- hosts: all
  become: true
  roles:
    - role: common_hardening  # Désactivation root SSH, UFW, Fail2ban
    - role: wireguard_mesh     # Tunnels chiffrés Zero-Trust
    - role: docker_engine      # Moteur de conteneurisation
    - role: traefik_ingress    # Reverse proxy dynamique