site.yml

---
- hosts: localhost
  gather_facts: true
  vars:
    dotfiles_repo: "{{ playbook_dir }}"
    user_home: "{{ lookup('env', 'HOME') }}"
    install_rvm: false
    # Accept ansible's auto-discovered interpreter without the warning. We run
    # against localhost only: unprivileged tasks use whatever python is on PATH
    # (often the mise-managed one), while `become` tasks re-discover as root and
    # land on the system python — so a hard pin would be wrong for one of them.
    # auto_silent keeps that per-context discovery and just suppresses the note.
    ansible_python_interpreter: auto_silent
  # Disable hk git hooks during provisioning. The symlinked ~/.gitconfig
  # registers config-based hooks (post-checkout, etc.) that run `mise x -- hk`,
  # but `hk` isn't installed until the `mise install` task -- so any git clone/
  # checkout before then would fail when the hook can't exec hk. HK=0 is the
  # hooks' own opt-out; tools still get hk installed for normal interactive use.
  environment:
    HK: "0"
  pre_tasks:
    # Host-local vars (uncommitted). Used to populate things like `nfs_mounts`
    # with LAN-only details (server hostname, share paths) that shouldn't live
    # in the repo. Missing file is fine — the playbook is a superset across
    # all machines. Using stat + `when` (not `ignore_errors`) so a malformed
    # local.yml still fails loudly instead of silently reverting to defaults.
    - name: Check if host-local vars file exists
      stat:
        path: "{{ user_home }}/.config/dotfiles/local.yml"
      register: local_vars_file
    - name: Load host-local vars if present
      include_vars:
        file: "{{ user_home }}/.config/dotfiles/local.yml"
      when: local_vars_file.stat.exists
  roles:
    - dotfiles
    - nfs_mounts