diff --git a/all.yml b/all.yml
index 6c26075..9e5a855 100644
--- a/all.yml
+++ b/all.yml
@@ -4,14 +4,14 @@
   roles:
     - lxd_host
 
-#- hosts: haproxy
-#  roles:
-#    - haproxy
-
-# TODO: break out container init into container_default role?
+- hosts: haproxy
+  tags: containers, haproxy
+  roles:
+    - haproxy
 
 - hosts:
-    - dokuwiki
+    # TODO: fix dokuwiki role
+    #- dokuwiki
     - freshrss
     - gitweb
   tags: containers
@@ -19,11 +19,11 @@
     - webserver
 
 - hosts: freshrss
-  tags: [containers, freshrss]
+  tags: containers, freshrss
   roles:
     - freshrss
 
 - hosts: dokuwiki
-  tags: containers
+  tags: containers, dokuwiki
   roles:
     - dokuwiki
diff --git a/roles/dokuwiki/tasks/dokuwiki.yml b/roles/dokuwiki/tasks/dokuwiki.yml
index c5ba0dc..ef9aab9 100644
--- a/roles/dokuwiki/tasks/dokuwiki.yml
+++ b/roles/dokuwiki/tasks/dokuwiki.yml
@@ -55,10 +55,14 @@
       name: "{{ packages | join(' ') }}"
       state: present
 
-  - name: copy lighttpd.conf
-    copy:
-      src: ../templates/lighttpd.conf.j2
-      dest: /etc/lighttpd/lighttpd.conf
+# TODO: replace seperate template with 'line in file'
+#$HTTP["url"] =~ "^/dokuwiki/(data|conf|bin|inc|vendor)/+." {
+#    url.access-deny = ("")
+#}
+#  - name: copy lighttpd.conf
+#    copy:
+#      src: ../templates/lighttpd.conf.j2
+#      dest: /etc/lighttpd/lighttpd.conf
 
   - name: ensure lighttpd service is started
     service:
diff --git a/roles/dokuwiki/tasks/main.yml b/roles/dokuwiki/tasks/main.yml
new file mode 100644
index 0000000..9ad032c
--- /dev/null
+++ b/roles/dokuwiki/tasks/main.yml
@@ -0,0 +1,30 @@
+---
+#- name: include dokuwiki install task
+#  include_tasks: dokuwiki.yml
+
+- name: backup block
+  when: "'backup' in ansible_run_tags"
+  vars:
+    output: /tmp/
+    archive: /tmp/dokuwiki_backup.tgz
+    doku_path: /var/www/localhost/htdocs/dokuwiki/
+  block:
+    - name: make dokuwiki archive
+      community.general.archive:
+        dest: "{{ archive }}"
+        path:
+          - "{{ doku_path }} + conf"
+          - "{{ doku_path }} + data"
+          - "{{ doku_path }} + lib/plugins"
+
+    - name: copy archive to controller
+      fetch:
+        src: "{{ archive }}"
+        dest: "{{ output }}"
+        flat: yes
+
+    - name: remove remote archive
+      file:
+        path: "{{ archive }}"
+        state: absent
+
diff --git a/roles/haproxy/tasks/main.yml b/roles/haproxy/tasks/main.yml
new file mode 100644
index 0000000..e69de29