diff --git a/all.yml b/all.yml
index 263e9d7..066f38c 100644
--- a/all.yml
+++ b/all.yml
@@ -1,6 +1,6 @@
 ---
 - hosts: lxd_host
-  tags: lxd_host
+  tags: container_install
   roles:
     - lxd_host
 
diff --git a/roles/dokuwiki/tasks/main.yml b/roles/dokuwiki/tasks/main.yml
index 83b067f..b0cb0ba 100644
--- a/roles/dokuwiki/tasks/main.yml
+++ b/roles/dokuwiki/tasks/main.yml
@@ -15,6 +15,7 @@
   import_tasks: dokuwiki.yml
 
 - name: backup block
+  tags: backup
   include_tasks: backup.yml
   vars:
     output: /tmp/
diff --git a/roles/lxd_host/tasks/lxd_host.yml b/roles/lxd_host/tasks/lxd_host.yml
deleted file mode 100644
index 0c46a5a..0000000
--- a/roles/lxd_host/tasks/lxd_host.yml
+++ /dev/null
@@ -1,77 +0,0 @@
----
-# TODO: use template for lxd-init --preseed
-- name: copy ssh pubkey from controller to lxd host
-  copy:
-    src: "{{ lookup('env', 'HOME') + '/.ssh/id_rsa.pub' }}"
-    dest: "{{ tmp_pubkey }}"
-
-# TODO: might make sense to add a cache redirect for alpine packages
-- include_tasks: tasks/container_install.yml
-  tags: container_install
-  vars:
-    container_name: "{{ item }}"
-    container_sshd_port: "{{ hostvars[item]['ansible_port'] }}"
-    container_ip: "{{ hostvars[item]['internal_ip'] }}"
-    tmp_sshd_config: "/tmp/sshd_config_{{ item }}"
-  with_items: "{{ groups['containers'] }}"
-
-- name: install iptables and iptables-persistent
-  tags: routing
-  become: yes
-  apt:
-    name: [iptables, iptables-persistent]
-    state: present
-  when: do_routing
-
-- name: add DNAT rules for containers
-  tags: routing
-  iptables:
-    table: nat
-    chain: PREROUTING
-    in_interface: "{{ host_iface }}"
-    protocol: tcp
-    match: tcp
-    source: "{{ host_cidr }}"
-    jump: DNAT
-    destination_port: "{{ hostvars[item]['ansible_port'] }}"
-    to_destination: "{{ hostvars[item]['internal_ip'] }}"
-  become: yes
-  with_items: "{{ groups['containers'] }}"
-  when: do_routing
-
-- name: save DNAT rules on lxd host
-  tags: routing
-  become: yes
-  community.general.iptables_state:
-    table: nat
-    state: saved
-    path: /etc/iptables/rules.v4
-  when: do_routing
-
-# TODO: add other dnat ports in above loop?
-#- name: add dokuwiki DNAT routing
-#  iptables:
-#    table: nat
-#    chain: PREROUTING
-#    in_interface: "{{ host_iface }}"
-#    protocol: tcp
-#    match: tcp
-#    source: "{{ host_cidr }}"
-#    jump: DNAT
-#    destination_port: "{{ hostvars['dokuwiki']['dnat_dest_port'] }}"
-#    to_destination: "{{ hostvars['dokuwiki']['internal_ip'] }}"
-#  become: yes
-#
-#- name: add freshrss DNAT routing
-#  iptables:
-#    table: nat
-#    chain: PREROUTING
-#    in_interface: "{{ host_iface }}"
-#    protocol: tcp
-#    match: tcp
-#    source: "{{ host_cidr }}"
-#    jump: DNAT
-#    destination_port: "{{ hostvars['freshrss']['dnat_dest_port'] }}"
-#    to_destination: "{{ hostvars['freshrss']['internal_ip'] }}"
-#  become: yes
-
diff --git a/roles/lxd_host/tasks/main.yml b/roles/lxd_host/tasks/main.yml
index fabc52b..5854337 100644
--- a/roles/lxd_host/tasks/main.yml
+++ b/roles/lxd_host/tasks/main.yml
@@ -1,5 +1,5 @@
 ---
-- import_tasks: lxd_host.yml
+- name: main lxd_host block
   vars:
     img_server: https://images.linuxcontainers.org
     alp_img_alias: alpine/3.13/amd64
@@ -9,5 +9,80 @@
     tmp_pubkey: /tmp/controller_key_rsa.pub
     host_iface: enp2s0
     host_cidr: '192.168.11.0/24'
-    do_routing: false
+  block:
+  # TODO: use template for lxd-init --preseed
+  - name: copy ssh pubkey from controller to lxd host
+    copy:
+      src: "{{ lookup('env', 'HOME') + '/.ssh/id_rsa.pub' }}"
+      dest: "{{ tmp_pubkey }}"
+
+  # TODO: might make sense to add a cache redirect for alpine packages
+  - include_tasks: tasks/container_install.yml
+    tags: container_install
+    vars:
+      container_name: "{{ item }}"
+      container_sshd_port: "{{ hostvars[item]['ansible_port'] }}"
+      container_ip: "{{ hostvars[item]['internal_ip'] }}"
+      tmp_sshd_config: "/tmp/sshd_config_{{ item }}"
+    with_items: "{{ groups['containers'] }}"
+
+  - name: install iptables and iptables-persistent
+    tags: routing
+    become: yes
+    apt:
+      name: [iptables, iptables-persistent]
+      state: present
+    when: "'routing' in ansible_run_tags"
+
+  - name: add DNAT rules for containers
+    tags: routing
+    iptables:
+      table: nat
+      chain: PREROUTING
+      in_interface: "{{ host_iface }}"
+      protocol: tcp
+      match: tcp
+      source: "{{ host_cidr }}"
+      jump: DNAT
+      destination_port: "{{ hostvars[item]['ansible_port'] }}"
+      to_destination: "{{ hostvars[item]['internal_ip'] }}"
+    become: yes
+    with_items: "{{ groups['containers'] }}"
+    when: "'routing' in ansible_run_tags"
+
+  - name: save DNAT rules on lxd host
+    tags: routing
+    become: yes
+    community.general.iptables_state:
+      table: nat
+      state: saved
+      path: /etc/iptables/rules.v4
+    when: "'routing' in ansible_run_tags"
+
+  # TODO: add other dnat ports in above loop?
+  #- name: add dokuwiki DNAT routing
+  #  iptables:
+  #    table: nat
+  #    chain: PREROUTING
+  #    in_interface: "{{ host_iface }}"
+  #    protocol: tcp
+  #    match: tcp
+  #    source: "{{ host_cidr }}"
+  #    jump: DNAT
+  #    destination_port: "{{ hostvars['dokuwiki']['dnat_dest_port'] }}"
+  #    to_destination: "{{ hostvars['dokuwiki']['internal_ip'] }}"
+  #  become: yes
+  #
+  #- name: add freshrss DNAT routing
+  #  iptables:
+  #    table: nat
+  #    chain: PREROUTING
+  #    in_interface: "{{ host_iface }}"
+  #    protocol: tcp
+  #    match: tcp
+  #    source: "{{ host_cidr }}"
+  #    jump: DNAT
+  #    destination_port: "{{ hostvars['freshrss']['dnat_dest_port'] }}"
+  #    to_destination: "{{ hostvars['freshrss']['internal_ip'] }}"
+  #  become: yes