diff --git a/ansible/router/.gitignore b/ansible/router/.gitignore
new file mode 100644
index 0000000000000000000000000000000000000000..eb200e400865633fc2118f09572fb4b85f062139
--- /dev/null
+++ b/ansible/router/.gitignore
@@ -0,0 +1,5 @@
+.idea
+.venv
+
+# autogenerated
+.template
diff --git a/ansible/router/README.md b/ansible/router/README.md
new file mode 100644
index 0000000000000000000000000000000000000000..9d85e5902e9f5edb48ce9cf65dc985593e5ff125
--- /dev/null
+++ b/ansible/router/README.md
@@ -0,0 +1,7 @@
+# MAIN VMs ansible
+
+First run:
+`ansible-playbook -i inventory.yaml install.yaml --user root`
+
+After first run:
+`ansible-playbook -i inventory.yaml install.yaml --become --user rlacko`
\ No newline at end of file
diff --git a/ansible/router/bootstrap.sh b/ansible/router/bootstrap.sh
new file mode 100755
index 0000000000000000000000000000000000000000..a6212cdec913c58815bd9b997976ffbb207287a6
--- /dev/null
+++ b/ansible/router/bootstrap.sh
@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+
+########################### Virtualenv setup ####################################
+
+# create virtualenv if not present
+[[ ! -d .venv ]] && python3 -m venv .venv
+
+source .venv/bin/activate
+
+pip3 install ansible ansible-lint
+
+########################### Ansible setup ####################################
+
+ansible-galaxy install --force -r requirements.galaxy.yaml
+
+########################### Help ####################################
+
+echo
+echo "########################################"
+echo
+echo "Your playbooks:"
+
+find . -maxdepth 1 -type f -name "*.yaml" | grep -v inventory
+
+echo
+echo "Recommendation: Set up your OpenSSH config based on inventory.yml"
+
+echo
+echo "You can run playbook with:"
+printf "\tansible-playbook your-playbook.yaml"
+echo
+
+# to stay in our comfy virtualenv
+exec "${SHELL:bash}"
diff --git a/ansible/router/install.yaml b/ansible/router/install.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..70b24a0f0ac3c945cce98e0e94cebd755dc1d483
--- /dev/null
+++ b/ansible/router/install.yaml
@@ -0,0 +1,22 @@
+---
+
+- hosts: all
+ roles:
+ - name: yatesr.timezone
+ vars:
+ timezone: Europe/Budapest
+ tasks:
+ - name: Setup Router Container
+ import_tasks: tasks/main.yaml
+
+ vars:
+ users:
+ - name: rlacko
+ sudo: yes
+ passwordless_sudo: yes
+ keys_url: https://git.sch.bme.hu/rlacko.keys
+ ssh:
+ port: 10022
+ permitRootLogin: 'no'
+ pubkeyAuthentication: 'yes'
+ passwordAuthentication: 'no'
\ No newline at end of file
diff --git a/ansible/router/inventory.yaml b/ansible/router/inventory.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..47671573d9ef04b34c76b1a7d62688ac3a8e2245
--- /dev/null
+++ b/ansible/router/inventory.yaml
@@ -0,0 +1,4 @@
+all:
+ hosts:
+ # Use OpenSSH config to make it confortable
+ router.maze:
diff --git a/ansible/router/requirements.galaxy.yaml b/ansible/router/requirements.galaxy.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..67cbeeaf312186f22e008e29f630b63d880d05dd
--- /dev/null
+++ b/ansible/router/requirements.galaxy.yaml
@@ -0,0 +1,8 @@
+---
+
+collections:
+ - community.general
+ - ansible.posix
+
+roles:
+ - src: yatesr.timezone
\ No newline at end of file
diff --git a/ansible/router/tasks/main.yaml b/ansible/router/tasks/main.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..69daddd9ae1ed8f3319884f3e17c97876aa90661
--- /dev/null
+++ b/ansible/router/tasks/main.yaml
@@ -0,0 +1,29 @@
+---
+
+- name: Setup Admin users
+ include_tasks: users.yaml
+ loop: "{{ users }}"
+ loop_control:
+ loop_var: user
+
+- name: Update and upgrade apt packages
+ become: true
+ apt:
+ upgrade: "yes"
+ update_cache: yes
+ cache_valid_time: 86400 # One day
+
+- name: Install packages
+ include_tasks: packages.yaml
+
+- name: Place sshd configuration file.
+ template:
+ src: etc/ssh/sshd_config.j2
+ dest: /etc/ssh/sshd_config
+ mode: 0600
+
+- name: Ensure sshd is restarted and enabled to start at boot.
+ service:
+ name: sshd
+ state: restarted
+ enabled: yes
diff --git a/ansible/router/tasks/packages.yaml b/ansible/router/tasks/packages.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..f55766ea4bc64f74f375b8ab5c874a04f348b513
--- /dev/null
+++ b/ansible/router/tasks/packages.yaml
@@ -0,0 +1,32 @@
+---
+- name: Install basic packages
+ package:
+ state: present
+ name:
+ # Debug tools
+ - sudo
+ - tmux
+ - htop
+ - dnsutils
+ - net-tools
+ - psmisc
+ - strace
+ - tcpdump
+ - xxd
+
+ # Editors
+ - nano
+ - vim
+
+ # Admin helpers
+ - rsync
+ - tree
+ - molly-guard
+
+ # Dependencies for scripting
+ - python3
+ - unzip
+ - curl
+ - wget
+ - jq
+ - git
diff --git a/ansible/router/tasks/users.yaml b/ansible/router/tasks/users.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..23de97ad04fd816ed8fbca60a967bed56a6e3d20
--- /dev/null
+++ b/ansible/router/tasks/users.yaml
@@ -0,0 +1,54 @@
+---
+
+- debug:
+ msg: "{{ user }}"
+
+- name: "Create group for user"
+ group:
+ name: "{{ user.name }}"
+
+- name: "Create user"
+ user:
+ name: "{{ user.name }}"
+ comment: "{{ user.comment | default('') }}"
+ group: "{{ user.name }}"
+ shell: "/bin/{{ user.shell | default('bash') }}"
+
+- name: "SUDO"
+ user:
+ name: "{{ user.name }}"
+ append: true
+ groups:
+ - sudo
+ when: user.sudo
+
+- set_fact:
+ sudoer_file: "/etc/sudoers.d/{{ user.name }}"
+
+- name: sudoers file for the user
+ file:
+ path: "{{ sudoer_file }}"
+ state: touch
+ mode: "0600"
+ owner: root
+ group: root
+ modification_time: preserve
+ access_time: preserve
+
+- name: Insert sudoer file content
+ copy:
+ dest: "{{ sudoer_file }}"
+ content: "{{ user.name }} ALL=(ALL) NOPASSWD:ALL"
+ when: user.passwordless_sudo
+
+- name: "Set password to be expired"
+ command: passwd --delete '{{ user.name }}'
+ when: not user.passwordless_sudo
+
+- name: Set authorized keys
+ ansible.posix.authorized_key:
+ user: "{{ user.name }}"
+ state: present
+ key: "{{ user.keys_url }}"
+ manage_dir: yes
+ exclusive: yes
diff --git a/ansible/router/templates/etc/ssh/sshd_config.j2 b/ansible/router/templates/etc/ssh/sshd_config.j2
new file mode 100644
index 0000000000000000000000000000000000000000..a85b408194e01ca8f5a28fafc16dcd19d4e2e79a
--- /dev/null
+++ b/ansible/router/templates/etc/ssh/sshd_config.j2
@@ -0,0 +1,36 @@
+# !!!
+# {{ ansible_managed }}
+# !!!
+
+Protocol 2
+Port {{ ssh.port }}
+
+HostKey /etc/ssh/ssh_host_rsa_key
+HostKey /etc/ssh/ssh_host_ed25519_key
+
+KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256
+Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
+MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com
+
+PermitRootLogin {{ ssh.permitRootLogin }}
+PubkeyAuthentication {{ ssh.pubkeyAuthentication }}
+PasswordAuthentication {{ ssh.passwordAuthentication }}
+
+ChallengeResponseAuthentication no
+KerberosAuthentication no
+GSSAPIAuthentication no
+UsePAM yes
+AllowAgentForwarding yes
+X11Forwarding yes
+PrintMotd no
+
+AcceptEnv LANG LC_*
+
+Subsystem sftp /usr/lib/openssh/sftp-server
+
+{% if ssh.allow.users is defined %}
+AllowUsers {{ ssh.allow.users }}
+{% endif %}
+{% if ssh.allow.groups is defined %}
+AllowGroups {{ ssh.allow.groups }}
+{% endif %}