diff --git a/group_vars/all.yaml b/group_vars/all.yaml
index 65db9c7..84587ed 100644
--- a/group_vars/all.yaml
+++ b/group_vars/all.yaml
@@ -1,2 +1,3 @@
 ansible_user: root
 ansible_python_interpreter: auto_silent
+notify_email: bestuur@bitlair.nl
diff --git a/hosts b/hosts
index 0496853..31415d3 100644
--- a/hosts
+++ b/hosts
@@ -1,2 +1,5 @@
 [bar]
 bank-pi.bitlair.nl
+
+[mqtt_internal]
+mqtt.bitlair.nl
diff --git a/mqtt-internal.yaml b/mqtt-internal.yaml
new file mode 100644
index 0000000..118e82e
--- /dev/null
+++ b/mqtt-internal.yaml
@@ -0,0 +1,7 @@
+---
+- hosts: mqtt_internal
+  vars:
+    mqtt_internal_public_host: bitlair.nl
+  roles:
+    - polyfloyd.tweaks
+    - mqtt-internal
diff --git a/requirements.yaml b/requirements.yaml
new file mode 100644
index 0000000..20ed5b3
--- /dev/null
+++ b/requirements.yaml
@@ -0,0 +1,4 @@
+---
+- name: polyfloyd.tweaks
+  src: gitea@git.polyfloyd.net:polyfloyd/ansible-tweaks.git
+  scm: git
diff --git a/roles/mqtt-internal/handlers/main.yaml b/roles/mqtt-internal/handlers/main.yaml
new file mode 100644
index 0000000..88fc2f9
--- /dev/null
+++ b/roles/mqtt-internal/handlers/main.yaml
@@ -0,0 +1,5 @@
+---
+- name: restart_mosquitto
+  systemd:
+    name: mosquitto
+    state: restarted
diff --git a/roles/mqtt-internal/tasks/main.yaml b/roles/mqtt-internal/tasks/main.yaml
new file mode 100644
index 0000000..b8e479c
--- /dev/null
+++ b/roles/mqtt-internal/tasks/main.yaml
@@ -0,0 +1,22 @@
+---
+- name: mqtt-internal
+  tags: mqtt_internal
+  block:
+    - name: Install broker
+      apt:
+        name: mosquitto
+
+    - name: Configure public bridge forwarding
+      template:
+        src: public-bridge.conf
+        dest: /etc/mosquitto/conf.d/public-bridge.conf
+        owner: root
+        group: root
+        mode: 0644
+      notify: restart_mosquitto
+
+    - name: Start mosquitto
+      systemd:
+        name: mosquitto
+        state: started
+        enabled: yes
diff --git a/roles/mqtt-internal/templates/public-bridge.conf b/roles/mqtt-internal/templates/public-bridge.conf
new file mode 100644
index 0000000..a645800
--- /dev/null
+++ b/roles/mqtt-internal/templates/public-bridge.conf
@@ -0,0 +1,20 @@
+# Managed by Ansible
+
+connection public-bridge
+
+address {{ mqtt_internal_public_host }}
+
+topic bitlair/test/+ out
+topic bitlair/debug/+ out
+topic bitlair/state out
+topic bitlair/state/djo out
+topic bitlair/cam/+ out
+topic bitlair/music/+/state out
+topic bitlair/music/+/volume out
+topic bitlair/wifi/+/online out
+topic bitlair/climate/+ out
+topic bitlair/temperature/+/current out
+topic bitlair/temperature/+/target out
+topic bitlair/humidity/+ out
+topic bitlair/lasercutter/+ out
+topic bitlair/flash out