp/snmpd.conf
+    owner: root
+    group: root
+    mode: "0644"
+    backup: true
+  when: is_raspi | bool
+  notify: Restart snmpd
+
+- name: Deploy snmpd.conf for physical/Proxmox host
+  ansible.builtin.copy:
+    src: snmpd-physicalhost.conf
+    dest: /etc/snmp/snmpd.conf
+    owner: root
+    group: root
+    mode: "0644"
+    backup: true
+  when: (is_physical_host | bool) or (is_proxmox_host | bool)
+  notify: Restart snmpd
+
+- name: Deploy snmpd.conf for virtual guests
+  ansible.builtin.copy:
+    src: snmpd.conf
+    dest: /etc/snmp/snmpd.conf
+    owner: root
+    group: root
+    mode: "0644"
+    backup: true
+  when: is_virt_guest | bool
+  notify: Restart snmpd
+
+# --- LLDP ---
+- name: Deploy /etc/default/lldpd
+  ansible.builtin.copy:
+    src: lldpd
+    dest: /etc/default/lldpd
+    owner: root
+    group: root
+    mode: "0644"
+    backup: true
+  notify: Restart lldpd
+
+# --- Cockpit ---
+- name: Deploy /etc/cockpit/disallowed-users
+  ansible.builtin.copy:
+    src: disallowed-users
+    dest: /etc/cockpit/disallowed-users
+    owner: root
+    group: root
+    mode: "0644"
+    backup: true
+  notify: Restart cockpit
+
+# --- rsyslog (skip on the LibreNMS syslog collector itself) ---
+- name: Ensure rsyslog installed and running (except on LibreNMS server)
+  when: not (is_librenms_server | bool)
+  block:
+    - name: Install rsyslog (if missing)
+      ansible.builtin.apt:
+        name: rsyslog
+        state: present
+        update_cache: false
+
+    - name: Ensure rsyslog is running
+      ansible.builtin.systemd:
+        name: rsyslog
+        state: started
+
+- name: Skip rsyslog reconfig on LibreNMS server
+  ansible.builtin.debug:
+    msg: "Skipping rsyslog reconfig — {{ inventory_hostname }} is the LibreNMS syslog collector."
+  when: is_librenms_server | bool
+
+# --- NTP (skip on NTP server hosts: pfv-netinfra-01/02, pfv-netboot) ---
+- name: Deploy /etc/ntpsec/ntp.conf (clients only)
+  ansible.builtin.template:
+    src: ntp.conf.j2
+    dest: /etc/ntpsec/ntp.conf
+    owner: root
+    group: root
+    mode: "0644"
+    backup: true
+  when: not (is_ntp_server | bool)
+  notify: Restart ntpsec
+
+- name: Skip NTP client config on NTP server
+  ansible.builtin.debug:
+    msg: "Skipping NTP client config — {{ inventory_hostname }} is an NTP server."
+  when: is_ntp_server | bool
+
+# --- Process accounting ---
+- name: Enable process accounting (accton on)
+  ansible.builtin.command: /usr/sbin/accton on
+  changed_when: true
+  failed_when: false
+
+# --- CPU governor on bare metal (physical hosts AND Proxmox hosts) ---
+- name: Set CPU governor to performance (physical and Proxmox hosts)
+  ansible.builtin.shell: |
+    cpufreq-set -r -g performance
+    cpupower frequency-set --governor performance
+  when: (is_physical_host | bool) or (is_proxmox_host | bool)
+  changed_when: true
+  failed_when: false
+
+# --- tuned profile on VMs ---
+- name: Set tuned profile to virtual-guest (VM guests only)
+  ansible.builtin.command: tuned-adm profile virtual-guest
+  when: is_virt_guest | bool
+  changed_when: true
+  failed_when: false
diff --git a/roles/system_config/templates/dhclient.conf.j2 b/roles/system_config/templates/dhclient.conf.j2
new file mode 100644
index 0000000..2490290
--- /dev/null
+++ b/roles/system_config/templates/dhclient.conf.j2
@@ -0,0 +1,14 @@
+option rfc3442-classless-static-routes code 121 = array of unsigned integer 8;
+
+send host-name = gethostname();
+request subnet-mask, broadcast-address, time-offset, routers,
+        domain-name, host-name,
+        domain-name-servers, domain-search, ntp-servers,
+        rfc3442-classless-static-routes;
+
+# Pin DNS and NTP to the redundant pfv-netinfra-01/02 pair regardless of what
+# the DHCP server advertises, so every host on this build uses the same
+# authoritative recursive resolvers and time sources.
+supersede domain-name-servers {{ dns_servers | join(', ') }};
+supersede domain-search "{{ dns_search_domain }}";
+supersede ntp-servers {{ ntp_servers | join(', ') }};
diff --git a/roles/system_config/templates/ntp.conf.j2 b/roles/system_config/templates/ntp.conf.j2
new file mode 100644
index 0000000..19a1bbf
--- /dev/null
+++ b/roles/system_config/templates/ntp.conf.j2
@@ -0,0 +1,22 @@
+driftfile /var/lib/ntp/ntp.drift
+leapfile /usr/share/zoneinfo/leap-seconds.list
+
+# Redundant upstream time sources: pfv-netinfra-01/02 (Technitium/Pi-hole hosts
+# also serving NTP). IPs are used (not hostnames) because the knel.net name for
+# these hosts resolves to a Tailscale CGNAT address, not the LAN address, and
+# because NTP must come up before DNS is available. iburst speeds initial sync.
+{% for srv in ntp_servers %}
+server {{ srv }} iburst
+{% endfor %}
+
+# Hardened client: sync from the configured servers but never serve time to
+# anyone else. Note: `interface listen 127.0.0.1` must NOT be used here — it
+# binds ntpd to loopback, making outbound queries carry a 127.0.0.1 source
+# address that upstream servers cannot reply to (symptoms: peers stuck in
+# .INIT. with reach 0). Use restrict rules to control access instead.
+restrict default ignore
+restrict 127.0.0.1
+restrict ::1
+{% for srv in ntp_servers %}
+restrict {{ srv }} nomodify notrap nopeer
+{% endfor %}
diff --git a/roles/system_config/templates/resolv.conf.j2 b/roles/system_config/templates/resolv.conf.j2
new file mode 100644
index 0000000..ac05a7c
--- /dev/null
+++ b/roles/system_config/templates/resolv.conf.j2
@@ -0,0 +1,11 @@
+# Managed by KNELIAC — do not edit; changes will be overwritten.
+# Redundant recursive DNS via pfv-netinfra-01/02 (Technitium + Pi-hole).
+# IPs are used (required: nameserver directives must be addresses, and the
+# knel.net name for these hosts resolves to a Tailscale CGNAT address rather
+# than the LAN address). If the primary is unreachable, glibc's resolver
+# automatically falls through to the secondary.
+domain {{ dns_search_domain }}
+search {{ dns_search_domain }}
+{% for ns in dns_servers %}
+nameserver {{ ns }}
+{% endfor %}
diff --git a/roles/system_config/templates/rsyslog.conf.j2 b/roles/system_config/templates/rsyslog.conf.j2
new file mode 100644
index 0000000..46358f5
--- /dev/null
+++ b/roles/system_config/templates/rsyslog.conf.j2
@@ -0,0 +1,6 @@
+module(load="imuxsock") # provides support for local system logging
+module(load="imklog")   # provides kernel logging support
+#module(load="immark")  # provides --MARK-- message capability
+
+*.* @{{ syslog_forward_host }}:514
+:omusrmsg:EOF