Path	Purpose
`site.yml`	Full workstation bootstrap
`passwordless.yml`	Sudo only
`services/`	Pi-hole, Kubernetes (nested; visible in ansibleTUI)
`security/`	SELinux, IPv6
`playbooks/`	VM-specific (e.g. Xen guest tools)
`roles/`	Reusable role implementations
`group_vars/`	Shared variables
`host_vars/`	Per-host overrides

Setup

ansible-galaxy collection install -r requirements.yml

Common runs

Run from this directory (or use ansibleTUI, which sets ANSIBLE_CONFIG and cwd automatically):

cd ~/.ansibletui/playbooks
ansible-playbook -i ../inventory site.yml --limit plex
ansible-playbook -i ../inventory services/pi-hole.yml --limit dns-host
ansible-playbook -i ../inventory security/ipv6-disable.yml --limit pvr

Check mode: site.yml skips git clone / stow / font download tasks during --check (they require packages already installed or a live run). System tasks (packages, sudo, cockpit) still report drift.

OS support

Roles load vars/Debian.yml or vars/RedHat.yml automatically via include_vars / Ansible OS mapping.