diff --git a/add-crowdsec.sh b/add-crowdsec.sh
new file mode 100644
index 0000000..8833dc1
--- /dev/null
+++ b/add-crowdsec.sh
@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+set -e
+
+main(){
+    echo "deb https://packagecloud.io/crowdsec/crowdsec/debian/ $OS_CODE main" | \
+        tee /etc/apt/sources.list.d/crowdsec_crowdsec.list
+    curl -fsSL "https://packagecloud.io/crowdsec/crowdsec/gpgkey" | \
+        gpg --dearmor | tee /etc/apt/trusted.gpg.d/crowdsec_crowdsec-archive-keyring.gpg  > /dev/null
+
+    command="nala"
+    command -v $command &>/dev/null || command="apt"
+    $command update
+    $command install -y crowdsec crowdsec-firewall-bouncer-iptables
+
+    echo -e "db_config:
+  use_wal: true" | tee /etc/crowdsec/config.yaml.local
+
+    echo -e "name: crowdsecurity/whitelists
+description: "Whitelist events from custom ip addresses"
+whitelist:
+  reason: "private ip ranges"
+  ip:
+    - "127.0.0.1"
+    - "::1"
+  cidr:
+    - "192.168.0.0/16"
+    - "10.0.0.0/8"
+    - "172.16.0.0/12"
+    - "fc00::/7"
+  # expression:
+  #   - "'foo.com' in evt.Meta.source_ip.reverse"
+" | tee /etc/crowdsec/parsers/s02-enrich/custom-whitelists.yaml
+
+    sed -i -r "s/#  - DOCKER-USER/  - DOCKER-USER/g" /etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml
+
+    systemctl reload crowdsec
+}
\ No newline at end of file
diff --git a/add-speedtest.sh b/add-speedtest.sh
new file mode 100644
index 0000000..0714862
--- /dev/null
+++ b/add-speedtest.sh
@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+set -e
+
+main(){
+    echo "deb https://packagecloud.io/ookla/speedtest-cli/debian/ $OS_CODE main" | \
+        tee /etc/apt/sources.list.d/ookla_speedtest-cli.list
+    curl -fsSL "https://packagecloud.io/ookla/speedtest-cli/gpgkey" | \
+        gpg --dearmor | tee /etc/apt/trusted.gpg.d/ookla_speedtest-cli-archive-keyring.gpg > /dev/null
+
+    command="nala"
+    command -v $command &>/dev/null || command="apt"
+    $command update
+    $command install -y speedtest
+}
\ No newline at end of file
diff --git a/init.sh b/init.sh
index 9dc02c1..cf421f9 100755
--- a/init.sh
+++ b/init.sh
@@ -90,12 +90,6 @@ deb $SEC_URL $OS_CODE-security main contrib non-free non-free-firmware
         gpg --dearmor | tee /etc/apt/trusted.gpg.d/shells_zsh-users_zsh-completions.gpg > /dev/null
 
 
-    echo "deb https://packagecloud.io/ookla/speedtest-cli/debian/ $OS_CODE main" | \
-        tee /etc/apt/sources.list.d/ookla_speedtest-cli.list
-    curl -fsSL "https://packagecloud.io/ookla/speedtest-cli/gpgkey" | \
-        gpg --dearmor | tee /etc/apt/trusted.gpg.d/ookla_speedtest-cli-archive-keyring.gpg > /dev/null
-
-
     if [ $FOR_PVE -eq 0 ]; then
         echo "deb [arch=$OS_ARCH] $DOCKER_URL $OS_CODE stable" | \
             tee /etc/apt/sources.list.d/docker.list
@@ -106,11 +100,6 @@ deb $SEC_URL $OS_CODE-security main contrib non-free non-free-firmware
             tee /etc/apt/sources.list.d/azlux.list
         curl -fsSL "https://azlux.fr/repo.gpg.key" | \
             gpg --dearmor | tee /etc/apt/trusted.gpg.d/azlux-archive-keyring.gpg > /dev/null
-
-        echo "deb https://packagecloud.io/crowdsec/crowdsec/debian/ $OS_CODE main" | \
-            tee /etc/apt/sources.list.d/crowdsec_crowdsec.list
-        curl -fsSL "https://packagecloud.io/crowdsec/crowdsec/gpgkey" | \
-            gpg --dearmor | tee /etc/apt/trusted.gpg.d/crowdsec_crowdsec-archive-keyring.gpg  > /dev/null
     fi
 
     usermod -s /usr/bin/zsh $(whoami)
diff --git a/iommu.sh b/iommu-group.sh
similarity index 100%
rename from iommu.sh
rename to iommu-group.sh
diff --git a/packages-base b/packages-base
index a4e185d..e3923e3 100644
--- a/packages-base
+++ b/packages-base
@@ -18,4 +18,3 @@ iperf3
 mosh
 screen
 zsh-completions
-speedtest