---
# Baseline starts audit-only. Opt-in variables are deliberately false by default.
- name: Apply controlled common baseline
  # The baseline role is OS-level and does not assume Docker Compose, so it
  # applies to the Matrix K3s node as well as the Compose hosts.
  hosts: all
  become: true
  gather_facts: false
  roles:
    - role: baseline
      tags: [baseline, audit]