---
- hosts: servers4 # @NOTE for IPv6, switch to 'servers6' instead of 'servers4'--for both, 'servers'
  vars_files:
    # - vars/ssh_keys_vault.yml
    - vars/ssh_keys.yml
  vars:
    ansible_ssh_private_key_file: "{{ chosen_native_ssh_private_key_file | default(chosen_local_ssh_private_key_file, true) }}"
  tasks:
    - name: Disable shell access for root
      ansible.builtin.include_role:
        name: lockdown
        defaults_from: main
        vars_from: main
        handlers_from: main
        tasks_from: deshell
        apply:
          become: yes