All service dirs' roles_path now includes shared/roles — single source of truth for roles used on multiple nodes. Alloy's docker network is parameterized (spokes push over WireGuard, no shared network needed). wireguard role: wg-quick@wg0, private key from WG_PRIVATE_KEY env (1Password), peers committed in each node's inventory.