diff --git a/group_vars/cirunner.yml b/group_vars/cirunner.yml
new file mode 100644
index 0000000..0b7f509
--- /dev/null
+++ b/group_vars/cirunner.yml
@@ -0,0 +1,4 @@
+---
+firewall_in:
+  - {proto: tcp, port: 22, from: [172.20.20.0/22]}
+  - {proto: tcp, port: 9100, from: [172.20.20.0/22]}
diff --git a/host_vars/ci-runner02.home.foo.sh.yml b/host_vars/ci-runner02.home.foo.sh.yml
new file mode 100644
index 0000000..617957c
--- /dev/null
+++ b/host_vars/ci-runner02.home.foo.sh.yml
@@ -0,0 +1,6 @@
+---
+vmhost: vmhost02.home.foo.sh
+network_interfaces:
+  - device: eth0
+    vlan: 20
+    mac: 52:54:00:ac:dc:7c
diff --git a/hosts.yml b/hosts.yml
index dd1fe07..4474676 100644
--- a/hosts.yml
+++ b/hosts.yml
@@ -11,6 +11,9 @@ audiobooks:
 backup:
   hosts:
     backup02.home.foo.sh:
+cirunner:
+  hosts:
+    ci-runner02.home.foo.sh:
 collab:
   hosts:
     collab01.home.foo.sh:
@@ -172,6 +175,7 @@ rocky9:
   children:
     adm:
     audiobooks:
+    cirunner:
     forgejo:
     frigate:
     homeassistant:
diff --git a/playbooks/ci-runner.yml b/playbooks/ci-runner.yml
new file mode 100644
index 0000000..90bd266
--- /dev/null
+++ b/playbooks/ci-runner.yml
@@ -0,0 +1,13 @@
+---
+- name: Deploy KVM virtual machines
+  ansible.builtin.import_playbook: include/deploy-kvm-guest.yml
+  vars:
+    myhosts: cirunner
+
+- name: Configure instance
+  hosts: cirunner
+  user: root
+  gather_facts: true
+
+  roles:
+    - base