inventory: manage ubongo (control node) as the operator account

group_vars/all assumes the ansible service user (created by bootstrap on
Terraform VMs). ubongo is the manually-provisioned control node (ADR-009/
ADR-015 exception) with no bootstrapped ansible user, so connect as sjat.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Makefile

@@ -5,7 +5,7 @@ VENV        := .venv
 PYTHON      := $(VENV)/bin/python
 PIP         := $(VENV)/bin/pip
 ANSIBLE     := $(VENV)/bin/ansible
-PLAYBOOK    := $(VENV)/bin/ansible-playbook
+PLAYBOOK_BIN := $(VENV)/bin/ansible-playbook
 GALAXY      := $(VENV)/bin/ansible-galaxy
 LINT        := $(VENV)/bin/ansible-lint
 MOLECULE    := $(VENV)/bin/molecule
@@ -89,13 +89,13 @@ check:
 ifndef PLAYBOOK
 	$(error PLAYBOOK is required: make check PLAYBOOK=<name>)
 endif
-	$(PLAYBOOK) $(INVENTORY) $(VAULT_ARGS) --check --diff playbooks/$(PLAYBOOK).yml
+	$(PLAYBOOK_BIN) $(INVENTORY) $(VAULT_ARGS) --check --diff playbooks/$(PLAYBOOK).yml
 
 deploy:
 ifndef PLAYBOOK
 	$(error PLAYBOOK is required: make deploy PLAYBOOK=<name>)
 endif
-	$(PLAYBOOK) $(INVENTORY) $(VAULT_ARGS) playbooks/$(PLAYBOOK).yml
+	$(PLAYBOOK_BIN) $(INVENTORY) $(VAULT_ARGS) playbooks/$(PLAYBOOK).yml
 
 # ── Vault ─────────────────────────────────────────────────────────────────────
 

ansible.cfg

@@ -4,8 +4,9 @@ roles_path          = roles
 collections_path    = .collections
 vault_password_file = scripts/vault-pass-client.sh
 interpreter_python  = auto_silent
-stdout_callback     = yaml
-callbacks_enabled   = timer, profile_tasks
+stdout_callback     = default
+callback_result_format = yaml
+callbacks_enabled   = ansible.posix.profile_tasks
 
 # Avoid slow DNS lookups
 [ssh_connection]

inventories/production/group_vars/control/vars.yml

@@ -5,3 +5,9 @@
 dev_env__users:
   - sjat
   - claude
+
+# Connection: ubongo is the manually-provisioned control node (ADR-009/ADR-015 exception),
+# not a Terraform VM bootstrapped with the `ansible` service user that group_vars/all
+# assumes. Manage it as the operator account. Overrides the all-group default for this
+# group only.
+ansible_user: sjat

roles/dev_env/defaults/main.yml

@@ -14,6 +14,7 @@ dev_env__packages:
   - tmux
   - git
   - stow
+  - acl              # lets Ansible become_user an unprivileged user (sjat -> claude) for file copies
   - build-essential
   - curl
   - ca-certificates