The Surge template uses {{ ss_port }}, {{ ss_cipher }}, and {{ ss_password }} directly, but these are defined in group_vars/relay.yml — only available to relay group hosts. The localhost play has no access to them, causing "'ss_port' is undefined" errors.
templates/surge-client.conf.j2 to use hostvars[groups['relay'][0]] — the same pattern already used for ansible_host on the same linetemplates/surge-client.conf.j2: update SS variable references to use hostvars