exclude manero-ca from most things

ansible/host_vars/ca.manero.org.yml

@@ -1,5 +1,7 @@
 ---
 # Debian IRC server — reachable via Tailscale MagicDNS
+# Only run packages + inspircd. Skip users, SSH keys, sudo config.
+skip_user_management: true
 ansible_ssh_common_args: '-o StrictHostKeyChecking=accept-new'
 ansible_python_interpreter: /usr/bin/python3
 

ansible/hosts

@@ -57,6 +57,9 @@ node3 ansible_host=node3
 [postgresql_servers]
 db.w5isp.com
 
+[irc_limited]
+ca.manero.org
+
 [irc_servers]
 us.manero.org ansible_host=manero-us
 ca.manero.org ansible_host=manero-ca

ansible/playbook.yml

@@ -16,7 +16,7 @@
         name: "{{ timezone }}"
 
 - name: Apply firewall configuration
-  hosts: all:!proxmox_servers
+  hosts: all:!proxmox_servers:!irc_limited
   become: true
   gather_facts: true
   tags:
@@ -192,7 +192,7 @@
       tags: ns
 
 - name: Apply general configuration to all nodes
-  hosts: all
+  hosts: all:!irc_limited
   become: true
   become_method: sudo
   roles:

ansible/roles/base/tasks/main.yml

@@ -24,6 +24,7 @@
 
 - name: Configure users and groups
   ansible.builtin.import_tasks: users.yml
+  when: not (skip_user_management | default(false))
   tags:
     - users
     - bootstrap