docs(ansible): stop shipping ansible_user: root in the inventory template

[thiras]

Summary

• Drop ansible_user: root from inventory/hosts.yml.example. With it unset, Ansible connects as your local $USER, which is the admin account baseline already creates (roles/baseline/tasks/main.yml, runner autodetect).
• New hosts bootstrap once with make deploy LIMIT=<host> ANSIBLE_ARGS='-u root' (or the image's default sudo user). Later runs need no flag, so there's no inventory edit after the first converge.
• The template and README now say when a per-host ansible_user is still needed: the admin name differs from $USER, or baseline_sudo_autodetect_runner: false. They also warn against setting it to the bootstrap user, because an inventory ansible_user overrides -u.

Why: after the first converge, ssh_hardening disabled root login, but the template still said root. Every host broke until someone edited the inventory by hand, and a fleet-wide make deploy failed on any host that was missed.

No Makefile or role changes: ANSIBLE_ARGS already passes -u through.

Test plan

• ansible-inventory --host decdn-node-1 on a .yml copy of the template: only ansible_host resolves
• yamllint (repo .yamllint) on the template copy
• pre-commit (markdownlint, hygiene) on both files
• CI: ansible-lint + galaxy-build

🤖 Generated with Claude Code

[Copilot]

Copilot review overview

🟡 Changes recommended

Unresolved documentation issues could cause bootstrap failures on supported host configurations.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 2

Open (2)

• Document replacing root with the image bootstrap account · New
• Document substituting the actual bootstrap user · New

What changed in this PR

Updates Ansible documentation and the inventory template to stop defaulting connections to root after bootstrap.

Changes:

• Removes the shipped ansible_user: root.
• Documents bootstrap with the image’s actual bootstrap account.
• Clarifies post-bootstrap ansible_user configuration.

File	Summary	Findings
ansible/​README.md	Documents bootstrap and subsequent deployment behavior.	Moderate findings: clarify replacing root with the image’s bootstrap user and leaving explicit admin settings unset until after bootstrap. Nit: qualify later runs as occurring after a successful first converge.
ansible/​inventory/​hosts.yml.example	Removes the default root user and adds usage guidance.	Moderate finding: annotate the bootstrap command with the actual bootstrap user. Nit: mark the explicit admin setting as post-bootstrap.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.