diff --git a/ansible-playbook.yml b/ansible-playbook.yml
index 668326c..0fc1858 100755
--- a/ansible-playbook.yml
+++ b/ansible-playbook.yml
@@ -12,28 +12,8 @@
         - images
 
   roles:
-    - role: packages
-      tags: [packages]
-    - role: directories
-      tags: [directories]
-    - role: sysctl
-      tags: [sysctl]
-    - role: network
-      tags: [network]
-    - role: wireguard
-      tags: [wireguard]
     - role: npm
       tags: [npm]
-    - role: gitea
-      tags: [gitea]
-    - role: jellyfin
-      tags: [jellyfin]
-    - role: wazuh
-      tags: [wazuh]
-    # - role: minecraft
-    #   tags: [minecraft]
-    # - role: 7dtd
-    #   tags: [7dtd]
-    # - role: zomboid
-    #   tags: [zomboid]
+    - role: 7dtd
+      tags: [7dtd]
 
diff --git a/roles/npm/tasks/main.yml b/roles/npm/tasks/main.yml
new file mode 100644
index 0000000..eb40473
--- /dev/null
+++ b/roles/npm/tasks/main.yml
@@ -0,0 +1,27 @@
+---
+- name: Create NPM directories
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    mode: '0755'
+  loop:
+    - /opt/apps/npm
+    - /opt/apps/letsencrypt
+
+- name: Deploy Nginx Proxy Manager
+  containers.podman.podman_container:
+    image: "docker.io/jc21/nginx-proxy-manager:latest"
+    name: npm
+    restart_policy: always
+    recreate: true
+    state: started
+    ports:
+      - "80:80"
+      - "81:81"
+      - "443:443"
+    volumes:
+      - "/opt/apps/npm:/data:z"
+      - "/opt/apps/letsencrypt:/etc/letsencrypt:z"
+    network:
+      - npm_internal
+    ip: '10.10.0.19'
diff --git a/vars.yml b/vars.yml
new file mode 100755
index 0000000..e3feb59
--- /dev/null
+++ b/vars.yml
@@ -0,0 +1,110 @@
+
+## add generic 755 directory for application here
+directories:
+  - /opt/apps/npm
+  - /opt/apps/7dtd
+  - /opt/apps/7dtd/data
+  - /opt/apps/7dtd/serverfiles
+
+
+
+images:
+  - docker.io/jc21/nginx-proxy-manager:latest
+  - docker.io/vinanrra/7dtd-server:latest
+
+## 7 Days to Die dedicated server (vinanrra/7dtd-server container, LinuxGSM-based)
+## PUBLIC server: listed in the in-game server browser; players connect to
+## 7dtd.boxswapper.io:26900 (TCP+UDP) and enter the join password (sdtd_server_password).
+## Server config is rendered from roles/7dtd/templates/sdtdserver.xml.j2 on every deploy —
+## vars.yml is the source of truth for the server config (edits here re-apply on re-run).
+## External DNS (not managed here): Cloudflare A record 7dtd.boxswapper.io -> public IP (grey-cloud,
+## same as mc.boxswapper.io / zomboid.boxswapper.io). Router MUST forward TCP+UDP 26900, UDP
+## 26901-26902 (Steam query) + TCP 8081 (telnet) -> 10.10.0.47.
+## VERSION=stable tracks the current public build; the container auto-installs/updates via SteamCMD
+## on first start. START_MODE must stay 1 with restart_policy always (see role comment).
+sdtd_host: 7dtd.boxswapper.io
+sdtd_ip: 10.10.0.47
+sdtd_image: docker.io/vinanrra/7dtd-server:latest
+sdtd_version: stable
+sdtd_start_mode: "1"
+sdtd_puid: 1000
+sdtd_pgid: 1000
+sdtd_timezone: America/Denver
+sdtd_backup: "NO"
+sdtd_monitor: "YES"
+## LinuxGSM config overrides (roles/7dtd/templates/sdtdserver.cfg.j2):
+## - querymode=1: this server answers NO A2S query on 26900 (ServerVisibility=0 + SteamNetworking
+##   disabled), so the default gamedig-based monitor (querymode=2) always fails its query and
+##   force-restarts the HEALTHY server every ~5 min. Session-only check avoids that loop.
+## - telnetpassword mirrors sdtd_telnet_password because LGSM's graceful stop reads
+##   ${telnetpassword} from its OWN cfg; the XML value is parsed into ${telnetpass} (different
+##   var) so without this the stop falls back to a hard tmux kill. Keep in sync below.
+sdtd_lgsm_querymode: "1"
+## CHANGE THESE before first deploy — the server is public and both passwords gate real access:
+## sdtd_server_password is the join password players must enter; if it is empty the server has NO
+## join password. sdtd_telnet_password guards the 8081/tcp admin console; if empty telnet only
+## listens on loopback.
+sdtd_server_password: h8zvU3v7WUEgLSYG
+sdtd_telnet_password: HDRSEsueredu3rf3
+## Change the seed + set sdtd_game_world: RWG for a fresh random-gen world on first boot
+## (Navezgane = built-in map, instant start, no generation time).
+sdtd_servername: "Boxswapper 7DTD"
+sdtd_server_description: "You will die in 7 Days, retard"
+sdtd_server_confirmation: "You will die, and you will like it, retard"
+sdtd_website_url: ""
+sdtd_region: NorthAmericaEast
+sdtd_language: English
+## Visibility of this server: 2 = public, 1 = only shown to friends, 0 = not listed. As you are never friend of a dedicated server setting this to "1" will only work when the first player connects manually by IP.
+sdtd_visibility: "1"
+## SteamNetworking disabled = direct connect via forwarded ports (correct setup for this box);
+## leave empty ("" ) to allow the Steam relay fallback if port forwards break.
+sdtd_disabled_network_protocols: SteamNetworking
+sdtd_port: 26900
+sdtd_max_players: 10
+sdtd_game_mode: GameModeSurvival
+sdtd_game_world: RWG
+sdtd_worldgen_seed: boxswapper
+sdtd_worldgen_size: 10240
+sdtd_game_name: Boxswapper
+## v3.0+ SandboxCode — the ONLY gameplay tuning v3.x reads. The vars below this block
+## (sdtd_difficulty .. sdtd_airdrop_frequency) are REFERENCE-ONLY: v3.0 removed them from
+## serverconfig.xml, the template no longer renders them, and the game IGNORES them. Empty
+## code = Adventurer defaults. To restore the server's intended tuning generate a code:
+## client -> New Game -> Sandbox Options -> match the vars below — Difficulty Nomad, XP 200
+## (2x), DayNight 60, DayLight 18, Blood Moon every 7 days, DropOnDeath Everything, Loot 150,
+## AirDrop 24h — with BOTH Day/Night Animal Density and Respawn = Default (so the MoreAnimals
+## modlet stays in charge of wildlife; XML applies only while density is Default) ->
+## copy -> paste here.
+sdtd_sandbox_code: ""
+## ── REFERENCE VARS FOR SANDBOXCODE GENERATION (not rendered to serverconfig.xml on v3.x) ──
+## Difficulty: 0 = Scavenger, 1 = Adventurer, 2 = Nomad, 3 = Warrior, 4 = Survivalist, 5 = Insane
+sdtd_difficulty: "1"
+sdtd_day_night_length: 60
+sdtd_day_light_length: 18
+## DropOnDeath: 0 = nothing, 1 = everything, 2 = toolbelt only, 3 = backpack only, 4 = delete all
+sdtd_drop_on_death: "1"
+## ZombieMove: 0 = walk, 1 = jog, 2 = run, 3 = sprint, 4 = nightmare
+sdtd_zombie_move: "0"
+sdtd_zombie_move_night: "3"
+sdtd_bloodmoon_frequency: 2
+sdtd_bloodmoon_enemy_count: 16
+sdtd_loot_abundance: 150
+sdtd_airdrop_frequency: 24
+## PlayerKillingMode: 0 = no killing, 1 = kill allies only, 2 = kill strangers only, 3 = kill everyone
+sdtd_player_killing_mode: "3"
+sdtd_max_spawned_zombies: 100
+sdtd_max_spawn_animals: "200"
+## EAC is ON (default protection). EAC blocks CODE mods (Harmony DLL hooks) — that is why it was
+## OFF while code mods were deployed. PURE XML data modlets (like MoreAnimals below) carry no DLL
+## and work fine with EAC ON; keep "false" only if code mods are ever reinstalled.
+sdtd_eac_enabled: "true"
+## Game mods deployed: MoreAnimals.zip — pure XML spawn-density patch (roles/7dtd/files/mods).
+## Server-side only: clients join vanilla with EAC ON, nothing to install. To re-add/swap a mod:
+## drop the zip into roles/7dtd/files/mods/ and list its name here. unarchive only ADDS — it
+## never removes, so a mod dropped from this list would keep loading: with an EMPTY list we wipe
+## the whole server Mods dir; swapping one mod for another (non-empty list) requires removing the
+## retired folder from the box by hand.
+sdtd_mods: [MoreAnimals.zip]
+sdtd_xp_multiplier: 200
+sdtd_telnet_enabled: "true"
+