diff --git a/vars/local_vars_big.yml b/vars/local_vars_big.yml
index 13f8ea711..8b680a2cc 100644
--- a/vars/local_vars_big.yml
+++ b/vars/local_vars_big.yml
@@ -76,32 +76,34 @@ dansguardian_enabled: True
 
 # 1-PREP
 
+# roles/sshd & roles/iiab-admin run here
+# SEE IIAB-ADMIN VARIABLES NEAR TOP OF THIS FILE:
+# e.g. iiab_admin_user_install, iiab_admin_user, iiab_admin_pwd_hash
+
+# SECURITY WARNING: See http://wiki.laptop.org/go/IIAB/Security
+openvpn_install: True
+openvpn_enabled: False
+# Set /etc/iiab/openvpn_handle in advance here:
+openvpn_handle: ""
+# The following seems necessary on CentOS:
+# openvpn_cron_enabled: True
+
 # 2-COMMON
 
 # 3-BASE-SERVER
 
 # Make this False to disable http://box/common/services/power_off.php button:
 apache_allow_sudo: True
-
-# For schools that use WordPress and/or Moodle intensively. See iiab/iiab #1147
+# For schools that use WordPress and/or Moodle intensively, see iiab/iiab #1147
 # WARNING: Enabling this (might) cause excess use of RAM or other resources?
 apache_high_php_limits: False
+# SEE ALSO VARIABLES NEAR TOP OF THIS FILE: default_language, language_priority
 
 # roles/mysql runs here (mandatory)
 
 
 # 4-SERVER-OPTIONS
 
-# SECURITY WARNING: See http://wiki.laptop.org/go/IIAB/Security
-openvpn_install: True
-openvpn_enabled: False
-
-# Set /etc/iiab/openvpn_handle in advance here:
-openvpn_handle: ""
-
-# The following seems necessary on CentOS:
-# openvpn_cron_enabled: True
-
 # roles/network runs here (MANY SETTINGS ABOVE)
 
 # PostgreSQL - auto-installed by Moodle and/or Pathagar - no need to touch!