ansible — control the forge fleet

Two halves make the appliance: the seed does first boot (recipe.py --spec forge, see ../PI-FORGE.md); this layer delivers the restored truth + the memory-only seed and starts the peer. Both are required.

ansible-galaxy collection install ansible.posix
ansible-playbook -i inventory.ini forge-node.yml

Control-node prereqs (git-ignored — never commit these): - wallet-seed.cred — wallet seed | systemd-creds encrypt --name=wallet-seed - wallet-seed.cred (on a systemd host). The ONLY secret; encrypted at rest, decrypted only into non-swappable ramfs at service start. - files/wallet — cd ~/code/jazz_wallet/src && GOOS=linux GOARCH=arm64 go build -o ../../packages/routed_vm/ansible/files/wallet . - ~/bin/config/forge/ — the canonical store (bare remotes/, artifacts/, jazz/anvil-state.json, deployments.json).

Everything except wallet-seed.cred is public / recoverable. Idempotent — re-run any time.