# Ansible

Global configuration for all Phytron servers. Run everything from this directory, preferably via `just`.

## Layout

- `hosts.ini` — inventory; one group per host (`phy_z_*`), host aliases match the real hostnames
- `group_vars/all.yml` — defaults for all hosts; `group_vars/<group>.yml` holds per-host overrides only
- `group_vars/secrets.yml` — ansible-vault encrypted secrets
- `run.yml` — main playbook; `playbooks/` — utilities (update.yml)
- `roles/` — custom roles; external roles come from `requirements.yml`

## Usage

```sh
just reqs                     # install Galaxy role requirements
just run <HOST> [ARGS]       # run run.yml against one host, e.g. just run phy_z_srv_cloud
just compose <HOST>          # docker compose tasks only (--tags compose)
just vault edit              # edit encrypted secrets (encrypt/decrypt/edit)
```