diff --git a/README.org b/README.org
new file mode 100644
index 0000000000000000000000000000000000000000..a66ea3db373fda0e88aedc518314f209769c4455
--- /dev/null
+++ b/README.org
@@ -0,0 +1,7 @@
+* Requirements
+Needs Ansible 2.8+, available in Debian buster-backports or newer.
+* Setup
+Fill in bbb_dialin_provider_password and bbb_letsencrypt_email in bigbluebutton.yml
+
+ansible-galaxy install -r requirements.yml
+ansible-playbook -u ubuntu -i some.fqdn, bigbluebutton.yml
diff --git a/bigbluebutton.yml b/bigbluebutton.yml
new file mode 100644
index 0000000000000000000000000000000000000000..9e9e50f4f0e91bc41f892223a7e881fc02afeb52
--- /dev/null
+++ b/bigbluebutton.yml
@@ -0,0 +1,25 @@
+- become: true
+  hosts: all
+  tasks:
+  - apt:
+      update_cache: true
+  - import_role:
+      name: "jnv.unattended-upgrades"
+  - import_role:
+      name: ebbba.bigbluebutton
+    vars:
+      bbb_allow_mail_notifications: false
+      bbb_coturn_secret: "{{ lookup('password', 'credentials/coturn_secret length=50') }}"
+      bbb_dialin_default_number: "+1-718-247-9666"
+      bbb_dialin_enabled: true
+      bbb_dialin_mask_caller: true
+      bbb_dialin_overwrite_footer: true
+      bbb_dialin_provider_extension: '17182479666'
+      bbb_dialin_provider_password: REDACTED
+      bbb_dialin_provider_proxy: sip.jnctn.net
+      bbb_dialin_provider_username: bbb_conservancy
+      bbb_freeswitch_socket_password: "{{ lookup('password', 'credentials/freeswitch_socket_password length=50') }}"
+      bbb_greenlight_db_password: "{{ lookup('password', 'credentials/greenlight_db_password length=50') }}"
+      bbb_greenlight_secret: "{{ lookup('password', 'credentials/greenlight_secret length=50') }}"
+      bbb_hostname: bbb.sfconservancy.org
+      bbb_letsencrypt_email: REDACTED
diff --git a/requirements.yml b/requirements.yml
new file mode 100644
index 0000000000000000000000000000000000000000..5c8dfcef2e17381ce0571e5082dd6652c12b1cb6
--- /dev/null
+++ b/requirements.yml
@@ -0,0 +1,3 @@
+- name: ebbba.bigbluebutton
+- name: "jnv.unattended-upgrades"
+- name: community.general