diff --git a/TODO.md b/TODO.md
index 8824b86..5eb1202 100644
--- a/TODO.md
+++ b/TODO.md
@@ -22,21 +22,24 @@ Server is delivered; base setup + NVIDIA driver are done (see `SETUP.md`).
 
 ### Server / Ansible
 
+- [ ] Add the three secrets to `group_vars/secrets.yml` (`just vault edit`):
+      `vault_owui_secret_key`, `vault_owui_db_password`, `vault_ldap_bind_password`
+- [ ] Fill the real LDAP bind DN / base DN in `group_vars/phy_srv_gpu01.yml`
+- [ ] Pin `vllm_image` to a build verified on SM120, then `just compose phy_srv_gpu01`
+      and start the stack manually (see `ansible/services/phy-srv-gpu01/README.md`)
 - [ ] Role `cifs_mounts` — read-only mounts, credentials from `group_vars/secrets.yml`
-- [ ] Role `llm_stack` — docker compose: vLLM (fixed `--gpu-memory-utilization`),
-      embedding server, Open WebUI + pgvector, reverse proxy, oikb timer.
-      Tag compose tasks with `compose` so `just compose` works.
+- [ ] oikb sync (share → knowledge base) once the corpus scope is decided
 - [ ] Smoke-test a vLLM container on the server (official images may not support SM120)
       — pin the working image, then build `llm_stack`. Start model: Qwen3-32B FP8
 - [ ] OCR pipeline for ~166k scanned PDFs (§2.1) — own work block, competes with vLLM for the GPU
 - [ ] TLS: currently plain HTTP on `chat.phytron.local`; retrofit an internal CA
       certificate (AD passwords travel in clear text until then)
-- [ ] Hostname mismatch: server reports `phy-srv-gpu01`, repo/inventory/label use
-      `phy-srv-gpu01` — align
 - [ ] Finish base hardening in `SETUP.md` (ssh, updates) via `just run phy_srv_gpu01`
 
 ### Done
 
+- [x] Renamed host/group/folder to `phy-srv-gpu01` everywhere
+- [x] LLM compose stack written (`ansible/services/phy-srv-gpu01/`) — not deployed
 - [x] Share analysis script → `scripts/share-analysis.ps1`, run on 2026-07-14 (§2.1)
 - [x] Storage decision (§2.3) — 876 GB usable, no extra disks needed
 - [x] NVIDIA driver via role `nvidia_gpu` (595 open kernel modules)