diff --git a/molecule/debian/converge.yml b/molecule/debian/converge.yml
new file mode 100644
index 0000000..934be3c
--- /dev/null
+++ b/molecule/debian/converge.yml
@@ -0,0 +1,9 @@
+---
+- name: Converge
+  hosts: localhost
+  connection: local
+  roles:
+    - role: ipr-cnrs.nftables
+      nft_debug: true
+      # can't remove iptables on an instance with docker
+      nft_old_pkg_manage: false
diff --git a/molecule/debian/molecule.yml b/molecule/debian/molecule.yml
new file mode 100644
index 0000000..4b88e40
--- /dev/null
+++ b/molecule/debian/molecule.yml
@@ -0,0 +1,15 @@
+---
+dependency:
+  name: galaxy
+driver:
+  name: docker
+platforms:
+  - name: instance
+    image: jrei/systemd-debian:latest
+    privileged: true
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+provisioner:
+  name: ansible
+verifier:
+  name: ansible
diff --git a/molecule/debian/verify.yml b/molecule/debian/verify.yml
new file mode 100644
index 0000000..79044cd
--- /dev/null
+++ b/molecule/debian/verify.yml
@@ -0,0 +1,10 @@
+---
+# This is an example playbook to execute Ansible tests.
+
+- name: Verify
+  hosts: all
+  gather_facts: false
+  tasks:
+  - name: Example assertion
+    assert:
+      that: true