diff --git a/iiab-install b/iiab-install
index ec6a128c9..81680e0aa 100755
--- a/iiab-install
+++ b/iiab-install
@@ -13,11 +13,22 @@ MIN_RPI_KERN=4.9.59-v7+
 MIN_ANSIBLE_VER=2.5.6
 
 if [ ! -f /etc/iiab/local_vars.yml ]; then
+
+    if [ -f /opt/iiab/iiab/vars/local_vars.yml ]; then
+        echo -e "\nACTION NEEDED: YOUR /opt/iiab/iiab/vars/local_vars.yml IS NO LONGER SUPPORTED.\n" >&2
+        echo -e "███████████████████ TO MOVE IT TO THE CORRECT LOCATION, RUN: ███████████████████" >&2
+        echo -e "██                                                                            ██" >&2
+        echo -e "██       mv /opt/iiab/iiab/vars/local_vars.yml /etc/iiab/local_vars.yml       ██" >&2
+        echo -e "██                                                                            ██" >&2
+        echo -e "████████████████████████████████████████████████████████████████████████████████\n" >&2
+    fi
+
     echo -e "\nEXITING: /opt/iiab/iiab/iiab-install REQUIRES /etc/iiab/local_vars.yml\n" >&2
     echo -e "(1) Please read http://wiki.iiab.io/local_vars.yml to learn more" >&2
     echo -e "(2) MIN/MEDIUM/BIG samples are included in /opt/iiab/iiab/vars" >&2
     echo -e "(3) NO TIME FOR DETAILS?  RUN INTERNET-IN-A-BOX'S FRIENDLY 1-LINE INSTALLER:\n" >&2
     echo -e '    http://download.iiab.io   (click on "6.6" or a more recent version!)\n' >&2
+
     #case $OS in
     #    OLPC | fedora)
     #        echo -e "Please examine /opt/iiab/iiab/vars/local_vars_olpc.yml for XO laptops.\n" >&2
@@ -32,6 +43,8 @@ if [ ! -f /etc/iiab/local_vars.yml ]; then
     exit 1
 fi
 
+# FUTURE: Test if their local_vars.yml is sufficiently version-compatible !
+
 echo -e "\n\n./iiab-install $* BEGUN IN $CWD\n"
 
 if [ ! -f /etc/ansible/facts.d/local_facts.fact ]; then
diff --git a/roles/kiwix/templates/iiab-make-kiwix-lib b/roles/kiwix/templates/iiab-make-kiwix-lib
index ae06bc0cd..5680470f3 100644
--- a/roles/kiwix/templates/iiab-make-kiwix-lib
+++ b/roles/kiwix/templates/iiab-make-kiwix-lib
@@ -1,8 +1,30 @@
-#!/bin/bash
-
-{{ systemctl_program }} stop kiwix-serve
-/usr/bin/iiab-make-kiwix-lib.py
-#/usr/bin/iiab-make-apache-config.py
-{{ systemctl_program }} start kiwix-serve
-
-exit 0
+#!/bin/bash
+
+LOCK_PATH=/run/lock/kiwix
+mkdir -p $LOCK_PATH
+
+WAITLOCK="$LOCK_PATH/make-kiwix-lib-wait.LCK";
+RUNLOCK="$LOCK_PATH/kiwix-lib-access.LCK";
+KIWIXLIB={{ kiwix_library_xml }}
+
+exec 200>$WAITLOCK;
+exec 201>$RUNLOCK;
+
+if flock -n -e 200; then :
+  echo 'Waiting to run iiab-make-kiwix-lib.py'
+  # wait for up to 5 min
+  flock -x -w 300 201
+  flock -u 200 # unlock queue
+  echo "Now running iiab-make-kiwix-lib.py"
+  # write to {{ kiwix_library_xml }}.tmp to minimize kiwix down
+  # zim map could be out of sync for a few seconds
+  /usr/bin/iiab-make-kiwix-lib.py
+  {{ systemctl_program }} stop kiwix-serve
+  rm $KIWIXLIB
+  mv $KIWIXLIB.tmp $KIWIXLIB
+  {{ systemctl_program }} start kiwix-serve
+else
+  echo "Can't get wait lock for iiab-make-kiwix-lib.py";
+  exit 1;
+fi
+exit 0
diff --git a/roles/kiwix/templates/iiab-make-kiwix-lib.py b/roles/kiwix/templates/iiab-make-kiwix-lib.py
index 40f45cb82..d331f194d 100644
--- a/roles/kiwix/templates/iiab-make-kiwix-lib.py
+++ b/roles/kiwix/templates/iiab-make-kiwix-lib.py
@@ -2,7 +2,7 @@
 
 """
 
-   Creates library.xml file for kiwix from contents of /zims/content and index
+   Creates temp library.xml file for kiwix from contents of /zims/content and index
 
    Author: Tim Moody <tim(at)timmoody(dot)com>
    Contributors: Jerry Vonau <jvonau3(at)gmail.com>
@@ -30,6 +30,8 @@ iiab_config_file = "{{ iiab_config_file }}"
 # Variables that should be read from config file
 # All of these variables will be read from config files and recomputed in init()
 iiab_zim_path = "{{ iiab_zim_path }}"
+
+# Later we will append .tmp to file name
 kiwix_library_xml = "{{ kiwix_library_xml }}"
 
 iiab_base_path = "{{ iiab_base }}"
@@ -41,8 +43,9 @@ old_zim_map = {"bad.zim" : "unparseable name"}
 
 def main():
     """Server routine"""
-
+    global kiwix_library_xml
     init()
+    kiwix_library_xml += '.tmp' # write to temp file    
 
     # remove existing file
     try:
diff --git a/roles/nextcloud/templates/nextcloud.conf.j2 b/roles/nextcloud/templates/nextcloud.conf.j2
index 965973ad4..7a24d512f 100644
--- a/roles/nextcloud/templates/nextcloud.conf.j2
+++ b/roles/nextcloud/templates/nextcloud.conf.j2
@@ -6,7 +6,7 @@ Alias {{ nextcloud_url }} {{ nextcloud_prefix }}/nextcloud
     <IfModule mod_authz_core.c>
     # Apache 2.4
     Require host localhost
-    Require ip 127.0.0.1 {{ lan_ip }}/{{ lan_netmask }} {{ nextcloud_required_ip }}
+    Require ip 127.0.0.1 {{ lan_ip }}/{{ lan_netmask }} {{ nextcloud_required_ip }} {{ openvpn_server_virtual_ip }}/255.255.255.0
     </IfModule>
     <IfModule !mod_authz_core.c>
     # Apache 2.2
diff --git a/runansible b/runansible.deprecated
similarity index 100%
rename from runansible
rename to runansible.deprecated
diff --git a/runtags b/runtags.deprecated
similarity index 100%
rename from runtags
rename to runtags.deprecated
diff --git a/vars/default_vars.yml b/vars/default_vars.yml
index 8f097e95a..76df8d252 100644
--- a/vars/default_vars.yml
+++ b/vars/default_vars.yml
@@ -188,6 +188,7 @@ sshd_enabled: True
 # OpenVPN
 vpn_presence: xscenet.net
 openvpn_server_port: 1194
+openvpn_server_virtual_ip: 10.8.0.1
 openvpn_cron_enabled: False
 openvpn_install: True
 openvpn_enabled: False