From 3678f4376760e02eaa458fc5abf01954dd0f16ea Mon Sep 17 00:00:00 2001 From: Bart Van Geyt Date: Thu, 9 Jul 2026 05:01:20 +0200 Subject: [PATCH] docs(ansible): document -K / passwordless sudo for become The playbook runs everything via become(root); note that -K (--ask-become-pass) is required unless the target user has passwordless sudo. Replace the misleading --check first-run hint with --syntax-check. Co-Authored-By: Claude Opus 4.8 --- platform-infra/ansible/README.md | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/platform-infra/ansible/README.md b/platform-infra/ansible/README.md index 1b96c2b..19812dc 100644 --- a/platform-infra/ansible/README.md +++ b/platform-infra/ansible/README.md @@ -35,12 +35,15 @@ Key variables in `group_vars/all.yml`: ## Run ```bash -ansible-playbook site.yml --check # dry run (note: first run can't fully - # check tasks that depend on ZFS/Docker - # not yet present) -ansible-playbook site.yml # apply +ansible-playbook site.yml --syntax-check # no-host pre-flight +ansible-playbook site.yml -K # apply (-K prompts for the sudo/become + # password; omit only if the user has + # passwordless sudo on the VM) ``` +Everything runs via `become` (root), so `-K` is required unless the target user +has passwordless sudo (`/etc/sudoers.d/… NOPASSWD:ALL`). + Run a single layer with tags: `--tags zfs`, `--tags docker`, `--tags firewall`, `--tags ssh`, `--tags base`.