Block a user
[P3] Uses id_rsa key — upgrade to id_ed25519 for consistency
[P3] NextDNS profile ID hardcoded in playbook — move to variable
[P1] SSH root login — harden with dedicated keypair and from= restriction
[P3] docker_status.yml missing become: true
[P3] fresh_install.yml runs full dist-upgrade — risky if run against existing machines
[P2] update_upgrade.yml targets all hosts — includes local Ansible machine
[P2] docker_update_containers.yml missing — referenced in README but does not exist
[P2] restic restore missing --overwrite always — silently skips existing files
[P2] Stale /source/gcloud restic restore path — leftover from GCP
[P2] Silent failures in deploy/disaster/redeploy — ignore_errors everywhere with no assertions
[P1] Reboot task in update_upgrade.yml crashes on non-Debian hosts
[P1] host_key_checking = False in ansible.cfg — MITM risk