diff --git a/roles/dns-nsd/defaults/main.yml b/roles/dns-nsd/defaults/main.yml
index 5dcbddf..c5ff6e7 100644
--- a/roles/dns-nsd/defaults/main.yml
+++ b/roles/dns-nsd/defaults/main.yml
@@ -5,6 +5,8 @@
 nsd_zonesdir: "/var/nsd/zones"
 nsd_group: "nsd"
 
+nsd_zones: []
+
 # default DNS TTL
 dns_ttl: 3600
 
diff --git a/roles/dns-nsd/tasks/main.yml b/roles/dns-nsd/tasks/main.yml
index bd87f99..56c452c 100644
--- a/roles/dns-nsd/tasks/main.yml
+++ b/roles/dns-nsd/tasks/main.yml
@@ -10,33 +10,41 @@
 
 - name: Ensure that zones directory exists
   file:
-    name={{ nsd_zonesdir }}
-    state=directory
-    mode=0755 owner=root group={{ nsd_group }}
+    name: "{{ nsd_zonesdir }}"
+    state: directory
+    mode: 0755
+    owner: root
+    group: "{{ nsd_group }}"
 
 - name: Create nsd.conf from template
   template:
-    src=nsd.conf.j2
-    dest={{ nsd_conf }}
-    mode=0644 owner=root group={{ nsd_group }}
+    src: nsd.conf.j2
+    dest: "{{ nsd_conf }}"
+    mode: 0644
+    owner: root
+    group: "{{ nsd_group }}"
   notify:
     - restart-nsd
 
 - name: create forward zonefiles from template
   template:
-    src=zone.forward.j2
-    dest={{ nsd_zonesdir }}/{{ item.name }}.forward
-    mode=0644 owner=root group={{ nsd_group }}
-  with_items: '{{ nsd_zones }}'
+    src: zone.forward.j2
+    dest: "{{ nsd_zonesdir }}/{{ item.name }}.forward"
+    mode: 0644
+    owner: root
+    group: "{{ nsd_group }}"
+  with_items: "{{ nsd_zones }}"
   notify:
     - reload-nsd
 
 - name: create reverse zonefiles from template
   template:
-    src=zone.reverse.j2
-    dest={{ nsd_zonesdir }}/{{ item.name }}.reverse
-    mode=0644 owner=root group={{ nsd_group }}
-  with_items: '{{ nsd_zones }}'
+    src: zone.reverse.j2
+    dest: "{{ nsd_zonesdir }}/{{ item.name }}.reverse"
+    mode: 0644
+    owner: root
+    group: "{{ nsd_group }}"
+  with_items: "{{ nsd_zones }}"
   notify:
     - reload-nsd
 
diff --git a/roles/dns-unbound/tasks/main.yml b/roles/dns-unbound/tasks/main.yml
index 03a80d3..cfd1546 100644
--- a/roles/dns-unbound/tasks/main.yml
+++ b/roles/dns-unbound/tasks/main.yml
@@ -10,9 +10,11 @@
 
 - name: create unbound.conf from template
   template:
-    src=unbound.conf.j2
-    dest={{ unbound_conf }}
-    mode=0644 owner=root group={{ unbound_group }}
+    src: unbound.conf.j2
+    dest: "{{ unbound_conf }}"
+    mode: 0644
+    owner: root
+    group: "{{ unbound_group }}"
     # validate='unbound-checkconf %s' - can't use, checks path, not just config.
   notify:
    - restart-unbound
diff --git a/roles/docker-install/tasks/main.yml b/roles/docker-install/tasks/main.yml
index c7b7d73..fac17d8 100644
--- a/roles/docker-install/tasks/main.yml
+++ b/roles/docker-install/tasks/main.yml
@@ -30,19 +30,15 @@
     update_cache: yes
     cache_valid_time: 3600
 
-- name: Remove obsolete docker-py pip module
-  become: yes
-  pip:
-    name: docker-py
-    state: absent
-
-- name: Install pip modules for docker and docker-compose
+- name: Install docker-compose, docker python module, imagebuilder deps via pip
   become: yes
   pip:
     name: "{{ item }}"
   with_items:
     - docker>=2.4.2
     - docker-compose>=1.14.0
+    - gitpython
+    - graphviz
 
 - name: Make current user part of the Docker group
   become: yes
@@ -51,3 +47,8 @@
     groups: "docker"
     append: yes
 
+# Doesn't work right now, but reported: https://github.com/ansible/ansible/issues/24794
+# see also http://docs.ansible.com/ansible/intro_configuration.html#openssh-specific-settings
+- name: Reset ssh connection so user gains docker group membership
+  meta: reset_connection
+