diff --git a/roles/2-common/tasks/packages.yml b/roles/2-common/tasks/packages.yml
index 35f55f499..89b3bad4e 100644
--- a/roles/2-common/tasks/packages.yml
+++ b/roles/2-common/tasks/packages.yml
@@ -63,10 +63,3 @@
       - usbutils
       - wget
     state: present
-
-# 2019-10-31: roles/kalite crashed without the following python-virtualenv -- weirdly python3-virtualenv was installed on Raspbian (not sure why) but insufficient
-- name: Install package python-virtualenv for KA Lite and Calibre-Web, on older OS's (raspbian-9, raspbian-10, debian-9, debian-10, ubuntu-16, ubuntu-18)
-  package:
-    name: python-virtualenv
-    state: present
-  when: is_raspbian_9 or is_raspbian_10 or is_debian_9 or is_debian_10 or is_ubuntu_16 or is_ubuntu_18
diff --git a/roles/4-server-options/tasks/main.yml b/roles/4-server-options/tasks/main.yml
index 409ebf366..ab3f97da4 100644
--- a/roles/4-server-options/tasks/main.yml
+++ b/roles/4-server-options/tasks/main.yml
@@ -23,28 +23,18 @@
   when: squid_install | bool
   tags: base, squid, network, domain
 
-# until porting is complete
-- name: Install python
-  package: 
-    name: python
-    state: present
-
-- name: Create a Python interface to iiab.env
-  template:
-    src: roles/1-prep/templates/iiab_env.py.j2
-    dest: /etc/iiab/iiab_env.py
-
-- name: Installing captive portal
-  include_tasks: roles/captive-portal/tasks/main.yml
-  when: captive_portal_install | bool
-  tags: base, captive-portal, network, domain
-
 - name: Install Bluetooth - only on Raspberry Pi
   include_role:
     name: bluetooth
   when: is_rpi and bluetooth_install
   tags: bluetooth
 
+- name: USB-LIB
+  include_role:
+    name: usb-lib
+  when: usb_lib_install | bool
+  tags: usb-lib
+
 # NETWORK moved to the very end, after Stage 9 (9-LOCAL-ADDONS)
 # It can also be run manually using: cd /opt/iiab/iiab; ./iiab-network
 #
@@ -67,13 +57,6 @@
   when: postgresql_install | bool
   tags: postgresql, pathagar, moodle
 
-# UNMAINTAINED
-- name: AUTHSERVER
-  include_role:
-    name: authserver
-  when: authserver_install is defined and authserver_install
-  tags: olpc, authserver
-
 - name: CUPS
   include_role:
     name: cups
@@ -86,12 +69,6 @@
   when: samba_install | bool
   tags: samba
 
-- name: USB-LIB
-  include_role:
-    name: usb-lib
-  when: usb_lib_install | bool
-  tags: usb-lib
-
 - name: Run /usr/bin/iiab-refresh-wiki-docs (scraper script) to create http://box/info offline documentation.  (This script was installed at the beginning of Stage 3 = roles/3-base-server/tasks/main.yml, which ran Apache playbook = roles/httpd/tasks/main.yml)
   command: /usr/bin/iiab-refresh-wiki-docs
   when: internet_available and not nodocs
diff --git a/roles/6-generic-apps/tasks/main.yml b/roles/6-generic-apps/tasks/main.yml
index 02a3b8dda..d1b9b8d7f 100644
--- a/roles/6-generic-apps/tasks/main.yml
+++ b/roles/6-generic-apps/tasks/main.yml
@@ -21,6 +21,7 @@
   when: mediawiki_install | bool
   tags: mediawiki
 
+# UNMAINTAINED
 - name: EJABBERD
   include_role:
     name: ejabberd
diff --git a/roles/8-mgmt-tools/tasks/main.yml b/roles/8-mgmt-tools/tasks/main.yml
index 806b24f8f..9536032b8 100644
--- a/roles/8-mgmt-tools/tasks/main.yml
+++ b/roles/8-mgmt-tools/tasks/main.yml
@@ -33,33 +33,12 @@
   when: phpmyadmin_install | bool
   tags: phpmyadmin
 
-# UNMAINTAINED
-- name: SUGAR-STATS
-  include_role:
-    name: sugar-stats
-  when: sugar_stats_install is defined and sugar_stats_install and ansible_distribution != "CentOS"
-  tags: olpc, sugar-stats
-
-# UNMAINTAINED
-- name: TEAMVIEWER
-  include_role:
-    name: teamviewer
-  when: teamviewer_install is defined and teamviewer_install
-  tags: teamviewer
-
 - name: VNSTAT
   include_role:
     name: vnstat
   when: vnstat_install | bool
   tags: vnstat
 
-# UNMAINTAINED
-- name: XOVIS
-  include_role:
-    name: xovis
-  when: xovis_install is defined and xovis_install and ansible_distribution != "CentOS"
-  tags: xovis
-
 - name: Recording STAGE 8 HAS COMPLETED ======================
   lineinfile:
     dest: "{{ iiab_env_file }}"
diff --git a/roles/9-local-addons/tasks/main.yml b/roles/9-local-addons/tasks/main.yml
index aabadd163..4af8db305 100644
--- a/roles/9-local-addons/tasks/main.yml
+++ b/roles/9-local-addons/tasks/main.yml
@@ -9,6 +9,25 @@
   when: internetarchive_install | bool
   tags: internetarchive
 
+# Until porting complete (@jvonau helping transition to Python 3)
+- name: 'Install Python 2.7 packages: python, python-pip'
+  package:
+    name:
+      - python
+      - python-pip    # Used by Admin Console
+    state: present
+
+# Used by iiab-update-map, supplied by osm-vector-maps
+- name: Create a Python interface to iiab.env
+  template:
+    src: roles/1-prep/templates/iiab_env.py.j2
+    dest: /etc/iiab/iiab_env.py
+
+- name: CAPTIVE PORTAL
+  include_tasks: roles/captive-portal/tasks/main.yml
+  when: captive_portal_install | bool
+  tags: base, captive-portal, network, domain
+
 - name: MINETEST
   include_role:
     name: minetest
diff --git a/roles/mysql/tasks/main.yml b/roles/mysql/tasks/main.yml
index 254c29bfc..00925eda0 100644
--- a/roles/mysql/tasks/main.yml
+++ b/roles/mysql/tasks/main.yml
@@ -124,7 +124,7 @@
     enabled: yes
   when: mysql_enabled | bool
 
-- name: Install .my.cnf file from template, with root password credentials, if mysql_enabled
+- name: Install /root/.my.cnf file from template, with root password credentials, if mysql_enabled
   template:
     src: my.cnf.j2
     dest: /root/.my.cnf
diff --git a/scripts/ansible b/scripts/ansible
index 7d60c147c..c967b4f8e 100755
--- a/scripts/ansible
+++ b/scripts/ansible
@@ -74,9 +74,11 @@ elif [ -f /etc/debian_version ]; then    # Includes Debian, Ubuntu & Raspbian
     echo -e '\nIF YOU FACE ERROR "signatures couldn'"'"'t be verified because the public key is not available" THEN REPEATEDLY RE-RUN "sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 93C4A3FD7BB9C367"\n'
     apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 93C4A3FD7BB9C367
 
-    echo -e "\napt update; apt install ansible and python3 dependencies\n"
+    echo -e "\napt update; apt install ansible and python3 dependencies explained at:"
+    echo -e "https://github.com/iiab/iiab/tree/master/scripts/ansible.md\n"
     apt update
-    apt -y --allow-downgrades install ansible python3-distutils python3-mysqldb python3-passlib python3-pip python3-setuptools python3-virtualenv python3-psycopg2
+    apt -y --allow-downgrades install ansible python3-pymysql python3-psycopg2 \
+        python3-passlib python3-pip python3-setuptools virtualenv
 
     echo -e "\nSUCCESS: verify Ansible using 'ansible --version' and/or 'apt -a list ansible'\n\n"
 
@@ -93,7 +95,7 @@ elif [ -f /etc/debian_version ]; then    # Includes Debian, Ubuntu & Raspbian
     echo -e "successfully saved to /etc/apt/sources.list.d/iiab-ansible.list\n"
 
     echo -e "IF *OTHER* ANSIBLE SOURCES APPEAR BELOW, PLEASE MANUALLY REMOVE THEM TO"
-    echo -e "ENSURE ANSIBLE UPDATES CLEANLY: (then re-run this script to be sure!)\n"
+    echo -e 'ENSURE ANSIBLE UPDATES CLEANLY: (then re-run this script to be sure!)\n'
     grep '^deb .*ansible' /etc/apt/sources.list /etc/apt/sources.list.d/*.list | grep -v '^/etc/apt/sources.list.d/iiab-ansible.list:' || true    # Override bash -e (instead of aborting at 1st error)
 else
     echo -e "\nEXITING: Could not detect your OS (unsupported?)\n"
diff --git a/scripts/ansible-2.8.x b/scripts/ansible-2.8.x
index f789c965f..b80d0c2b6 100755
--- a/scripts/ansible-2.8.x
+++ b/scripts/ansible-2.8.x
@@ -74,9 +74,12 @@ elif [ -f /etc/debian_version ]; then    # Includes Debian, Ubuntu & Raspbian
     echo -e '\nIF YOU FACE ERROR "signatures couldn'"'"'t be verified because the public key is not available" THEN REPEATEDLY RE-RUN "sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 93C4A3FD7BB9C367"\n'
     apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 93C4A3FD7BB9C367
 
-    echo -e "\napt update; apt install ansible and python3 dependencies\n"
+    echo -e "\napt update; apt install ansible and python3 dependencies explained at:"
+    echo -e "https://github.com/iiab/iiab/tree/master/scripts/ansible.md\n"
     apt update
-    apt -y --allow-downgrades install ansible python3-distutils python3-mysqldb python3-passlib python3-pip python3-setuptools python3-virtualenv python3-psycopg2
+    apt -y --allow-downgrades install ansible python3-pymysql python3-psycopg2 \
+        python3-passlib python3-pip python3-setuptools virtualenv
+
     echo -e "\nSUCCESS: verify Ansible using 'ansible --version' and/or 'apt -a list ansible'\n\n"
 
     # TEMPORARILY USE ANSIBLE 2.4.4 (REMOVE IT WITH "pip uninstall ansible")
@@ -92,7 +95,7 @@ elif [ -f /etc/debian_version ]; then    # Includes Debian, Ubuntu & Raspbian
     echo -e "successfully saved to /etc/apt/sources.list.d/iiab-ansible.list\n"
 
     echo -e "IF *OTHER* ANSIBLE SOURCES APPEAR BELOW, PLEASE MANUALLY REMOVE THEM TO"
-    echo -e "ENSURE ANSIBLE UPDATES CLEANLY: (then re-run this script to be sure!)\n"
+    echo -e 'ENSURE ANSIBLE UPDATES CLEANLY: (then re-run this script to be sure!)\n'
     grep '^deb .*ansible' /etc/apt/sources.list /etc/apt/sources.list.d/*.list | grep -v '^/etc/apt/sources.list.d/iiab-ansible.list:' || true    # Override bash -e (instead of aborting at 1st error)
 else
     echo -e "\nEXITING: Could not detect your OS (unsupported?)\n"
diff --git a/scripts/ansible-2.9.x b/scripts/ansible-2.9.x
index f33f00960..ee7e16ea9 100755
--- a/scripts/ansible-2.9.x
+++ b/scripts/ansible-2.9.x
@@ -74,9 +74,12 @@ elif [ -f /etc/debian_version ]; then    # Includes Debian, Ubuntu & Raspbian
     echo -e '\nIF YOU FACE ERROR "signatures couldn'"'"'t be verified because the public key is not available" THEN REPEATEDLY RE-RUN "sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 93C4A3FD7BB9C367"\n'
     apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 93C4A3FD7BB9C367
 
-    echo -e "\napt update; apt install ansible and python3 dependencies\n"
+    echo -e "\napt update; apt install ansible and python3 dependencies explained at:"
+    echo -e "https://github.com/iiab/iiab/tree/master/scripts/ansible.md\n"
     apt update
-    apt -y --allow-downgrades install ansible python3-distutils python3-mysqldb python3-passlib python3-pip python3-setuptools python3-virtualenv python3-psycopg2
+    apt -y --allow-downgrades install ansible python3-pymysql python3-psycopg2 \
+        python3-passlib python3-pip python3-setuptools virtualenv
+
     echo -e "\nSUCCESS: verify Ansible using 'ansible --version' and/or 'apt -a list ansible'\n\n"
 
     # TEMPORARILY USE ANSIBLE 2.4.4 (REMOVE IT WITH "pip uninstall ansible")
@@ -92,7 +95,7 @@ elif [ -f /etc/debian_version ]; then    # Includes Debian, Ubuntu & Raspbian
     echo -e "successfully saved to /etc/apt/sources.list.d/iiab-ansible.list\n"
     
     echo -e "IF *OTHER* ANSIBLE SOURCES APPEAR BELOW, PLEASE MANUALLY REMOVE THEM TO"
-    echo -e "ENSURE ANSIBLE UPDATES CLEANLY: (then re-run this script to be sure!)\n"
+    echo -e 'ENSURE ANSIBLE UPDATES CLEANLY: (then re-run this script to be sure!)\n'
     grep '^deb .*ansible' /etc/apt/sources.list /etc/apt/sources.list.d/*.list | grep -v '^/etc/apt/sources.list.d/iiab-ansible.list:' || true    # Override bash -e (instead of aborting at 1st error)
 else
     echo -e "\nEXITING: Could not detect your OS (unsupported?)\n"
diff --git a/scripts/ansible.md b/scripts/ansible.md
new file mode 100644
index 000000000..4aff4b213
--- /dev/null
+++ b/scripts/ansible.md
@@ -0,0 +1,29 @@
+Please read "What is Ansible and what version should I use?" at [http://FAQ.IIAB.IO](http://FAQ.IIAB.IO)
+
+Read https://github.com/iiab/iiab/wiki/IIAB-Contributors-Guide#ansible to learn more about how IIAB uses Ansible.
+
+Starting in November 2019, IIAB's Ansible installer ([/opt/iiab/iiab/scripts/ansible](https://github.com/iiab/iiab/blob/master/scripts/ansible)) began installing these python3-* apt packages, in support of the following Ansible modules:
+
+1. Ansible module: [pip](https://docs.ansible.com/ansible/latest/modules/pip_module.html)
+
+   IIAB installs apt packages:
+   - **python3-pip** (for IIAB's [Admin Console](https://github.com/iiab/iiab-admin-console))
+   - **python3-setuptools**
+   - **virtualenv** (is Python 3 only, for [roles/kalite](https://github.com/iiab/iiab/tree/master/roles/kalite) & [roles/calibre-web](https://github.com/iiab/iiab/tree/master/roles/calibre-web) ?) and pulls in additional packages... (`apt show virtualenv` shows "Depends: python3, python3-virtualenv")
+      - **python3-virtualenv** and pulls in additional package... (`apt show python3-virtualenv` shows "Depends: python-pip-whl (>= 8.1.1-2), python3, python3-distutils, python3-pkg-resources") 
+         - **python3-distutils**
+
+2. Ansible modules: [mysql_db](https://docs.ansible.com/ansible/latest/modules/mysql_db_module.html) and [mysql_user](https://docs.ansible.com/ansible/latest/modules/mysql_user_module.html) (for [roles/mysql](https://github.com/iiab/iiab/tree/master/roles/mysql))
+
+   IIAB installs apt package:
+   - **python3-pymysql** (see sudo's password-changing failure [iiab/iiab#1714](https://github.com/iiab/iiab/issues/1714) and [ansible/ansible#47736](https://github.com/ansible/ansible/issues/47736))
+
+3. Ansible modules: [postgresql_db](https://docs.ansible.com/ansible/latest/modules/postgresql_db_module.html) and [postgresql_dbuser](https://docs.ansible.com/ansible/latest/modules/postgresql_user_module.html)
+
+   IIAB installs apt package:
+   - **python3-psycopg2** (for [roles/moodle](https://github.com/iiab/iiab/tree/master/roles/moodle))
+
+4. Ansible module: [htpasswd](https://docs.ansible.com/ansible/latest/modules/htpasswd_module.html)
+
+   IIAB installs apt package:
+   - **python3-passlib** (for [roles/munin](https://github.com/iiab/iiab/tree/master/roles/munin))
diff --git a/vars/default_vars.yml b/vars/default_vars.yml
index cb62c15a1..4e612a776 100644
--- a/vars/default_vars.yml
+++ b/vars/default_vars.yml
@@ -316,6 +316,7 @@ dokuwiki_enabled: False
 mediawiki_install: False
 mediawiki_enabled: False
 
+# Unmaintained as of November 2019
 ejabberd_install: False
 ejabberd_enabled: False
 
@@ -538,10 +539,6 @@ calibreweb_home: "{{ content_base }}/calibre-web"    # /library/calibre-web
 # =============================================================================
 # UNMAINTAINED LEGACY VARIABLES: YOU'RE TAKING BIG RISKS IF YOU USE ANY HERE...
 
-# Unmaintained
-# authserver_install: False
-# authserver_enabled: False
-
 # CONSIDER THESE NEW OPENSTREETMAP (OSM) APPROACHES INSTEAD:
 #
 # 2019: https://github.com/iiab/iiab/wiki/IIAB-Maps SEE ABOVE osm_vector_maps_*
@@ -559,9 +556,13 @@ calibreweb_home: "{{ content_base }}/calibre-web"    # /library/calibre-web
 # docker_install: False
 # docker_enabled: False
 
-# THOSE ABOVE WERE STILL OCCASIONALLY USED AS OF SEPTEMBER 2019.
+# THOSE ABOVE WERE STILL OCCASIONALLY USED AS OF NOVEMBER 2019.
 # =============================================================================
-# THOSE BELOW WERE *NOT* USED FOR YEARS, AS OF SEPTEMBER 2019.
+# THOSE BELOW WERE *NOT* USED FOR YEARS, AS OF NOVEMBER 2019.
+
+# Unmaintained
+# authserver_install: False
+# authserver_enabled: False
 
 # Unmaintained (better to install from http://teamviewer.com or prep scripts at http://download.iiab.io)
 # teamviewer_install: False
diff --git a/vars/local_vars_big.yml b/vars/local_vars_big.yml
index 8f316cf40..ef2b9f4e1 100644
--- a/vars/local_vars_big.yml
+++ b/vars/local_vars_big.yml
@@ -209,6 +209,7 @@ dokuwiki_enabled: True
 mediawiki_install: True
 mediawiki_enabled: True
 
+# Unmaintained as of November 2019
 ejabberd_install: False
 ejabberd_enabled: False
 
diff --git a/vars/local_vars_medium.yml b/vars/local_vars_medium.yml
index 86af15027..4afe19d52 100644
--- a/vars/local_vars_medium.yml
+++ b/vars/local_vars_medium.yml
@@ -209,6 +209,7 @@ dokuwiki_enabled: False
 mediawiki_install: False
 mediawiki_enabled: False
 
+# Unmaintained as of November 2019
 ejabberd_install: False
 ejabberd_enabled: False
 
diff --git a/vars/local_vars_min.yml b/vars/local_vars_min.yml
index 65371faff..a92ce2e27 100644
--- a/vars/local_vars_min.yml
+++ b/vars/local_vars_min.yml
@@ -209,6 +209,7 @@ dokuwiki_enabled: False
 mediawiki_install: False
 mediawiki_enabled: False
 
+# Unmaintained as of November 2019
 ejabberd_install: False
 ejabberd_enabled: False