diff --git a/.gitignore b/.gitignore
index 58ea314..796ec91 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,6 @@
 roles/mastodon/vars/main.yml
 host_vars/
+roles/frontend/templates/cdn.fullchain.pem
+roles/frontend/templates/cdn.privkey.pem
+roles/frontend/templates/domain.fullchain.pem
+roles/frontend/templates/domain.privkey.pem
diff --git a/Makefile b/Makefile
index df19d37..299e94b 100644
--- a/Makefile
+++ b/Makefile
@@ -1,3 +1,3 @@
 install:
-	ansible-galaxy install geerlingguy.docker geerlingguy.nginx geerlingguy.certbot
+	ansible-galaxy install geerlingguy.docker geerlingguy.nginx
 	git submodule update --init --recursive
diff --git a/README.md b/README.md
index 052d622..fedfe05 100644
--- a/README.md
+++ b/README.md
@@ -50,7 +50,6 @@ ENV_PRODUCTION:
   AWS_SECRET_ACCESS_KEY: changeme
   S3_ALIAS_HOST: changeme
   STATSD_ADDR: statsd:9125
-swap_space: 1G
 ```
 
 In addition, you'll need to update the `group_vars/all` file and setup the location of your postgres server. This is used by pgbouncer.
@@ -72,3 +71,26 @@ sidekiq:
 ```
 
 This will create a service called `sidekiq-ingress-and-stuff` with the `ingress` and `default` queues.  To have the default queues, leave the `q` array empty.
+
+## Configuring frontend
+
+You must provide two sets of certificates and keys into the directory `roles/frontend/templates` of the names:
+- domain.fullchain.pem
+- domain.privkey.pem
+- cdn.fullchain.pem
+- cdn.privkey.pem
+
+These files can be built from any number of ways, for example in my development environment I have the following:
+```
+#!/bin/bash
+
+sudo certbot certonly -d masto.yttrx.com
+sudo certbot certonly -d files.yttrx.com
+cd $HOME/masto-ansible/roles/frontend/templates
+sudo cp /etc/letsencrypt/live/masto.yttrx.com/fullchain.pem domain.fullchain.pem
+sudo cp /etc/letsencrypt/live/masto.yttrx.com/privkey.pem domain.privkey.pem
+sudo cp /etc/letsencrypt/live/files.yttrx.com/fullchain.pem cdn.fullchain.pem
+sudo cp /etc/letsencrypt/live/files.yttrx.com/fullchain.pem cdn.fullchain.pem
+sudo cp /etc/letsencrypt/live/files.yttrx.com/privkey.pem cdn.privkey.pem
+chmod ga+r *.pem
+```
diff --git a/firstboot.yml b/firstboot.yml
new file mode 100644
index 0000000..6cd963d
--- /dev/null
+++ b/firstboot.yml
@@ -0,0 +1,22 @@
+---
+- hosts: yttrx
+  tasks:
+    - name: Update apt-get repo and cache
+      apt: update_cache=yes force_apt_get=yes
+    
+    - name: Upgrade all apt packages
+      apt: upgrade=dist force_apt_get=yes
+    
+    - name: Check if a reboot is needed for Debian and Ubuntu boxes
+      register: reboot_required_file
+      stat: path=/var/run/reboot-required get_md5=no
+    
+    - name: Reboot the Debian or Ubuntu server
+      reboot:
+        msg: "Reboot initiated by Ansible due to kernel updates"
+        connect_timeout: 5
+        reboot_timeout: 300
+        pre_reboot_delay: 0
+        post_reboot_delay: 30
+        test_command: uptime
+      when: reboot_required_file.stat.exists
diff --git a/group_vars/all b/group_vars/all
index 2f74ec7..f1e41ca 100644
--- a/group_vars/all
+++ b/group_vars/all
@@ -1,3 +1,4 @@
 MASTODON_VERSION: v4.0.2
 REAL_DB_HOST: tusky.masto.yttrx.com
 DB_POOL: 25
+letsencrypt_account_email: waffles@yttrx.com
diff --git a/hosts b/hosts
index bbeeec5..4ea7e5c 100644
--- a/hosts
+++ b/hosts
@@ -3,19 +3,20 @@ grafana.yttrx.com ansible_user=root
 tusky.masto.yttrx.com ansible_user=root
 mammut.masto.yttrx.com ansible_user=root
 mail.yttrx.com ansible_user=root
+wooly.masto.yttrx.com ansible_user=root
 
 [mastodon]
 #tusky.masto.yttrx.com ansible_user=root
 mammut.masto.yttrx.com ansible_user=root
 
 [sidekiq]
-wooly.masto.yttrx.com ansible_user=root
+#wooly.masto.yttrx.com ansible_user=root
 
 [frontend]
 wooly.masto.yttrx.com ansible_user=root
 
 [webapp]
-#wooly.masto.yttrx.com ansible_user=root
+wooly.masto.yttrx.com ansible_user=root
 
 [yttrx:vars]
 ansible_python_interpreter=/usr/bin/python3
diff --git a/roles/frontend/tasks/main.yml b/roles/frontend/tasks/main.yml
index 9b90521..50c5551 100644
--- a/roles/frontend/tasks/main.yml
+++ b/roles/frontend/tasks/main.yml
@@ -8,10 +8,10 @@
     owner: www-data
     group: www-data
 
-- name: Install nginx site files
+- name: Install nginx site cdn
   template:
-    src: files.j2
-    dest: /etc/nginx/sites-available/files
+    src: cdn.j2
+    dest: /etc/nginx/sites-available/cdn
   notify: restart nginx
 
 - name: Install nginx mastodon config
@@ -20,10 +20,10 @@
     dest: /etc/nginx/sites-available/mastodon
   notify: restart nginx
 
-- name: Enable files
+- name: Enable cdn
   file:
-    src: /etc/nginx/sites-available/files
-    dest: /etc/nginx/sites-enabled/files
+    src: /etc/nginx/sites-available/cdn
+    dest: /etc/nginx/sites-enabled/cdn
     state: link
 
 - name: Enable mastodon
@@ -43,13 +43,36 @@
     dest: /etc/nginx/dmca
   notify: restart nginx
 
+- name: Prep SSL directory
+  file:
+    path: /etc/nginx/ssl
+    state: directory
+    owner: www-data
+    group: www-data
+
+- name: Install mastodon domain SSL certificate
+  template:
+    src: domain.fullchain.pem
+    dest: /etc/nginx/ssl/domain.fullchain.pem
+
+- name: Install mastodon domain ssl key
+  template:
+    src: domain.privkey.pem
+    dest: /etc/nginx/ssl/domain.privkey.pem
+
+- name: Install mastodon CDN SSL certificate
+  template:
+    src: cdn.fullchain.pem
+    dest: /etc/nginx/ssl/cdn.fullchain.pem
+
+- name: Install mastodon CDN ssl key
+  template:
+    src: cdn.privkey.pem
+    dest: /etc/nginx/ssl/cdn.privkey.pem
+
 - name: Copy cloudflare
   template:
     src: cloudflare
     dest: /etc/nginx/cloudflare
   notify: restart nginx
 
-- name: install certbot
-  package:
-    name: python3-certbot-nginx
-    state: present
diff --git a/roles/frontend/templates/files.j2 b/roles/frontend/templates/cdn.j2
similarity index 93%
rename from roles/frontend/templates/files.j2
rename to roles/frontend/templates/cdn.j2
index 023a52d..95e69ef 100644
--- a/roles/frontend/templates/files.j2
+++ b/roles/frontend/templates/cdn.j2
@@ -22,8 +22,8 @@ server {
 
   include /etc/nginx/cloudflare;
 
-  ssl_certificate     /etc/letsencrypt/live/{{ ENV_PRODUCTION['S3_ALIAS_HOST'] }}/fullchain.pem;
-  ssl_certificate_key /etc/letsencrypt/live/{{ ENV_PRODUCTION['S3_ALIAS_HOST'] }}/privkey.pem;
+  ssl_certificate     /etc/nginx/ssl/cdn.fullchain.pem;
+  ssl_certificate_key /etc/nginx/ssl/cdn.privkey.pem;
 
   access_log /var/log/nginx/{{ ENV_PRODUCTION['S3_ALIAS_HOST'] }}.access.log files_cache;
   error_log /var/log/nginx/{{ ENV_PRODUCTION['S3_ALIAS_HOST'] }}.error.log;
diff --git a/roles/frontend/templates/mastodon.j2 b/roles/frontend/templates/mastodon.j2
index a1dfc8e..c898618 100644
--- a/roles/frontend/templates/mastodon.j2
+++ b/roles/frontend/templates/mastodon.j2
@@ -36,8 +36,8 @@ server {
   ssl_ciphers HIGH:!MEDIUM:!LOW:!aNULL:!NULL:!SHA; ssl_prefer_server_ciphers on;
   ssl_session_cache shared:SSL:10m;
 
-  ssl_certificate     /etc/letsencrypt/live/{{ ENV_PRODUCTION['LOCAL_DOMAIN'] }}/fullchain.pem;
-  ssl_certificate_key /etc/letsencrypt/live/{{ ENV_PRODUCTION['LOCAL_DOMAIN'] }}/privkey.pem;
+  ssl_certificate     /etc/nginx/ssl/domain.fullchain.pem;
+  ssl_certificate_key /etc/nginx/ssl/domain.privkey.pem;
 
   keepalive_timeout    70;
   sendfile             on;
diff --git a/roles/frontend/vars/main.yml b/roles/frontend/vars/main.yml
index ed97d53..0f1ddf6 100644
--- a/roles/frontend/vars/main.yml
+++ b/roles/frontend/vars/main.yml
@@ -1 +1,9 @@
 ---
+letsencrypt_cert:
+  name: yttrx
+  domains:
+    - masto.yttrx.com
+    - files.yttrx.com
+  challenge: dns
+  services:
+    - nginx