diff --git a/all.yml b/all.yml
index ff0b597..713a30d 100755
--- a/all.yml
+++ b/all.yml
@@ -82,4 +82,7 @@
       tags: nfs_server
     - name: cert_gen
       role: cert_gen
-      tags: cert_gen
\ No newline at end of file
+      tags: cert_gen
+    - name: letsgo
+      role: letsgo
+      tags: letsgo
diff --git a/hosts_init.yml b/hosts_init.yml
index df43df4..538d29a 100755
--- a/hosts_init.yml
+++ b/hosts_init.yml
@@ -43,3 +43,15 @@ datacenter:
         # ansible_user: admin
         # ansible_pass: l4c1!j4yd33?Du5lo1
         ansible_python_interpreter: /share/ZFS530_DATA/.qpkg/QPython312/bin/python3
+    vms:
+      hosts:
+        vm01.home.lan:
+        vm02.home.lan:
+      vars:
+        ansible_python_interpreter: /usr/bin/python3
+        ansible_ssh_user: jd
+        ansible_ssh_password: q
+        become_method: su
+        ansible_become_password: q
+        ansible_ssh_pass: q
+        ansible_become_user: root
\ No newline at end of file
diff --git a/hosts_roles.yml b/hosts_roles.yml
index 6777013..5adc011 100755
--- a/hosts_roles.yml
+++ b/hosts_roles.yml
@@ -183,3 +183,12 @@ datacenter:
             ansible_ssh_user: jd
             ansible_become_password: q
             ansible_ssh_private_key_file: ssh_key.pem
+    vms:
+      hosts:
+        vm01.home.lan:
+        vm02.home.lan:
+      vars:
+        ansible_python_interpreter: /usr/bin/python3
+        ansible_ssh_user: jd
+        ansible_become_password: l4c1j4yd33Du5lo
+        ansible_ssh_private_key_file: ssh_key.pem
\ No newline at end of file
diff --git a/jaydee.yml b/jaydee.yml
index b21c4d7..8ee5cb7 100755
--- a/jaydee.yml
+++ b/jaydee.yml
@@ -1,17 +1,18 @@
 $ANSIBLE_VAULT;1.1;AES256
-34653034626436373537323430316462643663336164613763306336333038346562356565393036
-3964393861323439333839383061303864326235306665620a346233313633393135366362326464
-63643039363635646131323365313833643864373637346536663831613837353833343030623366
-3038303063393565350a613439646161363330626566646264313939653339383439623532636638
-38646433353765396136333236656535636235313639393565306636376438346362646438613835
-62663031333832666262616365343831353530646263383932373666386631633430626363363966
-61396336303365306135363039303032646137613330646434366638633738363064356132383439
-36346432306531356333313963353463626232613563653331396334656539643531343136636635
-31613762383664353930653165313461626133336161353639303662666234356138373539376161
-30653837316266356136353132373663396365633434393166383230363263326139316362383766
-64303738393663343636616437346535346566346536616663333866613966343563306265633064
-66333331393861626637616330333463636135316466616532373663663464613034656337363437
-62653333653838326632643238616638313935383532303233643132303637653963626363633662
-33646161373931386133353338643462306635393866656662376234396533376431366134653536
-36363835346434323338363465336166303161633732333232653861646136326334616261653462
-66376139313433383665
+63356366383732396163376631336164373666646234646335323762626333316435356133393661
+6630376666323636633065653466343361643763376364310a303334343035626565303133396439
+35636130336265373230613766373831333863353339643631333262373439323561653737663265
+3733626334306165660a333631383966666238376135653065646134376335326635363136613734
+36643733333835303563653035363530653333626437316436396163333635313033363039306533
+66333538656564313062366437393666643161306139313936356134623133333931353733663834
+35653234383466383530356235303564383062626663343563663964323638323538336435363864
+35383839386230646636616633336639663038633237373530616233326436383666313338373761
+39653338663737666132393638343066346431326533653538353533313733363063356535326231
+65306464386332616561313664313066666231666366346434633633363934376137626662363939
+31383637333263383435633631393162653137336262313335303539666366623134333430643165
+62306364613436663932376530366534323038646639313630643637613531656239663434646437
+35303139373230646164353265313964326264616465623261633732643637306462653930353330
+63313363643832616433353565306462383962363331383431373630306566613931313564363439
+34383037366230363862313433633164303932343738393964353065613130376535326266326563
+62666664323731396639333931316635653464386166343464373664393334623430333037623764
+36383964623530373132323731396132306234343934653337326132653232333566
diff --git a/roles/cert_gen/tasks/main.yml b/roles/cert_gen/tasks/main.yml
index a31bbae..3bdc163 100755
--- a/roles/cert_gen/tasks/main.yml
+++ b/roles/cert_gen/tasks/main.yml
@@ -1,6 +1,9 @@
 - name: Cert gen
   become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
   block:
+    - name: Include vault
+      ansible.builtin.include_vars:
+        file: jaydee.yml
     - name: Create a directory for certs
       ansible.builtin.file:
         path: /tmp/certgen
@@ -58,19 +61,46 @@
 
     - name: Copy generated certs to files
       ansible.builtin.copy:
-        src: /tmp/certgen/ca.pem
+        src: /tmp/certgen/{{ cert1 }}
         dest: /media/nas/data/certs/docker/{{ inventory_hostname }}
         remote_src: true
         mode: '0644'
         owner: jd
         group: root
       when: inventory_hostname != 'sectorq.cloud'
-      loop: 
+      loop_control:
+        loop_var: cert1
+      loop:
         - ca.pem
         - cert.pem
         - key.pem
-    - name: Restart docker service
-      ansible.builtin.systemd:
-        name: docker
-        state: restarted
 
+    - name: Install sshpass
+      ansible.builtin.apt:
+        name: sshpass
+        state: present
+      when: inventory_hostname != 'nas.home.lan'
+    - name: Create cert directory on nas server
+      ansible.builtin.command: |
+        sshpass -p {{ nas_password }} \
+        ssh  -p2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null admin@sectorq.eu "mkdir -p /share/Data/certs/docker/{{ inventory_hostname }}"
+      register: certgen
+      changed_when: "certgen.rc == 0"
+      ignore_errors: true
+      when: inventory_hostname != 'nas.home.lan'
+    - name: Generate certs
+      ansible.builtin.command: |
+        sshpass -p {{ nas_password }} \
+        scp -P2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null {{ cert2 }} admin@sectorq.eu:/share/Data/certs/docker/{{ inventory_hostname }}/
+      register: certgen
+      changed_when: "certgen.rc == 0"
+      args:
+        chdir: /tmp/certgen
+      loop_control:
+        loop_var: cert2
+      loop:
+        - ca.pem
+        - cert.pem
+        - key.pem
+        - server-cert.pem
+        - server-key.pem
diff --git a/roles/docker/tasks/main.yml b/roles/docker/tasks/main.yml
index ce2973e..f6ec81b 100755
--- a/roles/docker/tasks/main.yml
+++ b/roles/docker/tasks/main.yml
@@ -44,21 +44,21 @@
 
 
     - name: Ensure docker keyring directory exists
-      file:
+      ansible.builtin.file:
         path: /etc/apt/keyrings
         state: directory
         mode: "0755"
 
     - name: Download Docker GPG key
-      get_url:
+      ansible.builtin.get_url:
         url: https://download.docker.com/linux/debian/gpg
         dest: /etc/apt/keyrings/docker.asc
         mode: "0644"
       when:
         - ansible_distribution == "Debian"  and ansible_distribution_major_version  == "13"
-        
+
     - name: Install docker.sources file
-      template:
+      ansible.builtin.template:
         src: docker.sources.j2
         dest: /etc/apt/sources.list.d/docker.sources
         owner: root
@@ -68,7 +68,7 @@
         - ansible_distribution == "Debian"  and ansible_distribution_major_version  == "13"
 
     - name: Create docker.sources file
-      copy:
+      ansible.builtin.copy:
         dest: /etc/apt/sources.list.d/docker.sources
         mode: "0644"
         content: |
@@ -78,31 +78,24 @@
           Components: stable
           Signed-By: /etc/apt/keyrings/docker.asc
       when:
-          - ansible_distribution == "Debian"  and ansible_distribution_major_version  == "13"        
+          - ansible_distribution == "Debian"  and ansible_distribution_major_version  == "13"
 
 
     - name: Update apt cache
-      apt:
-        update_cache: yes
+      ansible.builtin.apt:
+        update_cache: true
 
       when:
         - ansible_distribution == "Debian"  and ansible_distribution_major_version  == "13"
 
     - name: Download Docker GPG key
-      get_url:
+      ansible.builtin.get_url:
         url: https://download.docker.com/linux/debian/gpg
         dest: /etc/apt/keyrings/docker.asc
         mode: "0644"
       when:
         - ansible_distribution == "Debian"  and ansible_distribution_major_version  == "13"
 
-
-
-
-
-
-
-
     - name: Add an Apt signing key to a specific keyring file
       ansible.builtin.apt_key:
         url: https://download.docker.com/linux/ubuntu/gpg
@@ -135,75 +128,36 @@
       ansible.builtin.shell: echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
       when:
         - ansible_distribution == "Ubuntu"
+    - name: Pin docker version
+      ansible.builtin.copy:
+        dest: /etc/apt/preferences.d/docker.pref
+        mode: "0644"
+        content: |
+          Package: docker-ce
+          Pin: version 5:28.5.2-1~debian.13~trixie
+          Pin-Priority: 1001
+
+          Package: docker-ce-cli
+          Pin: version 5:28.5.2-1~debian.13~trixie
+          Pin-Priority: 1001
+      when:
+        - ansible_distribution == "Debian"
+        - ansible_distribution_major_version == "13"
 
-    # - name: Install docker
-    #   ansible.builtin.apt:
-    #     name:
-    #       - docker-ce
-    #       - docker-ce-cli
-    #       - containerd.io
-    #       - docker-buildx-plugin
-    #       - docker-compose-plugin
-    #     update_cache: true
     - name: Install the version docker1
       ansible.builtin.apt:
-        name: "{{ item }}=5:28.5.2-1~{{ ansible_distribution | lower }}.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release }}"
+        name: "{{ docker_package }}"
         state: present
       when:
         - ansible_distribution == "Debian"
+      loop_control:
+        loop_var: docker_package
       loop:
         - docker-ce
         - docker-ce-cli
-    - name: Install the version docker
-      ansible.builtin.apt:
-        name: "{{ item }}"
-        state: present
-        allow_downgrade: true
-      when:
-        - ansible_distribution == "Debian"
-      loop:
         - containerd.io
-
-    - name: Install the version docker
-      ansible.builtin.apt:
-        name: "{{ item }}"
-        state: present
-        allow_downgrade: true
-      when:
-        - ansible_distribution == "Debian"
-      loop:
-        - docker-buildx-plugin
-        
-
-    - name: Install the version docker
-      ansible.builtin.apt:
-        name: "{{ item }}=5:28.5.2-1~{{ ansible_distribution | lower }}.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release }}"
-        state: present
-        allow_downgrade: true
-      when:
-        - ansible_distribution == "Debian1"
-      loop:
-        - docker-ce
-        - docker-ce-cli
-    - name: Install the version docker
-      ansible.builtin.apt:
-        name: "{{ item }}=1.7.28-2~{{ ansible_distribution | lower }}.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release }}"
-        state: present
-        allow_downgrade: true
-      when:
-        - ansible_distribution == "Debian"
-      loop:
-        - containerd.io
-
-    - name: Install the version docker
-      ansible.builtin.apt:
-        name: "{{ item }}=0.28.0-0~{{ ansible_distribution | lower }}.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release }}"
-        state: present
-        allow_downgrade: true
-      when:
-        - ansible_distribution == "Debian"
-      loop:
         - docker-buildx-plugin
+        - docker-compose-plugin
 
     - name: Create a directory docker.service.d
       ansible.builtin.file:
@@ -211,55 +165,35 @@
         state: directory
         mode: '0755'
 
-
-    # - name: Copy files
-    #   ansible.builtin.copy:
-    #     src: server-key.pem
-    #     dest: /etc/docker/certs/
-    #     mode: '0600'
-    #     owner: root
-    #     group: root
-    # - name: Copy files
-    #   ansible.builtin.copy:
-    #     src: ca.pem
-    #     dest: /etc/docker/certs/
-    #     mode: '0600'
-    #     owner: root
-    #     group: root
-    # - name: Copy files
-    #   ansible.builtin.copy:
-    #     src: server-cert.pem
-    #     dest: /etc/docker/certs/
-    #     mode: '0600'
-    #     owner: root
-    #     group: root
     - name: Creating a file with content
       ansible.builtin.copy:
         dest: "/etc/systemd/system/docker.service.d/override.conf"
         content: |
           [Service]
           ExecStart=
-          ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock --tlsverify --tlscacert=/etc/docker/certs/ca.pem --tlscert=/etc/docker/certs/server-cert.pem --tlskey=/etc/docker/certs/server-key.pem -H=0.0.0.0:2376
+          ExecStart=/usr/bin/dockerd -H fd:// \
+          --containerd=/run/containerd/containerd.sock \
+          --tlsverify --tlscacert=/etc/docker/certs/ca.pem \
+          --tlscert=/etc/docker/certs/server-cert.pem \
+          --tlskey=/etc/docker/certs/server-key.pem -H=0.0.0.0:2376
         mode: '0600'
         owner: root
         group: root
       notify: restart_docker
       when: mode == "cert"
 
-    # - name: Creating a file with content
-    #   ansible.builtin.copy:
-    #     dest: "/etc/systemd/system/docker.service.d/override.conf"
-    #     content: |
-    #       [Service]
-    #       ExecStart=
-    #       ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock --tlsverify \
-    #       --tlscacert=/etc/docker/certs/ca.pem --tlscert=/etc/docker/certs/server-cert.pem \
-    #       --tlskey=/etc/docker/certs/server-key.pem -H=0.0.0.0:2376
-    #     mode: '0600'
-    #     owner: root
-    #     group: root
-    #   notify: restart_docker
-    #   when: mode != "nocert"
+    - name: Creating a file with content
+      ansible.builtin.copy:
+        dest: "/etc/systemd/system/docker.service.d/override.conf"
+        content: |
+          [Service]
+          ExecStart=
+          ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock  -H=0.0.0.0:2376
+        mode: '0600'
+        owner: root
+        group: root
+      notify: restart_docker
+      when: mode != "cert"
 
     - name: Just force systemd to reread configs
       ansible.builtin.systemd:
@@ -270,10 +204,12 @@
         name: docker
         state: restarted
 
-    # - name: Get keys for raspotify
-    #   ansible.builtin.shell: docker plugin install grafana/loki-docker-driver:3.3.2-{{ ansible_architecture }} --alias loki --grant-all-permissions
-    - name: Install a plugin
+    - name: Install Loki plugin with TLS
       community.docker.docker_plugin:
-        plugin_name: grafana/loki-docker-driver:3.3.2
+        plugin_name: grafana/loki-docker-driver
         alias: loki
         state: present
+      environment:
+        DOCKER_HOST: "tcp://{{ inventory_hostname }}:2376"
+        DOCKER_TLS_VERIFY: "1"
+        DOCKER_CERT_PATH: "/tmp/certgen"
diff --git a/roles/hosts/tasks/main.yml b/roles/hosts/tasks/main.yml
index 049dc51..4e0a8b6 100755
--- a/roles/hosts/tasks/main.yml
+++ b/roles/hosts/tasks/main.yml
@@ -30,4 +30,4 @@
       ansible.builtin.lineinfile:
         path: "/etc/hosts"
         regexp: "^193.168.144.164 .*"
-        line: "193.168.144.164 external"        
+        line: "193.168.144.164 external"