diff --git a/bundles/users/items.py b/bundles/users/items.py
index 3557a34..a9f39e5 100644
--- a/bundles/users/items.py
+++ b/bundles/users/items.py
@@ -8,6 +8,12 @@ pkg_apt = {
     'tmux': {},
 }
 
+users['root'] = {
+    'home': '/root',
+    'shell': '/bin/bash',
+    'password': repo.vault.human_password_for('root on {}'.format(node.name)),
+}
+
 for username, attrs in node.metadata['users'].items():
     home = attrs.get('home', '/home/{}'.format(username))
 
@@ -22,6 +28,9 @@ for username, attrs in node.metadata['users'].items():
         user['shell'] = attrs.get('shell', '/usr/bin/fish')
         user['password'] = repo.vault.human_password_for('user {} on {}'.format(username, node.name))
 
+        if 'groups' in attrs:
+            user['groups'] = attrs['groups']
+
         directories[home] = {
             'owner': username,
             'mode': '0700',
diff --git a/bundles/users/metadata.py b/bundles/users/metadata.py
deleted file mode 100644
index 3dd424f..0000000
--- a/bundles/users/metadata.py
+++ /dev/null
@@ -1,11 +0,0 @@
-@metadata_processor
-def root_user(metadata):
-    return {
-        'users': {
-            'root': {
-                'home': '/root',
-                'ssh_pubkey': [],
-                'shell': '/bin/bash',
-            },
-        },
-    }, DEFAULTS, DONE
diff --git a/bundles/vmhost/metadata.py b/bundles/vmhost/metadata.py
deleted file mode 100644
index cd37846..0000000
--- a/bundles/vmhost/metadata.py
+++ /dev/null
@@ -1,11 +0,0 @@
-@metadata_processor
-def add_users_to_libvirt_group(metadata):
-    if 'users' in metadata:
-        for user in metadata['users']:
-            if 'groups' not in metadata['users'][user]:
-                metadata['users'][user]['groups'] = []
-
-            if 'libvirt' not in metadata['users'][user]['groups']:
-                metadata['users'][user]['groups'].append('libvirt')
-
-    return metadata, RUN_ME_AGAIN
diff --git a/groups/all.py b/groups/all.py
index d343c7d..6f145e9 100644
--- a/groups/all.py
+++ b/groups/all.py
@@ -11,6 +11,11 @@ groups['all'] = {
                 'ssh_pubkey': [
                     'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC+ja1z5VRQzaKCCePsUM14qMr9QR94qlWc7Je5Poki9UmC1t/TyxRVzcCBL1ZdIfBGx6QKtfkEbvhgb3nxVt3PvXjoJrc6wwGLmNrVsU6B88y35g7nzupQiPKYJwkNzJ9j6Dmkgj1F5Q+aY2SitDaX6vqICLJ4Al/ZFw2IQxVJfC7JXRJ9jRMG5o9gWoE3gWDYEAmw+HU2mNzyeuaD12qJw9DHUimAlgkOWzll3gh9WclsYnnXGrCCn5fyHFUCJl+XXAIy519z7YTpKih02rsIOw5dnaGClBZD/YQu2ZKVFZiwIVH7aBiqHOmtgRyWTQgjbh/fMpIN0ar2f/iZsWYUjd6et48TOmXZYIPCQ5FivXNvxt9oo1XZfq76UHBwlmypLJIWROMbz375n2M6hr3hECuxuPjKEUXAv05KiC1aJ4xc6pFoVhqwAR99hvHw5U4o7/ko2NVjNpTu6Jr5DT5VaQLIdDDjC/93kUjMpdD/8P72bEn7454+WexU6OE6uvNiHj1fetrptr2UAuzVfnCoaV8pBqY7X95gk+lnSENdpr8ltJYMg8s0Z7Pzz0OxsZtzzDY5VmWfC9TCdJkN5lT8IbnaixsYlWdjQl1lMmZGElmelfU3K7YQLAbZiHmHKe4hTl9ZoCcWdTQ3d4y2t1DBos+N2HZNdtFCyOS8esDdMw== cardno:000609506971',
                 ],
+                'groups': [
+                    'sudo',
+                    'www-data',
+                    'libvirt',
+                ],
             },
             'sophie': {
                 'shell': '/bin/bash',