diff --git a/tasks/Debian.yml b/tasks/Debian.yml
new file mode 100644
index 0000000..b61b40e
--- /dev/null
+++ b/tasks/Debian.yml
@@ -0,0 +1,34 @@
+---
+# devtools tasks/Debian.yml
+#
+# SPDX-FileCopyrightText: 2022 Open Networking Foundation <support@opennetworking.org>
+# SPDX-License-Identifier: Apache-2.0
+
+- name: install base Debian tools
+  apt:
+    name:
+      - acl
+      - apt-transport-https
+      - build-essential
+      - ca-certificates
+      - curl
+      - file
+      - git
+      - git-crypt
+      - gnupg
+      - jq
+      - libenchant-2-dev
+      - libxml2-utils
+      - python-is-python3
+      - python3
+      - python3-dev
+      - python3-pip
+      - python3-venv
+      - rsync
+      - sshpass
+      - sudo
+      - tar
+      - unzip
+    state: present
+    update_cache: true
+    cache_valid_time: 3600
diff --git a/tasks/bazel.yml b/tasks/bazel.yml
new file mode 100644
index 0000000..d730ee7
--- /dev/null
+++ b/tasks/bazel.yml
@@ -0,0 +1,13 @@
+---
+# devtools tasks/bazel.yml
+#
+# SPDX-FileCopyrightText: 2022 Open Networking Foundation <support@opennetworking.org>
+# SPDX-License-Identifier: Apache-2.0
+
+# bazelisk
+- name: Download/install bazelisk binary
+  get_url:
+    url: "{{ devtools_bazelisk_url }}"
+    checksum: "{{ devtools_bazelisk_checksum }}"
+    dest: /usr/local/bin/bazel
+    mode: "0755"
diff --git a/tasks/chromium.yml b/tasks/chromium.yml
new file mode 100644
index 0000000..b432191
--- /dev/null
+++ b/tasks/chromium.yml
@@ -0,0 +1,12 @@
+---
+# devtools tasks/chromium.yml
+#
+# SPDX-FileCopyrightText: 2022 Open Networking Foundation <support@opennetworking.org>
+# SPDX-License-Identifier: Apache-2.0
+
+- name: install chromium browser
+  apt:
+    name: "{{ devtools_chromium_apt }}"
+    state: present
+    update_cache: true
+    cache_valid_time: 3600
diff --git a/tasks/java11.yml b/tasks/java11.yml
new file mode 100644
index 0000000..76e17f7
--- /dev/null
+++ b/tasks/java11.yml
@@ -0,0 +1,14 @@
+---
+# devtools tasks/java.yml
+#
+# SPDX-FileCopyrightText: 2022 Open Networking Foundation <support@opennetworking.org>
+# SPDX-License-Identifier: Apache-2.0
+#
+- name: install Java 11 dev tools (only needed on physical/VM)
+  apt:
+    name:
+      - maven
+      - openjdk-11-jdk-headless
+    state: present
+    update_cache: true
+    cache_valid_time: 3600
diff --git a/tasks/k8s.yml b/tasks/k8s.yml
new file mode 100644
index 0000000..d9e1cc5
--- /dev/null
+++ b/tasks/k8s.yml
@@ -0,0 +1,101 @@
+---
+# devtools tasks/k8s.yml
+#
+# SPDX-FileCopyrightText: 2022 Open Networking Foundation <support@opennetworking.org>
+# SPDX-License-Identifier: Apache-2.0
+
+
+# kubectl
+- name: Download/install kubectl binary
+  get_url:
+    url: "{{ devtools_kubectl_url }}"
+    checksum: "{{ devtools_kubectl_checksum }}"
+    dest: /usr/local/bin/kubectl
+    mode: "0755"
+
+# kind
+- name: Download/install kind binary
+  get_url:
+    url: "{{ devtools_kind_url }}"
+    checksum: "{{ devtools_kind_checksum }}"
+    dest: /usr/local/bin/kind
+    mode: "0755"
+
+# helm
+- name: Download helm archive
+  get_url:
+    url: "{{ devtools_helm_url }}"
+    checksum: "{{ devtools_helm_checksum }}"
+    dest: "/tmp/helm.tgz"
+
+- name: Unarchive helm
+  unarchive:
+    src: "/tmp/helm.tgz"
+    dest: "/tmp"
+    remote_src: true
+
+- name: Install helm binary
+  copy:
+    src: /tmp/linux-amd64/helm
+    dest: /usr/local/bin/helm
+    mode: "0755"
+    remote_src: true
+
+# kubeval
+- name: Download kubeval archive
+  get_url:
+    url: "{{ devtools_kubeval_url }}"
+    checksum: "{{ devtools_kubeval_checksum }}"
+    dest: "/tmp/kubeval.tgz"
+
+- name: Unarchive kubeval
+  unarchive:
+    src: "/tmp/kubeval.tgz"
+    dest: "/tmp"
+    remote_src: true
+
+- name: Install kubeval binary
+  copy:
+    src: /tmp/kubeval
+    dest: /usr/local/bin/kubeval
+    mode: "0755"
+    remote_src: true
+
+# conftest
+- name: Download conftest archive
+  get_url:
+    url: "{{ devtools_conftest_url }}"
+    checksum: "{{ devtools_conftest_checksum }}"
+    dest: "/tmp/conftest.tgz"
+
+- name: Unarchive conftest
+  unarchive:
+    src: "/tmp/conftest.tgz"
+    dest: "/tmp"
+    remote_src: true
+
+- name: Install conftest binary
+  copy:
+    src: /tmp/conftest
+    dest: /usr/local/bin/conftest
+    mode: "0755"
+    remote_src: true
+
+# fleet
+- name: Download/install fleet binary
+  get_url:
+    url: "{{ devtools_fleet_url }}"
+    checksum: "{{ devtools_fleet_checksum }}"
+    dest: /usr/local/bin/fleet
+    mode: "0755"
+
+# cleanup
+- name: Cleanup k8s downloads in /tmp
+  file:
+    path: "/tmp/{{ item }}"
+    state: absent
+  with_items:
+    - linux-amd64
+    - helm.tgz
+    - kubeval.tgz
+    - conftest.tgz
diff --git a/tasks/main.yml b/tasks/main.yml
new file mode 100644
index 0000000..f4fe901
--- /dev/null
+++ b/tasks/main.yml
@@ -0,0 +1,44 @@
+---
+# devtools tasks/main.yml
+#
+# SPDX-FileCopyrightText: 2022 Open Networking Foundation <support@opennetworking.org>
+# SPDX-License-Identifier: Apache-2.0
+
+- name: include OS-specific vars
+  include_vars: "{{ ansible_os_family }}.yml"
+
+- name: include OS-specific tasks
+  include_tasks: "{{ ansible_os_family }}.yml"
+
+# repo
+- name: Download repo launcher
+  get_url:
+    url: "{{ devtools_repo_url }}"
+    checksum: "{{ devtools_repo_checksum }}"
+    dest: /tmp/repo.b64
+
+- name: Decode, fix shebang, and make repo launcher executable
+  shell:
+    cmd: |
+      base64 --decode /tmp/repo.b64 > /tmp/repo
+      # force repo launcher to use python3 - not needed if python-is-python3 installed
+      sed -i.bak 's"#!/usr/bin/env python"#!/usr/bin/env python3"' /tmp/repo
+      cp /tmp/repo /usr/local/bin/repo
+      chmod 755 /usr/local/bin/repo
+    creates: /usr/local/bin/repo
+
+# cleanup
+- name: Clean up downloads in /tmp
+  file:
+    path: "/tmp/{{ item }}"
+    state: absent
+  with_items:
+    - repo.b64
+    - repo.bak
+    - repo
+
+- name: Install additional devtools
+  include_tasks: "{{ dt_inst_item }}.yml"
+  loop: "{{ devtools_install | flatten(levels=1) }}"
+  loop_control:
+    loop_var: dt_inst_item
diff --git a/tasks/python2.yml b/tasks/python2.yml
new file mode 100644
index 0000000..2b275e6
--- /dev/null
+++ b/tasks/python2.yml
@@ -0,0 +1,11 @@
+---
+# SPDX-FileCopyrightText: 2022 Open Networking Foundation <info@opennetworking.org>
+# SPDX-License-Identifier: Apache-2.0
+
+- name: Install python2 (deprecated)
+  apt:
+    name:
+      - python2
+    state: present
+    update_cache: true
+    cache_valid_time: 3600
diff --git a/tasks/shellcheck.yml b/tasks/shellcheck.yml
new file mode 100644
index 0000000..deeb6d0
--- /dev/null
+++ b/tasks/shellcheck.yml
@@ -0,0 +1,33 @@
+---
+# devtools tasks/shellcheck.yml
+#
+# SPDX-FileCopyrightText: 2022 Open Networking Foundation <support@opennetworking.org>
+# SPDX-License-Identifier: Apache-2.0
+
+- name: Download shellcheck archive
+  get_url:
+    url: "{{ devtools_shellcheck_url }}"
+    checksum: "{{ devtools_shellcheck_checksum }}"
+    dest: "/tmp/shellcheck.tar.xz"
+
+- name: Unarchive shellcheck
+  unarchive:
+    src: "/tmp/shellcheck.tar.xz"
+    dest: "/tmp"
+    remote_src: true
+
+- name: Install shellcheck binary
+  copy:
+    src: "/tmp/shellcheck-v{{ devtools_shellcheck_version }}/shellcheck"
+    dest: /usr/local/bin/shellcheck
+    mode: "0755"
+    remote_src: true
+
+# cleanup
+- name: Cleanup shellcheck downloads in /tmp
+  file:
+    path: "/tmp/{{ item }}"
+    state: absent
+  with_items:
+    - shellcheck.tar.xz
+    - "shellcheck-v{{ devtools_shellcheck_version }}"
diff --git a/tasks/terraform.yml b/tasks/terraform.yml
new file mode 100644
index 0000000..11bb240
--- /dev/null
+++ b/tasks/terraform.yml
@@ -0,0 +1,41 @@
+---
+# devtools tasks/terraform.yml
+#
+# SPDX-FileCopyrightText: 2022 Open Networking Foundation <support@opennetworking.org>
+# SPDX-License-Identifier: Apache-2.0
+
+# terraform
+- name: Download terraform archive
+  get_url:
+    url: "{{ devtools_terraform_url }}"
+    checksum: "{{ devtools_terraform_checksum }}"
+    dest: "/tmp/terraform.zip"
+
+- name: Unarchive terraform
+  unarchive:
+    src: "/tmp/terraform.zip"
+    dest: "/tmp"
+    remote_src: true
+
+- name: Install terraform binary
+  copy:
+    src: /tmp/terraform
+    dest: /usr/local/bin/terraform
+    mode: "0755"
+    remote_src: true
+
+# tfmask
+- name: Download/install tfmask binary
+  get_url:
+    url: "{{ devtools_tfmask_url }}"
+    checksum: "{{ devtools_tfmask_checksum }}"
+    dest: /usr/local/bin/tfmask
+    mode: "0755"
+
+# cleanup
+- name: Cleanup terraform downloads in /tmp
+  file:
+    path: "/tmp/{{ item }}"
+    state: absent
+  with_items:
+    - terraform.zip
diff --git a/tasks/vagrant.yml b/tasks/vagrant.yml
new file mode 100644
index 0000000..9de01ed
--- /dev/null
+++ b/tasks/vagrant.yml
@@ -0,0 +1,14 @@
+---
+# SPDX-FileCopyrightText: 2022 Open Networking Foundation <info@opennetworking.org>
+# SPDX-License-Identifier: Apache-2.0
+
+# Vagrant/virtualbox (note: Debian and variants specific)
+
+- name: Add Vagrant/Virtualbox using apt
+  apt:
+    name:
+      - vagrant
+      - virtualbox
+    state: present
+    update_cache: true
+    cache_valid_time: 3600
diff --git a/tasks/yq.yml b/tasks/yq.yml
new file mode 100644
index 0000000..3272d8c
--- /dev/null
+++ b/tasks/yq.yml
@@ -0,0 +1,13 @@
+---
+# devtools tasks/yq.yml
+#
+# SPDX-FileCopyrightText: 2022 Open Networking Foundation <support@opennetworking.org>
+# SPDX-License-Identifier: Apache-2.0
+
+# yq
+- name: Download/install yq binary
+  get_url:
+    url: "{{ devtools_yq_url }}"
+    checksum: "{{ devtools_yq_checksum }}"
+    dest: /usr/local/bin/yq
+    mode: "0755"