# Group Variables

Group variables define shared defaults for every VM. Override them in environment
or host-specific files rather than editing role tasks.

Secrets, private keys, API tokens, and issued certificates must not be committed.
Use Ansible Vault, SOPS, Vault, or Smallstep-backed workflows when those values
are introduced.