[defaults]

# All paths are relative to this directory (ansible/).

inventory = ./inventories/prd

roles_path = ./roles

collections_path = ./collections

playbook_dir = ./playbooks

# Output

stdout_callback = default

result_format = yaml

callbacks_enabled = profile_tasks, timer

display_skipped_hosts = False

display_ok_hosts = True

# Behavior

host_key_checking = True

retry_files_enabled = False

forks = 10

gathering = smart

fact_caching = jsonfile

fact_caching_connection = /tmp/ansible-facts

fact_caching_timeout = 3600

interpreter_python = auto_silent

# Diff output on --check runs

diff_always = True

[privilege_escalation]

become = True

become_method = sudo

become_ask_pass = False

[ssh_connection]

pipelining = True

# Host-key verification: clients trust the homelab SSH host CA via the

# single `@cert-authority` line in files/known_hosts.d/homelab. The

# user-level ~/.ssh/known_hosts is bypassed entirely so an ephemeral

# container without one behaves the same as a workstation that has one.

# The bootstrap playbook's transient known_hosts (for the pre-cert

# first connection to a brand-new VM) is a per-run artefact under tmp/,

# not here.

#

# HostKeyAlgorithms accepts the ed25519 host *certificate* (steady

# state) and plain ed25519 (the pre-certificate bootstrap window).

# rsa/ecdsa stay off — sshd auto-generates them non-deterministically.

#

# IdentityFile/IdentitiesOnly are explicit so the iac container (where

# root has no ~/.ssh/config) finds the key. On wrkdev the same path

# resolves under the operator's $HOME — matches the workstation runbook.

ssh_args = -o ControlMaster=auto -o ControlPersist=60s -o PreferredAuthentications=publickey -o UserKnownHostsFile=files/known_hosts.d/homelab -o GlobalKnownHostsFile=/dev/null -o HostKeyAlgorithms=ssh-ed25519-cert-v01@openssh.com,ssh-ed25519 -o IdentityFile=~/.ssh/id_ed25519_ansible -o IdentitiesOnly=yes