diff --git a/modules/20-docker.sh b/modules/20-docker.sh
new file mode 100755
index 0000000..91fefc1
--- /dev/null
+++ b/modules/20-docker.sh
@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# 20-docker — Docker Engine + Compose v2 plugin. $USER added to docker group.
+
+step_name="docker"
+step_desc="docker engine + compose v2, add \$USER to docker group"
+step_run="run_docker"
+
+run_docker() {
+  log "installing docker + compose v2"
+  if command -v docker >/dev/null 2>&1 && docker compose version >/dev/null 2>&1; then
+    ok "docker + compose v2 already installed"
+  else
+    case "$DISTRO" in
+      arch)   sudo_ pacman -Sy --noconfirm --needed docker docker-compose ;;
+      debian) _docker_debian ;;
+    esac
+  fi
+
+  # enable + start (best-effort; skip inside containers without systemd)
+  if command -v systemctl >/dev/null 2>&1 && systemctl is-system-running >/dev/null 2>&1; then
+    sudo_ systemctl enable --now docker.service containerd.service 2>/dev/null \
+      || warn "could not enable docker.service (no systemd?)"
+  else
+    warn "systemctl unavailable — start docker manually if needed"
+  fi
+
+  # add current user to docker group
+  if getent group docker >/dev/null 2>&1; then
+    if id -nG "$USER" | grep -qw docker; then
+      ok "$USER already in docker group"
+    else
+      sudo_ usermod -aG docker "$USER"
+      ok "$USER added to docker group (log out/in or 'newgrp docker' to use it)"
+    fi
+  fi
+}
+
+_docker_debian() {
+  sudo_ install -m 0755 -d /etc/apt/keyrings
+  curl -fsSL https://download.docker.com/linux/$(. /etc/os-release; echo "$ID")/gpg \
+    | sudo_ gpg --dearmor -o /etc/apt/keyrings/docker.gpg
+  sudo_ chmod a+r /etc/apt/keyrings/docker.gpg
+  local codename; codename="$(. /etc/os-release; echo "$VERSION_CODENAME")"
+  echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] \
+https://download.docker.com/linux/$(. /etc/os-release; echo "$ID") $codename stable" \
+    | sudo_ tee /etc/apt/sources.list.d/docker.list >/dev/null
+  sudo_ apt-get update -y
+  sudo_ apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
+}
\ No newline at end of file
diff --git a/modules/25-angie.sh b/modules/25-angie.sh
new file mode 100755
index 0000000..03e7e2c
--- /dev/null
+++ b/modules/25-angie.sh
@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+# 25-angie — Angie (nginx fork) web server.
+
+step_name="angie"
+step_desc="angie web server (nginx fork), enable + open 80/443"
+step_run="run_angie"
+
+run_angie() {
+  log "installing angie"
+  if command -v angie >/dev/null 2>&1; then
+    ok "angie already installed"
+  else
+    case "$DISTRO" in
+      arch)   _angie_arch ;;
+      debian) _angie_debian ;;
+    esac
+  fi
+
+  if command -v systemctl >/dev/null 2>&1 && systemctl is-system-running >/dev/null 2>&1; then
+    sudo_ systemctl enable --now angie 2>/dev/null || warn "could not enable angie.service"
+  else
+    warn "systemctl unavailable — start angie manually if needed"
+  fi
+
+  # firewall note: ufw rules for 80/443 are owned by the hardening step
+  ok "angie installed. ufw 80/443 handled in the hardening step."
+}
+
+_angie_arch() {
+  if command -v yay >/dev/null 2>&1; then
+    as_user yay -S --noconfirm angie 2>/dev/null \
+      || as_user yay -S --noconfirm aur/angie 2>/dev/null \
+      || warn "angie AUR build failed — try: yay -S angie"
+  else
+    warn "yay not available — install angie manually from AUR: yay -S angie"
+  fi
+}
+
+_angie_debian() {
+  . /etc/os-release
+  sudo_ install -m 0755 -d /etc/apt/keyrings
+  curl -fsSL https://angie.software/keys/angie-signing.gpg \
+    | sudo_ tee /etc/apt/keyrings/angie-signing.gpg >/dev/null
+  echo "deb [signed-by=/etc/apt/keyrings/angie-signing.gpg] https://download.angie.software/angie/${ID}/ ${VERSION_CODENAME} main" \
+    | sudo_ tee /etc/apt/sources.list.d/angie.list >/dev/null
+  sudo_ apt-get update -y
+  sudo_ apt-get install -y angie
+}
\ No newline at end of file