- hosts: all
  become: true
  vars_files:
    - ../inventory/group_vars/all.yaml
    - ../inventory/group_vars/secrets.sops.yaml
  roles:
    - role: base
    - role: sops_agent
    - role: custodian_agent   # injects ~/.ssh/id_custodian_agent.pub into authorized_keys
    # - role: wireguard   # enable if you configure WireGuard variables