diff --git a/vars/default_vars.yml b/vars/default_vars.yml
index 4f3ec18a8..367e46069 100644
--- a/vars/default_vars.yml
+++ b/vars/default_vars.yml
@@ -126,14 +126,6 @@ py_captive_portal_enabled: True
 # captive_portal_install: False
 # captive_portal_enabled: False
 
-# Squid
-squid_install: False
-squid_enabled: False
-
-# DansGuardian
-dansguardian_install: False
-dansguardian_enabled: False
-
 # Wonder Shaper
 # Unmaintained as of October 2017: https://github.com/iiab/iiab/pull/382
 wondershaper_install: False
@@ -147,8 +139,7 @@ wan_ip: dhcp
 wan_netmask:
 wan_gateway:
 wan_nameserver:
-# exFAT is auto-enabled for all "debuntu" OS's as of Nov 2017, in roles/2-common/tasks/packages.yml#L35-L36
-# exFAT_enabled: True
+
 
 # Parameters for Aggregate Roles
 # Each Role should have the following variables which are either True or False:
@@ -180,12 +171,20 @@ openvpn_server: xscenet.net
 openvpn_server_virtual_ip: 10.8.0.1
 openvpn_server_port: 1194
 
+
 # 2-COMMON
 
+# Auto-enabled in roles/2-common/tasks/packages.yml as set in
+# 0-init/defaults/main.yml AND 0-init/tasks/main.yml :
+exFAT_enabled: True
+
+# /usr/libexec/iiab-startup.sh is much like autoexec.bat & /etc/rc.local
+# It's put in place by 2-common/tasks/iiab-startup.yml at the end of Stage 2.
+
+
 # 3-BASE-SERVER
 
-# roles/httpd (Apache configuration) runs here
-
+# httpd (Apache)
 # Make this False to disable http://box/common/services/power_off.php button:
 apache_allow_sudo: True
 # For schools that use WordPress and/or Moodle intensively, see iiab/iiab #1147
@@ -202,7 +201,16 @@ mysql_root_password: fixmysql
 
 # 4-SERVER-OPTIONS
 
-# roles/network runs here (MANY SETTINGS ABOVE)
+# dnsmasq, named, dhcpd basics are installed here...in preparation for
+# the full roles/network = iiab-network that runs after 9-LOCAL-ADDONS
+
+# Squid
+squid_install: False
+squid_enabled: False
+
+# DansGuardian
+dansguardian_install: False
+dansguardian_enabled: False
 
 # Homepage
 iiab_home_url: /home
diff --git a/vars/local_vars_big.yml b/vars/local_vars_big.yml
index 8b680a2cc..79d5569ed 100644
--- a/vars/local_vars_big.yml
+++ b/vars/local_vars_big.yml
@@ -62,13 +62,6 @@ py_captive_portal_install: True
 py_captive_portal_enabled: True
 # In a pinch, disable it by running: systemctl disable py-captive-portal
 
-# Stages 3 & 4 must be run (using iiab-install or runrole) if changing these:
-squid_install: True
-squid_enabled: True
-
-dansguardian_install: True
-dansguardian_enabled: True
-
 # Unmaintained as of October 2017: https://github.com/iiab/iiab/pull/382
 # wondershaper_install: False
 # wondershaper_enabled: False
@@ -88,8 +81,16 @@ openvpn_handle: ""
 # The following seems necessary on CentOS:
 # openvpn_cron_enabled: True
 
+
 # 2-COMMON
 
+# exFAT_enabled: True is auto-enabled in roles/2-common/tasks/packages.yml
+# as set in 0-init/defaults/main.yml AND 0-init/tasks/main.yml
+
+# /usr/libexec/iiab-startup.sh is much like autoexec.bat & /etc/rc.local
+# It's put in place by 2-common/tasks/iiab-startup.yml at the end of Stage 2.
+
+
 # 3-BASE-SERVER
 
 # Make this False to disable http://box/common/services/power_off.php button:
@@ -104,7 +105,16 @@ apache_high_php_limits: False
 
 # 4-SERVER-OPTIONS
 
-# roles/network runs here (MANY SETTINGS ABOVE)
+# dnsmasq, named, dhcpd basics are installed here...in preparation for
+# the full roles/network = iiab-network that runs after 9-LOCAL-ADDONS
+
+# Squid
+squid_install: True
+squid_enabled: True
+
+# DansGuardian
+dansguardian_install: True
+dansguardian_enabled: True
 
 # PostgreSQL - auto-installed by Moodle and/or Pathagar - no need to touch!
 postgresql_install: False
diff --git a/vars/local_vars_medium.yml b/vars/local_vars_medium.yml
index 77f860faf..c50b5551f 100644
--- a/vars/local_vars_medium.yml
+++ b/vars/local_vars_medium.yml
@@ -62,13 +62,6 @@ py_captive_portal_install: True
 py_captive_portal_enabled: True
 # In a pinch, disable it by running: systemctl disable py-captive-portal
 
-# Stages 3 & 4 must be run (using iiab-install or runrole) if changing these:
-squid_install: False
-squid_enabled: False
-
-dansguardian_install: False
-dansguardian_enabled: False
-
 # Unmaintained as of October 2017: https://github.com/iiab/iiab/pull/382
 # wondershaper_install: False
 # wondershaper_enabled: False
@@ -88,8 +81,16 @@ openvpn_handle: ""
 # The following seems necessary on CentOS:
 # openvpn_cron_enabled: True
 
+
 # 2-COMMON
 
+# exFAT_enabled: True is auto-enabled in roles/2-common/tasks/packages.yml
+# as set in 0-init/defaults/main.yml AND 0-init/tasks/main.yml
+
+# /usr/libexec/iiab-startup.sh is much like autoexec.bat & /etc/rc.local
+# It's put in place by 2-common/tasks/iiab-startup.yml at the end of Stage 2.
+
+
 # 3-BASE-SERVER
 
 # Make this False to disable http://box/common/services/power_off.php button:
@@ -104,7 +105,16 @@ apache_high_php_limits: False
 
 # 4-SERVER-OPTIONS
 
-# roles/network runs here (MANY SETTINGS ABOVE)
+# dnsmasq, named, dhcpd basics are installed here...in preparation for
+# the full roles/network = iiab-network that runs after 9-LOCAL-ADDONS
+
+# Squid
+squid_install: False
+squid_enabled: False
+
+# DansGuardian
+dansguardian_install: False
+dansguardian_enabled: False
 
 # PostgreSQL - auto-installed by Moodle and/or Pathagar - no need to touch!
 postgresql_install: False
diff --git a/vars/local_vars_min.yml b/vars/local_vars_min.yml
index f1d019891..470c99ee2 100644
--- a/vars/local_vars_min.yml
+++ b/vars/local_vars_min.yml
@@ -62,13 +62,6 @@ py_captive_portal_install: True
 py_captive_portal_enabled: True
 # In a pinch, disable it by running: systemctl disable py-captive-portal
 
-# Stages 3 & 4 must be run (using iiab-install or runrole) if changing these:
-squid_install: False
-squid_enabled: False
-
-dansguardian_install: False
-dansguardian_enabled: False
-
 # Unmaintained as of October 2017: https://github.com/iiab/iiab/pull/382
 # wondershaper_install: False
 # wondershaper_enabled: False
@@ -88,8 +81,16 @@ openvpn_handle: ""
 # The following seems necessary on CentOS:
 # openvpn_cron_enabled: True
 
+
 # 2-COMMON
 
+# exFAT_enabled: True is auto-enabled in roles/2-common/tasks/packages.yml
+# as set in 0-init/defaults/main.yml AND 0-init/tasks/main.yml
+
+# /usr/libexec/iiab-startup.sh is much like autoexec.bat & /etc/rc.local
+# It's put in place by 2-common/tasks/iiab-startup.yml at the end of Stage 2.
+
+
 # 3-BASE-SERVER
 
 # Make this False to disable http://box/common/services/power_off.php button:
@@ -104,7 +105,16 @@ apache_high_php_limits: False
 
 # 4-SERVER-OPTIONS
 
-# roles/network runs here (MANY SETTINGS ABOVE)
+# dnsmasq, named, dhcpd basics are installed here...in preparation for
+# the full roles/network = iiab-network that runs after 9-LOCAL-ADDONS
+
+# Squid
+squid_install: False
+squid_enabled: False
+
+# DansGuardian
+dansguardian_install: False
+dansguardian_enabled: False
 
 # PostgreSQL - auto-installed by Moodle and/or Pathagar - no need to touch!
 postgresql_install: False