Connect as remote_user rather than ansible_user

An inventory ansible_user outranks a command-line -u, so -u was silently
ignored. A config default sits below it, which lets a bootstrap run as an
admin account.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

ansible/ansible.cfg

@@ -10,6 +10,15 @@ callback_result_format = yaml
 display_skipped_hosts = False
 interpreter_python = auto_silent
 
+# The account every playbook connects as. Deliberately here and not as
+# ansible_user in group_vars/all.yml: an inventory variable outranks a
+# command-line -u, so a `-u somebody` would be accepted and then silently
+# ignored. A config default sits *below* -u, which is what lets bootstrap.yml —
+# the one playbook that has to connect as somebody else — take a plain
+# `-u <admin-user>`. Override it for a single host with ansible_user in
+# inventory/host_vars/<host>.yml.
+remote_user = deploy
+
 # CI runners are ephemeral, so a known_hosts file never survives to be checked
 # against. Turn this back on if you deploy from a durable control node or put a
 # bastion in front of the hosts — it is the one setting here worth revisiting.

ansible/inventory/group_vars/all.yml

@@ -1,5 +1,9 @@
 ---
-ansible_user: deploy
+# ansible_user is deliberately absent. The deploy account is `remote_user` in
+# ansible.cfg instead, because an inventory variable cannot be overridden by a
+# command-line -u and a config default can. Set ansible_user in
+# inventory/host_vars/<host>.yml to change it for one host.
+
 # Override per host in inventory/host_vars/<host>.yml if sshd moves off 22.
 ansible_port: 22