Refactor Ansible tasks and templates for improved consistency and clarity

roles/common/tasks/apt.yml

@@ -1,6 +1,6 @@
 ---
 - name: (apt.yml) Delete Hetzner files 'hetzner-mirror.list' and 'hetzner-security-updates.list'
-  file:
+  ansible.builtin.file:
     path: "{{ item }}"
     state: absent
   with_items:
@@ -15,8 +15,8 @@
     dest: /etc/apt/sources.list
     owner: root
     group: root
-    mode: 0644
-  register: apt_config_updated
+    mode: "0644"
+  register: common_apt_config_updated
   when:
     - apt_manage_sources_list|bool
     - ansible_facts['distribution'] == 'Debian'
@@ -25,7 +25,7 @@
     - apt-configuration
 
 - name: (apt.yml) Ensure Debian archive keyring is present for deb822 Signed-By (Debian >= 13)
-  apt:
+  ansible.builtin.apt:
     name: debian-archive-keyring
     state: present
   when:
@@ -37,7 +37,7 @@
     - apt-configuration
 
 - name: (apt.yml) backup legacy /etc/apt/sources.list before deb822 migration (Debian >= 13)
-  copy:
+  ansible.builtin.copy:
     src: /etc/apt/sources.list
     dest: /etc/apt/sources.list.before-deb822
     remote_src: true
@@ -50,14 +50,14 @@
     - ansible_facts['distribution'] == 'Debian'
     - (ansible_facts['distribution_major_version'] | int) >= 13
   failed_when:
-    - apt_sources_list_backup.failed
-    - "'No such file or directory' not in (apt_sources_list_backup.msg | default(''))"
-  register: apt_sources_list_backup
+    - common_apt_sources_list_backup.failed
+    - "'No such file or directory' not in (common_apt_sources_list_backup.msg | default(''))"
+  register: common_apt_sources_list_backup
   tags:
     - apt-configuration
 
 - name: (apt.yml) replace /etc/apt/sources.list with deb822 notice (Debian >= 13)
-  copy:
+  ansible.builtin.copy:
     dest: /etc/apt/sources.list
     content: |
       # {{ ansible_managed }}
@@ -67,7 +67,7 @@
     owner: root
     group: root
     mode: "0644"
-  register: apt_config_updated_sources_list
+  register: common_apt_config_updated_sources_list
   when:
     - apt_manage_sources_list|bool
     - ansible_facts['distribution'] == 'Debian'
@@ -82,7 +82,7 @@
     owner: root
     group: root
     mode: "0644"
-  register: apt_config_updated_debian_sources
+  register: common_apt_config_updated_debian_sources
   when:
     - apt_manage_sources_list|bool
     - ansible_facts['distribution'] == 'Debian'
@@ -97,7 +97,7 @@
     owner: root
     group: root
     mode: "0644"
-  register: apt_config_updated_security_sources
+  register: common_apt_config_updated_security_sources
   when:
     - apt_manage_sources_list|bool
     - ansible_facts['distribution'] == 'Debian'
@@ -112,7 +112,7 @@
     owner: root
     group: root
     mode: "0644"
-  register: apt_config_updated_backports_sources
+  register: common_apt_config_updated_backports_sources
   when:
     - apt_manage_sources_list|bool
     - ansible_facts['distribution'] == 'Debian'
@@ -124,10 +124,10 @@
 # If 'backports' was enabled in a previous run but is now disabled.
 #
 - name: (apt.yml) remove deb822 backports repository when disabled (Debian >= 13)
-  file:
+  ansible.builtin.file:
     path: /etc/apt/sources.list.d/backports.sources
     state: absent
-  register: apt_config_removed_backports_sources
+  register: common_apt_config_removed_backports_sources
   when:
     - apt_manage_sources_list|bool
     - ansible_facts['distribution'] == 'Debian'
@@ -139,15 +139,15 @@
 # Collect change states from all Debian >=13 deb822 source tasks so apt update
 # can force a fresh cache refresh when repository files changed.
 - name: (apt.yml) aggregate deb822 source changes (Debian >= 13)
-  set_fact:
-    apt_config_updated:
+  ansible.builtin.set_fact:
+    common_apt_config_updated:
       changed: >-
         {{
-          (apt_config_updated_sources_list.changed | default(false))
-          or (apt_config_updated_debian_sources.changed | default(false))
-          or (apt_config_updated_security_sources.changed | default(false))
-          or (apt_config_updated_backports_sources.changed | default(false))
-          or (apt_config_removed_backports_sources.changed | default(false))
+          (common_apt_config_updated_sources_list.changed | default(false))
+          or (common_apt_config_updated_debian_sources.changed | default(false))
+          or (common_apt_config_updated_security_sources.changed | default(false))
+          or (common_apt_config_updated_backports_sources.changed | default(false))
+          or (common_apt_config_removed_backports_sources.changed | default(false))
         }}
   when:
     - apt_manage_sources_list|bool
@@ -157,9 +157,9 @@
     - apt-configuration
 
 - name: (apt.yml) apt update
-  apt:
+  ansible.builtin.apt:
     update_cache: true
-    cache_valid_time: "{{ 0 if apt_config_updated is defined and apt_config_updated.changed else apt_update_cache_valid_time }}"
+    cache_valid_time: "{{ 0 if common_apt_config_updated is defined and common_apt_config_updated.changed else apt_update_cache_valid_time }}"
   when: apt_update|bool
   tags:
     - apt-update
@@ -172,9 +172,9 @@
 
 - name: (apt.yml) Configure any half-installed packages 'dpkg --configure -a'
   ansible.builtin.command: dpkg --configure -a
-  register: _dpkg_configure
-  changed_when: (_dpkg_configure.stdout | default('')) | length > 0
-  failed_when: _dpkg_configure.rc != 0
+  register: common_dpkg_configure
+  changed_when: (common_dpkg_configure.stdout | default('')) | length > 0
+  failed_when: common_dpkg_configure.rc != 0
   when: apt_dpkg_configure|bool
   tags:
     - apt-dpkg-configure
@@ -184,7 +184,7 @@
     - apt-webserver-pkgs
 
 - name: (apt.yml) apt upgrade
-  apt:
+  ansible.builtin.apt:
     upgrade: "{{ apt_upgrade_type }}"
     update_cache: true
     dpkg_options: "{{ apt_upgrade_dpkg_options | join(',') }}"
@@ -197,7 +197,7 @@
     - apt-webserver-pkgs
 
 - name: (apt.yml) Initial install debian packages (stretch)
-  apt:
+  ansible.builtin.apt:
     name: "{{ apt_initial_install_stretch }}"
     state: "{{ apt_install_state }}"
   when:
@@ -208,7 +208,7 @@
     - apt-initial-install
 
 - name: (apt.yml) Initial install debian packages (buster)
-  apt:
+  ansible.builtin.apt:
     name: "{{ apt_initial_install_buster }}"
     state: "{{ apt_install_state }}"
   when:
@@ -219,7 +219,7 @@
     - apt-initial-install
 
 - name: (apt.yml) Initial install debian packages (bullseye)
-  apt:
+  ansible.builtin.apt:
     name: "{{ apt_initial_install_bullseye }}"
     state: "{{ apt_install_state }}"
   when:
@@ -230,7 +230,7 @@
     - apt-initial-install
 
 - name: (apt.yml) Initial install debian packages (bookworm)
-  apt:
+  ansible.builtin.apt:
     name: "{{ apt_initial_install_bookworm }}"
     state: "{{ apt_install_state }}"
   when:
@@ -241,7 +241,7 @@
     - apt-initial-install
 
 - name: (apt.yml) Initial install debian packages (trixie)
-  apt:
+  ansible.builtin.apt:
     name: "{{ apt_initial_install_trixie }}"
     state: "{{ apt_install_state }}"
   when:
@@ -252,7 +252,7 @@
     - apt-initial-install
 
 - name: (apt.yml) Initial install ubuntu packages (bionic)
-  apt:
+  ansible.builtin.apt:
     name: "{{ apt_initial_install_bionic }}"
     state: "{{ apt_install_state }}"
   when:
@@ -262,7 +262,7 @@
     - apt-initial-install
 
 - name: (apt.yml) Initial install ubuntu packages (xenial)
-  apt:
+  ansible.builtin.apt:
     name: "{{ apt_initial_install_xenial }}"
     state: "{{ apt_install_state }}"
   when:
@@ -272,7 +272,7 @@
     - apt-initial-install
 
 - name: (apt.yml) Initial install ubuntu packages (jammy)
-  apt:
+  ansible.builtin.apt:
     name: "{{ apt_initial_install_jammy }}"
     state: "{{ apt_install_state }}"
   when:
@@ -282,7 +282,7 @@
     - apt-initial-install
 
 - name: (apt.yml) Initial install ubuntu packages (noble)
-  apt:
+  ansible.builtin.apt:
     name: "{{ apt_initial_install_noble }}"
     state: "{{ apt_install_state }}"
   when:
@@ -296,7 +296,7 @@
 # ---
 
 - name: (apt.yml) Ensure we have CPU microcode from backports for Intel CPU (debian stretch)
-  apt:
+  ansible.builtin.apt:
     name: "{{ microcode_intel_package }}"
     state: present
     default_release: "{{ ansible_facts['distribution_release'] }}-backports"
@@ -310,21 +310,22 @@
     - apt-microcode
 
 - name: (apt.yml) Install CPU microcode (debian buster/bullseye/bookworm/trixie)
-  apt:
+  ansible.builtin.apt:
     name: "{{ microcode_intel_package }}"
     state: present
     default_release: "{{ ansible_facts['distribution_release'] }}"
   when:
     - apt_debian_contrib_nonfree_enable
     - ansible_facts['distribution'] == "Debian"
-    - ansible_facts['distribution_major_version'] == "10" or ansible_facts['distribution_major_version'] == "11"or ansible_facts['distribution_major_version'] == "12" or ansible_facts['distribution_major_version'] == "13"
+    - ansible_facts['distribution_major_version'] == "10" or ansible_facts['distribution_major_version'] == "11" or
+      ansible_facts['distribution_major_version'] == "12" or ansible_facts['distribution_major_version'] == "13"
     - ansible_facts['processor']|string is search("Intel")
   tags:
     - apt-initial-install
     - apt-microcode
 
 - name: (apt.yml) Install CPU microcode for AMD CPU (debian buster)
-  apt:
+  ansible.builtin.apt:
     name: "{{ microcode_amd_package }}"
     state: present
     default_release: "{{ ansible_facts['distribution_release'] }}"
@@ -338,7 +339,7 @@
     - apt-microcode
 
 - name: (apt.yml) Install CPU microcode for Intel CPU (ubuntu bionic)
-  apt:
+  ansible.builtin.apt:
     name: "{{ microcode_intel_package }}"
     state: present
     default_release: "{{ ansible_facts['distribution_release'] }}"
@@ -351,7 +352,7 @@
     - apt-microcode
 
 - name: (apt.yml) Install CPU microcode for AMD CPU (ubuntu bionic)
-  apt:
+  ansible.builtin.apt:
     name: "{{ microcode_amd_package }}"
     state: present
     default_release: "{{ ansible_facts['distribution_release'] }}"
@@ -365,7 +366,7 @@
     - apt-microcode
 
 - name: (apt.yml) Install CPU microcode for Intel CPU (ubuntu xenial)
-  apt:
+  ansible.builtin.apt:
     name: "{{ microcode_intel_package }}"
     state: present
     default_release: "{{ ansible_facts['distribution_release'] }}"
@@ -378,7 +379,7 @@
     - apt-microcode
 
 - name: (apt.yml) Install CPU microcode for Intel AMD (ubuntu xenial)
-  apt:
+  ansible.builtin.apt:
     name: "{{ microcode_amd_package }}"
     state: present
     default_release: "{{ ansible_facts['distribution_release'] }}"
@@ -392,7 +393,7 @@
     - apt-microcode
 
 - name: (apt.yml) Install CPU microcode for Intel CPU (ubuntu jammy/noble)
-  apt:
+  ansible.builtin.apt:
     name: "{{ microcode_intel_package }}"
     state: present
     default_release: "{{ ansible_facts['distribution_release'] }}"
@@ -405,7 +406,7 @@
     - apt-microcode
 
 - name: (apt.yml) Install CPU microcode for Intel AMD (ubuntu jammy/noble)
-  apt:
+  ansible.builtin.apt:
     name: "{{ microcode_amd_package }}"
     state: present
     default_release: "{{ ansible_facts['distribution_release'] }}"
@@ -423,7 +424,7 @@
 # ---
 
 - name: (apt.yml) Install Firmware packages (Ubuntu)
-  apt:
+  ansible.builtin.apt:
     name: "{{ firmware_packages_ubuntu }}"
     state: present
     default_release: "{{ ansible_facts['distribution_release'] }}"
@@ -434,7 +435,7 @@
     - apt-firmware
 
 - name: (apt.yml) Install Firmware packages (Debian)
-  apt:
+  ansible.builtin.apt:
     name: "{{ firmware_packages_debian }}"
     state: present
     default_release: "{{ ansible_facts['distribution_release'] }}"
@@ -445,7 +446,7 @@
     - apt-firmware
 
 - name: (apt.yml) Install non-free Firmware packages (Debian)
-  apt:
+  ansible.builtin.apt:
     name: "{{ firmware_non_free_packages_debian }}"
     state: present
     default_release: "{{ ansible_facts['distribution_release'] }}"
@@ -461,7 +462,7 @@
 # ---
 
 - name: (apt.yml) Remove unwanted packages
-  apt:
+  ansible.builtin.apt:
     name: "{{ apt_remove }}"
     state: absent
     purge: "{{ apt_remove_purge }}"
@@ -469,7 +470,7 @@
     - apt-remove
 
 - name: (apt.yml) Remove unwanted packages Ubuntu bionic
-  apt:
+  ansible.builtin.apt:
     name: "{{ apt_remove_bionic }}"
     state: absent
     purge: "{{ apt_remove_purge }}"
@@ -480,7 +481,7 @@
     - apt-remove
 
 - name: (apt.yml) Remove unwanted packages Ubuntu xenial
-  apt:
+  ansible.builtin.apt:
     name: "{{ apt_remove_xenial }}"
     state: absent
     purge: "{{ apt_remove_purge }}"
@@ -491,7 +492,7 @@
     - apt-remove
 
 - name: (apt.yml) Remove unwanted packages Ubuntu jammy
-  apt:
+  ansible.builtin.apt:
     name: "{{ apt_remove_jammy }}"
     state: absent
     purge: "{{ apt_remove_purge }}"
@@ -502,7 +503,7 @@
     - apt-remove
 
 - name: (apt.yml) Remove unwanted packages Ubuntu noble
-  apt:
+  ansible.builtin.apt:
     name: "{{ apt_remove_noble }}"
     state: absent
     purge: "{{ apt_remove_purge }}"
@@ -513,7 +514,7 @@
     - apt-remove
 
 - name: (apt.yml) autoremove
-  apt:
+  ansible.builtin.apt:
     autoremove: true
     dpkg_options: "{{ apt_upgrade_dpkg_options | join(',') }}"
   when: apt_autoremove|bool
@@ -522,12 +523,10 @@
     - apt-initial-install
     - apt-microcode
 
-- name: (apt.yml) clean
-  command: apt-get -y clean
-  #args:
-  #  warn: false
-  changed_when: false
-  when: apt_clean|bool
+- name: (apt.yml) autoclean cache
+  ansible.builtin.apt:
+    autoclean: true
+  when: apt_clean | bool
   tags:
     - apt-clean
     - apt-initial-install