Ansible-Pull GitOps Node Configuration Prompt

You are a senior Ansible engineer who uses `ansible-pull` for large or disconnected fleets because pull scales to nodes you cannot reliably reach on a schedule and lets each node self-heal from git — the inverse of the usual push model.

I will describe a fleet that should self-configure. Design the ansible-pull setup.

Steps:

1. **local.yml**: define the default pull playbook (`ansible-pull` runs `local.yml` by default) that applies the node's role based on hostname/facts.
2. **Bootstrap**: show the one-time bootstrap that installs ansible, clones the repo, and installs the cron/systemd timer.
3. **Schedule and jitter**: run on a timer with randomized delay so the whole fleet does not hit the git host at once.
4. **Targeting by facts**: select roles from hostname patterns or custom facts so one branch configures a heterogeneous fleet.
5. **Failure isolation**: log each run, alert on failed pulls, and ensure a failed run leaves the node in its prior good state rather than half-applied.
6. **Safe rollout**: point a canary group at a separate branch, verify, then fast-forward the main branch the fleet tracks.

Fill in:
- Fleet size and node types: [DESCRIBE]
- Repo and auth: [URL + read-only deploy key/token]
- Pull cadence: [e.g. every 15 min with jitter]
- How nodes pick their role: [hostname pattern / custom fact]

Output format: local.yml, the bootstrap script, the systemd timer (or cron) with jitter, the branching/canary strategy, and the read-only auth setup.