diff --git a/vars/local_vars_medium.yml b/vars/local_vars_medium.yml
index 21f7556f5..be4c943cc 100644
--- a/vars/local_vars_medium.yml
+++ b/vars/local_vars_medium.yml
@@ -39,8 +39,6 @@ host_channel: 6
 hostapd_secure: False
 hostapd_password: changeme
 
-dns_jail_enabled: False
-
 # Enables "campus access" to kiwix (3000), kalite (8008) & calibre (8010 or
 # 8080) on WAN side of server. See network/templates/gateway/iiab-gen-iptables
 # within github.com/iiab/iiab/blob/master/roles/
@@ -49,8 +47,15 @@ services_externally_visible: True
 # Make this True if client machines should have access to WAN/Internet:
 iiab_gateway_enabled: False
 
-# Make this False to disable http://box/common/services/power_off.php button:
-allow_apache_sudo: True
+# dnsmasq
+dnsmasq_install: True
+dnsmasq_enabled: False
+
+dns_jail_enabled: False
+
+# Simple python Captive Portal, that @m-anish & @jvonau are experimenting with in July 2018: github.com/iiab/iiab/pull/870
+py_captive_portal_install: True
+py_captive_portal_enabled: False
 
 # Stages 3 & 4 must be run (using iiab-install or runrole) if changing these:
 squid_install: False
@@ -69,6 +74,9 @@ dansguardian_enabled: False
 
 # 3-BASE-SERVER
 
+# Make this False to disable http://box/common/services/power_off.php button:
+allow_apache_sudo: True
+
 # roles/mysql runs here (mandatory)
 
 # 4-SERVER-OPTIONS