diff --git a/config/automatrop/ansible.cfg b/config/automatrop/ansible.cfg
index a1d86ba..6d8116e 100644
--- a/config/automatrop/ansible.cfg
+++ b/config/automatrop/ansible.cfg
@@ -6,3 +6,4 @@ library=plugins/modules
 
 [ssh_connection]
 pipelining = True # does not work with requiretty in /etc/sudoers
+ssh_args=-o ForwardAgent=yes # no need for installing/configuring/unlocking SSH/GPG keys on the host to be able to git clone extensions
diff --git a/config/automatrop/roles/dotfiles/handlers/main.yml b/config/automatrop/roles/dotfiles/handlers/main.yml
index e190624..e04e684 100644
--- a/config/automatrop/roles/dotfiles/handlers/main.yml
+++ b/config/automatrop/roles/dotfiles/handlers/main.yml
@@ -1,2 +1,3 @@
 - name: install dotfiles
   command: "{{ ansible_user_dir }}/.dotfiles/config/scripts/dotfiles install"
+# TODO A python module to do that, so without an handler
diff --git a/config/automatrop/roles/dotfiles/tasks/main.yml b/config/automatrop/roles/dotfiles/tasks/main.yml
index 807694f..0692b42 100644
--- a/config/automatrop/roles/dotfiles/tasks/main.yml
+++ b/config/automatrop/roles/dotfiles/tasks/main.yml
@@ -16,6 +16,7 @@
     dest: "{{ ansible_user_dir }}/.dotfiles"
     update: "{{ not has_forge_access }}"
   notify: install dotfiles
+# TODO Put actual dotfiles in a subdirectory of the repo, so we don't have to put everything in config
 
 - name: Register as Ansible collection
   file:
diff --git a/config/automatrop/roles/system/files/openvpn-client.service b/config/automatrop/roles/system/files/openvpn-client.service
index 616c8f3..1748351 100644
--- a/config/automatrop/roles/system/files/openvpn-client.service
+++ b/config/automatrop/roles/system/files/openvpn-client.service
@@ -8,3 +8,4 @@ User=
 AmbiantCapabilities=
 # It's not pretty, but other script only work with systemd or call resolvconf with -p,
 # which doesn't work without a local DNS resolver
+# TODO Local DNS resolver sounds nice anyway
diff --git a/config/automatrop/roles/system/tasks/main.yml b/config/automatrop/roles/system/tasks/main.yml
index 8e6d264..262ff40 100644
--- a/config/automatrop/roles/system/tasks/main.yml
+++ b/config/automatrop/roles/system/tasks/main.yml
@@ -361,3 +361,5 @@
 # $ sudoedit /etc/default/grub
 # Add resume=UUID=<UUID-of-swap-partition> to GRUB_CMDLINE_LINUX_DEFAULT
 # $ sudo grub-mkconfig -o /boot/grub/grub.cfg
+
+# TODO udevil
diff --git a/config/shell/shrc b/config/shell/shrc
index c5b7b23..b405670 100644
--- a/config/shell/shrc
+++ b/config/shell/shrc
@@ -101,7 +101,10 @@ unset _i_prefer
 # Needed because xterm/urxvt won't use the last color, needed for vim
 
 ## GPG
-# Update TTY
+# Makes the last open terminal the ones that receives the pinentry message (if
+# not run from a terminal with DESKTOP)
+# TODO Only run if gpg-agent is started?
+# TODO Make a command out of this for easy management (and maybe remove the below)
 export GPG_TTY=$(tty)
 gpg-connect-agent updatestartuptty /bye >/dev/null