Refactor Ansible tasks and templates for improved consistency and clarity

roles/common/tasks/default-users.yml

@@ -5,7 +5,7 @@
 # ---
 
 - name: (default-users.yml) Ensure default groups exists
-  group:
+  ansible.builtin.group:
     name: '{{ item.name }}'
     state: present
     gid: '{{ item.group_id | default(omit) }}'
@@ -17,14 +17,14 @@
     - groups-exists
 
 - name: (default-users.yml) Ensure default users exists
-  user:
+  ansible.builtin.user:
     name: '{{ item.name }}'
     state: present
     uid: '{{ item.user_id | default(omit) }}'
     group: '{{ item.group | default(omit) }}'
-    #group: '{{ item.name | default(omit) }}'
+    # group: '{{ item.name | default(omit) }}'
     home: '{{ item.home | default(omit) }}'
-    shell: '{{ item.shell|d("/bin/bash") }}'
+    shell: '{{ item.shell | d("/bin/bash") }}'
     password: "{{ item.password }}"
     update_password: on_create
   loop: "{{ default_user }}"
@@ -34,7 +34,7 @@
     - users-exists
 
 - name: (default-users.yml) Ensure authorized_key files for default users are present
-  authorized_key:
+  ansible.posix.authorized_key:
     user: "{{ item.0.name }}"
     key: "{{ item.1 }}"
     state: present
@@ -51,26 +51,26 @@
 # ---
 
 - name: (default-users.yml) Ensure extra groups exists
-  group:
+  ansible.builtin.group:
     name: '{{ item.name }}'
     state: present
     gid: '{{ item.group_id | default(omit) }}'
   loop: "{{ extra_user }}"
   loop_control:
     label: '{{ item.name }}'
-  when: 
+  when:
     - extra_user is defined and extra_user|length > 0
   tags:
     - groups-exists
 
 - name: (default-users.yml) Ensure extra users exists
-  user:
+  ansible.builtin.user:
     name: '{{ item.name }}'
     state: present
     uid: '{{ item.user_id | default(omit) }}'
     group: '{{ item.name | default(omit) }}'
     home: '{{ item.home | default(omit) }}'
-    shell: '{{ item.shell|d("/bin/bash") }}'
+    shell: '{{ item.shell | d("/bin/bash") }}'
     password: "{{ item.password }}"
     update_password: on_create
   loop: "{{ extra_user }}"
@@ -81,7 +81,7 @@
     - users-exists
 
 - name: (default-users.yml) Ensure authorized_key files for extra users are present
-  authorized_key:
+  ansible.posix.authorized_key:
     user: "{{ item.0.name }}"
     key: "{{ item.1 }}"
     state: present
@@ -95,7 +95,7 @@
     - authorized_key
 
 - name: (default-users.yml) other entries authorized_key files
-  authorized_key:
+  ansible.posix.authorized_key:
     user: "{{ item.user }}"
     key: "{{ item.key }}"
     state: present
@@ -103,20 +103,20 @@
   loop_control:
     label: "{{ item.user }}"
   when:
-     - entries_authorized_key is defined
-     - entries_authorized_key|length > 0
+    - entries_authorized_key is defined
+    - entries_authorized_key|length > 0
 
 # ---
 # - extra system user
 # ---
 
 - name: (default-users.yml) extra system user exists?
-  user:
+  ansible.builtin.user:
     name: '{{ item.name }}'
     state: present
-    system: yes
+    system: true
     home: '{{ item.home }}'
-    shell: '{{ item.shell|d("/usr/sbin/nologin") }}'
+    shell: '{{ item.shell | d("/usr/sbin/nologin") }}'
     groups: '{{ item.groups | default(omit) }}'
   loop: "{{ extra_system_user }}"
   loop_control:
@@ -125,43 +125,42 @@
   tags:
     - user-exists
 
-
 # ---
 # - extra system groups 'sftp_users'
 # ---
 
 - name: (default-users.yml) Extra system group sftp_users
-  group:
+  ansible.builtin.group:
     name: 'sftp_users'
     state: present
-    system: yes
-  when: 
+    system: true
+  when:
     - create_sftp_group is defined and create_sftp_group > 0
   tags:
     - groups-exists
 
-
-
 # =======================================================
 
-
 # ---
 # - Allow connection via ssh to backup host
 # ---
 
 - name: Ensure root's .ssh directory exists
-  file:
+  ansible.builtin.file:
     path: /root/.ssh
     state: directory
+    owner: root
+    group: root
+    mode: '0700'
 
 - name: (default-users.yml) Copy (backup) ed25519 ssh private key to user root
-  copy:
+  ansible.builtin.copy:
     src: '{{ item.priv_key_src }}'
     dest: '{{ item.priv_key_dest }}'
     owner: root
     group: root
     mode: '0600'
-  when: 
+  when:
     - insert_keypair_backup_client|bool
     - ssh_keypair_backup_client is defined
     - ssh_keypair_backup_client|length > 0
@@ -172,13 +171,13 @@
     - insert_ssh_keypair_backup_server
 
 - name: (default-users.yml) Copy (backup) ed25519 ssh public key to user root
-  copy:
+  ansible.builtin.copy:
     src: '{{ item.pub_key_src }}'
     dest: '{{ item.pub_key_dest }}'
     owner: root
     group: root
     mode: '0644'
-  when: 
+  when:
     - insert_keypair_backup_client|bool
     - ssh_keypair_backup_client is defined
     - ssh_keypair_backup_client|length > 0
@@ -189,7 +188,7 @@
     - insert_ssh_keypair_backup_server
 
 - name: (default-users.yml) Ensure authorized_key (root) on backup hosts contains public key
-  authorized_key:
+  ansible.posix.authorized_key:
     user: root
     key: "{{ lookup('file', item.pub_key_src) }}"
     state: present
@@ -204,9 +203,8 @@
     - authorized_key
     - ssh-keypair-backup-server
 
-
 - name: (default-users.yml) Copy further ssh private key(s) to user root
-  copy:
+  ansible.builtin.copy:
     src: '{{ item.priv_key_src }}'
     dest: '{{ item.priv_key_dest }}'
     owner: root
@@ -215,16 +213,15 @@
   loop: "{{ root_ssh_keypair }}"
   loop_control:
     label: 'dest: {{ item.priv_key_dest }}'
-  when: 
+  when:
     - insert_root_ssh_keypair|bool
     - root_ssh_keypair is defined
     - root_ssh_keypair|length > 0
   tags:
     - insert_root_ssh_keypair
     - root-defaut-ssh-keypair
-
 - name: (default-users.yml) Copy further ssh public key(s) to user root
-  copy:
+  ansible.builtin.copy:
     src: '{{ item.pub_key_src }}'
     dest: '{{ item.pub_key_dest }}'
     owner: root
@@ -233,11 +230,10 @@
   loop: "{{ root_ssh_keypair }}"
   loop_control:
     label: 'dest: {{ item.pub_key_dest }}'
-  when: 
+  when:
     - insert_root_ssh_keypair|bool
     - root_ssh_keypair is defined
     - root_ssh_keypair|length > 0
   tags:
     - insert_root_ssh_keypair
     - root-defaut-ssh-keypair
-