Prevent unintended local execution of delegated tasks in ansible-pull

roles/lmn_misc/templates/lmn-updater.service.j2

@@ -5,5 +5,5 @@ Description=Run LMN Client updates via ansible-pull
 Type=oneshot
 User=root
 ExecStart=/usr/bin/ansible-pull --only-if-changed --verbose --vault-password-file /root/.inventory-pw -l %H -d /root/lmn-client \
-           -i {{ misc_updater_inventory }} --url={{ misc_updater_repository }} -C {{ misc_updater_branch }} lmn-client.yml
+           --skip-tags no_ansible_pull -i {{ misc_updater_inventory }} --url={{ misc_updater_repository }} -C {{ misc_updater_branch }} lmn-client.yml
 

roles/lmn_vpn/tasks/main.yml

@@ -29,3 +29,5 @@
 - name: Configure Wireguard
   ansible.builtin.include_tasks: wg_config.yml
   when: vpn is defined and vpn == "wg"
+  tags:
+    - no_ansible_pull

roles/lmn_wlan/tasks/main.yaml

@@ -39,3 +39,5 @@
 - name: Configure WPA-Enterprise (EAP-TLS)
   ansible.builtin.include_tasks: eap-tls_check-certificate.yaml
   when: wlan == 'eap-tls'
+  tags:
+    - no_ansible_pull