diff --git a/playbook.yml b/playbook.yml
new file mode 100644
index 0000000..c813f92
--- /dev/null
+++ b/playbook.yml
@@ -0,0 +1,125 @@
+- name: Провижнинг приёмников пеленгации
+  hosts: all
+  tasks:
+
+    - name: apt update и full-upgrade
+      become: true
+      ansible.builtin.apt:
+        update_cache: true
+        cache_valid_time: 3600
+        upgrade: full
+      tags: [base]
+
+    - name: Зависимости сборки и утилиты HackRF
+      become: true
+      ansible.builtin.apt:
+        name: [cmake, g++, pkg-config, git, rsync, libhackrf-dev, libusb-1.0-0-dev, libfftw3-dev, hackrf]
+        state: present
+      tags: [base]
+
+    - name: pi в группе plugdev (udev HackRF)
+      become: true
+      ansible.builtin.user:
+        name: pi
+        groups: plugdev
+        append: true
+      tags: [base]
+
+    - name: Имя узла
+      become: true
+      ansible.builtin.hostname:
+        name: "{{ inventory_hostname }}"
+      tags: [hostname]
+
+    - name: Имя узла в /etc/hosts
+      become: true
+      ansible.builtin.lineinfile:
+        path: /etc/hosts
+        regexp: '^127\.0\.1\.1'
+        line: "127.0.1.1\t{{ inventory_hostname }}"
+      tags: [hostname]
+
+    - name: Deploy-ключ есть в keys/
+      delegate_to: localhost
+      run_once: true
+      ansible.builtin.stat:
+        path: "{{ playbook_dir }}/keys/gitea_deploy"
+      register: deploy_key
+      tags: [key]
+
+    - name: Ключа нет
+      run_once: true
+      ansible.builtin.fail:
+        msg: "[!] нет keys/gitea_deploy -- запустите scripts/gen-key.sh"
+      when: not deploy_key.stat.exists
+      tags: [key]
+
+    - name: ~/.ssh
+      ansible.builtin.file:
+        path: ~/.ssh
+        state: directory
+        mode: "0700"
+      tags: [key]
+
+    - name: Приватный deploy-ключ
+      ansible.builtin.copy:
+        src: "{{ playbook_dir }}/keys/gitea_deploy"
+        dest: ~/.ssh/gitea_deploy
+        mode: "0600"
+      tags: [key]
+
+    - name: ssh config для Gitea
+      ansible.builtin.blockinfile:
+        path: ~/.ssh/config
+        create: true
+        mode: "0600"
+        marker: "# {mark} fleet gitea"
+        block: |
+          Host {{ gitea_host }}
+            Port {{ gitea_port }}
+            User git
+            IdentityFile ~/.ssh/gitea_deploy
+            IdentitiesOnly yes
+      tags: [key]
+
+    - name: Gitea в known_hosts
+      ansible.builtin.known_hosts:
+        name: "[{{ gitea_host }}]:{{ gitea_port }}"
+        key: "{{ lookup('pipe', 'ssh-keyscan -p ' ~ gitea_port ~ ' -t ed25519 ' ~ gitea_host ~ ' 2>/dev/null') }}"
+        path: ~/.ssh/known_hosts
+      tags: [key]
+
+    - name: Локальные правки в репо (rsync-разработка)?
+      ansible.builtin.command: git status --porcelain
+      args:
+        chdir: ~/hackrf-scanner
+      register: dirty
+      failed_when: false
+      changed_when: false
+      tags: [repo]
+
+    - name: Stash локальных правок перед обновлением
+      ansible.builtin.command: git stash push -m fleet-provision
+      args:
+        chdir: ~/hackrf-scanner
+      when: dirty.rc == 0 and dirty.stdout != ""
+      tags: [repo]
+
+    - name: Репозиторий hackrf-scanner
+      ansible.builtin.git:
+        repo: "{{ scanner_repo }}"
+        dest: ~/hackrf-scanner
+        version: "{{ scanner_branch }}"
+        update: true
+      register: repo
+      tags: [repo]
+
+    - name: Сборка
+      ansible.builtin.shell: |
+        cmake -B build -DCMAKE_BUILD_TYPE=RelWithDebInfo >/dev/null
+        cmake --build build -j4
+      args:
+        chdir: ~/hackrf-scanner
+      register: build
+      changed_when: "'Building CXX' in build.stdout or 'Linking' in build.stdout"
+      tags: [build]