diff --git a/hopeless-masquerade/main.yml b/hopeless-masquerade/main.yml
new file mode 100644
index 0000000..a21db4d
--- /dev/null
+++ b/hopeless-masquerade/main.yml
@@ -0,0 +1,50 @@
+# TODO Consolidate this into a basic playbook
+- name: Basic requirements
+  hosts: hopeless-masquerade
+  become: true
+  tasks:
+
+    - name: Install basic packages
+      apt:
+        pkg:
+          - git
+          - net-tools # ifconfig
+          - neovim
+          - prometheus-node-exporter
+        state: present
+        update_cache: true
+
+# TODO Standardize these into a shared playbook
+- name: Secure the system
+  hosts: legacy-of-lunatic-kingdom
+  become: true
+  tasks:
+
+    - name: Disable SSH password logins
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: '^(#\s*)?{{ item }} '
+        line: "{{ item }} no"
+      with_items:
+        - ChallengeResponseAuthentication
+        - PasswordAuthentication
+        - UsePAM
+      notify: Restart sshd
+
+    - name: Allow sudo without password
+      lineinfile:
+        path: /etc/sudoers
+        regexp: '^%sudo'
+        line: '%sudo ALL=(ALL:ALL) NOPASSWD:ALL'
+        validate: 'visudo -cf %s'
+
+  handlers:
+    - name: Restart sshd
+      systemd:
+        name: sshd
+        state: restarted
+
+# TODO disallow network access from non-tailscale interfaces
+- import_playbook: ../playbooks/tailscale.yml # noqa: name[play]
+
+# vim: ft=yaml.ansible
diff --git a/hosts.yml b/hosts.yml
index 77e49ba..1d4ba33 100644
--- a/hosts.yml
+++ b/hosts.yml
@@ -1,3 +1,4 @@
+# reminder: use ansible_host to override the IP if the host isn't on Tailscale yet
 all:
   hosts:
     localhost:
@@ -6,6 +7,7 @@ all:
     ramble-hard:
       ansible_user: root
       ansible_python_interpreter: /usr/bin/python3
+    hopeless-masquerade:
     legacy-of-lunatic-kingdom:
     lotus-land-story:
     mountain-of-faith: