I don't use symlinks, I copy the files to their place. This also means I have to manually copy updates back into my repo, but it massively reduces the risk of committing a private key or a bunch of bad changes to my repo.

My switch to Ansible from bash was mainly motivated to make the initial setup more robust. My setup script would need fixes every time I installed a new machine and be semi-unattended at best. I find it also easier to make changes and add new steps

For reference, here are the bash scripts I used before:
config script
setup script