diff --git a/host_vars/tschunk.binary.kitchen b/host_vars/tschunk.binary.kitchen
new file mode 100644
index 0000000..296c9ca
--- /dev/null
+++ b/host_vars/tschunk.binary.kitchen
@@ -0,0 +1,7 @@
+---
+
+root_keys_host:
+- "# Thomas Schmid"
+- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC0Wq37DP89UO6MiJvvRbsXEcEV9d5/JJb7K2R0WHsHa sct39667@m-mob-062"
+
+uau_reboot: "true"
diff --git a/hosts b/hosts
index 109b46d..2b52ef7 100644
--- a/hosts
+++ b/hosts
@@ -10,6 +10,7 @@ pancake.binary.kitchen ansible_host=172.23.2.34
 knoedel.binary.kitchen ansible_host=172.23.2.35
 bob.binary.kitchen ansible_host=172.23.2.37
 lasagne.binary.kitchen ansible_host=172.23.2.38
+tschunk.binary.kitchen ansible_host=172.23.2.39
 bowle.binary.kitchen ansible_host=172.23.2.62
 salat.binary.kitchen ansible_host=172.23.9.61
 [auweg]
diff --git a/roles/dns_intern/templates/bind/23.172.in-addr.arpa.zone.j2 b/roles/dns_intern/templates/bind/23.172.in-addr.arpa.zone.j2
index 9b81395..c11caba 100644
--- a/roles/dns_intern/templates/bind/23.172.in-addr.arpa.zone.j2
+++ b/roles/dns_intern/templates/bind/23.172.in-addr.arpa.zone.j2
@@ -1,7 +1,7 @@
 $ORIGIN 23.172.in-addr.arpa.	; base for unqualified names
 $TTL 1h				; default time-to-live
 @				IN	SOA ns1.binary.kitchen. hostmaster.binary.kitchen. (
-					2022102201; serial
+					2023011601; serial
 					1d; refresh
 					2h; retry
 					4w; expire
@@ -51,6 +51,7 @@ $TTL 1h				; default time-to-live
 36.2				IN	PTR	schweinshaxn.binary.kitchen.
 37.2				IN	PTR	bob.binary.kitchen.
 38.2				IN	PTR	lasagne.binary.kitchen.
+39.2				IN	PTR	tschunk.binary.kitchen.
 62.2				IN	PTR	bowle.binary.kitchen.
 91.2				IN	PTR	strammermax.binary.kitchen.
 92.2				IN	PTR	obatzda.binary.kitchen.
diff --git a/roles/dns_intern/templates/bind/binary.kitchen.zone.j2 b/roles/dns_intern/templates/bind/binary.kitchen.zone.j2
index d319e13..512e6e6 100644
--- a/roles/dns_intern/templates/bind/binary.kitchen.zone.j2
+++ b/roles/dns_intern/templates/bind/binary.kitchen.zone.j2
@@ -1,7 +1,7 @@
 $ORIGIN binary.kitchen		; base for unqualified names
 $TTL 1h				; default time-to-live
 @				IN	SOA ns1.binary.kitchen. hostmaster.binary.kitchen. (
-					2022102201; serial
+					2023011601; serial
 					1d; refresh
 					2h; retry
 					4w; expire
@@ -75,6 +75,7 @@ knoedel				IN	A	172.23.2.35
 schweinshaxn			IN	A	172.23.2.36
 bob				IN	A	172.23.2.37
 lasagne				IN	A	172.23.2.38
+tschunk				IN	A	172.23.2.39
 bowle				IN	A	172.23.2.62
 strammermax			IN	A	172.23.2.91
 obatzda				IN	A	172.23.2.92
diff --git a/roles/strichliste/meta/main.yml b/roles/strichliste/meta/main.yml
new file mode 100644
index 0000000..a456842
--- /dev/null
+++ b/roles/strichliste/meta/main.yml
@@ -0,0 +1,4 @@
+---
+
+dependencies:
+- { role: acertmgr }
diff --git a/roles/strichliste/tasks/main.yml b/roles/strichliste/tasks/main.yml
new file mode 100644
index 0000000..80b8c8d
--- /dev/null
+++ b/roles/strichliste/tasks/main.yml
@@ -0,0 +1,4 @@
+---
+
+- name: Request nsupdate key for certificate
+  include_role: name=acme-dnskey-generate
diff --git a/site.yml b/site.yml
index 938d7ee..65ea92f 100644
--- a/site.yml
+++ b/site.yml
@@ -7,7 +7,7 @@
   - root_keys
 
 - name: Setup unattended updates
-  hosts: [sulis.binary.kitchen, nabia.binary.kitchen, epona.binary.kitchen, pizza.binary.kitchen, pancake.binary.kitchen, knoedel.binary.kitchen, bob.binary.kitchen, lasagne.binary.kitchen, bowle.binary.kitchen, beryllium.binary-kitchen.net, boron.binary-kitchen.net, carbon.binary-kitchen.net, nitrogen.binary-kitchen.net, oxygen.binary-kitchen.net, fluorine.binary-kitchen.net, neon.binary-kitchen.net, sodium.binary-kitchen.net, magnesium.binary-kitchen.net, krypton.binary-kitchen.net, yttrium.binary-kitchen.net, zirconium.binary-kitchen.net, molybdenum.binary-kitchen.net, ruthenium.binary-kitchen.net, rhodium.binary-kitchen.net, barium.binary-kitchen.net]
+  hosts: [sulis.binary.kitchen, nabia.binary.kitchen, epona.binary.kitchen, pizza.binary.kitchen, pancake.binary.kitchen, knoedel.binary.kitchen, bob.binary.kitchen, lasagne.binary.kitchen, tschunk.binary.kitchen, bowle.binary.kitchen, beryllium.binary-kitchen.net, boron.binary-kitchen.net, carbon.binary-kitchen.net, nitrogen.binary-kitchen.net, oxygen.binary-kitchen.net, fluorine.binary-kitchen.net, neon.binary-kitchen.net, sodium.binary-kitchen.net, magnesium.binary-kitchen.net, krypton.binary-kitchen.net, yttrium.binary-kitchen.net, zirconium.binary-kitchen.net, molybdenum.binary-kitchen.net, ruthenium.binary-kitchen.net, rhodium.binary-kitchen.net, barium.binary-kitchen.net]
   roles:
   - uau
 
@@ -52,6 +52,11 @@
   roles:
   - drone_runner
 
+- name: Setup strichliste runner
+  hosts: tschunk.binary.kitchen
+  roles:
+  - strichliste
+
 - name: Setup file server
   hosts: bowle.binary.kitchen
   roles: