diff --git a/.gitmodules b/.gitmodules
index 4f747c4..efc6ac1 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -1,3 +1,6 @@
 [submodule "roles/setup_user"]
 	path = roles/do1jlr.win_base_setup
 	url = https://backwesen.de/voc/win_ansible_role_base_setup.git
+[submodule "roles/do1jlr.win_obs_setup"]
+	path = roles/do1jlr.win_obs_setup
+	url = https://backwesen.de/voc/win_ansible_role_obs_setup.git
diff --git a/.yamllint b/.yamllint
new file mode 100644
index 0000000..f69cdd3
--- /dev/null
+++ b/.yamllint
@@ -0,0 +1,14 @@
+---
+extends: default
+
+rules:
+  # 150 chars should be enough, but don't fail if a line is longer
+  line-length:
+    max: 180
+    level: warning
+
+ignore: |
+  host_vars/mail01.l3d.space/vault.yml
+  host_vars/web01.l3d.space/vault.yml
+  group_vars/all/vault.yml
+  roles/
diff --git a/host_vars/obs-chrysalis/vars.yml b/host_vars/obs-chrysalis/vars.yml
index 3bec6e8..56db5ba 100644
--- a/host_vars/obs-chrysalis/vars.yml
+++ b/host_vars/obs-chrysalis/vars.yml
@@ -2,4 +2,4 @@
 ansible_connection: winrm
 ansible_user: ansible
 ansible_winrm_server_cert_validation: ignore
-ansible_password: "{{ lookup('community.general.passwordstore', 'ansible/windows/' + inventory_hostname + '/password') }}"
+ansible_password: "{{ lookup('community.general.passwordstore', 'ansible/windows/' + inventory_hostname + '/login/' + ansible_user) }}"
diff --git a/roles/do1jlr.win_base_setup b/roles/do1jlr.win_base_setup
index 64a25c2..3026ccd 160000
--- a/roles/do1jlr.win_base_setup
+++ b/roles/do1jlr.win_base_setup
@@ -1 +1 @@
-Subproject commit 64a25c272e08feb36d71ec4dccabaee6fe0c04c1
+Subproject commit 3026ccda415fd94d3d2450c9409829537d2e2a14
diff --git a/roles/do1jlr.win_obs_setup b/roles/do1jlr.win_obs_setup
new file mode 160000
index 0000000..c7de037
--- /dev/null
+++ b/roles/do1jlr.win_obs_setup
@@ -0,0 +1 @@
+Subproject commit c7de0373770c894b9b1e07f8794d6d5e8b94a1e2
diff --git a/site.yml b/site.yml
index d5fc01b..3144d4e 100644
--- a/site.yml
+++ b/site.yml
@@ -3,3 +3,4 @@
   hosts: obs
   roles:
     - {role: do1jlr.win_base_setup, tags: [user, setup]}
+    - {role: do1jlr.win_obs_setup, tags: [user, obs]}