diff --git a/playbooks/hello_world.yml b/playbooks/hello_world.yml
new file mode 100644
index 0000000..277645b
--- /dev/null
+++ b/playbooks/hello_world.yml
@@ -0,0 +1,33 @@
+---
+# AWX "hello world" smoke-test playbook.
+#
+# Point an AWX Project at this repo, then create a Job Template whose
+# playbook is playbooks/hello_world.yml and run it against any inventory.
+# A passing run confirms AWX can: clone the repo, parse the playbook,
+# reach the target over SSH, become root, and report facts.
+
+- name: AWX connectivity smoke test
+  hosts: all
+  gather_facts: true
+  become: true
+
+  tasks:
+    - name: Confirm reachable and privileged
+      ansible.builtin.assert:
+        that:
+          - ansible_facts.os_family == "Debian"
+        fail_msg: >-
+          KNELIAC only manages Debian-family hosts (Debian/Ubuntu/Kali/RPi OS);
+          found OS family "{{ ansible_facts.os_family }}".
+        success_msg: "Host {{ inventory_hostname }} is Debian-family ({{ ansible_facts.distribution }} {{ ansible_facts.distribution_version }})."
+
+    - name: Report management target
+      ansible.builtin.debug:
+        msg: >-
+          AWX successfully managed {{ inventory_hostname }}
+          ({{ ansible_facts.distribution }} {{ ansible_facts.distribution_version }},
+          kernel {{ ansible_facts.kernel }}, arch {{ ansible_facts.architecture }}).
+
+    - name: Show where full provisioning runs from
+      ansible.builtin.debug:
+        msg: "Run playbooks/setup_new_system.yml for the full host build."
diff --git a/playbooks/setup_new_system.yml b/playbooks/setup_new_system.yml
new file mode 100644
index 0000000..697fc07
--- /dev/null
+++ b/playbooks/setup_new_system.yml
@@ -0,0 +1,89 @@
+---
+# Full host provisioning — Ansible port of PFVCluster/provisioning/SetupNewSystem.sh
+#
+# The role order below matches the function call order at the bottom of the
+# legacy bash script:
+#
+#   PreflightCheck            -> roles/preflight
+#   global-oam                -> roles/oam
+#   global-installPackages    -> roles/packages
+#   global-systemServiceConfigurationFiles -> roles/system_config (phase 1)
+#   global-postPackageConfiguration         -> roles/system_config (phase 2)
+#   secharden-ssh             -> roles/security_ssh
+#   secharden-wazuh           -> roles/security_wazuh
+#   secharden-scap-stig       -> roles/security_scap_stig
+#   secharden-2fa             -> roles/security_2fa
+#
+# Each role is gated by a feature toggle (see group_vars/all.yml) so the same
+# Job Template can be reused for partial runs.
+
+- name: Preflight — verify we may provision this host
+  hosts: all
+  gather_facts: true
+  become: true
+  roles:
+    - role: preflight
+
+- name: OAM — LibreNMS / check_mk agent
+  hosts: all
+  gather_facts: true
+  become: true
+  roles:
+    - role: oam
+      when: run_oam | bool
+
+- name: Packages — up2date, install fleet toolset, remove unwanted packages
+  hosts: all
+  gather_facts: true
+  become: true
+  roles:
+    - role: packages
+      when: run_packages | bool
+
+- name: System configuration — service config files + post-package tuning
+  hosts: all
+  gather_facts: true
+  become: true
+  roles:
+    - role: system_config
+      when: run_system_config | bool
+
+- name: Security hardening — SSH
+  hosts: all
+  gather_facts: true
+  become: true
+  roles:
+    - role: security_ssh
+      when: run_security_ssh | bool
+
+- name: Security hardening — Wazuh agent
+  hosts: all
+  gather_facts: true
+  become: true
+  roles:
+    - role: security_wazuh
+      when: run_security_wazuh | bool
+
+- name: Security hardening — SCAP/STIG baseline
+  hosts: all
+  gather_facts: true
+  become: true
+  roles:
+    - role: security_scap_stig
+      when: run_security_scap_stig | bool
+
+- name: Security hardening — two-factor authentication
+  hosts: all
+  gather_facts: true
+  become: true
+  roles:
+    - role: security_2fa
+      when: run_security_2fa | bool
+
+- name: Security hardening — auditd / journald / logrotate
+  hosts: all
+  gather_facts: true
+  become: true
+  roles:
+    - role: security_audit
+      when: run_security_audit | bool