diff --git a/.gitea/workflows/linode.yml b/.gitea/workflows/linode.yml
index 8a30d44..a4ea938 100644
--- a/.gitea/workflows/linode.yml
+++ b/.gitea/workflows/linode.yml
@@ -53,8 +53,11 @@ jobs:
         uses: actions/checkout@v4
         with:
           path: 'podman-host'
+
       - name: Set up Python
         uses: actions/setup-python@v2
+        
       - name: Molecule test
         run: |
-          ls -la
+          cd podman-host/extensions
+          molecule test -s linode
diff --git a/extensions/molecule/default/converge.yml b/extensions/molecule/default/converge.yml
new file mode 100644
index 0000000..7f5ecf6
--- /dev/null
+++ b/extensions/molecule/default/converge.yml
@@ -0,0 +1,26 @@
+---
+- name: Fail if molecule group is missing
+  hosts: localhost
+  tasks:
+    - name: Print some info
+      ansible.builtin.debug:
+        msg: "{{ groups }}"
+
+    - name: Assert group existence
+      ansible.builtin.assert:
+        that: "'molecule' in groups"
+        fail_msg: |
+          molecule group was not found inside inventory groups: {{ groups }}
+
+- name: Converge
+  hosts: molecule
+  # We disable gather facts because it would fail due to our container not
+  # having python installed. This will not prevent use from running 'raw'
+  # commands. Most molecule users are expected to use containers that already
+  # have python installed in order to avoid notable delays installing it.
+  tasks:
+    - name: Apply podman_netbird Role
+      include_role:
+        name: podman_netbird
+#      ansible.builtin.assert:
+#        that: result.stdout | regex_search("^Linux")
diff --git a/extensions/molecule/default/create.yml b/extensions/molecule/default/create.yml
new file mode 100644
index 0000000..72c7604
--- /dev/null
+++ b/extensions/molecule/default/create.yml
@@ -0,0 +1,118 @@
+---
+- name: Create
+  hosts: localhost
+  connection: local
+  gather_facts: false
+  vars:
+    molecule_inventory:
+      all:
+        hosts: {}
+        molecule: {}
+
+  tasks:
+    - name: Create a container
+      community.docker.docker_container:
+        name: "{{ item.name }}"
+        image: "{{ item.image }}"
+        state: started
+#        command: sleep 1d
+        log_driver: json-file
+      register: result
+      loop: "{{ molecule_yml.platforms }}"
+
+    - name: Print some info
+      ansible.builtin.debug:
+        msg: "{{ result.results }}"
+
+    - name: Fail if container is not running
+      when: >
+        item.container.State.ExitCode != 0 or
+        not item.container.State.Running
+      ansible.builtin.include_tasks:
+        file: tasks/create-fail.yml
+      loop: "{{ result.results }}"
+      loop_control:
+        label: "{{ item.container.Name }}"
+
+    - name: Add container to molecule_inventory
+      vars:
+        inventory_partial_yaml: |
+          all:
+            children:
+              molecule:
+                hosts:
+                  "{{ item.name }}":
+                    ansible_connection: community.docker.docker
+                    service_users:
+                      - name: eqadmin
+                        services:
+                          - netbird
+      ansible.builtin.set_fact:
+        molecule_inventory: >
+          {{ molecule_inventory | combine(inventory_partial_yaml | from_yaml, recursive=true) }}
+      loop: "{{ molecule_yml.platforms }}"
+      loop_control:
+        label: "{{ item.name }}"
+
+    - name: Dump molecule_inventory
+      ansible.builtin.copy:
+        content: |
+          {{ molecule_inventory | to_yaml }}
+        dest: "{{ molecule_ephemeral_directory }}/inventory/molecule_inventory.yml"
+        mode: "0600"
+
+    - name: Force inventory refresh
+      ansible.builtin.meta: refresh_inventory
+
+    - name: Fail if molecule group is missing
+      ansible.builtin.assert:
+        that: "'molecule' in groups"
+        fail_msg: |
+          molecule group was not found inside inventory groups: {{ groups }}
+      run_once: true # noqa: run-once[task]
+
+# we want to avoid errors like "Failed to create temporary directory"
+- name: Validate that inventory was refreshed
+  hosts: molecule
+  gather_facts: false
+  tasks:
+    - name: Check uname
+      ansible.builtin.raw: uname -a
+      register: result
+      changed_when: false
+
+    - name: Display uname info
+      ansible.builtin.debug:
+        msg: "{{ result.stdout }}"
+
+- name: Verify container properties
+  hosts: molecule
+  gather_facts: false
+
+  tasks:
+    - name: Prerequisite packages
+      ansible.builtin.dnf:
+        name: ['openssh-server', 'python3-policycoreutils', 'python3-firewall', 'cronie']
+        state: present
+
+- name: Apply prerequisite roles
+  hosts: molecule
+  gather_facts: true
+
+  tasks:
+    - name: Apply podman-host Role
+      include_role:
+        name: podman-host
+
+    - name: Apply repo-epel Role
+      include_role:
+        name: geerlingguy.repo-epel
+
+    - name: Apply certbot Role
+      include_role:
+        name: geerlingguy.certbot
+
+    - name: Register certbot
+      command:
+        cmd: "certbot register --agree-tos --email admin@libre.audio"
+        creates: "/etc/letsencrypt/renewal-hooks/"
diff --git a/extensions/molecule/default/destroy.yml b/extensions/molecule/default/destroy.yml
new file mode 100644
index 0000000..2214991
--- /dev/null
+++ b/extensions/molecule/default/destroy.yml
@@ -0,0 +1,20 @@
+---
+- name: Destroy molecule containers
+  hosts: molecule
+  gather_facts: false
+  tasks:
+    - name: Stop and remove container
+      delegate_to: localhost
+      community.docker.docker_container:
+        name: "{{ inventory_hostname }}"
+        state: absent
+        auto_remove: true
+
+- name: Remove dynamic molecule inventory
+  hosts: localhost
+  gather_facts: false
+  tasks:
+    - name: Remove dynamic inventory file
+      ansible.builtin.file:
+        path: "{{ molecule_ephemeral_directory }}/inventory/molecule_inventory.yml"
+        state: absent
diff --git a/extensions/molecule/default/molecule.yml b/extensions/molecule/default/molecule.yml
new file mode 100644
index 0000000..797b6a7
--- /dev/null
+++ b/extensions/molecule/default/molecule.yml
@@ -0,0 +1,20 @@
+---
+dependency:
+  name: galaxy
+driver:
+  options:
+    managed: false
+    login_cmd_template: "docker exec -it {instance} bash"
+    ansible_connection_options:
+      ansible_connection: docker
+platforms:
+  - name: instance
+    image: geerlingguy/docker-rockylinux9-ansible:latest
+    command: "/sbin/init"
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+    privileged: true
+    pre_build_image: true
+    # you might want to add your own variables here based on what provisioning
+    # you are doing like:
+    # image: quay.io/centos/centos:stream8
diff --git a/extensions/molecule/default/requirements.yml b/extensions/molecule/default/requirements.yml
new file mode 100644
index 0000000..b2f6546
--- /dev/null
+++ b/extensions/molecule/default/requirements.yml
@@ -0,0 +1,7 @@
+roles:
+  - geerlingguy.repo-epel
+  - geerlingguy.certbot
+collections:
+  - community.general
+  - community.docker
+  - ansible.posix
diff --git a/extensions/molecule/default/tasks/create-fail.yml b/extensions/molecule/default/tasks/create-fail.yml
new file mode 100644
index 0000000..34915c6
--- /dev/null
+++ b/extensions/molecule/default/tasks/create-fail.yml
@@ -0,0 +1,13 @@
+- name: Retrieve container log
+  ansible.builtin.command:
+    cmd: >-
+      {% raw %}
+      docker logs
+      {% endraw %}
+      {{ item.stdout_lines[0] }}
+  changed_when: false
+  register: logfile_cmd
+
+- name: Display container log
+  ansible.builtin.fail:
+    msg: "{{ logfile_cmd.stderr }}"