From 15122b924d7ef9af6d9b2596fbf875a027d88428 Mon Sep 17 00:00:00 2001
From: Sandwich <sandwich@archworks.co>
Date: Fri, 20 Feb 2026 20:19:37 +0100
Subject: [PATCH] feat(system_check): add safety check for physical installs

---
 roles/system_check/tasks/main.yml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/roles/system_check/tasks/main.yml b/roles/system_check/tasks/main.yml
index 19efcb9..658d37c 100644
--- a/roles/system_check/tasks/main.yml
+++ b/roles/system_check/tasks/main.yml
@@ -1,4 +1,14 @@
 ---
+- name: Physical install safety confirmation
+  when: system_cfg.type == "physical"
+  ansible.builtin.assert:
+    that:
+      - physical_install_confirmed | default(false) | bool
+    fail_msg: >-
+      DANGER: Physical install will WIPE {{ install_drive }} on {{ inventory_hostname }}.
+      Set physical_install_confirmed=true in inventory to proceed.
+    quiet: true
+
 - name: VM existence protection check
   when: system_cfg.type == "virtual"
   block: