diff --git a/common.yaml b/common.yaml
index 5006036..08b3cc2 100644
--- a/common.yaml
+++ b/common.yaml
@@ -8,3 +8,8 @@
   roles:
     - haproxy
     - bitwarden
+    - nextcloud
+
+- hosts: dnsmasq.lan.0rpheus.net
+  roles:
+    - dnsmasq
diff --git a/hosts.yaml b/hosts.yaml
index 10d53fb..5a82dd6 100644
--- a/hosts.yaml
+++ b/hosts.yaml
@@ -3,19 +3,23 @@
 all:
   hosts:
     mail.0rpheus.net:
-    192.168.0.15:
+    odroid.lan.0rpheus.net:
+      ansible_ssh_host: 192.168.0.15
+    dnsmasq.lan.0rpheus.net:
+      ansible_ssh_host: 192.168.0.2
 
   vars:
     ansible_become: false
+    ansible_user: root
 
     admin_mailaddress: micha@0rpheus.net
-    
+
     # automated updates
     Unattended_Upgrade: 1
-    Update_Package_Lists: 1 
+    Update_Package_Lists: 1
 
     bitwarden_version: 1.14.2-alpine
-  
+
     certbot_domains:
       - "jabber.0rpheus.net"
 
@@ -23,6 +27,7 @@ all:
       # <Domain>: <Backend>
       smokeping.0rpheus.net: smokeping
       bitwarden.0rpheus.net: bitwarden
+      nextcloud.0rpheus.net: nextcloud
       seafile.0rpheus.net: odroid
       jabber.0rpheus.net: prosody
       tt-rss.0rpheus.net: odroid
@@ -36,6 +41,10 @@ all:
         server_defs:
           - "apache 127.0.0.1:8080 check"
 
+      nextcloud:
+        server_defs:
+          - "nextcloud-docker 127.0.0.1:2090 check"
+
       prosody:
         server_defs:
           - "prosody 127.0.0.1:5281 check ssl verify none"