pushing updates

IMPLEMENTATION.md

@@ -87,17 +87,32 @@ Ansible needs SSH + sudo on each target before playbooks work.
    ssh westfarn@10.0.0.77
    ssh westfarn@10.0.0.176
    ```
-4. On ai-server-4080 (control node), install Ansible:
+4. **First-time only** — grant passwordless sudo on each new host before the first
+   `provision.sh` run. Ubuntu 26.04 ships `sudo-rs` by default; Ansible's
+   `--ask-become-pass` does not recognize its password prompt, so bootstrap sudo
+   manually over SSH instead:
+   ```bash
+   ssh -t westfarn@10.0.0.176   # repeat for each host IP
+   ```
+   On the host:
+   ```bash
+   echo 'westfarn ALL=(ALL) NOPASSWD:ALL' | sudo tee /etc/sudoers.d/westfarn
+   sudo chmod 440 /etc/sudoers.d/westfarn
+   exit
+   ```
+   The `common` role writes the same file on later runs; this one-time step is only
+   needed before Ansible can escalate privileges the first time.
+5. On ai-server-4080 (control node), install Ansible:
    ```bash
    sudo apt update && sudo apt install -y ansible
    # or: pip install ansible
    ```
-5. Install Galaxy collections:
+6. Install Galaxy collections:
    ```bash
    cd ~/Documents/repos/server-infra
    ansible-galaxy collection install -r requirements.yml
    ```
-6. Update `inventory/host_vars/ai-server-4080.yml` with this machine's LAN IP (`ansible_host`).
+7. Update `inventory/host_vars/ai-server-4080.yml` with this machine's LAN IP (`ansible_host`).
 
 ## Testing on a Single Server
 
@@ -112,6 +127,9 @@ ansible adama -m ping
 
 ### Provision one host
 
+New hosts need the one-time passwordless sudo bootstrap in
+[Prerequisites](#prerequisites-one-time-bootstrap) before the first run.
+
 ```bash
 # Dry run (no changes)
 ./scripts/provision.sh adama --check

README.md

@@ -10,15 +10,20 @@ ansible-galaxy collection install -r requirements.yml
 
 # Bootstrap SSH key to each host (one-time, before Ansible)
 ssh-copy-id westfarn@10.0.0.77
+ssh-copy-id westfarn@10.0.0.176
+
+# First-time only: passwordless sudo on each new host (before first provision)
+ssh -t westfarn@10.0.0.176   # repeat for each host IP
+# on the host:
+echo 'westfarn ALL=(ALL) NOPASSWD:ALL' | sudo tee /etc/sudoers.d/westfarn
+sudo chmod 440 /etc/sudoers.d/westfarn
+exit
 
 # Test connectivity to one host
 ansible adama -m ping
 
 # Provision one host (dry run first)
-./scripts/provision.sh adama --check --ask-become-pass
-./scripts/provision.sh adama --ask-become-pass   # first run; sudo password once
-
-# Later runs (after common role sets passwordless sudo)
+./scripts/provision.sh adama --check
 ./scripts/provision.sh adama
 
 # Provision all hosts

inventory/host_vars/ai-server-4080.yml

@@ -4,6 +4,8 @@
 ansible_host: 10.0.0.128
 
 ansible_control_node: true
+# Deploy/ansible runs on this host; avoid self-SSH (breaks after long tasks / CI keys).
+ansible_connection: local
 act_runner_enabled: true
 
 # This host's pre-existing ~/.ssh/id_ed25519 is a personal key WITH a passphrase,

scripts/provision.sh

@@ -26,7 +26,7 @@ Options:
 Examples:
   $(basename "$0") adama --check    # dry run on adama only
   $(basename "$0") adama            # provision adama
-  $(basename "$0") adama --ask-pass --ask-become-pass  # first run, password auth
+  $(basename "$0") adama --ask-pass  # first SSH login before ssh-copy-id
   $(basename "$0") ai-server-4080   # provision the control node
   $(basename "$0")                  # provision all hosts
 EOF