Refactor Ansible tasks and templates for improved consistency and clarity

roles/common/tasks/sshd.yml

@@ -6,40 +6,40 @@
 # ---
 
 - name: (sshd.yml) Set fact_sshd_kexalgorithms (comma separated list)
-  set_fact:
-    fact_sshd_kexalgorithms: "{{ sshd_kexalgorithms | join (',') }}"
+  ansible.builtin.set_fact:
+    common_fact_sshd_kexalgorithms: "{{ sshd_kexalgorithms | join(',') }}"
   when:
     - sshd_kexalgorithms is defined and sshd_kexalgorithms | length > 0
   tags:
     - sshd-config
 
 - name: (sshd.yml) Set fact_sshd_ciphers (comma separated list)
-  set_fact:
-    fact_sshd_ciphers: "{{ sshd_ciphers | join (',') }}"
+  ansible.builtin.set_fact:
+    common_fact_sshd_ciphers: "{{ sshd_ciphers | join(',') }}"
   when:
     - sshd_ciphers is defined and sshd_ciphers | length > 0
   tags:
     - sshd-config
 
-- name: (sshd.yml) Set fact_sshd_macs 
-  set_fact:
-    fact_sshd_macs: "{{ sshd_macs | join (',') }}"
+- name: (sshd.yml) Set fact_sshd_macs
+  ansible.builtin.set_fact:
+    common_fact_sshd_macs: "{{ sshd_macs | join(',') }}"
   when:
     - sshd_macs is defined and sshd_macs | length > 0
   tags:
     - sshd-config
 
 - name: (sshd.yml) Set fact_sshd_hostkeyalgorithms (blank separated list)
-  set_fact:
-    fact_sshd_hostkeyalgorithms: "{{ sshd_hostkeyalgorithms | join (',') }}"
+  ansible.builtin.set_fact:
+    common_fact_sshd_hostkeyalgorithms: "{{ sshd_hostkeyalgorithms | join(',') }}"
   when:
     - sshd_hostkeyalgorithms is defined and sshd_hostkeyalgorithms | length > 0
   tags:
     - sshd-config
 
 - name: (sshd.yml) Set fact_sshd_allowed_users (blank separated list)
-  set_fact:
-    fact_sshd_allowed_users: "{{ sshd_allowed_users | join (' ') }}"
+  ansible.builtin.set_fact:
+    common_fact_sshd_allowed_users: "{{ sshd_allowed_users | join(' ') }}"
   when:
     - sshd_allowed_users is defined and sshd_allowed_users | length > 0
   tags:
@@ -50,15 +50,22 @@
 # ---
 
 - name: (sshd.yml) Check file '/etc/ssh/sshd_config.ORIG' exists
-  stat:
+  ansible.builtin.stat:
     path: /etc/ssh/sshd_config.ORIG
-  register: etc_sshd_sshd_config_ORIG
+  register: common_etc_sshd_sshd_config_orig
   tags:
     - sshd-config
 
 - name: (sshd.yml) Backup installation version of file '/etc/ssh/sshd_config'
-  command: cp -a /etc/ssh/sshd_config /etc/ssh/sshd_config.ORIG
-  when: etc_sshd_sshd_config_ORIG.stat.exists == False
+  ansible.builtin.copy:
+    src: /etc/ssh/sshd_config
+    dest: /etc/ssh/sshd_config.ORIG
+    remote_src: true
+    owner: root
+    group: root
+    mode: "0644"
+    force: false
+  when: not common_etc_sshd_sshd_config_orig.stat.exists
   tags:
     - sshd-config
 
@@ -69,9 +76,9 @@
     dest: /etc/ssh/sshd_config
     owner: root
     group: root
-    mode: 0644
+    mode: "0644"
     validate: 'sshd -f %s -T'
-    #backup: yes
+    # backup: yes
   notify: "Restart ssh"
   when:
     - ansible_facts['distribution'] == "Ubuntu"
@@ -85,7 +92,7 @@
     dest: /etc/ssh/sshd_config
     owner: root
     group: root
-    mode: 0644
+    mode: "0644"
     validate: 'sshd -f %s -T'
   notify: "Restart ssh"
   when:
@@ -101,7 +108,7 @@
     dest: /etc/ssh/sshd_config
     owner: root
     group: root
-    mode: 0644
+    mode: "0644"
     validate: 'sshd -f %s -T -C user=sftp_users'
   notify: "Restart ssh"
   when:
@@ -113,21 +120,21 @@
 
 
 - name: (sshd.yml) Check if sshd_config contains activ parameter 'Subsystem sftp'..
-  lineinfile:
+  ansible.builtin.lineinfile:
     path: /etc/ssh/sshd_config
     regexp: '^Subsystem\s+sftp(.+)$'
     state: absent
-  check_mode: yes
+  check_mode: true
   changed_when: false
   register: sshd_config_sftp
   tags:
     - sshd-config
 
 - name: (sshd.yml) Ensure directory '/etc/ssh/sshd_config.d' exists
-  file:
+  ansible.builtin.file:
     path: /etc/ssh/sshd_config.d
     state: directory
-    mode: 0755
+    mode: "0755"
     group: root
     owner: root
   when:
@@ -142,7 +149,7 @@
     dest: /etc/ssh/sshd_config.d/50-sshd-local.conf
     owner: root
     group: root
-    mode: 0644
+    mode: "0644"
   notify: "Restart ssh"
   when:
     - ansible_facts['distribution'] == "Debian"