### Installer ↔ Ansible boundary

`install.py` (and the `installer/` package) and Ansible are treated as **independent tools**.

- The installer may *invoke* `ansible` / `ansible-playbook` as an external subprocess.
- The installer must not assume:
  - Ansible vault access
  - inventory parsing as a required part of the workflow
  - any specific private repo checkout layout (e.g. a sibling `prole/infrastructure`)
- Ansible playbooks/roles must not assume `install.py` is discovering secrets or passing hidden, repo-local state.

This is designed so private inventory/secret material can live entirely in `prole/infrastructure` (or elsewhere) without this repo requiring it.

#### Explicit inputs (recommended)

When the installer needs to call `ansible-playbook` (for example to fetch a kubeconfig), provide paths explicitly via environment variables:

- `PROLE_ANSIBLE_K3S_FETCH_KUBECONFIG_PLAYBOOK`
  - Full path to `k3s_fetch_kubeconfig.yml`.
- `PROLE_ANSIBLE_PLAYBOOKS_DIR` (or `PROLE_ANSIBLE_PLAYBOOK_DIR`)
  - Directory that contains `k3s_fetch_kubeconfig.yml`.
- `PROLE_ANSIBLE_INVENTORY` (or `ANSIBLE_INVENTORY`)
  - Inventory path passed as `ansible-playbook -i ...`.
- `PROLE_ANSIBLE_VAULT_PASSWORD_FILE` (or `ANSIBLE_VAULT_PASSWORD_FILE`)
  - Vault password file path passed as `ansible-playbook --vault-password-file ...`.
- `PROLE_ANSIBLE_CONFIG` (or `ANSIBLE_CONFIG`)
  - Path to an Ansible config file to use for the subprocess.

Separately, when the deployment workflow needs k3s connection info, provide it explicitly:

- `PROLE_K3S_SERVER`
- `PROLE_K3S_TOKEN` (or `K3S_TOKEN`)

#### Optional legacy auto-detection (opt-in)

For local developer convenience only, repo-relative discovery can be enabled explicitly:

- `PROLE_ANSIBLE_AUTO_DETECT=true`

When enabled, some flows may look for legacy repo-relative playbooks (under `infrastructure/playbooks/`). This is **not** required for normal operation and should not be relied on for private infrastructure.

### K3s slow-storage tolerance knobs (Ansible)

The `infrastructure/roles/k3s` role exposes configurable defaults intended for slow storage (Pi / USB) rollouts:

- `k3s_kubelet_args` (default includes `runtime-request-timeout=15m`, `image-pull-progress-deadline=15m`, `node-status-update-frequency=20s`)
- `k3s_systemd_override_enabled` (default `true`)
- `k3s_systemd_timeout_start_sec` (default `15min`)
- `k3s_systemd_timeout_stop_sec` (default `10min`)
- `k3s_systemd_restart` (default `always`)
- `k3s_systemd_restart_sec` (default `15s`)