---
# Reach the VMs over Tailscale, and fall back to the LAN if the tailnet is down.
#
# ansible_host is a MagicDNS name. If tailscaled is not running on the control
# node that name does not resolve, so `nc %h %p` fails fast and the second nc
# takes over on the LAN address recorded as lan_ip in inventory.ini.
#
# This is safe against the LAN addresses drifting again (which is how
# fulcrum/mempool came to be transposed): known_hosts is keyed to the MagicDNS
# NAME, so if lan_ip ever points at a different machine the host key will not
# match and ssh aborts. Verified 2026-09-12 by pointing fulcrum-box at
# mempool-box's address: "Host key verification failed."
#
# lan_ip is a convenience, not an identity. If it goes stale the fallback stops
# working; it will never connect you to the wrong box.
ansible_ssh_common_args: >-
  -o ProxyCommand="sh -c 'nc -w2 %h %p 2>/dev/null || nc -w4 {{ lan_ip }} %p'"