Makefile

@@ -5,7 +5,7 @@ VENV        := .venv
 PYTHON      := $(VENV)/bin/python
 PIP         := $(VENV)/bin/pip
 ANSIBLE     := $(VENV)/bin/ansible
-PLAYBOOK_BIN := $(VENV)/bin/ansible-playbook
+PLAYBOOK    := $(VENV)/bin/ansible-playbook
 GALAXY      := $(VENV)/bin/ansible-galaxy
 LINT        := $(VENV)/bin/ansible-lint
 MOLECULE    := $(VENV)/bin/molecule
@@ -89,13 +89,13 @@ check:
 ifndef PLAYBOOK
 	$(error PLAYBOOK is required: make check PLAYBOOK=<name>)
 endif
-	$(PLAYBOOK_BIN) $(INVENTORY) $(VAULT_ARGS) --check --diff playbooks/$(PLAYBOOK).yml
+	$(PLAYBOOK) $(INVENTORY) $(VAULT_ARGS) --check --diff playbooks/$(PLAYBOOK).yml
 
 deploy:
 ifndef PLAYBOOK
 	$(error PLAYBOOK is required: make deploy PLAYBOOK=<name>)
 endif
-	$(PLAYBOOK_BIN) $(INVENTORY) $(VAULT_ARGS) playbooks/$(PLAYBOOK).yml
+	$(PLAYBOOK) $(INVENTORY) $(VAULT_ARGS) playbooks/$(PLAYBOOK).yml
 
 # ── Vault ─────────────────────────────────────────────────────────────────────
 

ansible.cfg

@@ -4,9 +4,8 @@ roles_path          = roles
 collections_path    = .collections
 vault_password_file = scripts/vault-pass-client.sh
 interpreter_python  = auto_silent
-stdout_callback     = default
-callback_result_format = yaml
-callbacks_enabled   = ansible.posix.profile_tasks
+stdout_callback     = yaml
+callbacks_enabled   = timer, profile_tasks
 
 # Avoid slow DNS lookups
 [ssh_connection]

inventories/production/group_vars/control/vars.yml

@@ -5,9 +5,3 @@
 dev_env__users:
   - sjat
   - claude
-
-# Connection: ubongo is the manually-provisioned control node (ADR-009/ADR-015 exception),
-# not a Terraform VM bootstrapped with the `ansible` service user that group_vars/all
-# assumes. Manage it as the operator account. Overrides the all-group default for this
-# group only.
-ansible_user: sjat

roles/dev_env/defaults/main.yml

@@ -14,7 +14,6 @@ dev_env__packages:
   - tmux
   - git
   - stow
-  - acl              # lets Ansible become_user an unprivileged user (sjat -> claude) for file copies
   - build-essential
   - curl
   - ca-certificates