diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..5533d98
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,13 @@
+# Ansible artifacts
+*.retry
+
+# Sensitive group vars
+playbook/group_vars/vault.yml
+
+# Local facts/cache
+.ansible/
+.ansible_facts_cache/
+
+# Editor/OS
+.DS_Store
+*.swp
diff --git a/README.md b/README.md
index 0210e56..36f690b 100644
--- a/README.md
+++ b/README.md
@@ -1,2 +1,7 @@
 # os-upgrade-automation
 
+
+## Structure
+- playbook/ (roles, vars, inventories)
+- group_vars/vault.yml excluded (use sops/age)
+
diff --git a/ansible.cfg b/ansible.cfg
new file mode 100644
index 0000000..a30ce43
--- /dev/null
+++ b/ansible.cfg
@@ -0,0 +1,9 @@
+[defaults]
+inventory = playbook/inventories
+roles_path = playbook/roles
+retry_files_enabled = False
+stdout_callback = yaml
+host_key_checking = False
+force_color = True
+forks = 10
+callback_whitelist = profile_tasks