diff --git a/home/bin/deboco b/home/bin/deboco
index 20912b3..476282a 100755
--- a/home/bin/deboco
+++ b/home/bin/deboco
@@ -216,6 +216,15 @@ deboco__init()
 {
 	local debops_controller_path="$1"
 
+	# TODO: by default, update-debops.sh uses bin/ansible.vault.ipr.sh. It would be nice to make deboco create the ansible vault
+	# debopsupdater@mazinger:~$ cp -p ~/debops/controllers/alambix.disabled/.ansible.vault ~/
+	# debopsupdater@mazinger:~$ vi /home/debopsupdater/bin/ansible.vault.ipr.sh
+	# debopsupdater@mazinger:~$ cat /home/debopsupdater/bin/ansible.vault.ipr.sh
+	# #!/usr/bin/env bash
+	# cat ~/.ansible.vault
+	# debopsupdater@mazinger:~$ chmod a+x /home/debopsupdater/bin/ansible.vault.ipr.sh
+
+
 	debops_controller_path=$(realpath $debops_controller_path)
 	log 'info' "creating debobs controller in $debops_controller_path"
 	if [ "$debops_controller_path" = '' ]
@@ -457,6 +466,8 @@ deboco__update_machine()
 		source "$virtual_env_path/bin/activate"
 		ANS_HOST=$(echo ${target_host_fqdn} | sed -E 's/\.univ-rennes[1]?\.fr$//')
 		log 'debug' "ANS_HOST=${ANS_HOST}"
+		# example to apply just the role rsyslog:
+		# debops run site --limit "${ANS_HOST:-/dev/null}" -t "role::rsyslog" | tee --append ${report_file_path}
 		debops run site --limit "${ANS_HOST:-/dev/null}" | tee --append ${report_file_path}
 		debops_exit_code=$?
 		echo "return code for debops run site --limit ${ANS_HOST:-/dev/null} : $debops_exit_code" >> "${report_file_path}"