Homelab / Ansible owns everything that happens inside a guest.
Configuration
Terraform creates, Ansible configures, and the inventory is regenerated from Terraform output instead of maintained by hand. Long remote-exec scripts were left out on purpose: a script that exits 0 makes the resource report success while state stops describing reality.
Terraform publishes the output of the guests it just created.
The Ansible inventory is regenerated from that output instead of being maintained by hand.
Roles bring each host to a known state and run again without changing it.
How I built it
A derived inventory removes the dullest class of automation failure: a machine that exists but no playbook reaches because nobody updated a list. Roles are written to be repeated, and that discipline also makes them the right place to assert what must not exist on a host, not only what must.