diff --git a/roles/2-common/tasks/packages.yml b/roles/2-common/tasks/packages.yml
index 2b8f32d55..81bc35c94 100644
--- a/roles/2-common/tasks/packages.yml
+++ b/roles/2-common/tasks/packages.yml
@@ -30,6 +30,8 @@
       #- openssh-server    # ssh (Raspbian) or openssh-server (other OS's) already installed by 1-prep's roles/sshd/tasks/main.yml
       - pandoc             # For /usr/bin/iiab-refresh-wiki-docs
       - pastebinit         # For /usr/bin/iiab-diagnostics
+      #- python3-pip       # 2021-07-29: Already installed by /opt/iiab/iiab/scripts/ansible -- this auto-installs 'python3-setuptools' and 'python3' etc
+      #- python3-venv      # 2021-07-30: For Ansible module 'pip' used in roles like {calibre-web, jupyterhub, lokole} -- whereas roles/kalite uses (virtual) package 'virtualenv' for Python 2 -- all these 3+1 IIAB roles install 'python3-venv' for themselves.  FYI: Debian 11 auto-installs 'python3-venv' when you install 'python3' -- whereas Ubuntu (e.g. 20.04 & 21.10) and RaspiOS 10 do not.
       - rsync
       #- screen            # Installed by 1-prep's roles/iiab-admin/tasks/access.yml
       - sqlite3
diff --git a/roles/calibre-web/tasks/install.yml b/roles/calibre-web/tasks/install.yml
index 7fc422397..0e8a88122 100644
--- a/roles/calibre-web/tasks/install.yml
+++ b/roles/calibre-web/tasks/install.yml
@@ -1,4 +1,4 @@
-- name: "Install ImageMagick package: imagemagick"
+- name: "Install packages: imagemagick, python3-venv"
   package:
     name:
       - imagemagick
diff --git a/roles/jupyterhub/tasks/install.yml b/roles/jupyterhub/tasks/install.yml
index f33d05191..1f71ba454 100644
--- a/roles/jupyterhub/tasks/install.yml
+++ b/roles/jupyterhub/tasks/install.yml
@@ -13,6 +13,11 @@
   when: nodejs_installed is undefined
 
 
+- name: "Install package: python3-venv"
+  package:
+    name: python3-venv
+    state: present
+
 - name: Make 3 directories to hold JupyterHub config
   file:
     state: directory
@@ -40,8 +45,8 @@
       - jupyterhub-systemdspawner
     virtualenv: "{{ jupyterhub_venv }}"    # /opt/iiab/jupyterhub
     virtualenv_site_packages: no
-    virtualenv_command: /usr/bin/virtualenv
-    virtualenv_python: python3
+    virtualenv_command: python3 -m venv "{{ jupyterhub_venv }}"    # 2021-07-29: This works on RaspiOS 10, Debian 11, Ubuntu 20.04 and Mint 20 -- however if you absolutely must use the older Debian 10 -- you can work around errors "can't find Rust compiler" and "This package requires Rust >=1.41.0" if you (1) revert this line to 'virtualenv_command: virtualenv' AND (2) uncomment the line just below
+    #virtualenv_python: python3    # 2021-07-29: Was needed when above line was 'virtualenv_command: virtualenv' (generally for Python 2)
     extra_args: "--no-cache-dir"
   when: internet_available
 
diff --git a/roles/kalite/tasks/install.yml b/roles/kalite/tasks/install.yml
index fe3b812b8..df85a2140 100644
--- a/roles/kalite/tasks/install.yml
+++ b/roles/kalite/tasks/install.yml
@@ -11,13 +11,14 @@
 #  ignore_errors: yes
 #  when: is_raspbian
 
-- name: Install python2, if Raspbian/Debian > 10 or Ubuntu > 19
+- name: 'Install packages: python2, python-setuptools, virtualenv (for Python 2)'
   package:
     name:
       - python2
-      - python-setuptools # provides setuptools-44 last version compatible with python2
+      - python-setuptools    # Provides setuptools-44 on recent OS's (last version compatible with python2)
+      - virtualenv           # For Ansible module 'pip' when used with 'virtualenv_command: /usr/bin/virtualenv' and 'virtualenv_python: python2.7' -- compare package 'python3-venv' used by roles {calibre-web, jupyterhub, lokole}
     state: present
-  when: not (is_debian_9 or is_debian_10 or is_ubuntu_16 or is_ubuntu_17 or is_ubuntu_18 or is_ubuntu_19)
+  #when: not (is_debian_9 or is_debian_10 or is_ubuntu_16 or is_ubuntu_17 or is_ubuntu_18 or is_ubuntu_19)
   # 2020-03-31: Testing for {is_raspbian_9, is_raspbian_10} is not currently nec, as testing for {is_debian_9, is_debian_10} covers that already.
 
 - name: Use pip to pin setuptools to 44 in {{ kalite_venv }} if Raspbian/Debian > 10 or Ubuntu > 19
diff --git a/roles/munin/tasks/install.yml b/roles/munin/tasks/install.yml
index 0e7af8fe4..7d439ff5a 100644
--- a/roles/munin/tasks/install.yml
+++ b/roles/munin/tasks/install.yml
@@ -1,11 +1,12 @@
-- name: "Install 4 packages: munin, munin-node, munin-plugins-extra, libcgi-fast-perl"
+- name: "Install 5 packages: libcgi-fast-perl, munin, munin-node, munin-plugins-extra, python3-passlib"
   package:
     name:
+      #- libapache2-mod-fcgid
+      - libcgi-fast-perl
       - munin
       - munin-node
       - munin-plugins-extra
-      - libcgi-fast-perl
-      #- libapache2-mod-fcgid
+      - python3-passlib    # For Ansible module 'htpasswd' in Ansible collection community.general -- used just below
     state: present
 
 - name: Establish username/password Admin/changeme in /etc/munin/munin-htpasswd
diff --git a/roles/mysql/tasks/install.yml b/roles/mysql/tasks/install.yml
index 0dc338bd3..6788c4e9e 100644
--- a/roles/mysql/tasks/install.yml
+++ b/roles/mysql/tasks/install.yml
@@ -12,6 +12,7 @@
       - mariadb-client
       #- php{{ php_version }}-common    # Auto-installed as an apt dependency.  REGARDLESS: php{{ php_version }}-common superset php{{ php_version }}-cli is auto-installed by php{{ php_version }}-fpm in nginx/tasks/install.yml
       - php{{ php_version }}-mysql      # Likewise installed in nextcloud/tasks/install.yml, pbx/tasks/freepbx_dependencies.yml, wordpress/tasks/install.yml
+      - python3-pymysql                 # For Ansible modules {mysql_db, mysql_user} in Ansible collection community.mysql -- used in MySQL roles {mediawiki, nextcloud, wordpress} and possibly {elgg, pbx}
     state: present
 
 # 2020-07-11:
diff --git a/roles/nodejs/tasks/install.yml b/roles/nodejs/tasks/install.yml
index 33039d899..c3ff5f98b 100644
--- a/roles/nodejs/tasks/install.yml
+++ b/roles/nodejs/tasks/install.yml
@@ -7,11 +7,12 @@
 # 2019-07-04: FOR A SOMEWHAT MORE MODERN "VERSION DETECTOR" SEE:
 # github.com/iiab/iiab/blob/master/roles/nextcloud/tasks/install.yml#L1-L40
 
-- name: Try to run 'nodejs -v' to get Node.js version
-  # 'node -v' doesn't work with older versions e.g. Ubuntu 16.04's nodejs 4.2.6
+- name: Try to run 'node -v' to get Node.js version
+  # 'node -v' doesn't work with older versions e.g. Ubuntu 16.04's Node.js 4.2.6
+  # 'nodejs -v' doesn't work with newer versions e.g. Node.js 16.x
   # Both below convert v10.15.1 to 10.x, but this is safer: (removes non-digits)
-  shell: nodejs -v | sed 's/[^0-9]*//' | sed 's/[^0-9].*/.x/'
-  #shell: nodejs -v | sed 's/^[vV]//' | sed 's/\..*/.x/'
+  shell: node -v | sed 's/[^0-9]*//' | sed 's/[^0-9].*/.x/'
+  #shell: node -v | sed 's/^[vV]//' | sed 's/\..*/.x/'
   register: nodejs_version_installed
 
 #- debug:
@@ -32,12 +33,13 @@
 #      /etc/iiab/local_vars.yml -- then re-run this IIAB installer.
 #  when: nodejs_version_installed is defined and nodejs_version_installed.stdout != nodejs_version and nodejs_version_installed.stderr == ""
 
+# 2021-08-04: Regardless, nodesource.com (below) overwrites /etc/apt/sources.list.d/nodesource.list
 # Forces < 16.x or > 16.x to be removed, ignored if file is absent
-- name: Remove /etc/apt/sources.list.d/nodesource.list if nodejs_version_installed.stdout is not {{ nodejs_version }}
-  file:
-    state: absent
-    path: /etc/apt/sources.list.d/nodesource.list
-  when: nodejs_version_installed is defined and nodejs_version_installed.stdout != nodejs_version and nodejs_version_installed.stdout != ""
+#- name: Remove /etc/apt/sources.list.d/nodesource.list if nodejs_version_installed.stdout is not {{ nodejs_version }}
+#  file:
+#    state: absent
+#    path: /etc/apt/sources.list.d/nodesource.list
+#  when: nodejs_version_installed is defined and nodejs_version_installed.stdout != nodejs_version and nodejs_version_installed.stdout != ""
 
 # BRUTAL but ensures consistency across OS's / distros like Raspbian Desktop & Ubermix that often include an older version of Node.js
 # Forces < 16.x or > 16.x to be uninstalled
@@ -45,9 +47,9 @@
   package:
     name: nodejs
     state: absent
-  when: nodejs_version_installed is defined and nodejs_version_installed.stdout != nodejs_version and nodejs_version_installed.stdout != ""
+  when: nodejs_version_installed is defined and nodejs_version_installed.stdout != nodejs_version
+  #when: nodejs_version_installed is defined and nodejs_version_installed.stdout != nodejs_version and nodejs_version_installed.stdout != ""
 
-# Forces == 16.x
 - name: Warn if Node.js {{ nodejs_version}} already installed & might be updated
   debug:
     msg: "WARN: YOUR Node.js {{ nodejs_version }} MIGHT NOW BE UPDATED USING nodesource.com"
@@ -65,12 +67,12 @@
 #    state: absent
 #  when: internet_available and is_debuntu
 
-- name: Set up Node.js {{ nodejs_version }} apt sources
+- name: Run 'curl -sL https://deb.nodesource.com/setup_{{ nodejs_version }} | bash -' to overwrite /etc/apt/sources.list.d/nodesource.list
   shell: curl -sL https://deb.nodesource.com/setup_{{ nodejs_version }} | bash -
-  args:
-    warn: no
-    creates: /etc/apt/sources.list.d/nodesource.list
-  when: internet_available
+  #args:
+  #  warn: no
+  #  creates: /etc/apt/sources.list.d/nodesource.list
+  #when: internet_available    # 2021-08-04: Better to fail & notify implementer!
   #when: internet_available and (is_debian_8 or is_debian_9 or is_ubuntu_16 or is_ubuntu_17)
   # NOT NEC TO TEST FOR is_raspbian_8 OR is_raspbian_9 AS /opt/iiab/iiab/vars/<OS>.yml
   # DEFINES THESE AS SUBSETS OF is_debian_8 OR is_debian_9 (FOR NOW!)
@@ -86,15 +88,9 @@
     name: nodejs
     state: latest
     #state: present
-  when: internet_available
+  #when: internet_available    # 2021-08-04: Better to fail & notify implementer!
   #when: internet_available and (is_debian_8 or is_debian_9 or is_ubuntu_16 or is_ubuntu_17)
 
-# - name: Set up & install Node.js {{ nodejs_version }} which includes /usr/bin/npm (redhat)
-#   shell: curl -sL https://rpm.nodesource.com/setup_{{ nodejs_version }} | bash -
-#   args:
-#     warn: no
-#   when: internet_available and is_redhat
-
 
 # 2018-07-14: BOTH STEPS ABOVE TAKE TIME, but Raspbian (apt offers npm
 # 1.4.21) & Debian 9 (apt offers no npm!) STILL NEED the above
diff --git a/roles/openvpn/tasks/install.yml b/roles/openvpn/tasks/install.yml
index 4276c19b6..f876ecc99 100644
--- a/roles/openvpn/tasks/install.yml
+++ b/roles/openvpn/tasks/install.yml
@@ -1,18 +1,12 @@
-- name: "Install packages: nmap, openvpn, sudo"
+- name: "Install packages: ncat, nmap, openvpn, sudo"
   package:
     name:
+      - ncat    # Newer versions of NMap do not include NCat, needed to announce /etc/iiab/openvpn_handle (if Debian > 9 or Ubuntu > 18)
       - nmap
       - openvpn
       - sudo    # (1) Should be installed prior to installing IIAB, (2) Can also be installed by 1-prep here, (3) Is definitely installed by 1-prep's roles/iiab-admin/tasks/sudo-prereqs.yml, (4) Used to be installed by roles/2-common/tasks/packages.yml (but that's too late!)
     state: present
 
-# Newer versions of NMap do not include NCat, needed to announce /etc/iiab/openvpn_handle
-- name: Install Ncat package (if Debian > 9 or Ubuntu > 18)
-  package:
-    name: ncat
-    state: present
-  when: is_debuntu and not (is_debian_8 or is_debian_9 or is_ubuntu_16 or is_ubuntu_17 or is_ubuntu_18)
-
 - name: Install ssh public keys for remote support (if openvpn_install)
   lineinfile:
     line: "{{ item.pubkey }}"
diff --git a/roles/pbx/tasks/asterisk.yml b/roles/pbx/tasks/asterisk.yml
index 2048ccc8a..1ecc5feae 100644
--- a/roles/pbx/tasks/asterisk.yml
+++ b/roles/pbx/tasks/asterisk.yml
@@ -2,10 +2,10 @@
 #- name: Asterisk - Install dependencies
 #  include: asterisk_dependencies.yml
 
-- name: Asterisk - Download software to {{ downloads_dir }}
+- name: Asterisk - Download {{ asterisk_url }}/{{ asterisk_src_file }} to {{ downloads_dir }}
   get_url:
     url: "{{ asterisk_url }}/{{ asterisk_src_file }}"
-    dest: "{{ downloads_dir }}/{{ asterisk_src_file }}"    # e.g. /opt/iiab/downloads/asterisk-18-current.tar.gz
+    dest: "{{ downloads_dir }}"    # e.g. /opt/iiab/downloads/asterisk-18-current.tar.gz
     timeout: "{{ download_timeout }}"
   when: internet_available
 
@@ -16,15 +16,15 @@
 
 - name: Asterisk - FAIL (force Ansible to exit) IF {{ downloads_dir }}/{{ asterisk_src_file }} doesn't exist
   fail:
-    msg: "{{ downloads_dir }}/{{ asterisk_src_file }} is REQUIRED in order to install."
+    msg: "{{ downloads_dir }}/{{ asterisk_src_file }} is REQUIRED to install Asterisk."
   when: not asterisk_src.stat.exists
 
-- name: Asterisk - Create install source dir {{ asterisk_src_dir }}
+- name: Asterisk - Create source dir {{ asterisk_src_dir }}
   file:
     path: "{{ asterisk_src_dir }}"    # /opt/iiab/asterisk
     state: directory
 
-- name: Asterisk - Extract source
+- name: Asterisk - Extract to source dir (root:root)
   unarchive:
     src: "{{ downloads_dir }}/{{ asterisk_src_file }}"
     dest: "{{ asterisk_src_dir }}"
@@ -33,6 +33,7 @@
     extra_opts: [--strip-components=1]
     creates: "{{ asterisk_src_dir }}/Makefile"
 
+
 # 2021-08-03: Asterisk's install_prereq script (stanza just below) installs
 # 'aptitude' regardless, within handle_debian() here:
 # https://github.com/asterisk/asterisk/blob/master/contrib/scripts/install_prereq#L262-L271
@@ -54,7 +55,7 @@
     chdir: "{{ asterisk_src_dir }}"
     creates: addons/mp3/mpg123.h
 
-- name: Asterisk - Run the configure script
+- name: Asterisk - Run './configure --with-jansson-bundled'
   command: ./configure --with-jansson-bundled
   args:
     chdir: "{{ asterisk_src_dir }}"
@@ -101,6 +102,7 @@
   args:
     chdir: "{{ asterisk_src_dir }}"
 
+
 - name: Asterisk - Ensure group 'asterisk' exists
   group:
     name: asterisk
diff --git a/roles/pbx/tasks/chan_dongle.yml b/roles/pbx/tasks/chan_dongle.yml
index 5cef9861f..d9dab0d0d 100644
--- a/roles/pbx/tasks/chan_dongle.yml
+++ b/roles/pbx/tasks/chan_dongle.yml
@@ -1,49 +1,50 @@
-- name: chan_dongle - Download software to /opt/iiab/downloads
+- name: chan_dongle - Download {{ chan_dongle_url }}/{{ chan_dongle_src_file }} to {{ downloads_dir }}
   get_url:
-    url: "{{ chan_dongle_url }}/{{ chan_dongle_src_file }}"
-    dest: "{{ downloads_dir }}/{{ chan_dongle_src_file }}"
+    url: "{{ chan_dongle_url }}/{{ chan_dongle_src_file }}"    # /opt/iiab/downloads/master.zip
+    dest: "{{ downloads_dir }}/{{ chan_dongle_src_file }}"     # Keep name as "master.zip" whereas browsers rename it to asterisk-chan-dongle-master.zip
     timeout: "{{ download_timeout }}"
   when: internet_available
 
-- name: chan_dongle - Check for /opt/iiab/downloads/{{ chan_dongle_src_file }}
+- name: chan_dongle - Check for {{ downloads_dir }}/{{ chan_dongle_src_file }}
   stat:
     path: "{{ downloads_dir }}/{{ chan_dongle_src_file }}"
   register: chan_dongle_src
 
 - name: chan_dongle - FAIL (force Ansible to exit) IF /opt/iiab/downloads/{{ chan_dongle_src_file }} doesn't exist
   fail:
-    msg: "{ downloads_dir }}/{{ chan_dongle_src_file }} is REQUIRED in order to install."
+    msg: "{ downloads_dir }}/{{ chan_dongle_src_file }} is REQUIRED to install chan_dongle."
   when: not chan_dongle_src.stat.exists
 
-- name: chan_dongle - Create install source directory
+- name: chan_dongle - Create source dir {{ chan_dongle_src_dir }}
   file: 
-    path: "{{ chan_dongle_src_dir }}"
+    path: "{{ chan_dongle_src_dir }}"    # /opt/iiab/chan_dongle
     state: directory
 
-- name: chan_dongle - Extract source
+- name: chan_dongle - Extract to {{ downloads_dir }} (root:root)
   unarchive: 
     src: "{{ downloads_dir }}/{{ chan_dongle_src_file }}"
     dest: "{{ downloads_dir }}"
     owner: root
     group: root
 
-- name: chan_dongle - move to {{ chan_dongle_src_dir }}
+- name: chan_dongle - Run 'rsync -av {{ downloads_dir }}/asterisk-chan-dongle-master/ {{ chan_dongle_src_dir }}'
   command: rsync -av {{ downloads_dir }}/asterisk-chan-dongle-master/ {{ chan_dongle_src_dir }}
   args:
     chdir: "{{ downloads_dir }}"
 
-- name: chan_dongle - Run the bootstrap script
-  command: "./bootstrap"
+
+- name: chan_dongle - Run './bootstrap'
+  command: ./bootstrap
   args:
     chdir: "{{ chan_dongle_src_dir }}"
     creates: "{{ chan_dongle_src_dir }}/configure"
 
-- name: chan_dongle - Find out asterisk version
-  shell: asterisk -V |cut -d " " -f 2
+- name: chan_dongle - Run 'asterisk -V | cut -d " " -f 2' for asterisk_ver
+  shell: asterisk -V | cut -d " " -f 2
   register: asterisk_ver
 
-- name: chan_dongle - Run the configure script
-  command: "./configure --with-astversion={{asterisk_ver.stdout}}"
+- name: chan_dongle - Run './configure --with-astversion={{ asterisk_ver.stdout }}'
+  command: ./configure --with-astversion={{ asterisk_ver.stdout }}
   args:
     chdir: "{{ chan_dongle_src_dir }}"
     creates: "{{ chan_dongle_src_dir }}/Makefile"
@@ -60,9 +61,8 @@
     chdir: "{{ chan_dongle_src_dir }}"
     creates: "/usr/lib/asterisk/modules/chan_dongle.so"
 
-- name: chan_dongle - Copy dongle.conf over
+- name: chan_dongle - Run 'cp {{ chan_dongle_src_dir }}/etc/dongle.conf /etc/asterisk/'
   command: cp {{ chan_dongle_src_dir }}/etc/dongle.conf /etc/asterisk/
   args:
     chdir: "{{ chan_dongle_src_dir }}"
     creates: "/etc/asterisk/dongle.conf"
-
diff --git a/roles/pbx/tasks/enable-or-disable.yml b/roles/pbx/tasks/enable-or-disable.yml
index 53d83fd9f..e60921b59 100644
--- a/roles/pbx/tasks/enable-or-disable.yml
+++ b/roles/pbx/tasks/enable-or-disable.yml
@@ -1,18 +1,29 @@
-- name: Enable & (Re)start 'asterisk' systemd service (if pbx_enabled)
-  systemd:
-    daemon_reload: yes
-    name: asterisk
-    enabled: yes
-    state: restarted
-  when: pbx_enabled
+# 2021-08-04: Stanza below commonly causes systemd error "Asterisk is already
+# running.  /etc/init.d/asterisk will exit now" (initial installs especially?)
+#
+# But without this stanza, 'systemctl restart freepbx' all alone during initial
+# install ALSO fails to start Asterisk reliably, on Ubuntu 20.04 & Debian 11 :/
+#
+# Yes /etc/systemd/system/freepbx.service is supposed to run 'fwconsole stop'
+# then 'fwconsole start' reliably, as many web posts recommend, But No Dice!
+#
+# Do we need something like 'RestartSec=3' in freepbx.service ??
+#
+#- name: Enable & (Re)start 'asterisk' systemd service (if pbx_enabled)
+#  systemd:
+#    daemon_reload: yes
+#    name: asterisk
+#    enabled: yes
+#    state: restarted
+#  when: pbx_enabled
 
-- name: Disable & Stop 'asterisk' systemd service (if not pbx_enabled)
-  systemd:
-    daemon_reload: yes
-    name: asterisk
-    enabled: no
-    state: stopped
-  when: not pbx_enabled
+#- name: Disable & Stop 'asterisk' systemd service (if not pbx_enabled)
+#  systemd:
+#    daemon_reload: yes
+#    name: asterisk
+#    enabled: no
+#    state: stopped
+#  when: not pbx_enabled
 
 
 - name: Enable & (Re)start 'freepbx' systemd service (if pbx_enabled)
diff --git a/roles/pbx/tasks/freepbx.yml b/roles/pbx/tasks/freepbx.yml
index 570da4bf1..586df3be6 100644
--- a/roles/pbx/tasks/freepbx.yml
+++ b/roles/pbx/tasks/freepbx.yml
@@ -1,10 +1,10 @@
 - name: FreePBX - Install dependencies
   include: freepbx_dependencies.yml
 
-- name: FreePBX - Download software to {{ downloads_dir }}/{{ freepbx_src_file }}
+- name: FreePBX - Download {{ freepbx_url }}/{{ freepbx_src_file }} to {{ downloads_dir }}
   get_url:
     url: "{{ freepbx_url }}/{{ freepbx_src_file }}"
-    dest: "{{ downloads_dir }}/{{ freepbx_src_file }}"    # e.g. /opt/iiab/downloads/freepbx-16.0-latest.tgz
+    dest: "{{ downloads_dir }}"    # e.g. /opt/iiab/downloads/freepbx-16.0-latest.tgz
     timeout: "{{ download_timeout }}"
   when: internet_available
 
@@ -15,15 +15,15 @@
 
 - name: FreePBX - FAIL (force Ansible to exit) IF {{ downloads_dir }}/{{ freepbx_src_file }} doesn't exist
   fail:
-    msg: "{ downloads_dir }}/{{ freepbx_src_file }} is REQUIRED in order to install."
+    msg: "{{ downloads_dir }}/{{ freepbx_src_file }} is REQUIRED to install FreePBX."
   when: not freepbx_src.stat.exists
 
-- name: FreePBX - Create install source dir {{ freepbx_src_dir }}
+- name: FreePBX - Create source dir {{ freepbx_src_dir }}
   file:
     path: "{{ freepbx_src_dir }}"    # /opt/iiab/freepbx
     state: directory
 
-- name: FreePBX - Extract source
+- name: FreePBX - Extract to source dir (root:root)
   unarchive:
     src: "{{ downloads_dir }}/{{ freepbx_src_file }}"
     dest: "{{ freepbx_src_dir }}"
@@ -32,15 +32,18 @@
     extra_opts: [--strip-components=1]
     creates: "{{ freepbx_src_dir }}/install"
 
-- name: FreePBX - Patch FreePBX source - IIAB Bug 1685
-  patch:
-    src: roles/pbx/templates/71-freepbx-framework.patch
-    dest: "{{ freepbx_src_dir }}/amp_conf/htdocs/admin/libraries/BMO/Framework.class.php"
+# 2021-08-04: FreePBX 16 no longer needs this FreePBX 15 patch
+# - name: FreePBX - Patch FreePBX source - IIAB Bug 1685
+#   patch:
+#     src: roles/pbx/templates/71-freepbx-framework.patch
+#     dest: "{{ freepbx_src_dir }}/amp_conf/htdocs/admin/libraries/BMO/Framework.class.php"
+
+# 2021-08-04: FreePBX 16 no longer needs this FreePBX 15 patch
+# - name: FreePBX - Patch FreePBX source - wants [] not {}
+#   patch:
+#     src: roles/pbx/templates/pbx.patch
+#     dest: "{{ freepbx_src_dir }}/amp_conf/htdocs/admin/libraries/Composer/vendor/neitanod/forceutf8/src/ForceUTF8/Encoding.php"
 
-- name: FreePBX - Patch FreePBX source - wants [] not {}
-  patch:
-    src: roles/pbx/templates/pbx.patch
-    dest: "{{ freepbx_src_dir }}/amp_conf/htdocs/admin/libraries/Composer/vendor/neitanod/forceutf8/src/ForceUTF8/Encoding.php"
 
 - name: FreePBX - Disable & Stop 'asterisk' systemd service
   systemd:
@@ -101,19 +104,17 @@
     group: asterisk
     recurse: yes
 
-- name: FreePBX - Install (just run once) - CAN TAKE 12 MIN OR LONGER!
-  command: ./start_asterisk start
+
+- name: FreePBX - 2-stage install (just run once) - CAN TAKE 12 MIN OR LONGER!
+  command: "{{ item }}"
   args:
     chdir: "{{ freepbx_src_dir }}"
     creates: "{{ freepbx_install_dir }}"
+  with_items:
+    - ./start_asterisk start
+    - ./install -n --webroot {{ freepbx_install_dir }} --dbuser {{ asterisk_db_user }} --dbpass {{ asterisk_db_password }} --dbname {{ asterisk_db_dbname }} --cdrdbname {{ asterisk_db_cdrdbname }}
 
-- name: FreePBX - Install (just run once) - CAN TAKE 12 MIN OR LONGER!
-  command: ./install -n --webroot {{ freepbx_install_dir }} --dbuser {{ asterisk_db_user }} --dbpass {{ asterisk_db_password }} --dbname {{ asterisk_db_dbname }} --cdrdbname {{ asterisk_db_cdrdbname }}
-  args:
-    chdir: "{{ freepbx_src_dir }}"
-    creates: "{{ freepbx_install_dir }}"
-
-# 2021-08-02: FreePBX 16 seems to no longer need this FreePBX 15 patch?
+# 2021-08-04: FreePBX 16 no longer needs this FreePBX 15 patch
 # - name: FreePBX - Patch FreePBX source - disable get_magic_quotes_gpc()
 #   patch:
 #     src: roles/pbx/templates/pbx2.patch
@@ -124,11 +125,17 @@
     src: odbc.ini.j2
     dest: /etc/odbc.ini
 
+- name: FreePBX - Install /etc/systemd/system/freepbx.service systemd unit file from template (root:root, 0644 by default)
+  template:
+    src: freepbx.service.j2
+    dest: /etc/systemd/system/freepbx.service
+
+
 - name: FreePBX - Install /etc/apache2/sites-available/freepbx.conf from template ({{ apache_user }}:{{ apache_user }}, 0644 by default)
   template:
     src: freepbx.conf.j2
     dest: /etc/apache2/sites-available/freepbx.conf
-    owner: "{{ apache_user }}"
+    owner: "{{ apache_user }}"    # www-data
     group: "{{ apache_user }}"
 
 - name: FreePBX - Add directive "Listen {{ pbx_http_port }}" to /etc/apache2/ports.conf
@@ -136,8 +143,3 @@
     path: /etc/apache2/ports.conf
     line: "Listen {{ pbx_http_port }}"
     # insertafter: Listen 80
-
-- name: FreePBX - Install /etc/systemd/system/freepbx.service systemd unit file from template (root:root, 0644 by default)
-  template:
-    src: freepbx.service.j2
-    dest: /etc/systemd/system/freepbx.service
diff --git a/roles/pbx/templates/71-freepbx-framework.patch b/roles/pbx/templates/71-freepbx-framework.patch.unused
similarity index 100%
rename from roles/pbx/templates/71-freepbx-framework.patch
rename to roles/pbx/templates/71-freepbx-framework.patch.unused
diff --git a/roles/pbx/templates/freepbx.service.j2 b/roles/pbx/templates/freepbx.service.j2
index 50a23eea8..8ac644dc4 100644
--- a/roles/pbx/templates/freepbx.service.j2
+++ b/roles/pbx/templates/freepbx.service.j2
@@ -7,6 +7,9 @@ Type=oneshot
 RemainAfterExit=yes
 ExecStart=/usr/sbin/fwconsole start
 ExecStop=/usr/sbin/fwconsole stop
+# 2021-08-04: Does this help Asterisk (re)start reliably, as FreePBX install completes?
+# PR #2908: https://github.com/iiab/iiab/blob/master/roles/pbx/tasks/enable-or-disable.yml
+RestartSec=3
 
 [Install]
 WantedBy=multi-user.target
diff --git a/roles/pbx/templates/pbx.patch b/roles/pbx/templates/pbx.patch.unused
similarity index 100%
rename from roles/pbx/templates/pbx.patch
rename to roles/pbx/templates/pbx.patch.unused
diff --git a/roles/postgresql/tasks/install.yml b/roles/postgresql/tasks/install.yml
index bc180c234..3fa1a95d0 100644
--- a/roles/postgresql/tasks/install.yml
+++ b/roles/postgresql/tasks/install.yml
@@ -3,6 +3,7 @@
     name:
       - postgresql
       - postgresql-client
+      - python3-psycopg2    # For Ansible modules {postgresql_db, postgresql_user} in Ansible collection community.postgresql -- used in moodle/tasks/install.yml
     state: present
 
 - name: Install /etc/systemd/system/postgresql-iiab.service from template (0644 by default)
diff --git a/scripts/ansible b/scripts/ansible
index b76c888ed..bd14bc7b5 100755
--- a/scripts/ansible
+++ b/scripts/ansible
@@ -4,7 +4,6 @@
 # https://stackoverflow.com/questions/9952177/whats-the-meaning-of-the-parameter-e-for-bash-shell-command-line/9952249
 
 # PLZ SEE http://FAQ.IIAB.IO > "What is Ansible and what version should I use?"
-#         https://github.com/iiab/iiab/tree/master/scripts/ansible.md
 #         https://github.com/iiab/iiab/wiki/IIAB-Contributors-Guide#ansible
 
 APT_PATH=/usr/bin     # Avoids problematic /usr/local/bin/apt on Linux Mint
@@ -149,13 +148,24 @@ fi
 ###echo -e 'ENSURE ANSIBLE UPDATES CLEANLY: (then re-run this script to be sure!)\n'
 ###grep '^deb .*ansible' /etc/apt/sources.list /etc/apt/sources.list.d/*.list | grep -v '^/etc/apt/sources.list.d/iiab-ansible.list:' || true    # Override bash -e (instead of aborting at 1st error)
 
-echo -e "\napt update; apt install of python3-* / virtualenv packages explained at:"
-echo -e "https://github.com/iiab/iiab/blob/master/scripts/ansible.md\n"
+echo -e "\napt update; apt install python3-pip    # Also installs 'python3-setuptools' and 'python3' etc"
+#echo -e "https://github.com/iiab/iiab/blob/master/scripts/ansible.md\n"
 $APT_PATH/apt update
+$APT_PATH/apt -y install python3-pip
+
+# 2021-07-29:
+# 'python3-packaging' dropped for now
+# 'python3-pymysql' (drags in 'python3' which drags in 'python3-venv' on Debian 11 but not on Ubuntu 20.04) -- moved to roles/mysql/tasks/install.yml
+# 'python3-psycopg2' moved to roles/postgresql/tasks/install.yml
+# 'python3-passlib' moved to roles/munin/tasks/install.yml
+# 'python3-venv' moved to roles/2-common/tasks/packages.yml
+# 'virtualenv' for Python 2 moved to roles/kalite/tasks/install.yml
+#
+#$APT_PATH/apt -y install \
+#              python3-pymysql python3-psycopg2 python3-passlib python3-pip \
+#              python3-setuptools python3-packaging python3-venv virtualenv
+
 #$APT_PATH/apt -y --allow-downgrades install ansible-core \
-$APT_PATH/apt -y install \
-              python3-pymysql python3-psycopg2 python3-passlib python3-pip \
-              python3-setuptools python3-packaging python3-venv virtualenv
 
 echo -e "\n\n'pip3 install --upgrade ansible-core' will now run:\n"
 pip3 install --upgrade ansible-core
diff --git a/scripts/ansible.md b/scripts/ansible.md.unused
similarity index 100%
rename from scripts/ansible.md
rename to scripts/ansible.md.unused
diff --git a/vars/default_vars.yml b/vars/default_vars.yml
index bda6297ea..02148d36c 100644
--- a/vars/default_vars.yml
+++ b/vars/default_vars.yml
@@ -167,16 +167,6 @@ dnsmasq_enabled: True
 # Enable in local_vars.yml AFTER installing IIAB!  Then run "cd /opt/iiab/iiab; ./iiab-network"
 dns_jail_enabled: False
 
-# Python-based Captive Portal, that @m-anish & @jvonau experimented with in
-# July 2018 (https://github.com/iiab/iiab/pull/870) and that @georgejhunt
-# extensively later refined (PRs #1179, #1300, #1327, #2070).
-captiveportal_install: True
-captiveportal_enabled: False
-captiveportal_port: 9090
-captiveportal_splash_page: /
-# You might also want to set iiab_home_url (above!)
-# In a pinch, disable Captive Portal using instructions in http://FAQ.IIAB.IO
-
 # Bluetooth PAN access to IIAB server
 bluetooth_install: True
 bluetooth_enabled: False
@@ -213,9 +203,6 @@ sshd_install: True    # Required by OpenVPN
 sshd_enabled: True
 sshd_port: 22    # Not fully functional.  SEE: roles/sshd/tasks/install.yml
 
-# IIAB-ADMIN runs here - see its vars near top of this file:
-# e.g. iiab_admin_user_install, iiab_admin_user, iiab_admin_pwd_hash
-
 openvpn_install: True
 openvpn_enabled: False
 # For /etc/iiab/openvpn_handle
@@ -229,6 +216,9 @@ openvpn_server_real_ip: 3.89.148.185
 openvpn_server_virtual_ip: 10.8.0.1
 openvpn_server_port: 1194
 
+# IIAB-ADMIN runs here - see its vars near top of this file:
+# e.g. iiab_admin_user_install, iiab_admin_user, iiab_admin_pwd_hash
+
 # Some prefer 512MB for Zero W, others prefer 2048MB or higher for RPi 3 and 4.
 # Please see recommendations at: https://itsfoss.com/swap-size/
 pi_swap_file_size: 1024
@@ -421,17 +411,6 @@ nextcloud_enabled: False
 # Uncomment the following line to end that: (might install an older Nextcloud!)
 # nextcloud_dl_url: http://d.iiab.io/packages/latest.tar.bz2
 
-# A full-featured PBX (for rural telephony, etc) based on Asterisk and FreePBX.
-# Untested since Ubuntu 18.04, Debian 9 w/ Node.js 10.x.  Experimental on RPi.
-# If using PBX intensively, set nginx_high_php_limits further above.
-pbx_install: False
-pbx_enabled: False
-asterisk_chan_dongle: False
-pbx_signaling_ports_chan_sip: 5160:5161
-pbx_signaling_ports_chan_pjsip: 5060
-pbx_data_ports: 10000:20000
-pbx_http_port: 83
-
 # If using WordPress intensively, set nginx_high_php_limits further above.
 wordpress_install: False
 wordpress_enabled: False
@@ -569,6 +548,16 @@ vnstat_enabled: False
 
 # 9-LOCAL-ADDONS
 
+# Python-based Captive Portal, that @m-anish & @jvonau experimented with in
+# July 2018 (https://github.com/iiab/iiab/pull/870) and that @georgejhunt
+# extensively later refined (PRs #1179, #1300, #1327, #2070).
+captiveportal_install: True
+captiveportal_enabled: False
+captiveportal_port: 9090
+captiveportal_splash_page: /
+# You might also want to set iiab_home_url (above!)
+# In a pinch, disable Captive Portal using instructions in http://FAQ.IIAB.IO
+
 # 2020-09-24: BOTH VALUES BELOW ARE IGNORED as Yarn is installed on demand as a
 # dependency -- by Internet Archive
 yarn_install: False
@@ -589,7 +578,20 @@ minetest_server_admin: Admin
 minetest_default_game: carbone-ng    # only carbone-ng and minetest are supported
 minetest_flat_world: False
 
-# Calibre E-Book Library
+# Calibre-Web E-Book Library -- Alternative to Calibre, offers a clean/modern UX
+calibreweb_install: False
+calibreweb_enabled: False
+calibreweb_port: 8083       # PORT VARIABLE HAS NO EFFECT (as of January 2019)
+# http://box/books works.  Add {box/libros, box/livres, box/livros, box/liv} etc?
+calibreweb_url1: /books     # For SHORT URL http://box/books  (English)
+calibreweb_url2: /libros    # For SHORT URL http://box/libros (Spanish)
+calibreweb_url3: /livres    # For SHORT URL http://box/livres (French)
+calibreweb_home: "{{ content_base }}/calibre-web"    # /library/calibre-web
+
+# SUGGESTION: Calibre-Web can use Calibre's /usr/bin/ebook-convert program, so
+# ALSO CONSIDER installing Calibre (below, if its graphical bloat is tolerable!)
+
+# Calibre E-Book Library -- https://calibre-ebook.com
 # WARNING: CALIBRE INSTALLS GRAPHICAL LIBRARIES SIMILAR TO X WINDOWS & OPENGL
 # ON (HEADLESS, SERVER, LITE) OS'S THAT DON'T ALREADY HAVE THESE INSTALLED.
 calibre_install: False
@@ -606,18 +608,17 @@ calibre_port: 8080
 calibre_web_path: calibre  #NEEDS WORK: https://github.com/iiab/iiab/issues/529
 # Avoid URL collisions w/ calibreweb_url1, calibreweb_url2, calibreweb_url3 below!
 
-# WARNING: Calibre-Web (below) depends on Calibre's own /usr/bin/ebook-convert
-# program, so we recommend you also install Calibre (above!)
-
-# Calibre-Web alternative to Calibre, offers a clean/modern UX
-calibreweb_install: False
-calibreweb_enabled: False
-calibreweb_port: 8083       # PORT VARIABLE HAS NO EFFECT (as of January 2019)
-# http://box/books works.  Add {box/libros, box/livres, box/livros, box/liv} etc?
-calibreweb_url1: /books     # For SHORT URL http://box/books  (English)
-calibreweb_url2: /libros    # For SHORT URL http://box/libros (Spanish)
-calibreweb_url3: /livres    # For SHORT URL http://box/livres (French)
-calibreweb_home: "{{ content_base }}/calibre-web"    # /library/calibre-web
+# A full-featured PBX (for rural telephony, etc) based on Asterisk and FreePBX.
+# REQUIRES PHP 7.4 e.g. Ubuntu 20.04, Debian 11 -- RaspiOS 11 might also work.
+# INSTRUCTIONS: https://github.com/iiab/iiab/tree/master/roles/pbx#pbx-readme
+# If using PBX intensively, investigate nginx_high_php_limits further above.
+pbx_install: False
+pbx_enabled: False
+asterisk_chan_dongle: False
+pbx_signaling_ports_chan_sip: 5160:5161
+pbx_signaling_ports_chan_pjsip: 5060
+pbx_data_ports: 10000:20000
+pbx_http_port: 83
 
 
 # =============================================================================
diff --git a/vars/local_vars_big.yml b/vars/local_vars_big.yml
index f153d206c..71237e20e 100644
--- a/vars/local_vars_big.yml
+++ b/vars/local_vars_big.yml
@@ -114,24 +114,11 @@ dnsmasq_enabled: True
 # Enable AFTER installing IIAB!  Then run "cd /opt/iiab/iiab; ./iiab-network"
 dns_jail_enabled: False
 
-# Python-based Captive Portal, that @m-anish & @jvonau experimented with in
-# July 2018 (https://github.com/iiab/iiab/pull/870) and that @georgejhunt
-# extensively later refined (PRs #1179, #1300, #1327, #2070).
-captiveportal_install: True
-captiveportal_enabled: False
-captiveportal_splash_page: /
-# You might also want to set iiab_home_url (above!)
-# In a pinch, disable Captive Portal using instructions in http://FAQ.IIAB.IO
-
 # Bluetooth PAN access to IIAB server
 bluetooth_install: True
 bluetooth_enabled: False
 bluetooth_term_enabled: False
 
-# UNMAINTAINED as of October 2017: https://github.com/iiab/iiab/pull/382
-# wondershaper_install: False
-# wondershaper_enabled: False
-
 
 # 1-PREP
 
@@ -139,15 +126,15 @@ bluetooth_term_enabled: False
 sshd_install: True    # Required by OpenVPN
 sshd_enabled: True
 
-# IIAB-ADMIN runs here - see its vars near top of this file:
-# e.g. iiab_admin_user_install, iiab_admin_user, iiab_admin_pwd_hash
-
 # SECURITY WARNING: See http://wiki.laptop.org/go/IIAB/Security
 openvpn_install: True
 openvpn_enabled: False
 # Set /etc/iiab/openvpn_handle in advance here:
 openvpn_handle: BIG-sized - Put Your Name Here
 
+# IIAB-ADMIN runs here - see its vars near top of this file:
+# e.g. iiab_admin_user_install, iiab_admin_user, iiab_admin_pwd_hash
+
 # Some prefer 512MB for Zero W, others prefer 2048MB or higher for RPi 3 and 4.
 # Please see recommendations at: https://itsfoss.com/swap-size/
 pi_swap_file_size: 1024
@@ -279,13 +266,6 @@ nextcloud_enabled: True
 # Uncomment the following line to end that: (might install an older Nextcloud!)
 # nextcloud_dl_url: http://d.iiab.io/packages/latest.tar.bz2
 
-# A full-featured PBX (for rural telephony, etc) based on Asterisk and FreePBX.
-# Untested since Ubuntu 18.04, Debian 9 w/ Node.js 10.x.  Experimental on RPi.
-# If using PBX intensively, set nginx_high_php_limits further above.
-pbx_install: False
-pbx_enabled: False
-asterisk_chan_dongle: False
-
 # If using WordPress intensively, set nginx_high_php_limits further above.
 wordpress_install: True
 wordpress_enabled: True
@@ -368,6 +348,15 @@ vnstat_enabled: True
 
 # 9-LOCAL-ADDONS
 
+# Python-based Captive Portal, that @m-anish & @jvonau experimented with in
+# July 2018 (https://github.com/iiab/iiab/pull/870) and that @georgejhunt
+# extensively later refined (PRs #1179, #1300, #1327, #2070).
+captiveportal_install: True
+captiveportal_enabled: False
+captiveportal_splash_page: /
+# You might also want to set iiab_home_url (above!)
+# In a pinch, disable Captive Portal using instructions in http://FAQ.IIAB.IO
+
 # Internet Archive Decentralized Web - create your own offline version box:4244
 # (or http://box/archive) arising from digital library https://dweb.archive.org
 internetarchive_install: True
@@ -377,7 +366,20 @@ internetarchive_enabled: True
 minetest_install: True
 minetest_enabled: True
 
-# Calibre E-Book Library
+# Calibre-Web E-Book Library -- Alternative to Calibre, offers a clean/modern UX
+calibreweb_install: True
+calibreweb_enabled: True
+calibreweb_port: 8083       # PORT VARIABLE HAS NO EFFECT (as of January 2019)
+# http://box/books works.  Add {box/libros, box/livres, box/livros, box/liv} etc?
+calibreweb_url1: /books     # For SHORT URL http://box/books  (English)
+calibreweb_url2: /libros    # For SHORT URL http://box/libros (Spanish)
+calibreweb_url3: /livres    # For SHORT URL http://box/livres (French)
+calibreweb_home: /library/calibre-web    # default_vars.yml uses: "{{ content_base }}/calibre-web"
+
+# SUGGESTION: Calibre-Web can use Calibre's /usr/bin/ebook-convert program, so
+# ALSO CONSIDER installing Calibre (below, if its graphical bloat is tolerable!)
+
+# Calibre E-Book Library -- https://calibre-ebook.com
 # WARNING: CALIBRE INSTALLS GRAPHICAL LIBRARIES SIMILAR TO X WINDOWS & OPENGL
 # ON (HEADLESS, SERVER, LITE) OS'S THAT DON'T ALREADY HAVE THESE INSTALLED.
 calibre_install: False
@@ -388,15 +390,10 @@ calibre_port: 8080
 calibre_web_path: calibre  #NEEDS WORK: https://github.com/iiab/iiab/issues/529
 # Avoid URL collisions w/ calibreweb_url1, calibreweb_url2, calibreweb_url3 below!
 
-# WARNING: Calibre-Web (below) depends on Calibre's own /usr/bin/ebook-convert
-# program, so we recommend you also install Calibre (above!)
-
-# Calibre-Web alternative to Calibre, offers a clean/modern UX
-calibreweb_install: True
-calibreweb_enabled: True
-calibreweb_port: 8083       # PORT VARIABLE HAS NO EFFECT (as of January 2019)
-# http://box/books works.  Add {box/libros, box/livres, box/livros, box/liv} etc?
-calibreweb_url1: /books     # For SHORT URL http://box/books  (English)
-calibreweb_url2: /libros    # For SHORT URL http://box/libros (Spanish)
-calibreweb_url3: /livres    # For SHORT URL http://box/livres (French)
-calibreweb_home: /library/calibre-web    # default_vars.yml uses: "{{ content_base }}/calibre-web"
+# A full-featured PBX (for rural telephony, etc) based on Asterisk and FreePBX.
+# REQUIRES PHP 7.4 e.g. Ubuntu 20.04, Debian 11 -- RaspiOS 11 might also work.
+# INSTRUCTIONS: https://github.com/iiab/iiab/tree/master/roles/pbx#pbx-readme
+# If using PBX intensively, investigate nginx_high_php_limits further above.
+pbx_install: False
+pbx_enabled: False
+asterisk_chan_dongle: False
diff --git a/vars/local_vars_medium.yml b/vars/local_vars_medium.yml
index 78bf4f707..831803dd6 100644
--- a/vars/local_vars_medium.yml
+++ b/vars/local_vars_medium.yml
@@ -114,24 +114,11 @@ dnsmasq_enabled: True
 # Enable AFTER installing IIAB!  Then run "cd /opt/iiab/iiab; ./iiab-network"
 dns_jail_enabled: False
 
-# Python-based Captive Portal, that @m-anish & @jvonau experimented with in
-# July 2018 (https://github.com/iiab/iiab/pull/870) and that @georgejhunt
-# extensively later refined (PRs #1179, #1300, #1327, #2070).
-captiveportal_install: True
-captiveportal_enabled: False
-captiveportal_splash_page: /
-# You might also want to set iiab_home_url (above!)
-# In a pinch, disable Captive Portal using instructions in http://FAQ.IIAB.IO
-
 # Bluetooth PAN access to IIAB server
 bluetooth_install: True
 bluetooth_enabled: False
 bluetooth_term_enabled: False
 
-# UNMAINTAINED as of October 2017: https://github.com/iiab/iiab/pull/382
-# wondershaper_install: False
-# wondershaper_enabled: False
-
 
 # 1-PREP
 
@@ -139,15 +126,15 @@ bluetooth_term_enabled: False
 sshd_install: True    # Required by OpenVPN
 sshd_enabled: True
 
-# IIAB-ADMIN runs here - see its vars near top of this file:
-# e.g. iiab_admin_user_install, iiab_admin_user, iiab_admin_pwd_hash
-
 # SECURITY WARNING: See http://wiki.laptop.org/go/IIAB/Security
 openvpn_install: True
 openvpn_enabled: False
 # Set /etc/iiab/openvpn_handle in advance here:
 openvpn_handle: MEDIUM-sized - Put Your Name Here
 
+# IIAB-ADMIN runs here - see its vars near top of this file:
+# e.g. iiab_admin_user_install, iiab_admin_user, iiab_admin_pwd_hash
+
 # Some prefer 512MB for Zero W, others prefer 2048MB or higher for RPi 3 and 4.
 # Please see recommendations at: https://itsfoss.com/swap-size/
 pi_swap_file_size: 1024
@@ -279,13 +266,6 @@ nextcloud_enabled: True
 # Uncomment the following line to end that: (might install an older Nextcloud!)
 # nextcloud_dl_url: http://d.iiab.io/packages/latest.tar.bz2
 
-# A full-featured PBX (for rural telephony, etc) based on Asterisk and FreePBX.
-# Untested since Ubuntu 18.04, Debian 9 w/ Node.js 10.x.  Experimental on RPi.
-# If using PBX intensively, set nginx_high_php_limits further above.
-pbx_install: False
-pbx_enabled: False
-asterisk_chan_dongle: False
-
 # If using WordPress intensively, set nginx_high_php_limits further above.
 wordpress_install: True
 wordpress_enabled: True
@@ -368,6 +348,15 @@ vnstat_enabled: False
 
 # 9-LOCAL-ADDONS
 
+# Python-based Captive Portal, that @m-anish & @jvonau experimented with in
+# July 2018 (https://github.com/iiab/iiab/pull/870) and that @georgejhunt
+# extensively later refined (PRs #1179, #1300, #1327, #2070).
+captiveportal_install: True
+captiveportal_enabled: False
+captiveportal_splash_page: /
+# You might also want to set iiab_home_url (above!)
+# In a pinch, disable Captive Portal using instructions in http://FAQ.IIAB.IO
+
 # Internet Archive Decentralized Web - create your own offline version box:4244
 # (or http://box/archive) arising from digital library https://dweb.archive.org
 internetarchive_install: False
@@ -377,7 +366,20 @@ internetarchive_enabled: False
 minetest_install: False
 minetest_enabled: False
 
-# Calibre E-Book Library
+# Calibre-Web E-Book Library -- Alternative to Calibre, offers a clean/modern UX
+calibreweb_install: True
+calibreweb_enabled: True
+calibreweb_port: 8083       # PORT VARIABLE HAS NO EFFECT (as of January 2019)
+# http://box/books works.  Add {box/libros, box/livres, box/livros, box/liv} etc?
+calibreweb_url1: /books     # For SHORT URL http://box/books  (English)
+calibreweb_url2: /libros    # For SHORT URL http://box/libros (Spanish)
+calibreweb_url3: /livres    # For SHORT URL http://box/livres (French)
+calibreweb_home: /library/calibre-web    # default_vars.yml uses: "{{ content_base }}/calibre-web"
+
+# SUGGESTION: Calibre-Web can use Calibre's /usr/bin/ebook-convert program, so
+# ALSO CONSIDER installing Calibre (below, if its graphical bloat is tolerable!)
+
+# Calibre E-Book Library -- https://calibre-ebook.com
 # WARNING: CALIBRE INSTALLS GRAPHICAL LIBRARIES SIMILAR TO X WINDOWS & OPENGL
 # ON (HEADLESS, SERVER, LITE) OS'S THAT DON'T ALREADY HAVE THESE INSTALLED.
 calibre_install: False
@@ -388,15 +390,10 @@ calibre_port: 8080
 calibre_web_path: calibre  #NEEDS WORK: https://github.com/iiab/iiab/issues/529
 # Avoid URL collisions w/ calibreweb_url1, calibreweb_url2, calibreweb_url3 below!
 
-# WARNING: Calibre-Web (below) depends on Calibre's own /usr/bin/ebook-convert
-# program, so we recommend you also install Calibre (above!)
-
-# Calibre-Web alternative to Calibre, offers a clean/modern UX
-calibreweb_install: True
-calibreweb_enabled: True
-calibreweb_port: 8083       # PORT VARIABLE HAS NO EFFECT (as of January 2019)
-# http://box/books works.  Add {box/libros, box/livres, box/livros, box/liv} etc?
-calibreweb_url1: /books     # For SHORT URL http://box/books  (English)
-calibreweb_url2: /libros    # For SHORT URL http://box/libros (Spanish)
-calibreweb_url3: /livres    # For SHORT URL http://box/livres (French)
-calibreweb_home: /library/calibre-web    # default_vars.yml uses: "{{ content_base }}/calibre-web"
+# A full-featured PBX (for rural telephony, etc) based on Asterisk and FreePBX.
+# REQUIRES PHP 7.4 e.g. Ubuntu 20.04, Debian 11 -- RaspiOS 11 might also work.
+# INSTRUCTIONS: https://github.com/iiab/iiab/tree/master/roles/pbx#pbx-readme
+# If using PBX intensively, investigate nginx_high_php_limits further above.
+pbx_install: False
+pbx_enabled: False
+asterisk_chan_dongle: False
diff --git a/vars/local_vars_min.yml b/vars/local_vars_min.yml
index 2ef6770ba..517574915 100644
--- a/vars/local_vars_min.yml
+++ b/vars/local_vars_min.yml
@@ -114,24 +114,11 @@ dnsmasq_enabled: True
 # Enable AFTER installing IIAB!  Then run "cd /opt/iiab/iiab; ./iiab-network"
 dns_jail_enabled: False
 
-# Python-based Captive Portal, that @m-anish & @jvonau experimented with in
-# July 2018 (https://github.com/iiab/iiab/pull/870) and that @georgejhunt
-# extensively later refined (PRs #1179, #1300, #1327, #2070).
-captiveportal_install: True
-captiveportal_enabled: False
-captiveportal_splash_page: /
-# You might also want to set iiab_home_url (above!)
-# In a pinch, disable Captive Portal using instructions in http://FAQ.IIAB.IO
-
 # Bluetooth PAN access to IIAB server
 bluetooth_install: True
 bluetooth_enabled: False
 bluetooth_term_enabled: False
 
-# UNMAINTAINED as of October 2017: https://github.com/iiab/iiab/pull/382
-# wondershaper_install: False
-# wondershaper_enabled: False
-
 
 # 1-PREP
 
@@ -139,15 +126,15 @@ bluetooth_term_enabled: False
 sshd_install: True    # Required by OpenVPN
 sshd_enabled: True
 
-# IIAB-ADMIN runs here - see its vars near top of this file:
-# e.g. iiab_admin_user_install, iiab_admin_user, iiab_admin_pwd_hash
-
 # SECURITY WARNING: See http://wiki.laptop.org/go/IIAB/Security
 openvpn_install: True
 openvpn_enabled: False
 # Set /etc/iiab/openvpn_handle in advance here:
 openvpn_handle: MIN-sized - Put Your Name Here
 
+# IIAB-ADMIN runs here - see its vars near top of this file:
+# e.g. iiab_admin_user_install, iiab_admin_user, iiab_admin_pwd_hash
+
 # Some prefer 512MB for Zero W, others prefer 2048MB or higher for RPi 3 and 4.
 # Please see recommendations at: https://itsfoss.com/swap-size/
 pi_swap_file_size: 1024
@@ -279,13 +266,6 @@ nextcloud_enabled: False
 # Uncomment the following line to end that: (might install an older Nextcloud!)
 # nextcloud_dl_url: http://d.iiab.io/packages/latest.tar.bz2
 
-# A full-featured PBX (for rural telephony, etc) based on Asterisk and FreePBX.
-# Untested since Ubuntu 18.04, Debian 9 w/ Node.js 10.x.  Experimental on RPi.
-# If using PBX intensively, set nginx_high_php_limits further above.
-pbx_install: False
-pbx_enabled: False
-asterisk_chan_dongle: False
-
 # If using WordPress intensively, set nginx_high_php_limits further above.
 wordpress_install: False
 wordpress_enabled: False
@@ -368,6 +348,15 @@ vnstat_enabled: False
 
 # 9-LOCAL-ADDONS
 
+# Python-based Captive Portal, that @m-anish & @jvonau experimented with in
+# July 2018 (https://github.com/iiab/iiab/pull/870) and that @georgejhunt
+# extensively later refined (PRs #1179, #1300, #1327, #2070).
+captiveportal_install: True
+captiveportal_enabled: False
+captiveportal_splash_page: /
+# You might also want to set iiab_home_url (above!)
+# In a pinch, disable Captive Portal using instructions in http://FAQ.IIAB.IO
+
 # Internet Archive Decentralized Web - create your own offline version box:4244
 # (or http://box/archive) arising from digital library https://dweb.archive.org
 internetarchive_install: False
@@ -377,7 +366,20 @@ internetarchive_enabled: False
 minetest_install: False
 minetest_enabled: False
 
-# Calibre E-Book Library
+# Calibre-Web E-Book Library -- Alternative to Calibre, offers a clean/modern UX
+calibreweb_install: False
+calibreweb_enabled: False
+calibreweb_port: 8083       # PORT VARIABLE HAS NO EFFECT (as of January 2019)
+# http://box/books works.  Add {box/libros, box/livres, box/livros, box/liv} etc?
+calibreweb_url1: /books     # For SHORT URL http://box/books  (English)
+calibreweb_url2: /libros    # For SHORT URL http://box/libros (Spanish)
+calibreweb_url3: /livres    # For SHORT URL http://box/livres (French)
+calibreweb_home: /library/calibre-web    # default_vars.yml uses: "{{ content_base }}/calibre-web"
+
+# SUGGESTION: Calibre-Web can use Calibre's /usr/bin/ebook-convert program, so
+# ALSO CONSIDER installing Calibre (below, if its graphical bloat is tolerable!)
+
+# Calibre E-Book Library -- https://calibre-ebook.com
 # WARNING: CALIBRE INSTALLS GRAPHICAL LIBRARIES SIMILAR TO X WINDOWS & OPENGL
 # ON (HEADLESS, SERVER, LITE) OS'S THAT DON'T ALREADY HAVE THESE INSTALLED.
 calibre_install: False
@@ -388,15 +390,10 @@ calibre_port: 8080
 calibre_web_path: calibre  #NEEDS WORK: https://github.com/iiab/iiab/issues/529
 # Avoid URL collisions w/ calibreweb_url1, calibreweb_url2, calibreweb_url3 below!
 
-# WARNING: Calibre-Web (below) depends on Calibre's own /usr/bin/ebook-convert
-# program, so we recommend you also install Calibre (above!)
-
-# Calibre-Web alternative to Calibre, offers a clean/modern UX
-calibreweb_install: False
-calibreweb_enabled: False
-calibreweb_port: 8083       # PORT VARIABLE HAS NO EFFECT (as of January 2019)
-# http://box/books works.  Add {box/libros, box/livres, box/livros, box/liv} etc?
-calibreweb_url1: /books     # For SHORT URL http://box/books  (English)
-calibreweb_url2: /libros    # For SHORT URL http://box/libros (Spanish)
-calibreweb_url3: /livres    # For SHORT URL http://box/livres (French)
-calibreweb_home: /library/calibre-web    # default_vars.yml uses: "{{ content_base }}/calibre-web"
+# A full-featured PBX (for rural telephony, etc) based on Asterisk and FreePBX.
+# REQUIRES PHP 7.4 e.g. Ubuntu 20.04, Debian 11 -- RaspiOS 11 might also work.
+# INSTRUCTIONS: https://github.com/iiab/iiab/tree/master/roles/pbx#pbx-readme
+# If using PBX intensively, investigate nginx_high_php_limits further above.
+pbx_install: False
+pbx_enabled: False
+asterisk_chan_dongle: False