[defaults]
inventory = inventory/hosts.yml
roles_path = roles
collections_paths = collections
host_key_checking = False
callback_result_format = yaml
nocows = True

# NOTE: no global become — the inventory is mixed Linux (sudo) + Windows (can't sudo).
# Linux plays declare `become: true` themselves; Windows uses runas per-task where needed.

# Encrypted group_vars/all/vault.yml are COMMITTED; the password is not.
# Relative to this file, so it resolves for any checkout location.
vault_password_file = ../../../.vault_pass