diff --git a/ansible/roles/day0-baseline/defaults/main.yml b/ansible/roles/day0-baseline/defaults/main.yml
new file mode 100644
index 0000000..61a966e
--- /dev/null
+++ b/ansible/roles/day0-baseline/defaults/main.yml
@@ -0,0 +1,12 @@
+---
+# Timezone
+timezone: "UTC"
+
+# Packages to ensure are present
+baseline_packages:
+  - chrony
+  - vim
+  - htop
+  - curl
+  - wget
+  - rsync
\ No newline at end of file
diff --git a/ansible/roles/day0-baseline/handlers/main.yml b/ansible/roles/day0-baseline/handlers/main.yml
new file mode 100644
index 0000000..4d149ce
--- /dev/null
+++ b/ansible/roles/day0-baseline/handlers/main.yml
@@ -0,0 +1,6 @@
+---
+- name: Restart sshd
+  ansible.builtin.systemd:
+    name: sshd
+    state: restarted
+  become: true
\ No newline at end of file
diff --git a/ansible/roles/day0-baseline/tasks/main.yml b/ansible/roles/day0-baseline/tasks/main.yml
new file mode 100644
index 0000000..65382cd
--- /dev/null
+++ b/ansible/roles/day0-baseline/tasks/main.yml
@@ -0,0 +1,32 @@
+---
+- name: Set timezone
+  community.general.timezone:
+    name: "{{ timezone }}"
+  become: true
+
+- name: Enable and start chronyd
+  ansible.builtin.systemd:
+    name: chronyd
+    state: started
+    enabled: true
+  become: true
+
+- name: Update all packages
+  ansible.builtin.package:
+    name: "*"
+    state: latest
+  become: true
+
+- name: Install baseline packages
+  ansible.builtin.package:
+    name: "{{ baseline_packages }}"
+    state: present
+  become: true
+
+- name: Disable root SSH login
+  ansible.builtin.lineinfile:
+    path: /etc/ssh/sshd_config
+    regexp: '^PermitRootLogin'
+    line: "PermitRootLogin no"
+  become: true
+  notify: Restart sshd
\ No newline at end of file