```
ansible-playbook secure.yml -i inventory/hosts.yml --check --diff
```

```
ansible-galaxy collection install containers.podman
```
```
ssh-keygen -t ed25519 -C "matrix-deploy"
# Press Enter to save default: ~/.ssh/id_ed25519
```
```
ssh-copy-id deploy@matrix.example.com
# Replace with your actual server IP/hostname & user
```
## Deployment ##
```
# Just re-run (idempotent):
ansible-playbook playbook.yml -i inventory/hosts.yml --ask-become-pass

# Or re-run only nginx role (if you changed site/Nginx)
ansible-playbook playbook.yml --tags nginx-proxy --ask-vault-pass
```