diff --git a/servers/barber/readme.md b/servers/barber/readme.md
new file mode 100644
index 0000000..cb812db
--- /dev/null
+++ b/servers/barber/readme.md
@@ -0,0 +1,136 @@
+# Barber
+
+## network
+
+```bash
+# ip: 87.236.197.158, 87.236.197.157
+```
+
+
+## TODO
+
+- firewall
+- kvm
+
+## KVM
+
+```bash
+egrep -c '(vmx|svm)' /proc/cpuinfo      # > 0 expected (Intel VT-x / AMD-V)
+
+# qemu-kvm is a transitional metapackage on 26.04; qemu-system-x86 is the real binary.
+apt update
+apt install -y \
+  qemu-system-x86 qemu-utils \
+  libvirt-daemon-system libvirt-clients \
+  virtinst cpu-checker ovmf
+
+apt install virt-manager
+# optional: libguestfs-tools (image surgery), virt-manager (GUI over X-fwd)
+
+
+# Verify acceleration + service
+kvm-ok                  # expect: "KVM acceleration can be used"
+lsmod | grep kvm        # kvm + kvm_intel|kvm_amd loaded
+
+sudo systemctl enable --now libvirtd
+sudo systemctl is-active libvirtd
+
+# non-root management
+sudo usermod -aG libvirt,kvm $USER
+newgrp libvirt          # apply to current shell; otherwise log out/in
+virsh list --all        # should run without sudo
+
+
+# default libvirt network configuration changed to: 192.168.124.*
+```
+
+
+## Firewall
+
+```bash
+ufw default deny incoming
+ufw default allow outgoing
+ufw limit 22/tcp        # SSH — limit, not allow (see below)
+ufw enable              # answer 'y' — safe, the rule's already in
+ufw status verbose
+
+# Pin IP forwarding
+echo 'net.ipv4.ip_forward=1' | sudo tee /etc/sysctl.d/99-ip-forward.conf
+sudo sysctl --system
+
+# Fix the FORWARD policy (mandatory for NAT guests)
+sudo sed -i 's/^DEFAULT_FORWARD_POLICY=.*/DEFAULT_FORWARD_POLICY="ACCEPT"/' /etc/default/ufw
+sudo ufw reload
+
+# DHCP/DNS to guests (usually automatic)
+sudo ufw allow in on virbr0 to any port 53 proto udp
+sudo ufw allow in on virbr0 to any port 67 proto udp
+
+# dns on utility-101
+ufw route allow proto udp from any to 192.168.124.101 port 53
+ufw route allow proto tcp from any to 192.168.124.101 port 53
+```
+
+```bash
+# ufw fights with libvirtd about some iptables rules
+
+# /etc/libvirt/hooks/network
+cat > /etc/libvirt/hooks/network <<'EOF'
+#!/bin/bash
+# Re-inject inbound DNS ACCEPT into libvirt's LIBVIRT_FWI chain.
+# libvirt flushes/rebuilds this chain on network start, so the rule
+# must be re-applied each time the network comes up.
+
+NET="$1"   # network name (arg 1)
+OP="$2"    # operation   (arg 2)
+
+TARGET_NET="default"      # <-- set to your `virsh net-list` name
+VM_IP="192.168.124.101"
+WAN_IF="enp5s0"
+BR_IF="virbr0"
+
+OSPROVIDER_NET="osprovider"
+OSPROVIDER_BR="virbr2"
+OSPROVIDER_SUBNET="10.10.50.0/24"
+
+[ "$OP" = "started" ] || exit 0
+
+if [ "$NET" = "$TARGET_NET" ]; then
+    for proto in udp tcp; do
+        iptables -C LIBVIRT_FWI -i "$WAN_IF" -o "$BR_IF" -d "$VM_IP" -p "$proto" --dport 53 -j ACCEPT 2>/dev/null \
+          || iptables -I LIBVIRT_FWI 1 -i "$WAN_IF" -o "$BR_IF" -d "$VM_IP" -p "$proto" --dport 53 -j ACCEPT
+    done
+fi
+
+if [ "$NET" = "$OSPROVIDER_NET" ]; then
+    # libvirt's LIBVIRT_FWO chain REJECTs all forwarding from virbr2 because osprovider is
+    # defined as an isolated network. Insert these rules at the top of FORWARD (before the
+    # LIBVIRT_* chains run) so provider-network traffic can reach POSTROUTING/MASQUERADE.
+    iptables -C FORWARD -i "$OSPROVIDER_BR" -s "$OSPROVIDER_SUBNET" -j ACCEPT 2>/dev/null \
+      || iptables -I FORWARD 1 -i "$OSPROVIDER_BR" -s "$OSPROVIDER_SUBNET" -j ACCEPT
+    iptables -C FORWARD -o "$OSPROVIDER_BR" -d "$OSPROVIDER_SUBNET" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT 2>/dev/null \
+      || iptables -I FORWARD 1 -o "$OSPROVIDER_BR" -d "$OSPROVIDER_SUBNET" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+fi
+EOF
+chmod +x /etc/libvirt/hooks/network 
+
+```
+
+## VNC remote desktop
+
+```bash
+apt install tigervnc-standalone-server xfce4 xfce4-goodies
+apt install dbus-x11
+
+# Fix the xstartup to launch Xfce explicitly inside a fresh dbus session:
+cat > ~/.vnc/xstartup <<'EOF'
+#!/bin/sh
+unset SESSION_MANAGER
+unset DBUS_SESSION_BUS_ADDRESS
+export XDG_SESSION_TYPE=x11
+export XDG_CURRENT_DESKTOP=XFCE
+[ -r "$HOME/.Xresources" ] && xrdb "$HOME/.Xresources"
+exec dbus-run-session -- startxfce4
+EOF
+chmod +x ~/.vnc/xstartup
+```
\ No newline at end of file
diff --git a/servers/barber/vms/utility-101-barber.md b/servers/barber/vms/utility-101-barber.md
new file mode 100644
index 0000000..e69de29