double playbook causes two runs
PLAYBOOKS="$PLAYBOOKS $INVSITE"
results in:
ansible-playbook ... /root/playbook-repo/site.yml /root/inventory-repo/site.yml
If the two repos are really the same, then it runs all the roles/tasks twice.
Which somehow muck up /etc/nftables.conf (the 2nd run reverts back to the original.. I don't get it. removing inventory-repo/site.yml fixed it.