diff --git a/play.yml b/play.yml
index 8f11c6f..26123f2 100644
--- a/play.yml
+++ b/play.yml
@@ -1,17 +1,20 @@
 ---
-- hosts: "{{ target | default('all') }}" # target inventory group, default all
-  gather_facts: yes
+# vim: ft=yaml.ansible
+- name: Deploy basics
+  hosts: all  # reminder: '--limit'
+  gather_facts: true
   vars:
-#    auto_update: "true"  # would configure dnf-automatic
-#    hardened_ssh_port: "1181" # tcp is assumed in selinux/firewalld allowance
-    URL_PUBKEYS: "https://github.com/joshlay.keys" # https://github.com/user.keys
+    #  auto_update: "true"  # would configure dnf-automatic
+    #  hardened_ssh_port: "1181" # tcp is assumed in selinux/firewalld allowance
   roles:
-    - {role: btrfs}  # sets up scrubbing
-    - {role: bootstrap}
-    - {role: tuned}
-    - {role: install-packages}
-    - {role: update-packages} # depends on 'is_atomic' in bootstrap
-    - {role: fedora-upgrade} # consider renaming to dist-upgrade / supporting more than fedora
-    - {role: create-user}  # this should always follow packages; they often provide groups the user may want to join
-    - {role: hardening}
-    - {role: docker}
+    - {role: custom-facts, tags: ['facts', 'custom-facts']}
+    # - {role: btrfs, tags: ['btrfs']}  # sets up scrubbing
+    - {role: bootstrap, tags: ['boot', 'bootstrap']}
+    - {role: grub, tags: ['grub']}
+    - {role: tuned, tags: ['tuned']}
+    - {role: install-packages, tags: ['pkgs', 'install', 'install-pkgs']}
+    - {role: update-packages, tags: ['pkgs', 'install', 'update-pkgs']}
+    # - {role: fedora-upgrade}  # replacing w/ 'dist-upgrade', supporting more than fedora
+    - {role: create-user, tags: ['user']}  # should follow package-installing roles; provide groups the user may want to join
+    - {role: hardening, tags: ['harden', 'hardening']}
+#    - {role: docker}