diff --git a/files/technitium_download.sh b/files/technitium_download.sh
deleted file mode 100644
index cfe6f79..0000000
--- a/files/technitium_download.sh
+++ /dev/null
@@ -1,257 +0,0 @@
-#!/bin/sh
-
-dotnetDir="/opt/dotnet"
-dotnetVersion="10.0"
-dotnetRuntime="Microsoft.AspNetCore.App 10.0."
-dotnetUrl="https://dot.net/v1/dotnet-install.sh"
-
-if [ -d "/etc/dns/config" ]
-then
-    dnsDir="/etc/dns"
-else
-    dnsDir="/opt/technitium/dns"
-fi
-
-dnsConfig="/etc/dns"
-dnsLog="/var/log/technitium/dns"
-dnsTar="$dnsDir/DnsServerPortable.tar.gz"
-dnsUrl="https://download.technitium.com/dns/DnsServerPortable.tar.gz"
-
-serviceUser="dns-server"
-installLog="$dnsDir/install.log"
-
-echo ""
-echo "==============================="
-echo "Technitium DNS Server Installer"
-echo "==============================="
-echo ""
-
-mkdir -p $dnsDir
-mkdir -p $dnsConfig
-
-echo "" > $installLog
-
-if dotnet --list-runtimes 2> /dev/null | grep -q "$dotnetRuntime";
-then
-    dotnetFound="yes"
-else
-    dotnetFound="no"
-fi
-
-if [ ! -d $dotnetDir ] && [ "$dotnetFound" = "yes" ]
-then
-    echo "ASP.NET Core Runtime is already installed."
-else
-    if [ -d $dotnetDir ] && [ "$dotnetFound" = "yes" ]
-    then
-        dotnetUpdate="yes"
-        echo "Updating ASP.NET Core Runtime..."
-    else
-        dotnetUpdate="no"
-        echo "Installing ASP.NET Core Runtime..."
-    fi
-
-    curl -sSL $dotnetUrl | bash /dev/stdin -c $dotnetVersion --runtime aspnetcore --no-path --install-dir $dotnetDir --verbose >> $installLog 2>&1
-
-    # On Alpine Linux dotnet requires libstdc++
-    if command -v apk >/dev/null 2>&1
-    then
-        echo "Installing ASP.NET Core Runtime dependencies..."
-        apk add --no-cache libstdc++ >> $installLog 2>&1
-    fi
-
-    if [ ! -f "/usr/bin/dotnet" ]
-    then
-        ln -s $dotnetDir/dotnet /usr/bin >> $installLog 2>&1
-    fi
-
-    if dotnet --list-runtimes 2> /dev/null | grep -q "$dotnetRuntime";
-    then
-        if [ "$dotnetUpdate" = "yes" ]
-        then
-            echo "ASP.NET Core Runtime was updated successfully!"
-        else
-            echo "ASP.NET Core Runtime was installed successfully!"
-        fi
-    else
-        echo "Failed to install ASP.NET Core Runtime. Please check '$installLog' for details."
-        exit 1
-    fi
-fi
-
-echo ""
-echo "Downloading Technitium DNS Server..."
-
-if ! curl -o $dnsTar --fail $dnsUrl >> $installLog 2>&1
-then
-    echo "Failed to download Technitium DNS Server from: $dnsUrl"
-    echo "Please check '$installLog' for details."
-    exit 1
-fi
-
-if [ -d $dnsConfig ]
-then
-    echo "Updating Technitium DNS Server..."
-else
-    echo "Installing Technitium DNS Server..."
-fi
-
-tar -zxf $dnsTar -C $dnsDir >> $installLog 2>&1
-
-echo ""
-
-if $( dotnet $dnsDir/DnsServerApp.dll --icu-test >> $installLog 2>&1 ) >/dev/null 2>&1;
-then
-    echo "ICU package is already installed."
-else
-    echo "Checking for required ICU package..."
-
-    if command -v apt-get >/dev/null 2>&1; then
-        # Debian/Ubuntu based
-        if ! dpkg -l | grep -q "libicu"; then
-            echo "Installing required ICU package..."
-            apt-get update >> $installLog 2>&1
-
-            # Try to install the most common package name
-            if apt-cache show libicu74 >/dev/null 2>&1; then
-                echo "Installing libicu74 package..."
-                apt-get install -y libicu74 >> $installLog 2>&1
-            elif apt-cache show libicu72 >/dev/null 2>&1; then
-                echo "Installing libicu72 package..."
-                apt-get install -y libicu72 >> $installLog 2>&1
-            elif apt-cache show libicu70 >/dev/null 2>&1; then
-                echo "Installing libicu70 package..."
-                apt-get install -y libicu70 >> $installLog 2>&1
-            else
-                # Fallback to a generic approach
-                echo "No specific libicu package was found, trying generic installation..."
-                apt-get install -y libicu* >> $installLog 2>&1
-            fi
-        fi
-    elif command -v dnf >/dev/null 2>&1; then
-        # Fedora/RHEL based
-        if ! rpm -qa | grep -q "libicu"; then
-            echo "Installing required ICU package..."
-            dnf install -y libicu >> $installLog 2>&1
-        fi
-    elif command -v yum >/dev/null 2>&1; then
-        # Older RHEL/CentOS systems
-        if ! rpm -qa | grep -q "libicu"; then
-            echo "Installing required ICU package..."
-            yum install -y libicu >> $installLog 2>&1
-        fi
-    elif command -v zypper >/dev/null 2>&1; then
-        # openSUSE based
-        if ! rpm -qa | grep -q "libicu"; then
-            echo "Installing required ICU package..."
-            zypper install -y libicu >> $installLog 2>&1
-        fi
-    elif command -v pacman >/dev/null 2>&1; then
-        # Arch based
-        if ! pacman -Q | grep -q "icu"; then
-            echo "Installing required ICU package..."
-            pacman -S --noconfirm icu >> $installLog 2>&1
-        fi
-    elif command -v apk >/dev/null 2>&1; then
-        # Alpine Linux
-        if ! apk list --installed | grep -q "icu"; then
-            echo "Installing required ICU package..."
-            apk add --no-cache icu >> $installLog 2>&1
-        fi
-    else
-        echo "Failed to install Technitium DNS Server: could not determine package manager to install ICU package. Please install ICU package manually and try again."
-        echo "Please read the 'Missing ICU Package' section in this blog post to understand how to manually install the ICU package for your distro: https://blog.technitium.com/2017/11/running-dns-server-on-ubuntu-linux.html"
-        exit 1
-    fi
-
-    #test again to confirm
-    if $( dotnet $dnsDir/DnsServerApp.dll --icu-test >> $installLog 2>&1 ) >/dev/null 2>&1;
-    then
-        echo "ICU package was installed successfully!"
-    else
-        echo "Failed to install Technitium DNS Server: failed to install ICU package. Please install ICU package manually and try again."
-        echo "Please read the 'Missing ICU Package' section in this blog post to understand how to manually install the ICU package for your distro: https://blog.technitium.com/2017/11/running-dns-server-on-ubuntu-linux.html"
-        exit 1
-    fi
-fi
-
-echo ""
-
-if [ "$(ps --no-headers -o comm 1 | tr -d '\n')" = "systemd" ]
-then
-    if [ -f "/etc/systemd/system/dns.service" ]
-    then
-        echo "Configuring permissions..."
-        chown -R $serviceUser:$serviceUser $dnsDir $dnsConfig $dnsLog >> $installLog 2>&1
-
-        echo "Restarting systemd service..."
-        systemctl restart dns.service >> $installLog 2>&1
-    else
-        mkdir -p $dnsLog
-
-        echo "Configuring user and permissions..."
-        useradd --system -M --shell /usr/sbin/nologin --user-group $serviceUser >> $installLog 2>&1
-        chown -R $serviceUser:$serviceUser $dnsDir $dnsConfig $dnsLog >> $installLog 2>&1
-
-        echo "Configuring systemd service..."
-        cp $dnsDir/systemd.service /etc/systemd/system/dns.service
-        systemctl enable dns.service >> $installLog 2>&1
-
-        systemctl stop systemd-resolved >> $installLog 2>&1
-        systemctl disable systemd-resolved >> $installLog 2>&1
-
-        systemctl start dns.service >> $installLog 2>&1
-
-        if [ -f "/etc/NetworkManager/NetworkManager.conf" ]
-        then
-            currentVal=$(grep -F "dns=" /etc/NetworkManager/NetworkManager.conf)
-
-            if [ "$currentVal" = "" ]
-            then
-                printf "\n[main]\ndns=none\n" >> /etc/NetworkManager/NetworkManager.conf 2>> $installLog
-            elif [ "$currentVal" != "dns=none" ]
-            then
-                sed -i "s/$currentVal/dns=none/g" /etc/NetworkManager/NetworkManager.conf 2>> $installLog
-            fi
-        fi
-    fi
-elif [ -x "/sbin/rc-service" ]
-then
-    if [ -f "/etc/init.d/dns" ]
-    then
-        echo "Configuring permissions..."
-        chown -R $serviceUser:$serviceUser $dnsDir $dnsConfig $dnsLog >> $installLog 2>&1
-
-        echo "Restarting OpenRC service..."
-        rc-service dns stop >> $installLog 2>&1
-        rc-service dns start >> $installLog 2>&1
-    else
-        mkdir -p $dnsLog
-
-        echo "Configuring user and permissions..."
-        addgroup -S $serviceUser >> $installLog 2>&1
-        adduser -H -S -D -s /bin/false -G $serviceUser $serviceUser >> $installLog 2>&1
-        chown -R $serviceUser:$serviceUser $dnsDir $dnsConfig $dnsLog >> $installLog 2>&1
-
-        echo "Configuring OpenRC service..."
-        cp $dnsDir/openrc.service /etc/init.d/dns
-        chmod +x /etc/init.d/dns
-        rc-update add dns >> $installLog 2>&1
-        rc-service dns start >> $installLog 2>&1
-    fi
-else
-    echo "Failed to install Technitium DNS Server: systemd/openrc was not detected."
-    echo "Please read the 'Installing DNS Server Manually' section in this blog post to understand how to manually install the DNS server on your distro: https://blog.technitium.com/2017/11/running-dns-server-on-ubuntu-linux.html"
-    exit 1
-fi 2>/dev/null
-
-cp -a /etc/resolv.conf $dnsDir/resolv.conf.bak >> $installLog 2>&1    
-rm /etc/resolv.conf >> $installLog 2>&1    
-printf "# Generated by Technitium DNS Server Installer\n\nnameserver 127.0.0.1\n" > /etc/resolv.conf 2>> $installLog
-
-echo ""
-echo "Technitium DNS Server was installed successfully!"
-echo "Open http://$(cat /proc/sys/kernel/hostname):5380/ to access the web console."
-echo ""
-echo "Donate! Make a contribution by becoming a Patron: https://www.patreon.com/technitium"
-echo ""
diff --git a/inventory/host_vars/ch01.balsillie.house/ansible_connection.yml b/inventory/host_vars/ch01.balsillie.house/ansible_connection.yml
deleted file mode 100644
index 059d209..0000000
--- a/inventory/host_vars/ch01.balsillie.house/ansible_connection.yml
+++ /dev/null
@@ -1 +0,0 @@
-ansible_ssh_host: ch01.balsillie.house
diff --git a/inventory/host_vars/ch01.balsillie.house/sudoers.yml b/inventory/host_vars/ch01.balsillie.house/sudoers.yml
deleted file mode 100644
index 95c473b..0000000
--- a/inventory/host_vars/ch01.balsillie.house/sudoers.yml
+++ /dev/null
@@ -1 +0,0 @@
-unprivileged_user: quadlet
diff --git a/inventory/host_vars/ch02.balsillie.house/ansible_connection.yml b/inventory/host_vars/ch02.balsillie.house/ansible_connection.yml
deleted file mode 100644
index 5633ce5..0000000
--- a/inventory/host_vars/ch02.balsillie.house/ansible_connection.yml
+++ /dev/null
@@ -1 +0,0 @@
-ansible_ssh_host: ch02.balsillie.house
diff --git a/inventory/host_vars/ch02.balsillie.house/sudoers.yml b/inventory/host_vars/ch02.balsillie.house/sudoers.yml
deleted file mode 100644
index 95c473b..0000000
--- a/inventory/host_vars/ch02.balsillie.house/sudoers.yml
+++ /dev/null
@@ -1 +0,0 @@
-unprivileged_user: quadlet
diff --git a/inventory/host_vars/cs01.balsillie.house/ansible_connection.yml b/inventory/host_vars/cs01.balsillie.house/ansible_connection.yml
new file mode 100644
index 0000000..eb11b14
--- /dev/null
+++ b/inventory/host_vars/cs01.balsillie.house/ansible_connection.yml
@@ -0,0 +1 @@
+ansible_ssh_host: cs01.balsillie.house
diff --git a/inventory/host_vars/ch01.balsillie.house/high_availability.yml b/inventory/host_vars/cs01.balsillie.house/high_availability.yml
similarity index 100%
rename from inventory/host_vars/ch01.balsillie.house/high_availability.yml
rename to inventory/host_vars/cs01.balsillie.house/high_availability.yml
diff --git a/inventory/host_vars/cs01.balsillie.house/sudoers.yml b/inventory/host_vars/cs01.balsillie.house/sudoers.yml
new file mode 100644
index 0000000..b8855a1
--- /dev/null
+++ b/inventory/host_vars/cs01.balsillie.house/sudoers.yml
@@ -0,0 +1,5 @@
+unprivileged_users:
+  - git
+  - distribution
+  - talos-discovery
+  - syncthing
diff --git a/inventory/host_vars/cs02.balsillie.house/ansible_connection.yml b/inventory/host_vars/cs02.balsillie.house/ansible_connection.yml
new file mode 100644
index 0000000..e791a66
--- /dev/null
+++ b/inventory/host_vars/cs02.balsillie.house/ansible_connection.yml
@@ -0,0 +1 @@
+ansible_ssh_host: cs02.balsillie.house
diff --git a/inventory/host_vars/ch02.balsillie.house/high_availability.yml b/inventory/host_vars/cs02.balsillie.house/high_availability.yml
similarity index 100%
rename from inventory/host_vars/ch02.balsillie.house/high_availability.yml
rename to inventory/host_vars/cs02.balsillie.house/high_availability.yml
diff --git a/inventory/host_vars/cs02.balsillie.house/sudoers.yml b/inventory/host_vars/cs02.balsillie.house/sudoers.yml
new file mode 100644
index 0000000..b8855a1
--- /dev/null
+++ b/inventory/host_vars/cs02.balsillie.house/sudoers.yml
@@ -0,0 +1,5 @@
+unprivileged_users:
+  - git
+  - distribution
+  - talos-discovery
+  - syncthing
diff --git a/inventory/host_vars/dl01.balsillie.house/sudoers.yml b/inventory/host_vars/dl01.balsillie.house/sudoers.yml
index 9023be0..2ed3391 100644
--- a/inventory/host_vars/dl01.balsillie.house/sudoers.yml
+++ b/inventory/host_vars/dl01.balsillie.house/sudoers.yml
@@ -1 +1,2 @@
-unprivileged_user: download
+unprivileged_users:
+  - download
diff --git a/inventory/host_vars/ns01.balsillie.house/ansible_connection.yml b/inventory/host_vars/ns01.balsillie.house/ansible_connection.yml
new file mode 100644
index 0000000..5457919
--- /dev/null
+++ b/inventory/host_vars/ns01.balsillie.house/ansible_connection.yml
@@ -0,0 +1 @@
+ansible_ssh_host: ns01.balsillie.house
diff --git a/inventory/host_vars/ns01.balsillie.house/high_availability.yml b/inventory/host_vars/ns01.balsillie.house/high_availability.yml
new file mode 100644
index 0000000..ee7d366
--- /dev/null
+++ b/inventory/host_vars/ns01.balsillie.house/high_availability.yml
@@ -0,0 +1,2 @@
+ha_pair_value: '01'
+subnet_suffix_value: '1'
diff --git a/inventory/host_vars/ns01.balsillie.house/sudoers.yml b/inventory/host_vars/ns01.balsillie.house/sudoers.yml
new file mode 100644
index 0000000..ccf3829
--- /dev/null
+++ b/inventory/host_vars/ns01.balsillie.house/sudoers.yml
@@ -0,0 +1,2 @@
+unprivileged_users:
+  - technitium
diff --git a/inventory/host_vars/ns02.balsillie.house/ansible_connection.yml b/inventory/host_vars/ns02.balsillie.house/ansible_connection.yml
new file mode 100644
index 0000000..43a67ed
--- /dev/null
+++ b/inventory/host_vars/ns02.balsillie.house/ansible_connection.yml
@@ -0,0 +1 @@
+ansible_ssh_host: ns02.balsillie.house
diff --git a/inventory/host_vars/ns02.balsillie.house/high_availability.yml b/inventory/host_vars/ns02.balsillie.house/high_availability.yml
new file mode 100644
index 0000000..c698281
--- /dev/null
+++ b/inventory/host_vars/ns02.balsillie.house/high_availability.yml
@@ -0,0 +1,2 @@
+ha_pair_value: '02'
+subnet_suffix_value: '2'
diff --git a/inventory/host_vars/ns02.balsillie.house/sudoers.yml b/inventory/host_vars/ns02.balsillie.house/sudoers.yml
new file mode 100644
index 0000000..ccf3829
--- /dev/null
+++ b/inventory/host_vars/ns02.balsillie.house/sudoers.yml
@@ -0,0 +1,2 @@
+unprivileged_users:
+  - technitium
diff --git a/inventory/inventory.yml b/inventory/inventory.yml
index 9916b3c..f5dca8f 100644
--- a/inventory/inventory.yml
+++ b/inventory/inventory.yml
@@ -18,3 +18,6 @@ all:
       hosts:
         hv01.balsillie.house:
         hv02.balsillie.house:
+    ipv4_only_hosts:
+      children:
+        download_clients:
diff --git a/playbooks/archlinux-servers.yml b/playbooks/archlinux-servers.yml
index d139dc2..275c502 100644
--- a/playbooks/archlinux-servers.yml
+++ b/playbooks/archlinux-servers.yml
@@ -3,7 +3,8 @@
 - name: Configure ssh and firewall
   hosts:
     # - archlinux_servers
-    - ch02.balsillie.house
+    # - ch02.balsillie.house
+    - dl01.balsillie.house
   gather_facts: false
   become: true
   pre_tasks:
@@ -34,4 +35,5 @@
     # - sudoers
     # - sshd
     # - podman
-    - technitium
+    # - technitium
+    - ipv4_only
diff --git a/roles/ipv4_only/handlers/main.yml b/roles/ipv4_only/handlers/main.yml
new file mode 100644
index 0000000..d1eab11
--- /dev/null
+++ b/roles/ipv4_only/handlers/main.yml
@@ -0,0 +1,5 @@
+# code: language=ansible
+
+- name: Reboot
+  ansible.builtin.reboot:
+    reboot_timeout: 180
diff --git a/roles/ipv4_only/tasks/main.yml b/roles/ipv4_only/tasks/main.yml
new file mode 100644
index 0000000..c351b32
--- /dev/null
+++ b/roles/ipv4_only/tasks/main.yml
@@ -0,0 +1,32 @@
+# code: language=ansible
+
+- name: Disable ipv6 (all)
+  ansible.posix.sysctl:
+    name: "{{ item }}"
+    reload: true
+    state: present
+    sysctl_set: true
+    value: 1
+  loop:
+    - net.ipv6.conf.all.disable_ipv6
+    - net.ipv6.conf.default.disable_ipv6
+    - net.ipv6.conf.lo.disable_ipv6
+  notify:
+    - Reboot
+
+- name: Remove IPv6 localhost entries from /etc/hosts
+  when:
+    - (ipv4_only | default(false))
+  ansible.builtin.lineinfile:
+    path: /etc/hosts
+    line: "{{ item }}"
+    state: absent
+  loop:
+    - '::1 localhost ip6-localhost ip6-loopback'
+    - 'ff02::1 ip6-allnodes'
+    - 'ff02::2 ip6-allrouters'
+  notify:
+    - Reboot
+
+- name: Flush handlers to trigger reboot if required
+  ansible.builtin.meta: flush_handlers
diff --git a/roles/ipv4_only/vars/main.yml b/roles/ipv4_only/vars/main.yml
new file mode 100644
index 0000000..f4366fe
--- /dev/null
+++ b/roles/ipv4_only/vars/main.yml
@@ -0,0 +1 @@
+# code: language=ansible
diff --git a/roles/sudoers/tasks/main.yml b/roles/sudoers/tasks/main.yml
index 369ad82..a69f4a6 100644
--- a/roles/sudoers/tasks/main.yml
+++ b/roles/sudoers/tasks/main.yml
@@ -46,7 +46,7 @@
     name: "{{ sudoers_user }}"
     state: present
 
-- name: Add sudoers entries
+- name: Add main root sudoers entry
   community.general.sudoers:
     commands:
       - ALL
@@ -54,19 +54,28 @@
       - '!fqdn' # Ensures using shortname only when assessing hostname in sudo rule
     group: sudo
     host: "{{ inventory_hostname_short }}"
-    name: sudo_{{ item.name }}
-    nopassword: "{{ item.nopassword }}"
-    runas: "{{ item.name }}"
+    name: sudo_root
+    nopassword: false
+    runas: root
     state: present
     sudoers_path: "/etc/sudoers.d"
     validation: required
-  loop:
-    - name: root
-      nopassword: false
-    - name: "{{ unprivileged_user }}"
-      nopassword: true
-  loop_control:
-    label: "{{ item.name }}"
+
+- name: Add become unpriviligeed users sudoers entries
+  community.general.sudoers:
+    commands:
+      - ALL
+    defaults:
+      - '!fqdn' # Ensures using shortname only when assessing hostname in sudo rule
+    group: sudo
+    host: "{{ inventory_hostname_short }}"
+    name: sudo_{{ item }}
+    nopassword: true
+    runas: "{{ item }}"
+    state: present
+    sudoers_path: "/etc/sudoers.d"
+    validation: required
+  loop: "{{ unprivileged_users }}"
 
 - name: Remove default sudoers file
   ansible.builtin.file: