chore: refined control script

ansible/README.md

@@ -37,7 +37,13 @@ export BACKUP_S3_SECRET_ACCESS_KEY=your-secret-access-key
 export BACKUP_S3_ENDPOINT=your-s3-endpoint   # omit for real AWS S3
 ```
 
-`ansible_ssh_private_key_file` (see `group_vars/all.yml`) defaults to
+`../control.sh`'s **Set variables** menu does the same thing interactively and
+persists your answers to `../.control.env` (gitignored) so you don't have to
+re-export them every session.
+
+`deploy_user` (see `group_vars/all.yml`) defaults to `deploy` - override with
+the `DEPLOY_USER` env var if you want a different non-root user created on each
+host. `ansible_ssh_private_key_file` (same file) defaults to
 `~/.ssh/id_ed25519` - override with `ANSIBLE_SSH_PRIVATE_KEY_FILE` if you use a
 different key. It must match one of the SSH keys OpenTofu installed on the
 servers (`var.ssh_key_names`).

ansible/group_vars/all.yml

@@ -1,8 +1,9 @@
 ---
-# Keep in sync with infra/variables.tf's var.deploy_user (default "deploy") -
-# the two aren't wired together automatically, since Ansible no longer reads
-# any Terraform state or output.
-deploy_user: deploy
+# Non-root sudo user the bootstrap role creates on each host - purely an
+# Ansible-side concept, OpenTofu has no equivalent variable. Override with the
+# DEPLOY_USER env var (control.sh's "Set variables" menu writes it) if you
+# don't want the default.
+deploy_user: "{{ lookup('env', 'DEPLOY_USER') | default('deploy', true) }}"
 ansible_user: "{{ deploy_user }}"
 ansible_ssh_private_key_file: "{{ lookup('env', 'ANSIBLE_SSH_PRIVATE_KEY_FILE') | default('~/.ssh/id_ed25519', true) }}"