diff --git a/vars/default_vars.yml b/vars/default_vars.yml
index bd6990ad9..4f3ec18a8 100644
--- a/vars/default_vars.yml
+++ b/vars/default_vars.yml
@@ -150,17 +150,36 @@ wan_nameserver:
 # exFAT is auto-enabled for all "debuntu" OS's as of Nov 2017, in roles/2-common/tasks/packages.yml#L35-L36
 # exFAT_enabled: True
 
-# Parameters by Aggregate Roles
-# Each Role must have the following variables which are either True or False:
+# Parameters for Aggregate Roles
+# Each Role should have the following variables which are either True or False:
 #   <role-name>_install
 #   <role-name>_enabled
 
-# Our past convention was to install everything in all aggregates
+# Past convention had been to install everything in all aggregate roles (stages)
 # And to enable everything in 1-PREP, 2-COMMON, and 3-BASE-SERVER
 
 
 # 1-PREP
 
+# sshd
+sshd_enabled: True
+
+# roles/iiab-admin runs here
+# SEE IIAB-ADMIN VARIABLES NEAR TOP OF THIS FILE: e.g. iiab_admin_user_install,
+# iiab_admin_user, iiab_admin_published_pwd, iiab_admin_pwd_hash
+
+# OpenVPN
+openvpn_install: True
+openvpn_enabled: False
+# For /etc/iiab/openvpn_handle
+openvpn_handle: ""
+# cron seems necessary on CentOS:
+openvpn_cron_enabled: False
+# General OpenVPN settings
+openvpn_server: xscenet.net
+openvpn_server_virtual_ip: 10.8.0.1
+openvpn_server_port: 1194
+
 # 2-COMMON
 
 # 3-BASE-SERVER
@@ -169,12 +188,10 @@ wan_nameserver:
 
 # Make this False to disable http://box/common/services/power_off.php button:
 apache_allow_sudo: True
-
-# For schools that use WordPress and/or Moodle intensively. See iiab/iiab #1147
+# For schools that use WordPress and/or Moodle intensively, see iiab/iiab #1147
 # WARNING: Enabling this (might) cause excess use of RAM or other resources?
 apache_high_php_limits: False
-
-# roles/iiab-admin runs here
+# SEE ALSO VARIABLES NEAR TOP OF THIS FILE: default_language, language_priority
 
 # MySQL MANDATORY - THESE SETTINGS HAVE NO EFFECT - SEE roles/1-prep/tasks/computed_vars.yml, roles/mysql/tasks/main.yml
 mysql_install: True
@@ -185,23 +202,6 @@ mysql_root_password: fixmysql
 
 # 4-SERVER-OPTIONS
 
-# sshd
-sshd_enabled: True
-
-# OpenVPN
-openvpn_install: True
-openvpn_enabled: False
-
-# For /etc/iiab/openvpn_handle
-openvpn_handle: ""
-
-# cron seems necessary on CentOS:
-openvpn_cron_enabled: False
-
-openvpn_server: xscenet.net
-openvpn_server_virtual_ip: 10.8.0.1
-openvpn_server_port: 1194
-
 # roles/network runs here (MANY SETTINGS ABOVE)
 
 # Homepage