Refactor Ansible tasks and templates for improved consistency and clarity

apt-migrate-to-trixie.yml

@@ -1,121 +0,0 @@
----
-
-# ---
-# deb822 ist das neue Konfigurationsformats für APT-Quellen (Repositories).
-# Es basiert auf der Debian Control Syntax nach RFC 822 – daher der Name
-# ---
-
-- name: Nur APT auf Debian 13 (Trixie) migrieren
-  hosts: all
-  become: true
-  gather_facts: true
-
-  vars:
-    target_release: trixie
-    debian_mirror: "http://deb.debian.org/debian"
-    security_mirror: "http://security.debian.org/debian-security"
-    components: "main contrib non-free non-free-firmware"
-    enable_backports: true         # auf false setzen, wenn du keine Backports willst
-    pin_backports_low: true        # Backports nur auf Anfrage
-    # Nur manuelle Installation/Upgrade aus Backports:
-    #    backports_pin_priority: 100
-    #
-    # Automatische Updates für bereits installierte Backports-Pakete.
-    #    backports_pin_priority: 500 (>= 500)
-    #
-    backports_pin_priority: 100    # 100 = nie automatisch bevorzugen
-    apt_cache_valid_time: 3600
-    # Für offizielle Debian-Repos brauchst es kein Signed-By, weil debian-archive-keyring 
-    # ohnehin systemweit vertrauenswürdig ist.
-    #
-    use_signed_by: true  # oder false, wenn du Option A willst
-    # Wenn Signed-By explizit gesetzt werden soll, dann nutze den Keyring-Pfad und stelle sicher, 
-    # dass das Paket installiert ist.
-    signed_by_keyring: "/usr/share/keyrings/debian-archive-keyring.gpg"
-
-  pre_tasks:
-    - name: Sicherstellen, dass wir Debian sind
-      assert:
-        that:
-          - ansible_facts['os_family'] == "Debian"
-        fail_msg: "Dieses Playbook ist nur für Debian geeignet."
-
-  tasks:
-
-    - name: Keyring für Debian-Archive sicherstellen (falls Signed-By genutzt)
-      ansible.builtin.apt:
-        name: debian-archive-keyring
-        state: present
-      when: use_signed_by
-
-    - name: (Optional) Alte /etc/apt/sources.list sichern
-      ansible.builtin.copy:
-        src: /etc/apt/sources.list
-        dest: /etc/apt/sources.list.before-trixie
-        remote_src: true
-        force: false
-      ignore_errors: true
-
-    - name: Alte /etc/apt/sources.list deaktivieren (leere Kommentar-Datei)
-      ansible.builtin.copy:
-        dest: /etc/apt/sources.list
-        content: |
-          # Verwaltet via Ansible. Repositories liegen in /etc/apt/sources.list.d/*.sources (deb822).
-          # Zielrelease: {{ target_release }}
-        owner: root
-        group: root
-        mode: "0644"
-
-    - name: Debian-Repo (deb + deb-src) als deb822 anlegen
-      ansible.builtin.template:
-        src: templates/apt-migrate-to-trixie/debian.sources.j2
-        dest: /etc/apt/sources.list.d/debian.sources
-        owner: root
-        group: root
-        mode: "0644"
-
-    - name: Security-Repo (deb + deb-src) als deb822 anlegen
-      ansible.builtin.template:
-        src: templates/apt-migrate-to-trixie/security.sources.j2
-        dest: /etc/apt/sources.list.d/security.sources
-        owner: root
-        group: root
-        mode: "0644"
-
-    - name: Backports-Repo (optional) als deb822 anlegen/entfernen
-      ansible.builtin.template:
-        src: templates/apt-migrate-to-trixie/backports.sources.j2
-        dest: /etc/apt/sources.list.d/backports.sources
-        owner: root
-        group: root
-        mode: "0644"
-      when: enable_backports
-    - name: Backports-Repo entfernen wenn deaktiviert
-      ansible.builtin.file:
-        path: /etc/apt/sources.list.d/backports.sources
-        state: absent
-      when: not enable_backports
-
-    - name: Optionales Backports-Pinning setzen
-      ansible.builtin.template:
-        src: templates/apt-migrate-to-trixie/99-backports.j2
-        dest: /etc/apt/preferences.d/99-backports
-        owner: root
-        group: root
-        mode: "0644"
-      when: enable_backports and pin_backports_low
-
-    - name: APT-Cache aktualisieren
-      ansible.builtin.apt:
-        update_cache: yes
-        cache_valid_time: "{{ apt_cache_valid_time }}"
-
-    - name: Verifikation - zeigen, ob Suites auf trixie stehen
-      ansible.builtin.command: apt-cache policy
-      register: apt_policy
-      changed_when: false
-
-    - name: Ausgabe anzeigen (nur Info)
-      ansible.builtin.debug:
-        msg: "{{ apt_policy.stdout.split('\n') | select('search', 'trixie') | list | join('\n') }}"
-

group_vars/akb.yml

@@ -99,27 +99,27 @@ nfs_start_servers: 32
 #    Take car to increase 'fsid' in case of more than one export
 #
 nfs_exports:
-   - src: 192.168.82.10:/data/home
-     path: /data/home
-     mount_opts: user,exec,rsize=8192,wsize=8192,hard,intr
-     export_opt: rw,root_squash,sync,subtree_check
-     export_networks:
-       - 192.168.82.0/24
-       - 10.0.82.0/24
-       - 10.1.82.0/24
-       - 192.168.63.0/24
-     use_fsid_option: true
+  - src: 192.168.82.10:/data/home
+    path: /data/home
+    mount_opts: user,exec,rsize=8192,wsize=8192,hard,intr
+    export_opt: rw,root_squash,sync,subtree_check
+    export_networks:
+      - 192.168.82.0/24
+      - 10.0.82.0/24
+      - 10.1.82.0/24
+      - 192.168.63.0/24
+    use_fsid_option: true
 
-   - src: 192.168.82.10:/data/samba
-     path: /data/samba
-     mount_opts: user,exec,rsize=8192,wsize=8192,hard,intr
-     export_opt: rw,root_squash,sync,subtree_check
-     export_networks:
-       - 192.168.82.0/24
-       - 10.0.82.0/24
-       - 10.1.82.0/24
-       - 192.168.63.0/24
-     use_fsid_option: true
+  - src: 192.168.82.10:/data/samba
+    path: /data/samba
+    mount_opts: user,exec,rsize=8192,wsize=8192,hard,intr
+    export_opt: rw,root_squash,sync,subtree_check
+    export_networks:
+      - 192.168.82.0/24
+      - 10.0.82.0/24
+      - 10.1.82.0/24
+      - 192.168.63.0/24
+    use_fsid_option: true
 
 
 # ==========
@@ -158,7 +158,7 @@ pureftpd_virtual_users:
     uid: jibran
     gid: users
 
-#pureftpd_virtual_deleted_users:
+# pureftpd_virtual_deleted_users:
 #
 #  Available properties
 #  - name: vuser2
@@ -176,10 +176,10 @@ pureftpd_virtual_users_import: false
 pureftpd_tls_certificate_method: 'generate'
 
 # for method 'generate'
-# 
+#
 # Available properties
 #
-#pureftpd_tls_certificate_openssl:
+# pureftpd_tls_certificate_openssl:
 #  size: 4096
 #  days: 365
 #  fqdn: ftp.example.com
@@ -207,19 +207,19 @@ pureftpd_tls_certificate_openssl:
 #
 # On NIS supported Server put your users and groups in the
 # appropriate section for playbook 'nis-user.yml'
-# 
+#
 # ! Notice !
 
 remove_system_users: []
-#remove_system_users:
+# remove_system_users:
 #  - name: test
 
 system_users: []
-#system_users:
+# system_users:
 #  - name: test
 #    password: 'test100'
 
-#system_users:
+# system_users:
 #
 #  - name: sysadm
 #    password: '9xFXkdPR_2'
@@ -259,7 +259,7 @@ nis_groups:
     group_id: 1130
 
 remove_nis_users: []
-#remove_nis_users:
+# remove_nis_users:
 #   - name: anna
 #   - name: birgit
 #   - name: jonas
@@ -470,7 +470,7 @@ samba_shares:
     recycle_path: '@Recycle.Bin'
     user:
       - buero
-      - chris 
+      - chris
       - jibran
       - praktikum
       - maica
@@ -689,4 +689,3 @@ sudo_pc_users:
 # ==========
 # vars used by roles/common/tasks/luks.yml
 # ==========
-

group_vars/flr.yml

@@ -121,7 +121,7 @@ resolved_nameserver:
 # If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
   - ~.
   - flr.netz
@@ -131,16 +131,12 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 172.16.102.254
-
-
+  - 172.16.102.254
 
 # ==========
 # vars used by roles/common/tasks/git.yml
 # ==========
 
-
-
 # ==========
 # vars used by roles/common/tasks/ntp.yml
 # ==========
@@ -162,29 +158,29 @@ nfs_start_servers: 16
 # partition.
 #
 nfs_exports:
-   - src: 192.168.102.10:/data/home
-     path: /data/home
-     mount_opts: users,rsize=8192,wsize=8192,hard,intr
-     export_opt: rw,root_squash,sync,subtree_check
-     export_networks:
-       - 192.168.102.0/24
-       - 10.0.102.0/24
-       - 10.1.102.0/24
-       - 192.168.63.0/24
-     fs_encrypted: false
-     use_fsid_option: true
+  - src: 192.168.102.10:/data/home
+    path: /data/home
+    mount_opts: users,rsize=8192,wsize=8192,hard,intr
+    export_opt: rw,root_squash,sync,subtree_check
+    export_networks:
+      - 192.168.102.0/24
+      - 10.0.102.0/24
+      - 10.1.102.0/24
+      - 192.168.63.0/24
+    fs_encrypted: false
+    use_fsid_option: true
 
-   - src: 192.168.102.10:/data/samba
-     path: /data/samba
-     mount_opts: users,rsize=8192,wsize=8192,hard,intr
-     export_opt: rw,root_squash,sync,subtree_check
-     export_networks:
-       - 192.168.102.0/24
-       - 10.0.102.0/24
-       - 10.1.102.0/24
-       - 192.168.63.0/24
-     fs_encrypted: false
-     use_fsid_option: true
+  - src: 192.168.102.10:/data/samba
+    path: /data/samba
+    mount_opts: users,rsize=8192,wsize=8192,hard,intr
+    export_opt: rw,root_squash,sync,subtree_check
+    export_networks:
+      - 192.168.102.0/24
+      - 10.0.102.0/24
+      - 10.1.102.0/24
+      - 192.168.63.0/24
+    fs_encrypted: false
+    use_fsid_option: true
 
 
 # ==========
@@ -206,7 +202,7 @@ nfs_exports:
 remove_system_users: []
 
 system_users: []
-#system_users:
+# system_users:
 #  - name: sysadm
 #    password: '9xFXkdPR_2'
 
@@ -253,7 +249,7 @@ nis_groups:
     group_id: 1038
 
 remove_nis_users: []
-#remove_nis_users:
+# remove_nis_users:
 #   - name: test
 #   - name: ivana
 
@@ -484,7 +480,7 @@ samba_server_cidr_prefix: 24
 samba_workgroup: FLR
 samba_netbios_name: FILE-FLR
 
-#samba_allow_insecure_wide_links: !!str yes
+# samba_allow_insecure_wide_links: !!str yes
 
 samba_shares:
   - name: Team
@@ -583,7 +579,7 @@ samba_shares:
     group_write_list: team
     file_create_mask: '0660'
     dir_create_mask: '2770'
-    #wide_links: !!str yes
+    # wide_links: !!str yes
     vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
@@ -634,4 +630,3 @@ sudo_pc_users:
 # ==========
 # vars used by roles/common/tasks/luks.yml
 # ==========
-

group_vars/kb.yml

@@ -33,7 +33,7 @@ sshd_permit_root_login: !!str "prohibit-password"
 
 # name or ip-adress from the (local) ntp server, mostly the gateway
 #
-#ntp_server: gw-kb.anw-kb.netz
+# ntp_server: gw-kb.anw-kb.netz
 
 
 # ==========
@@ -147,8 +147,6 @@ nfs_exports:
       - 10.0.32.109
       - 192.168.2.190
     use_fsid_option: true
-     
-
 
 
 # ==========
@@ -163,12 +161,12 @@ nfs_exports:
 # ! Notice !
 
 remove_system_users: []
-#remove_system_users:
+# remove_system_users:
 #  - name: test
 #  - name: jennifer.prost
 
 system_users: []
-#system_users:
+# system_users:
 #  - name: sysadm
 #    password: '9xFXkdPR_2'
 
@@ -204,15 +202,14 @@ nis_groups:
     group_id: 1200
 
 
-
-#nis_groups:
+# nis_groups:
 #  - name: mbr-finanzen (wird zu vdk)
 #    group_id: 1210
 #  - name: mbr-personal (wird zu mbr-finanzen-personal)
 #    group_id: 1220
 
 remove_nis_users: []
-#remove_nis_users:
+# remove_nis_users:
 #   - name: test
 #   - name: jennifer.prost
 
@@ -309,7 +306,6 @@ nis_user:
     password: ''
 
 
-
 # ==========
 # vars used by roles/common/tasks/samba-install.yml
 # ==========
@@ -348,7 +344,6 @@ samba_netbios_name: FILE-KB
 samba_server_min_protocol: !!str "NT1"
 
 
-
 samba_shares:
 
 # ---
@@ -428,8 +423,6 @@ samba_shares:
     recycle_path: '@Recycle.Bin'
 
 
-
-
 # ==========
 # vars used by roles/common/tasks/system-user-systemfiles.yml
 # ==========
@@ -438,7 +431,7 @@ samba_shares:
 #
 # variables used from other previos sections:
 #
-#    - system_users:          roles/common/tasks/system-user.yml      
+#    - system_users:          roles/common/tasks/system-user.yml
 
 
 # ==========
@@ -477,4 +470,3 @@ sudo_pc_users:
 # ==========
 # vars used by roles/common/tasks/luks.yml
 # ==========
-

group_vars/sprachenatelier.yml

@@ -46,27 +46,27 @@ nfs_start_servers: 16
 #    Take car to increase 'fsid' in case of more than one export
 #
 nfs_exports:
-   - src: 192.168.92.10:/data/home
-     path: /data/home
-     mount_opts: users,rsize=8192,wsize=8192,hard,intr
-     export_opt: rw,root_squash,sync,subtree_check
-     export_networks:
-       - 192.168.92.0/24
-       - 10.0.92.0/24
-       - 10.1.92.0/24
-       - 192.168.63.0/24
-     fs_encrypted: false
+  - src: 192.168.92.10:/data/home
+    path: /data/home
+    mount_opts: users,rsize=8192,wsize=8192,hard,intr
+    export_opt: rw,root_squash,sync,subtree_check
+    export_networks:
+      - 192.168.92.0/24
+      - 10.0.92.0/24
+      - 10.1.92.0/24
+      - 192.168.63.0/24
+    fs_encrypted: false
 
-   - src: 192.168.92.10:/data/samba
-     path: /data/samba
-     mount_opts: users,rsize=8192,wsize=8192,hard,intr
-     export_opt: rw,root_squash,sync,subtree_check
-     export_networks:
-       - 192.168.92.0/24
-       - 10.0.92.0/24
-       - 10.1.92.0/24
-       - 192.168.63.0/24
-     fs_encrypted: false
+  - src: 192.168.92.10:/data/samba
+    path: /data/samba
+    mount_opts: users,rsize=8192,wsize=8192,hard,intr
+    export_opt: rw,root_squash,sync,subtree_check
+    export_networks:
+      - 192.168.92.0/24
+      - 10.0.92.0/24
+      - 10.1.92.0/24
+      - 192.168.63.0/24
+    fs_encrypted: false
 
 
 # ==========
@@ -81,14 +81,14 @@ nfs_exports:
 # ! Notice !
 
 remove_system_users: []
-#remove_system_users:
-#  - name: test
-#  - name: jennifer.prost
+# remove_system_users:
+#   - name: test
+#   - name: jennifer.prost
 
 system_users: []
-#system_users:
-#  - name: sysadm
-#    password: '9xFXkdPR_2'
+# system_users:
+#   - name: sysadm
+#     password: '9xFXkdPR_2'
 
 system_groups: []
 
@@ -122,19 +122,18 @@ nis_groups:
   - name: no-backup
     group_id: 1120
 
-#remove_nis_users:
-#  - name: lea
-#  - name: alina
-#remove_nis_users:
-#  - name: daniel
-#  - name: andrea
-#  - name: tali
-#  - name: eva
-#  - name: mariam
-#  - name: simone
+# remove_nis_users:
+#   - name: lea
+#   - name: alina
+# remove_nis_users:
+#   - name: daniel
+#   - name: andrea
+#   - name: tali
+#   - name: eva
+#   - name: mariam
+#   - name: simone
 
 nis_user:
-
   - name: chris
     groups:
       - intern
@@ -142,12 +141,12 @@ nis_user:
       - no-backup
     is_samba_user: true
     password: !vault |
-          $ANSIBLE_VAULT;1.1;AES256
-          35653838343532663632326462656437363665316337316336316335383263633630616638313736
-          3937666561356232666136646435613361336437303637360a353561316633373265323931623565
-          32643966373962313334343565643130373535353238316161623837333130353231343332663930
-          3638386337333636390a393738373935646638383237373663376434366361363938346335663438
-          6637
+      $ANSIBLE_VAULT;1.1;AES256
+      35653838343532663632326462656437363665316337316336316335383263633630616638313736
+      3937666561356232666136646435613361336437303637360a353561316633373265323931623565
+      32643966373962313334343565643130373535353238316161623837333130353231343332663930
+      3638386337333636390a393738373935646638383237373663376434366361363938346335663438
+      6637
 
   - name: anahit
     groups:
@@ -451,19 +450,13 @@ sudo_pc_users:
   - sysadm
   - localadmin
 
-
 # ==========
 # vars used by roles/common/tasks/sudoers-server.yml
 # ==========
-
-
 # ==========
 # vars used by roles/common/tasks/ubuntu-x11vnc-1604-amd64.yml
 # vars used by roles/common/tasks/ubuntu-x11vnc-1804-amd64.yml
 # ==========
-
-
 # ==========
 # vars used by roles/common/tasks/luks.yml
 # ==========
-

host_vars/file-akb.akb.netz.yml

@@ -4,12 +4,11 @@
 # vars used by roles/network_interfaces
 # ---
 
-
 # If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
-network_manage_devices: True
+network_manage_devices: true
 
 # Should the interfaces be reloaded after config change?
-network_interface_reload: False
+network_interface_reload: false
 
 network_interface_path: /etc/network/interfaces.d
 network_interface_required_packages:
@@ -19,7 +18,6 @@ network_interface_required_packages:
   - ifupdown
   - ifenslave
 
-
 network_interfaces:
 
   - device: eno1
@@ -48,19 +46,17 @@ network_interfaces:
       - 192.168.82.1
     search: akb.netz
 
-
 # ---
 # vars used by roles/common/tasks/basic.yml
 # ---
 
 set_default_limit_nofile: true
 
-
 # ---
 # roles/common/tasks/default-users.yml
 # ---
 
-#extra_user: 
+# extra_user:
 #
 #  - name: borg
 #    user_id: 1065
@@ -75,14 +71,12 @@ set_default_limit_nofile: true
 #      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMhbQo8gm3zNCkNTSHrLE1np0IDiSUHgfyy8469guHFz root@file-akb'
 #      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMlm5VPClcXv5O8GaL9H5EVgXaP3/FY7aafB0Jes3BvH root@gw-akb'
 
-
 # ---
 # vars used by roles/common/tasks/systemd-resolved.yml
 # ---
 
 systemd_resolved: true
 
-
 # CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
 #   Primäre DNS-Adresse: 38.132.106.139
 #   Sekundäre DNS-Adresse: 194.187.251.67
@@ -93,8 +87,8 @@ systemd_resolved: true
 #      IPv6: 2606:4700:4700::1111
 #   sekundäre DNS-Adresse
 #      IPv4: 1.0.0.1
-#      IPv6: 2606:4700:4700::1001 
-# 
+#      IPv6: 2606:4700:4700::1001
+#
 # Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
 #   primäre DNS-Adresse
 #      IPv4: 8.8.8.8
@@ -105,20 +99,20 @@ systemd_resolved: true
 #
 # Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
 #   primäre DNS-Adresse
-#      IPv4: 9.9.9.9  
-#      IPv6: 2620:fe::fe 
+#      IPv4: 9.9.9.9
+#      IPv6: 2620:fe::fe
 #   sekundäre DNS-Adresse
 #      IPv4: 149.112.112.112
 #      IPv6: 2620:fe::9
 #
 # OpenNIC - https://www.opennic.org/
-#      IPv4: 195.10.195.195 - ns31.de 
-#      IPv4: 94.16.114.254  - ns28.de 
-#      IPv4: 51.254.162.59  - ns9.de   
+#      IPv4: 195.10.195.195 - ns31.de
+#      IPv4: 94.16.114.254  - ns28.de
+#      IPv4: 51.254.162.59  - ns9.de
 #      IPv4: 194.36.144.87  - ns29.de
 #      IPv6: 2a00:f826:8:2::195 - ns31.de
-# 
-# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) 
+#
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
 #    IPv4: 5.1.66.255
 #    IPv6: 2001:678:e68:f000::
 #    Servername für DNS-over-TLS: dot.ffmuc.net
@@ -128,10 +122,10 @@ resolved_nameserver:
 
 # search domains
 #
-# If there are more than one search domains, then specify them here in the order in which 
+# If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
   - ~.
   - akb.netz
@@ -141,8 +135,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 172.16.82.254
-
+  - 172.16.82.254
 
 # ---
 # vars used by roles/common/tasks/sshd.yml
@@ -154,8 +147,7 @@ sshd_permit_root_login: !!str "yes"
 
 sshd_password_authentication: !!str "yes"
 
-#sshd_use_pam: !!str "no"
-
+# sshd_use_pam: !!str "no"
 
 # ---
 # vars used by roles/common/tasks/cron.yml
@@ -191,7 +183,6 @@ cron_user_entries:
     hour: "23"
     job: /root/bin/admin-stuff/cleanup_from_old_files.sh
 
-
 cron_user_special_time_entries:
 
   - name: "Restart DNS Cache service 'systemd-resolved'"

host_vars/file-flr.flr.netz.yml

@@ -4,12 +4,11 @@
 # vars used by roles/network_interfaces
 # ---
 
-
 # If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
-network_manage_devices: True
+network_manage_devices: true
 
 # Should the interfaces be reloaded after config change?
-network_interface_reload: False
+network_interface_reload: false
 
 network_interface_path: /etc/network/interfaces.d
 network_interface_required_packages:
@@ -19,7 +18,6 @@ network_interface_required_packages:
   - ifupdown
   - ifenslave
 
-
 network_interfaces:
 
   - device: eno1
@@ -48,19 +46,17 @@ network_interfaces:
       - 192.168.102.1
     search: flr.netz
 
-
 # ---
 # vars used by roles/common/tasks/basic.yml
 # ---
 
 set_default_limit_nofile: true
 
-
 # ---
 # vars used by roles/common/tasks/default-users.yml
 # ---
 
-#extra_user: 
+# extra_user:
 #
 #  - name: borg
 #    user_id: 1065
@@ -75,14 +71,12 @@ set_default_limit_nofile: true
 #      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHTvxBfneJxBjMdpO9JCSkDyXQZUFXjYa/rqA6gQ0TL2 root@file-flr'
 #      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOSvVJ6MbYdXhIeS6FWFx2M/p7Gb6aG3oy25ZJRctXYd root@gw-flr'
 
-
 # ---
 # vars used by roles/common/tasks/systemd-resolved.yml
 # ---
 
 systemd_resolved: true
 
-
 # CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
 #   Primäre DNS-Adresse: 38.132.106.139
 #   Sekundäre DNS-Adresse: 194.187.251.67
@@ -93,8 +87,8 @@ systemd_resolved: true
 #      IPv6: 2606:4700:4700::1111
 #   sekundäre DNS-Adresse
 #      IPv4: 1.0.0.1
-#      IPv6: 2606:4700:4700::1001 
-# 
+#      IPv6: 2606:4700:4700::1001
+#
 # Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
 #   primäre DNS-Adresse
 #      IPv4: 8.8.8.8
@@ -105,20 +99,20 @@ systemd_resolved: true
 #
 # Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
 #   primäre DNS-Adresse
-#      IPv4: 9.9.9.9  
-#      IPv6: 2620:fe::fe 
+#      IPv4: 9.9.9.9
+#      IPv6: 2620:fe::fe
 #   sekundäre DNS-Adresse
 #      IPv4: 149.112.112.112
 #      IPv6: 2620:fe::9
 #
 # OpenNIC - https://www.opennic.org/
-#      IPv4: 195.10.195.195 - ns31.de 
-#      IPv4: 94.16.114.254  - ns28.de 
-#      IPv4: 51.254.162.59  - ns9.de   
+#      IPv4: 195.10.195.195 - ns31.de
+#      IPv4: 94.16.114.254  - ns28.de
+#      IPv4: 51.254.162.59  - ns9.de
 #      IPv4: 194.36.144.87  - ns29.de
 #      IPv6: 2a00:f826:8:2::195 - ns31.de
-# 
-# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) 
+#
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
 #    IPv4: 5.1.66.255
 #    IPv6: 2001:678:e68:f000::
 #    Servername für DNS-over-TLS: dot.ffmuc.net
@@ -128,10 +122,10 @@ resolved_nameserver:
 
 # search domains
 #
-# If there are more than one search domains, then specify them here in the order in which 
+# If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
   - flr.netz
 
@@ -140,8 +134,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 172.16.102.254
-
+  - 172.16.102.254
 
 # ---
 # vars used by roles/common/tasks/sshd.yml
@@ -153,8 +146,7 @@ sshd_permit_root_login: !!str "yes"
 
 sshd_password_authentication: !!str "yes"
 
-#sshd_use_pam: !!str "no"
-
+# sshd_use_pam: !!str "no"
 
 # ---
 # vars used by roles/common/tasks/cron.yml
@@ -181,11 +173,9 @@ cron_user_entries:
     hour: "7-22"
     job: /root/bin/monitoring/check_cups-browsed.sh
 
-
 cron_user_special_time_entries:
 
   - name: "Restart DNS Cache service 'systemd-resolved'"
     special_time: reboot
     job: "sleep 10 ; /bin/systemctl restart systemd-resolved"
     insertafter: PATH
-

host_vars/file-kb.anw-kb.netz.yml

@@ -4,14 +4,11 @@
 # vars used by roles/network_interfaces
 # ---
 
-
 # If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
-network_manage_devices: False
+network_manage_devices: false
 
 # Should the interfaces be reloaded after config change?
-network_interface_reload: False
-
-
+network_interface_reload: false
 
 # ---
 # vars used by roles/common/tasks/basic.yml
@@ -19,15 +16,12 @@ network_interface_reload: False
 
 set_default_limit_nofile: true
 
-
-
 # ---
 # vars used by roles/common/tasks/systemd-resolved.yml
 # ---
 
 systemd_resolved: true
 
-
 # CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
 #   Primäre DNS-Adresse: 38.132.106.139
 #   Sekundäre DNS-Adresse: 194.187.251.67
@@ -38,8 +32,8 @@ systemd_resolved: true
 #      IPv6: 2606:4700:4700::1111
 #   sekundäre DNS-Adresse
 #      IPv4: 1.0.0.1
-#      IPv6: 2606:4700:4700::1001 
-# 
+#      IPv6: 2606:4700:4700::1001
+#
 # Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
 #   primäre DNS-Adresse
 #      IPv4: 8.8.8.8
@@ -50,20 +44,20 @@ systemd_resolved: true
 #
 # Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
 #   primäre DNS-Adresse
-#      IPv4: 9.9.9.9  
-#      IPv6: 2620:fe::fe 
+#      IPv4: 9.9.9.9
+#      IPv6: 2620:fe::fe
 #   sekundäre DNS-Adresse
 #      IPv4: 149.112.112.112
 #      IPv6: 2620:fe::9
 #
 # OpenNIC - https://www.opennic.org/
-#      IPv4: 195.10.195.195 - ns31.de 
-#      IPv4: 94.16.114.254  - ns28.de 
-#      IPv4: 51.254.162.59  - ns9.de   
+#      IPv4: 195.10.195.195 - ns31.de
+#      IPv4: 94.16.114.254  - ns28.de
+#      IPv4: 51.254.162.59  - ns9.de
 #      IPv4: 194.36.144.87  - ns29.de
 #      IPv6: 2a00:f826:8:2::195 - ns31.de
-# 
-# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) 
+#
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
 #    IPv4: 5.1.66.255
 #    IPv6: 2001:678:e68:f000::
 #    Servername für DNS-over-TLS: dot.ffmuc.net
@@ -73,10 +67,10 @@ resolved_nameserver:
 
 # search domains
 #
-# If there are more than one search domains, then specify them here in the order in which 
+# If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
   - anw-kb.netz
 
@@ -85,8 +79,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 172.16.32.254
-
+  - 172.16.32.254
 
 # ---
 # vars used by roles/common/tasks/sshd.yml
@@ -98,8 +91,7 @@ sshd_permit_root_login: !!str "yes"
 
 sshd_password_authentication: !!str "yes"
 
-#sshd_use_pam: !!str "no"
-
+# sshd_use_pam: !!str "no"
 
 # ---
 # vars used by roles/common/tasks/cron.yml
@@ -111,12 +103,9 @@ cron_user_entries:
     minute: "*/15"
     job: /root/bin/monitoring/check_postfix.sh
 
-
 cron_user_special_time_entries:
 
   - name: "Restart DNS Cache service 'systemd-resolved'"
     special_time: reboot
     job: "sleep 10 ; /bin/systemctl restart systemd-resolved"
     insertafter: PATH
-
-

host_vars/file-mbr.mbr-bln.netz.yml

@@ -4,12 +4,11 @@
 # vars used by roles/network_interfaces
 # ---
 
-
 # If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
-network_manage_devices: True
+network_manage_devices: true
 
 # Should the interfaces be reloaded after config change?
-network_interface_reload: False
+network_interface_reload: false
 
 network_interface_path: /etc/network/interfaces.d
 network_interface_required_packages:
@@ -19,7 +18,6 @@ network_interface_required_packages:
   - ifupdown
   - ifenslave
 
-
 network_interfaces:
 
   - device: br0
@@ -66,7 +64,7 @@ network_interfaces:
     # inline hook scripts
     pre-up:
       - !!str "ip link set dev eno1 up" # pre-up script lines
-    up: [] #up script lines
+    up: [] # up script lines
     post-up: [] # post-up script lines (alias for up)
     pre-down: [] # pre-down script lines (alias for down)
     down: [] # down script lines
@@ -80,22 +78,18 @@ network_interfaces:
     address: 192.168.112.211
     netmask: 32
 
-
 # ---
 # vars used by roles/common/tasks/basic.yml
 # ---
 
 set_default_limit_nofile: true
 
-
-
 # ---
 # vars used by roles/common/tasks/systemd-resolved.yml
 # ---
 
 systemd_resolved: true
 
-
 # CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
 #   Primäre DNS-Adresse: 38.132.106.139
 #   Sekundäre DNS-Adresse: 194.187.251.67
@@ -106,8 +100,8 @@ systemd_resolved: true
 #      IPv6: 2606:4700:4700::1111
 #   sekundäre DNS-Adresse
 #      IPv4: 1.0.0.1
-#      IPv6: 2606:4700:4700::1001 
-# 
+#      IPv6: 2606:4700:4700::1001
+#
 # Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
 #   primäre DNS-Adresse
 #      IPv4: 8.8.8.8
@@ -118,20 +112,20 @@ systemd_resolved: true
 #
 # Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
 #   primäre DNS-Adresse
-#      IPv4: 9.9.9.9  
-#      IPv6: 2620:fe::fe 
+#      IPv4: 9.9.9.9
+#      IPv6: 2620:fe::fe
 #   sekundäre DNS-Adresse
 #      IPv4: 149.112.112.112
 #      IPv6: 2620:fe::9
 #
 # OpenNIC - https://www.opennic.org/
-#      IPv4: 195.10.195.195 - ns31.de 
-#      IPv4: 94.16.114.254  - ns28.de 
-#      IPv4: 51.254.162.59  - ns9.de   
+#      IPv4: 195.10.195.195 - ns31.de
+#      IPv4: 94.16.114.254  - ns28.de
+#      IPv4: 51.254.162.59  - ns9.de
 #      IPv4: 194.36.144.87  - ns29.de
 #      IPv6: 2a00:f826:8:2::195 - ns31.de
-# 
-# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) 
+#
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
 #    IPv4: 5.1.66.255
 #    IPv6: 2001:678:e68:f000::
 #    Servername für DNS-over-TLS: dot.ffmuc.net
@@ -141,10 +135,10 @@ resolved_nameserver:
 
 # search domains
 #
-# If there are more than one search domains, then specify them here in the order in which 
+# If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
   - oopen.de
 
@@ -153,8 +147,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 172.16.112.254
-
+  - 172.16.112.254
 
 # ---
 # vars used by roles/common/tasks/sshd.yml
@@ -166,8 +159,7 @@ sshd_permit_root_login: !!str "yes"
 
 sshd_password_authentication: !!str "yes"
 
-#sshd_use_pam: !!str "no"
-
+# sshd_use_pam: !!str "no"
 
 # ---
 # vars used by roles/common/tasks/cron.yml
@@ -199,12 +191,9 @@ cron_user_entries:
     hour: "23"
     job: /root/bin/admin-stuff/cleanup_from_old_files.sh
 
-
 cron_user_special_time_entries:
 
   - name: "Restart DNS Cache service 'systemd-resolved'"
     special_time: reboot
     job: "sleep 10 ; /bin/systemctl restart systemd-resolved"
     insertafter: PATH
-
-

host_vars/file-spr.sprachenatelier.netz.yml

@@ -4,12 +4,11 @@
 # vars used by roles/network_interfaces
 # ---
 
-
 # If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
-network_manage_devices: True
+network_manage_devices: true
 
 # Should the interfaces be reloaded after config change?
-network_interface_reload: False
+network_interface_reload: false
 
 network_interface_path: /etc/network/interfaces.d
 network_interface_required_packages:
@@ -19,7 +18,6 @@ network_interface_required_packages:
   - ifupdown
   - ifenslave
 
-
 network_interfaces:
 
   - device: eno1
@@ -48,21 +46,18 @@ network_interfaces:
       - 192.168.92.1
     search: sprachenatelier.netz
 
-
 # ---
 # vars used by roles/common/tasks/basic.yml
 # ---
 
 set_default_limit_nofile: true
 
-
 # ---
 # vars used by roles/common/tasks/systemd-resolved.yml
 # ---
 
 systemd_resolved: true
 
-
 # CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
 #   Primäre DNS-Adresse: 38.132.106.139
 #   Sekundäre DNS-Adresse: 194.187.251.67
@@ -73,8 +68,8 @@ systemd_resolved: true
 #      IPv6: 2606:4700:4700::1111
 #   sekundäre DNS-Adresse
 #      IPv4: 1.0.0.1
-#      IPv6: 2606:4700:4700::1001 
-# 
+#      IPv6: 2606:4700:4700::1001
+#
 # Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
 #   primäre DNS-Adresse
 #      IPv4: 8.8.8.8
@@ -85,20 +80,20 @@ systemd_resolved: true
 #
 # Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
 #   primäre DNS-Adresse
-#      IPv4: 9.9.9.9  
-#      IPv6: 2620:fe::fe 
+#      IPv4: 9.9.9.9
+#      IPv6: 2620:fe::fe
 #   sekundäre DNS-Adresse
 #      IPv4: 149.112.112.112
 #      IPv6: 2620:fe::9
 #
 # OpenNIC - https://www.opennic.org/
-#      IPv4: 195.10.195.195 - ns31.de 
-#      IPv4: 94.16.114.254  - ns28.de 
-#      IPv4: 51.254.162.59  - ns9.de   
+#      IPv4: 195.10.195.195 - ns31.de
+#      IPv4: 94.16.114.254  - ns28.de
+#      IPv4: 51.254.162.59  - ns9.de
 #      IPv4: 194.36.144.87  - ns29.de
 #      IPv6: 2a00:f826:8:2::195 - ns31.de
-# 
-# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) 
+#
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
 #    IPv4: 5.1.66.255
 #    IPv6: 2001:678:e68:f000::
 #    Servername für DNS-over-TLS: dot.ffmuc.net
@@ -108,10 +103,10 @@ resolved_nameserver:
 
 # search domains
 #
-# If there are more than one search domains, then specify them here in the order in which 
+# If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
   - oopen.de
 
@@ -120,8 +115,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 172.16.92.254
-
+  - 172.16.92.254
 
 # ---
 # vars used by roles/common/tasks/sshd.yml
@@ -133,8 +127,7 @@ sshd_permit_root_login: !!str "yes"
 
 sshd_password_authentication: !!str "yes"
 
-#sshd_use_pam: !!str "no"
-
+# sshd_use_pam: !!str "no"
 
 # ---
 # vars used by roles/common/tasks/cron.yml
@@ -161,7 +154,6 @@ cron_user_entries:
     hour: "7-22"
     job: /root/bin/monitoring/check_cups-browsed.sh
 
-
 cron_user_special_time_entries:
 
   - name: "Restart DNS Cache service 'systemd-resolved'"

roles/common/tasks/apt.yml

@@ -1,25 +1,165 @@
 ---
+- name: (apt.yml) Delete Hetzner files 'hetzner-mirror.list' and 'hetzner-security-updates.list'
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: absent
+  with_items:
+    - /etc/apt/sources.list.d/hetzner-mirror.list
+    - /etc/apt/sources.list.d/hetzner-security-updates.list
+  tags:
+    - apt-configuration
 
 - name: (apt.yml) update configuration file - /etc/apt/sources.list
-  template:
+  ansible.builtin.template:
     src: "etc/apt/sources.list.{{ ansible_facts['distribution'] }}.j2"
     dest: /etc/apt/sources.list
     owner: root
     group: root
-    mode: 0644
-  register: apt_config_updated
+    mode: "0644"
+  register: common_apt_config_updated
   when:
-    - ansible_facts['distribution'] == "Debian"
     - apt_manage_sources_list|bool
+    - ansible_facts['distribution'] == 'Debian'
     - (ansible_facts['distribution_major_version'] | int) < 13
   tags:
     - apt-configuration
 
+- name: (apt.yml) Ensure Debian archive keyring is present for deb822 Signed-By (Debian >= 13)
+  ansible.builtin.apt:
+    name: debian-archive-keyring
+    state: present
+  when:
+    - apt_manage_sources_list|bool
+    - ansible_facts['distribution'] == 'Debian'
+    - (ansible_facts['distribution_major_version'] | int) >= 13
+    - apt_deb822_use_signed_by | default(true) | bool
+  tags:
+    - apt-configuration
+
+- name: (apt.yml) backup legacy /etc/apt/sources.list before deb822 migration (Debian >= 13)
+  ansible.builtin.copy:
+    src: /etc/apt/sources.list
+    dest: /etc/apt/sources.list.before-deb822
+    remote_src: true
+    force: false
+    owner: root
+    group: root
+    mode: "0644"
+  when:
+    - apt_manage_sources_list|bool
+    - ansible_facts['distribution'] == 'Debian'
+    - (ansible_facts['distribution_major_version'] | int) >= 13
+  failed_when:
+    - common_apt_sources_list_backup.failed
+    - "'No such file or directory' not in (common_apt_sources_list_backup.msg | default(''))"
+  register: common_apt_sources_list_backup
+  tags:
+    - apt-configuration
+
+- name: (apt.yml) replace /etc/apt/sources.list with deb822 notice (Debian >= 13)
+  ansible.builtin.copy:
+    dest: /etc/apt/sources.list
+    content: |
+      # {{ ansible_managed }}
+      #
+      # Verwaltet via Ansible. Repositories liegen in /etc/apt/sources.list.d/*.sources (deb822).
+      # Zielrelease: {{ ansible_facts['distribution_release'] }}
+    owner: root
+    group: root
+    mode: "0644"
+  register: common_apt_config_updated_sources_list
+  when:
+    - apt_manage_sources_list|bool
+    - ansible_facts['distribution'] == 'Debian'
+    - (ansible_facts['distribution_major_version'] | int) >= 13
+  tags:
+    - apt-configuration
+
+- name: (apt.yml) configure deb822 Debian repository (Debian >= 13)
+  ansible.builtin.template:
+    src: "etc/apt/deb822/debian.sources.j2"
+    dest: /etc/apt/sources.list.d/debian.sources
+    owner: root
+    group: root
+    mode: "0644"
+  register: common_apt_config_updated_debian_sources
+  when:
+    - apt_manage_sources_list|bool
+    - ansible_facts['distribution'] == 'Debian'
+    - (ansible_facts['distribution_major_version'] | int) >= 13
+  tags:
+    - apt-configuration
+
+- name: (apt.yml) configure deb822 security repository (Debian >= 13)
+  ansible.builtin.template:
+    src: "etc/apt/deb822/security.sources.j2"
+    dest: /etc/apt/sources.list.d/security.sources
+    owner: root
+    group: root
+    mode: "0644"
+  register: common_apt_config_updated_security_sources
+  when:
+    - apt_manage_sources_list|bool
+    - ansible_facts['distribution'] == 'Debian'
+    - (ansible_facts['distribution_major_version'] | int) >= 13
+  tags:
+    - apt-configuration
+
+- name: (apt.yml) configure deb822 backports repository (Debian >= 13)
+  ansible.builtin.template:
+    src: "etc/apt/deb822/backports.sources.j2"
+    dest: /etc/apt/sources.list.d/backports.sources
+    owner: root
+    group: root
+    mode: "0644"
+  register: common_apt_config_updated_backports_sources
+  when:
+    - apt_manage_sources_list|bool
+    - ansible_facts['distribution'] == 'Debian'
+    - (ansible_facts['distribution_major_version'] | int) >= 13
+    - apt_backports_enable | default(false) | bool
+  tags:
+    - apt-configuration
+
+# If 'backports' was enabled in a previous run but is now disabled.
+#
+- name: (apt.yml) remove deb822 backports repository when disabled (Debian >= 13)
+  ansible.builtin.file:
+    path: /etc/apt/sources.list.d/backports.sources
+    state: absent
+  register: common_apt_config_removed_backports_sources
+  when:
+    - apt_manage_sources_list|bool
+    - ansible_facts['distribution'] == 'Debian'
+    - (ansible_facts['distribution_major_version'] | int) >= 13
+    - not (apt_backports_enable | default(false) | bool)
+  tags:
+    - apt-configuration
+
+# Collect change states from all Debian >=13 deb822 source tasks so apt update
+# can force a fresh cache refresh when repository files changed.
+- name: (apt.yml) aggregate deb822 source changes (Debian >= 13)
+  ansible.builtin.set_fact:
+    common_apt_config_updated:
+      changed: >-
+        {{
+          (common_apt_config_updated_sources_list.changed | default(false))
+          or (common_apt_config_updated_debian_sources.changed | default(false))
+          or (common_apt_config_updated_security_sources.changed | default(false))
+          or (common_apt_config_updated_backports_sources.changed | default(false))
+          or (common_apt_config_removed_backports_sources.changed | default(false))
+        }}
+  when:
+    - apt_manage_sources_list|bool
+    - ansible_facts['distribution'] == 'Debian'
+    - (ansible_facts['distribution_major_version'] | int) >= 13
+  tags:
+    - apt-configuration
 
 - name: (apt.yml) apt update
-  apt:
+  ansible.builtin.apt:
     update_cache: true
-    cache_valid_time: "{{ 0 if apt_config_updated is defined and apt_config_updated.changed else apt_update_cache_valid_time }}"
+    cache_valid_time: "{{ 0 if common_apt_config_updated is defined and common_apt_config_updated.changed else apt_update_cache_valid_time }}"
   when: apt_update|bool
   tags:
     - apt-update
@@ -30,12 +170,11 @@
     - apt-compiler-pkgs
     - apt-webserver-pkgs
 
-
 - name: (apt.yml) Configure any half-installed packages 'dpkg --configure -a'
   ansible.builtin.command: dpkg --configure -a
-  register: _dpkg_configure
-  changed_when: (_dpkg_configure.stdout | default('')) | length > 0
-  failed_when: _dpkg_configure.rc != 0
+  register: common_dpkg_configure
+  changed_when: (common_dpkg_configure.stdout | default('')) | length > 0
+  failed_when: common_dpkg_configure.rc != 0
   when: apt_dpkg_configure|bool
   tags:
     - apt-dpkg-configure
@@ -44,9 +183,8 @@
     - apt-compiler-pkgs
     - apt-webserver-pkgs
 
-
 - name: (apt.yml) apt upgrade
-  apt:
+  ansible.builtin.apt:
     upgrade: "{{ apt_upgrade_type }}"
     update_cache: true
     dpkg_options: "{{ apt_upgrade_dpkg_options | join(',') }}"
@@ -58,9 +196,8 @@
     - apt-compiler-pkgs
     - apt-webserver-pkgs
 
-
 - name: (apt.yml) Initial install debian packages (stretch)
-  apt:
+  ansible.builtin.apt:
     name: "{{ apt_initial_install_stretch }}"
     state: "{{ apt_install_state }}"
   when:
@@ -70,9 +207,8 @@
   tags:
     - apt-initial-install
 
-
 - name: (apt.yml) Initial install debian packages (buster)
-  apt:
+  ansible.builtin.apt:
     name: "{{ apt_initial_install_buster }}"
     state: "{{ apt_install_state }}"
   when:
@@ -82,9 +218,8 @@
   tags:
     - apt-initial-install
 
-
 - name: (apt.yml) Initial install debian packages (bullseye)
-  apt:
+  ansible.builtin.apt:
     name: "{{ apt_initial_install_bullseye }}"
     state: "{{ apt_install_state }}"
   when:
@@ -94,9 +229,8 @@
   tags:
     - apt-initial-install
 
-
 - name: (apt.yml) Initial install debian packages (bookworm)
-  apt:
+  ansible.builtin.apt:
     name: "{{ apt_initial_install_bookworm }}"
     state: "{{ apt_install_state }}"
   when:
@@ -106,9 +240,8 @@
   tags:
     - apt-initial-install
 
-
 - name: (apt.yml) Initial install debian packages (trixie)
-  apt:
+  ansible.builtin.apt:
     name: "{{ apt_initial_install_trixie }}"
     state: "{{ apt_install_state }}"
   when:
@@ -118,9 +251,8 @@
   tags:
     - apt-initial-install
 
-
 - name: (apt.yml) Initial install ubuntu packages (bionic)
-  apt:
+  ansible.builtin.apt:
     name: "{{ apt_initial_install_bionic }}"
     state: "{{ apt_install_state }}"
   when:
@@ -130,7 +262,7 @@
     - apt-initial-install
 
 - name: (apt.yml) Initial install ubuntu packages (xenial)
-  apt:
+  ansible.builtin.apt:
     name: "{{ apt_initial_install_xenial }}"
     state: "{{ apt_install_state }}"
   when:
@@ -140,7 +272,7 @@
     - apt-initial-install
 
 - name: (apt.yml) Initial install ubuntu packages (jammy)
-  apt:
+  ansible.builtin.apt:
     name: "{{ apt_initial_install_jammy }}"
     state: "{{ apt_install_state }}"
   when:
@@ -150,7 +282,7 @@
     - apt-initial-install
 
 - name: (apt.yml) Initial install ubuntu packages (noble)
-  apt:
+  ansible.builtin.apt:
     name: "{{ apt_initial_install_noble }}"
     state: "{{ apt_install_state }}"
   when:
@@ -159,13 +291,12 @@
   tags:
     - apt-initial-install
 
-
 # ---
 # Microcode
 # ---
 
 - name: (apt.yml) Ensure we have CPU microcode from backports for Intel CPU (debian stretch)
-  apt:
+  ansible.builtin.apt:
     name: "{{ microcode_intel_package }}"
     state: present
     default_release: "{{ ansible_facts['distribution_release'] }}-backports"
@@ -178,24 +309,23 @@
     - apt-initial-install
     - apt-microcode
 
-
 - name: (apt.yml) Install CPU microcode (debian buster/bullseye/bookworm/trixie)
-  apt:
+  ansible.builtin.apt:
     name: "{{ microcode_intel_package }}"
     state: present
     default_release: "{{ ansible_facts['distribution_release'] }}"
   when:
     - apt_debian_contrib_nonfree_enable
     - ansible_facts['distribution'] == "Debian"
-    - ansible_facts['distribution_major_version'] == "10" or ansible_facts['distribution_major_version'] == "11"or ansible_facts['distribution_major_version'] == "12" or ansible_facts['distribution_major_version'] == "13"
+    - ansible_facts['distribution_major_version'] == "10" or ansible_facts['distribution_major_version'] == "11" or
+      ansible_facts['distribution_major_version'] == "12" or ansible_facts['distribution_major_version'] == "13"
     - ansible_facts['processor']|string is search("Intel")
   tags:
     - apt-initial-install
     - apt-microcode
 
-
 - name: (apt.yml) Install CPU microcode for AMD CPU (debian buster)
-  apt:
+  ansible.builtin.apt:
     name: "{{ microcode_amd_package }}"
     state: present
     default_release: "{{ ansible_facts['distribution_release'] }}"
@@ -208,9 +338,8 @@
     - apt-initial-install
     - apt-microcode
 
-
 - name: (apt.yml) Install CPU microcode for Intel CPU (ubuntu bionic)
-  apt:
+  ansible.builtin.apt:
     name: "{{ microcode_intel_package }}"
     state: present
     default_release: "{{ ansible_facts['distribution_release'] }}"
@@ -222,9 +351,8 @@
     - apt-initial-install
     - apt-microcode
 
-
 - name: (apt.yml) Install CPU microcode for AMD CPU (ubuntu bionic)
-  apt:
+  ansible.builtin.apt:
     name: "{{ microcode_amd_package }}"
     state: present
     default_release: "{{ ansible_facts['distribution_release'] }}"
@@ -237,9 +365,8 @@
     - apt-initial-install
     - apt-microcode
 
-
 - name: (apt.yml) Install CPU microcode for Intel CPU (ubuntu xenial)
-  apt:
+  ansible.builtin.apt:
     name: "{{ microcode_intel_package }}"
     state: present
     default_release: "{{ ansible_facts['distribution_release'] }}"
@@ -251,9 +378,8 @@
     - apt-initial-install
     - apt-microcode
 
-
 - name: (apt.yml) Install CPU microcode for Intel AMD (ubuntu xenial)
-  apt:
+  ansible.builtin.apt:
     name: "{{ microcode_amd_package }}"
     state: present
     default_release: "{{ ansible_facts['distribution_release'] }}"
@@ -266,9 +392,8 @@
     - apt-initial-install
     - apt-microcode
 
-
 - name: (apt.yml) Install CPU microcode for Intel CPU (ubuntu jammy/noble)
-  apt:
+  ansible.builtin.apt:
     name: "{{ microcode_intel_package }}"
     state: present
     default_release: "{{ ansible_facts['distribution_release'] }}"
@@ -280,9 +405,8 @@
     - apt-initial-install
     - apt-microcode
 
-
 - name: (apt.yml) Install CPU microcode for Intel AMD (ubuntu jammy/noble)
-  apt:
+  ansible.builtin.apt:
     name: "{{ microcode_amd_package }}"
     state: present
     default_release: "{{ ansible_facts['distribution_release'] }}"
@@ -300,34 +424,32 @@
 # ---
 
 - name: (apt.yml) Install Firmware packages (Ubuntu)
-  apt:
-     name: "{{ firmware_packages_ubuntu }}"
-     state: present
-     default_release: "{{ ansible_facts['distribution_release'] }}"
+  ansible.builtin.apt:
+    name: "{{ firmware_packages_ubuntu }}"
+    state: present
+    default_release: "{{ ansible_facts['distribution_release'] }}"
   when:
     - ansible_facts['distribution'] == "Ubuntu"
   tags:
     - apt-initial-install
     - apt-firmware
 
-
 - name: (apt.yml) Install Firmware packages (Debian)
-  apt:
-     name: "{{ firmware_packages_debian }}"
-     state: present
-     default_release: "{{ ansible_facts['distribution_release'] }}"
+  ansible.builtin.apt:
+    name: "{{ firmware_packages_debian }}"
+    state: present
+    default_release: "{{ ansible_facts['distribution_release'] }}"
   when:
     - ansible_facts['distribution'] == "Debian"
   tags:
     - apt-initial-install
     - apt-firmware
 
-
 - name: (apt.yml) Install non-free Firmware packages (Debian)
-  apt:
-     name: "{{ firmware_non_free_packages_debian }}"
-     state: present
-     default_release: "{{ ansible_facts['distribution_release'] }}"
+  ansible.builtin.apt:
+    name: "{{ firmware_non_free_packages_debian }}"
+    state: present
+    default_release: "{{ ansible_facts['distribution_release'] }}"
   when:
     - ansible_facts['distribution'] == "Debian"
     - apt_debian_contrib_nonfree_enable
@@ -335,13 +457,12 @@
     - apt-initial-install
     - apt-firmware
 
-
 # ---
 # unwanted packages
 # ---
 
 - name: (apt.yml) Remove unwanted packages
-  apt:
+  ansible.builtin.apt:
     name: "{{ apt_remove }}"
     state: absent
     purge: "{{ apt_remove_purge }}"
@@ -349,7 +470,7 @@
     - apt-remove
 
 - name: (apt.yml) Remove unwanted packages Ubuntu bionic
-  apt:
+  ansible.builtin.apt:
     name: "{{ apt_remove_bionic }}"
     state: absent
     purge: "{{ apt_remove_purge }}"
@@ -360,7 +481,7 @@
     - apt-remove
 
 - name: (apt.yml) Remove unwanted packages Ubuntu xenial
-  apt:
+  ansible.builtin.apt:
     name: "{{ apt_remove_xenial }}"
     state: absent
     purge: "{{ apt_remove_purge }}"
@@ -371,7 +492,7 @@
     - apt-remove
 
 - name: (apt.yml) Remove unwanted packages Ubuntu jammy
-  apt:
+  ansible.builtin.apt:
     name: "{{ apt_remove_jammy }}"
     state: absent
     purge: "{{ apt_remove_purge }}"
@@ -382,7 +503,7 @@
     - apt-remove
 
 - name: (apt.yml) Remove unwanted packages Ubuntu noble
-  apt:
+  ansible.builtin.apt:
     name: "{{ apt_remove_noble }}"
     state: absent
     purge: "{{ apt_remove_purge }}"
@@ -393,7 +514,7 @@
     - apt-remove
 
 - name: (apt.yml) autoremove
-  apt:
+  ansible.builtin.apt:
     autoremove: true
     dpkg_options: "{{ apt_upgrade_dpkg_options | join(',') }}"
   when: apt_autoremove|bool
@@ -402,12 +523,10 @@
     - apt-initial-install
     - apt-microcode
 
-- name: (apt.yml) clean
-  command: apt-get -y clean
-  #args:
-  #  warn: false
-  changed_when: false
-  when: apt_clean|bool
+- name: (apt.yml) autoclean cache
+  ansible.builtin.apt:
+    autoclean: true
+  when: apt_clean | bool
   tags:
     - apt-clean
     - apt-initial-install

roles/common/tasks/basic.yml

@@ -1,22 +1,21 @@
 ---
 
 - name: (basic.yml) Ensure timezone is is correct
-  timezone: name={{ time_zone }}
+  community.general.timezone:
+    name: "{{ time_zone }}"
   tags:
     - timezone
 
-
 - name: (basic.yml) Ensure locales are present
-  locale_gen:
+  community.general.locale_gen:
     name: "{{ item }}"
     state: present
   with_items: "{{ locales }}"
   tags:
     - locales
 
-
 - name: (basic.yml) Create a symbolic link /bin/sh -> bash
-  file:
+  ansible.builtin.file:
     src: bash
     dest: /bin/sh
     owner: root
@@ -27,16 +26,15 @@
   tags:
     - symlink-sh
 
-
 # ----------
 # security limit (maybe DEPRECATED see systemd settings)
 # ----------
 
 - name: (basic.yml) Ensure directory '/etc/security/limits.d' exists
-  file:
+  ansible.builtin.file:
     path: /etc/security/limits.d
     state: directory
-    mode: 0755
+    mode: "0755"
     group: root
     owner: root
   when:
@@ -47,7 +45,7 @@
     - systemd-config
 
 - name: (basic.yml) Ensure files /etc/security/limits.d/*.conf exists
-  copy:
+  ansible.builtin.copy:
     src: '{{ item.src_path }}'
     dest: '{{ item.dest_path }}'
     owner: root
@@ -63,16 +61,15 @@
   tags:
     - systemd-config
 
-
 # ----------
 # systemd stuff
 # ----------
 
 - name: (basic.yml) Ensure directory '/etc/systemd/system.conf.d' exists
-  file:
+  ansible.builtin.file:
     path: /etc/systemd/system.conf.d
     state: directory
-    mode: 0755
+    mode: "0755"
     group: root
     owner: root
   when:
@@ -83,7 +80,7 @@
     - systemd-config
 
 - name: (basic.yml) Ensure files /etc/systemd/system.conf.d/*.conf exists
-  copy:
+  ansible.builtin.copy:
     src: '{{ item.src_path }}'
     dest: '{{ item.dest_path }}'
     owner: root
@@ -100,10 +97,10 @@
     - systemd-config
 
 - name: (basic.yml) Ensure directory '/etc/systemd/journald.conf.d' exists
-  file:
+  ansible.builtin.file:
     path: /etc/systemd/journald.conf.d
     state: directory
-    mode: 0755
+    mode: "0755"
     group: root
     owner: root
   when:
@@ -113,7 +110,7 @@
     - systemd-config
 
 - name: (basic.yml) Ensure files /etc/systemd/journald.conf.d/*.conf exists
-  copy:
+  ansible.builtin.copy:
     src: '{{ item.src_path }}'
     dest: '{{ item.dest_path }}'
     owner: root
@@ -129,97 +126,114 @@
   tags:
     - systemd-config
 
-
 # ----------
 # unattended upgrades
 # ----------
 
 - name: (basic.yml) install unattended-upgrades
-  apt: pkg=unattended-upgrades state=present
+  ansible.builtin.apt:
+    pkg: unattended-upgrades
+    state: present
   when:
     - ansible_facts['distribution'] == "Debian"
   tags:
     - unattended-upgrades
 
 - name: (basic.yml) install apt-listchanges
-  apt: pkg=apt-listchanges state=present
+  ansible.builtin.apt:
+    pkg: apt-listchanges
+    state: present
   when:
     - ansible_facts['distribution'] == "Debian"
   tags:
     - unattended-upgrades
 
 - name: (basic.yml) remove apticron
-  apt: pkg=apticron state=absent
+  ansible.builtin.apt:
+    pkg: apticron
+    state: absent
   when:
     - ansible_facts['distribution'] == "Debian"
   tags:
     - unattended-upgrades
 
 - name: (basic.yml) check if /etc/apt/apt.conf.d/20auto-upgrades exists
-  stat: path=/etc/apt/apt.conf.d/20auto-upgrades
-  register: ua_enabled
+  ansible.builtin.stat:
+    path: /etc/apt/apt.conf.d/20auto-upgrades
+  register: common_ua_enabled
   when:
     - ansible_facts['distribution'] == "Debian"
   tags:
     - unattended-upgrades
 
 - name: (basic.yml) activate unattended upgrades
-  shell: DEBIAN_FRONTEND=noninteractive DEBCONF_NONINTERACTIVE_SEEN=true dpkg-reconfigure -plow unattended-upgrades
+  ansible.builtin.command:
+    cmd: dpkg-reconfigure -plow unattended-upgrades
+    creates: /etc/apt/apt.conf.d/20auto-upgrades
+  environment:
+    DEBIAN_FRONTEND: noninteractive
+    DEBCONF_NONINTERACTIVE_SEEN: "true"
   when:
     - ansible_facts['distribution'] == "Debian"
-    - ua_enabled.stat.exists == False
+    - not common_ua_enabled.stat.exists
   tags:
     - unattended-upgrades
 
 - name: (basic.yml) copy apt-listchanges.conf
-  template:
+  ansible.builtin.template:
     src: etc/apt/listchanges.conf.j2
     dest: /etc/apt/listchanges.conf
     owner: root
     group: root
-    mode: 0644
+    mode: "0644"
   when:
     - ansible_facts['distribution'] == "Debian"
   tags:
     - unattended-upgrades
 
 - name: (basic.yml) copy unattended-upgrades conf
-  template:
+  ansible.builtin.template:
     src: etc/apt/apt.conf.d/50unattended-upgrades.j2
     dest: /etc/apt/apt.conf.d/50unattended-upgrades
-    backup: yes
+    backup: true
     owner: root
     group: root
-    mode: 0644
+    mode: "0644"
   when:
     - ansible_facts['distribution'] == "Debian"
   tags:
     - unattended-upgrades
 
-
 # ----------
 # - /etc/hosts
 # ----------
 
 - name: (basic.yml) Check file '/etc/hosts.ORIG' exists
-  stat:
+  ansible.builtin.stat:
     path: /etc/hosts.ORIG
-  register: etc_hosts_ORIG
+  register: common_etc_hosts_orig
   when:
     - "groups['file_server']|string is search(inventory_hostname)"
   tags:
     - etc_hosts
 
 - name: (basic.yml) Backup installation version of file '/etc/hosts'
-  command: cp -a /etc/hosts /etc/hosts.ORIG
+  ansible.builtin.copy:
+    src: /etc/hosts
+    dest: /etc/hosts.ORIG
+    remote_src: true
+    force: false
+    owner: root
+    group: root
+    mode: "0644"
   when:
     - "groups['file_server']|string is search(inventory_hostname)"
-    - etc_hosts_ORIG.stat.exists == False
+    - not common_etc_hosts_orig.stat.exists
   tags:
     - etc_hosts
 
 - name: (basic.yml) addjust '/etc/hosts' add nis-server ..
-  lineinfile:
+  ansible.builtin.lineinfile:
     path: /etc/hosts
     regexp: '^192\.168\.'
     line: '{{ nis_server_address }} {{ nis_server_name }} {{ nis_server_name.split(".")[0] }}'
@@ -227,4 +241,3 @@
     - "groups['nis_server']|string is search(inventory_hostname)"
   tags:
     - etc_hosts
-

roles/common/tasks/cron.yml

@@ -1,48 +1,45 @@
 ---
-
 - name: (cron.yml) Set env entries in user crontabs
-  cron:
-    name: '{{ item.name }}'
-    env: 'yes'
-    user: '{{ item.user | default("root", true) }}'
-    job: '{{ item.job }}'
-    insertafter: '{{ item.insertafter | default(omit) }}'
-  loop: "{{ cron_env_entries }}"
+  ansible.builtin.cron:
+    name: "{{ item.name }}"
+    env: "yes"
+    user: '{{ item.user | default("root") }}'
+    job: "{{ item.job }}"
+    insertafter: "{{ item.insertafter | default(omit) }}"
+  loop: "{{ cron_env_entries | default([]) }}"
   loop_control:
-    label: '{{ item.name }}'
+    label: "{{ item.name }}"
   when: item.job is defined
   tags:
     - user_crontab
 
-
 - name: (cron.yml) Set special time entries in user crontabs
-  cron:
-    name: '{{ item.name }}'
-    special_time: '{{ item.special_time }}'
-    user: '{{ item.user | default("root", true) }}'
-    job: '{{ item.job }}'
+  ansible.builtin.cron:
+    name: "{{ item.name }}"
+    special_time: "{{ item.special_time }}"
+    user: '{{ item.user | default("root") }}'
+    job: "{{ item.job }}"
     state: present
-  loop: "{{ cron_user_special_time_entries }}"
+  loop: "{{ cron_user_special_time_entries | default([]) }}"
   loop_control:
-    label: '{{ item.name }}'
+    label: "{{ item.name }}"
   when: item.job is defined
   tags:
     - user_crontab
 
-
 - name: (cron.yml) Set normal entries in user crontabs
-  cron:
-    name: '{{ item.name }}'
-    minute: '{{ item.minute | default(omit) }}'
-    hour: '{{ item.hour | default(omit) }}'
-    day: '{{ day | default(omit) }}'
-    weekday: '{{ item.weekday | default(omit) }}'
-    month: '{{ item.month | default(omit) }}'
-    user: '{{ item.user | default("root", true) }}'
-    job: '{{ item.job }}'
-  loop: "{{ cron_user_entries }}"
+  ansible.builtin.cron:
+    name: "{{ item.name }}"
+    minute: "{{ item.minute | default(omit) }}"
+    hour: "{{ item.hour | default(omit) }}"
+    day: "{{ item.day | default(omit) }}"
+    weekday: "{{ item.weekday | default(omit) }}"
+    month: "{{ item.month | default(omit) }}"
+    user: '{{ item.user | default("root") }}'
+    job: "{{ item.job }}"
+  loop: "{{ cron_user_entries | default([]) }}"
   loop_control:
-    label: '{{ item.name }}'
+    label: "{{ item.name }}"
   when: item.job is defined
   tags:
     - user_crontab

roles/common/tasks/cups-install.yml

@@ -1,121 +1,130 @@
 ---
 
-
 # ---
 # Cups Server
 # ---
 
 - name: (cups-install.yml) Ensure CUPS packages server (buster) are installed.
-  package:
-    pkg: '{{ apt_install_server_cups }}'
+  ansible.builtin.package:
+    pkg: "{{ apt_install_server_cups }}"
     state: present
   when:
     - ansible_facts['distribution'] == "Debian"
   tags:
     - cups-server
 
-
 # ---
 # Cups clients
 # ---
 
 - name: (cups.yml) Ensure CUPS packages clients are installed.
-  package:
+  ansible.builtin.package:
     pkg: "{{ apt_install_client_cups }}"
     state: present
-  when: 
+  when:
     - ansible_facts['distribution'] == "Ubuntu"
-    - ansible_distribution_version ==  "18.04"
+    - ansible_distribution_version == "18.04"
     - ansible_architecture == "x86_64"
   tags:
     - cups-client
 
-
-
 # -- file /etc/cups/cups-browsed.conf
 - name: (cups.yml) Check if file '/etc/cups/cups-browsed.conf.ORIGi' exists
-  stat:
+  ansible.builtin.stat:
     path: /etc/cups/cups-browsed.conf.ORIG
-  register: cups_browsed_conf_orig_exists
+  register: common_cups_browsed_conf_orig_exists
   tags:
     - cups-server
     - cups-client
 
 - name: (cups.yml) Backup /etc/cups/cups-browsed.conf file
-  command: cp /etc/cups/cups-browsed.conf /etc/cups/cups-browsed.conf.ORIG
-  when: cups_browsed_conf_orig_exists.stat.exists == False
+  ansible.builtin.copy:
+    src: /etc/cups/cups-browsed.conf
+    dest: /etc/cups/cups-browsed.conf.ORIG
+    remote_src: true
+    force: false
+    owner: root
+    group: root
+    mode: "0644"
+  when: not common_cups_browsed_conf_orig_exists.stat.exists
   tags:
     - cups-server
     - cups-client
 
 - name: (cups.yml) update configuration file server - /etc/cups/cups-browsed.conf
-  template:
+  ansible.builtin.template:
     src: "etc/cups/cups-browsed.conf.server.j2"
     dest: /etc/cups/cups-browsed.conf
     owner: root
     group: root
-    mode: 0644
+    mode: "0644"
   notify:
-     Restart cups-browsed
+    - Restart cups-browsed
   when:
     - groups['file_server']|string is search(inventory_hostname)
   tags:
     - cups-server
 
 - name: (cups.yml) update configuration file client - /etc/cups/cups-browsed.conf
-  template:
+  ansible.builtin.template:
     src: "etc/cups/cups-browsed.conf.client.j2"
     dest: /etc/cups/cups-browsed.conf
     owner: root
     group: root
-    mode: 0644
+    mode: "0644"
   notify:
-     Restart cups-browsed
+    - Restart cups-browsed
   when:
     - groups['client_pc']|string is search(inventory_hostname)
   tags:
     - cups-client
 
-
 # -- file /etc/cups/cupsd.conf
 - name: (cups.yml) Check if file '/etc/cups/cupsd.conf.ORIG' exists
-  stat:
+  ansible.builtin.stat:
     path: /etc/cups/cupsd.conf.ORIG
-  register: cupsd_conf_orig_exists
+  register: common_cupsd_conf_orig_exists
   tags:
     - cups-server
     - cups-client
 
 - name: (cups.yml) Backup /etc/cups/cupsd.conf file
-  command: cp /etc/cups/cupsd.conf /etc/cups/cupsd.conf.ORIG
-  when: cupsd_conf_orig_exists.stat.exists == False
+  ansible.builtin.copy:
+    src: /etc/cups/cupsd.conf
+    dest: /etc/cups/cupsd.conf.ORIG
+    remote_src: true
+    force: false
+    owner: root
+    group: root
+    mode: "0644"
+  when: not common_cupsd_conf_orig_exists.stat.exists
   tags:
     - cups-server
     - cups-client
 
 - name: (cups.yml) update configuration file server - /etc/cups/cupsd.conf
-  template:
+  ansible.builtin.template:
     src: "etc/cups/cupsd.conf.server.j2"
     dest: /etc/cups/cupsd.conf
     owner: root
     group: root
-    mode: 0644
+    mode: "0644"
   notify:
-     Restart cups
+    - Restart cups
   when:
     - groups['file_server']|string is search(inventory_hostname)
   tags:
     - cups-server
 
 - name: (cups.yml) update configuration file client - /etc/cups/cupsd.conf
-  template:
+  ansible.builtin.template:
     src: "etc/cups/cupsd.conf.client.j2"
     dest: /etc/cups/cupsd.conf
     owner: root
     group: root
-    mode: 0644
+    mode: "0644"
   notify:
-     Restart cups
+    - Restart cups
   when:
     - groups['client_pc']|string is search(inventory_hostname)
   tags:
@@ -123,30 +132,36 @@
 
 # -- file /etc/cups/cups-files.conf
 - name: (cups.yml) Check if file '/etc/cups/cups-files.conf.ORIGi' exists
-  stat:
+  ansible.builtin.stat:
     path: /etc/cups/cups-files.conf.ORIG
-  register: cups_files_conf_orig_exists
+  register: common_cups_files_conf_orig_exists
   tags:
     - cups-server
     - cups-client
 
 - name: (cups.yml) Backup /etc/cups/cups-files.conf file
-  command: cp /etc/cups/cups-files.conf /etc/cups/cups-files.conf.ORIG
-  when: cups_files_conf_orig_exists.stat.exists == False
+  ansible.builtin.copy:
+    src: /etc/cups/cups-files.conf
+    dest: /etc/cups/cups-files.conf.ORIG
+    remote_src: true
+    force: false
+    owner: root
+    group: root
+    mode: "0644"
+  when: not common_cups_files_conf_orig_exists.stat.exists
   tags:
     - cups-server
     - cups-client
 
 - name: (cups.yml) update configuration file server - /etc/cups/cups-files.conf
-  template:
+  ansible.builtin.template:
     src: "etc/cups/cups-files.conf.j2"
     dest: /etc/cups/cups-files.conf
     owner: root
     group: root
-    mode: 0644
+    mode: "0644"
   notify:
-     Restart cups
+    - Restart cups
   tags:
     - cups-server
     - cups-client
-

roles/common/tasks/default-users.yml

@@ -5,7 +5,7 @@
 # ---
 
 - name: (default-users.yml) Ensure default groups exists
-  group:
+  ansible.builtin.group:
     name: '{{ item.name }}'
     state: present
     gid: '{{ item.group_id | default(omit) }}'
@@ -17,14 +17,14 @@
     - groups-exists
 
 - name: (default-users.yml) Ensure default users exists
-  user:
+  ansible.builtin.user:
     name: '{{ item.name }}'
     state: present
     uid: '{{ item.user_id | default(omit) }}'
     group: '{{ item.group | default(omit) }}'
-    #group: '{{ item.name | default(omit) }}'
+    # group: '{{ item.name | default(omit) }}'
     home: '{{ item.home | default(omit) }}'
-    shell: '{{ item.shell|d("/bin/bash") }}'
+    shell: '{{ item.shell | d("/bin/bash") }}'
     password: "{{ item.password }}"
     update_password: on_create
   loop: "{{ default_user }}"
@@ -34,7 +34,7 @@
     - users-exists
 
 - name: (default-users.yml) Ensure authorized_key files for default users are present
-  authorized_key:
+  ansible.posix.authorized_key:
     user: "{{ item.0.name }}"
     key: "{{ item.1 }}"
     state: present
@@ -51,26 +51,26 @@
 # ---
 
 - name: (default-users.yml) Ensure extra groups exists
-  group:
+  ansible.builtin.group:
     name: '{{ item.name }}'
     state: present
     gid: '{{ item.group_id | default(omit) }}'
   loop: "{{ extra_user }}"
   loop_control:
     label: '{{ item.name }}'
-  when: 
+  when:
     - extra_user is defined and extra_user|length > 0
   tags:
     - groups-exists
 
 - name: (default-users.yml) Ensure extra users exists
-  user:
+  ansible.builtin.user:
     name: '{{ item.name }}'
     state: present
     uid: '{{ item.user_id | default(omit) }}'
     group: '{{ item.name | default(omit) }}'
     home: '{{ item.home | default(omit) }}'
-    shell: '{{ item.shell|d("/bin/bash") }}'
+    shell: '{{ item.shell | d("/bin/bash") }}'
     password: "{{ item.password }}"
     update_password: on_create
   loop: "{{ extra_user }}"
@@ -81,7 +81,7 @@
     - users-exists
 
 - name: (default-users.yml) Ensure authorized_key files for extra users are present
-  authorized_key:
+  ansible.posix.authorized_key:
     user: "{{ item.0.name }}"
     key: "{{ item.1 }}"
     state: present
@@ -95,7 +95,7 @@
     - authorized_key
 
 - name: (default-users.yml) other entries authorized_key files
-  authorized_key:
+  ansible.posix.authorized_key:
     user: "{{ item.user }}"
     key: "{{ item.key }}"
     state: present
@@ -103,20 +103,20 @@
   loop_control:
     label: "{{ item.user }}"
   when:
-     - entries_authorized_key is defined
-     - entries_authorized_key|length > 0
+    - entries_authorized_key is defined
+    - entries_authorized_key|length > 0
 
 # ---
 # - extra system user
 # ---
 
 - name: (default-users.yml) extra system user exists?
-  user:
+  ansible.builtin.user:
     name: '{{ item.name }}'
     state: present
-    system: yes
+    system: true
     home: '{{ item.home }}'
-    shell: '{{ item.shell|d("/usr/sbin/nologin") }}'
+    shell: '{{ item.shell | d("/usr/sbin/nologin") }}'
     groups: '{{ item.groups | default(omit) }}'
   loop: "{{ extra_system_user }}"
   loop_control:
@@ -125,43 +125,42 @@
   tags:
     - user-exists
 
-
 # ---
 # - extra system groups 'sftp_users'
 # ---
 
 - name: (default-users.yml) Extra system group sftp_users
-  group:
+  ansible.builtin.group:
     name: 'sftp_users'
     state: present
-    system: yes
-  when: 
+    system: true
+  when:
     - create_sftp_group is defined and create_sftp_group > 0
   tags:
     - groups-exists
 
-
-
 # =======================================================
 
-
 # ---
 # - Allow connection via ssh to backup host
 # ---
 
 - name: Ensure root's .ssh directory exists
-  file:
+  ansible.builtin.file:
     path: /root/.ssh
     state: directory
+    owner: root
+    group: root
+    mode: '0700'
 
 - name: (default-users.yml) Copy (backup) ed25519 ssh private key to user root
-  copy:
+  ansible.builtin.copy:
     src: '{{ item.priv_key_src }}'
     dest: '{{ item.priv_key_dest }}'
     owner: root
     group: root
     mode: '0600'
-  when: 
+  when:
     - insert_keypair_backup_client|bool
     - ssh_keypair_backup_client is defined
     - ssh_keypair_backup_client|length > 0
@@ -172,13 +171,13 @@
     - insert_ssh_keypair_backup_server
 
 - name: (default-users.yml) Copy (backup) ed25519 ssh public key to user root
-  copy:
+  ansible.builtin.copy:
     src: '{{ item.pub_key_src }}'
     dest: '{{ item.pub_key_dest }}'
     owner: root
     group: root
     mode: '0644'
-  when: 
+  when:
     - insert_keypair_backup_client|bool
     - ssh_keypair_backup_client is defined
     - ssh_keypair_backup_client|length > 0
@@ -189,7 +188,7 @@
     - insert_ssh_keypair_backup_server
 
 - name: (default-users.yml) Ensure authorized_key (root) on backup hosts contains public key
-  authorized_key:
+  ansible.posix.authorized_key:
     user: root
     key: "{{ lookup('file', item.pub_key_src) }}"
     state: present
@@ -204,9 +203,8 @@
     - authorized_key
     - ssh-keypair-backup-server
 
-
 - name: (default-users.yml) Copy further ssh private key(s) to user root
-  copy:
+  ansible.builtin.copy:
     src: '{{ item.priv_key_src }}'
     dest: '{{ item.priv_key_dest }}'
     owner: root
@@ -215,16 +213,15 @@
   loop: "{{ root_ssh_keypair }}"
   loop_control:
     label: 'dest: {{ item.priv_key_dest }}'
-  when: 
+  when:
     - insert_root_ssh_keypair|bool
     - root_ssh_keypair is defined
     - root_ssh_keypair|length > 0
   tags:
     - insert_root_ssh_keypair
     - root-defaut-ssh-keypair
-
 - name: (default-users.yml) Copy further ssh public key(s) to user root
-  copy:
+  ansible.builtin.copy:
     src: '{{ item.pub_key_src }}'
     dest: '{{ item.pub_key_dest }}'
     owner: root
@@ -233,11 +230,10 @@
   loop: "{{ root_ssh_keypair }}"
   loop_control:
     label: 'dest: {{ item.pub_key_dest }}'
-  when: 
+  when:
     - insert_root_ssh_keypair|bool
     - root_ssh_keypair is defined
     - root_ssh_keypair|length > 0
   tags:
     - insert_root_ssh_keypair
     - root-defaut-ssh-keypair
-

roles/common/tasks/git.yml

@@ -5,10 +5,20 @@
 # ---
 
 - name: (git.yml) Install/Update default repositories
-  git:
-    repo: '{{ item.repo }}'
-    dest: '{{ item.dest }}'
-  with_items: '{{ git_default_repositories }}'
+  ansible.builtin.git:
+    repo: "{{ item.repo }}"
+    dest: "{{ item.dest }}"
+    version: >-
+      {{
+        item.version
+        | default(item.branch)
+        | default(
+          'master'
+          if (lookup('pipe', 'git ls-remote --heads ' ~ item.repo ~ ' master') | length > 0)
+          else 'main'
+        )
+      }}
+  with_items: "{{ git_default_repositories }}"
   loop_control:
     label: "{{ item.name }}"
   tags:
@@ -20,10 +30,20 @@
 # ---
 
 - name: (git.yml) Install/Update file_server repositories
-  git:
-    repo: '{{ item.repo }}'
-    dest: '{{ item.dest }}'
-  with_items: '{{ git_oopen_server_repositories }}'
+  ansible.builtin.git:
+    repo: "{{ item.repo }}"
+    dest: "{{ item.dest }}"
+    version: >-
+      {{
+        item.version
+        | default(item.branch)
+        | default(
+          'master'
+          if (lookup('pipe', 'git ls-remote --heads ' ~ item.repo ~ ' master') | length > 0)
+          else 'main'
+        )
+      }}
+  with_items: "{{ git_oopen_server_repositories }}"
   loop_control:
     label: "{{ item.name }}"
   when: "groups['file_server']|string is search(inventory_hostname)"
@@ -36,14 +56,34 @@
 # ---
 
 - name: (git.yml) Install/Update samba server repositories
-  git:
-    repo: '{{ item.repo }}'
-    dest: '{{ item.dest }}'
-  with_items: '{{ git_samba_repositories }}'
+  ansible.builtin.git:
+    repo: "{{ item.repo }}"
+    dest: "{{ item.dest }}"
+    version: >-
+      {{
+        item.version
+        | default(item.branch)
+        | default(
+          'master'
+          if (lookup('pipe', 'git ls-remote --heads ' ~ item.repo ~ ' master') | length > 0)
+          else 'main'
+        )
+      }}
+  with_items: "{{ git_samba_repositories }}"
+  register: common_git_samba_result
   loop_control:
     label: "{{ item.name }}"
   when: "groups['samba_server']|string is search(inventory_hostname)"
-  ignore_errors: True
+  failed_when: >-
+    (common_git_samba_result.failed | default(false)) and (
+      common_git_samba_result.msg is not defined or (
+        ('Could not resolve host' not in common_git_samba_result.msg)
+        and ('Connection timed out' not in common_git_samba_result.msg)
+        and ('Failed to connect to' not in common_git_samba_result.msg)
+        and ('Connection reset by peer' not in common_git_samba_result.msg)
+        and ('Operation timed out' not in common_git_samba_result.msg)
+      )
+    )
   tags:
     - git-samba-server-repositories
 
@@ -53,14 +93,22 @@
 # ---
 
 - name: (git.yml) Install/Update gateway repositories
-  git:
-    repo: '{{ item.repo }}'
-    dest: '{{ item.dest }}'
-  with_items: '{{ git_gateway_repositories }}'
+  ansible.builtin.git:
+    repo: "{{ item.repo }}"
+    dest: "{{ item.dest }}"
+    version: >-
+      {{
+        item.version
+        | default(item.branch)
+        | default(
+          'master'
+          if (lookup('pipe', 'git ls-remote --heads ' ~ item.repo ~ ' master') | length > 0)
+          else 'main'
+        )
+      }}
+  with_items: "{{ git_gateway_repositories }}"
   loop_control:
     label: "{{ item.name }}"
   when: "groups['gateway_server']|string is search(inventory_hostname)"
   tags:
     - git-gateway-server-repositories
-
-

roles/common/tasks/luks.yml

@@ -1,6 +1,5 @@
 - name: (luks.ym) add new key to the LUKS container (container has to exist)
-  luks_device:
+  community.crypto.luks_device:
     device: "{{ luks_device }}"
     keyfile: "{{ role_path + '/files/vault/luks_default_passwd' }}"
     new_keyfile: "{{ role_path + '/files/vault/luks_chris_passwd' }}"
-

roles/common/tasks/main.yml

@@ -5,7 +5,8 @@
 #    timezone
 #    locales
 #    systemd-nofiles
-- import_tasks: basic.yml
+- name: (main.yml) Import basic.yml tasks
+  ansible.builtin.import_tasks: basic.yml
   tags:
     - basic
 
@@ -13,7 +14,8 @@
 # tags supported inside sshd.yml
 #
 #    sshd-config
-- import_tasks: sshd.yml
+- name: (main.yml) Import sshd.yml tasks
+  ansible.builtin.import_tasks: sshd.yml
   tags: sshd
 
 
@@ -27,18 +29,21 @@
 #   apt-remove
 #   apt-autoremove
 #   apt-clean
-- import_tasks: apt.yml
+- name: (main.yml) Import apt.yml tasks
+  ansible.builtin.import_tasks: apt.yml
   tags: apt
 
 
-- import_tasks: default-users.yml
+- name: (main.yml) Import default-users.yml tasks
+  ansible.builtin.import_tasks: default-users.yml
   tags: default-user
 
 
 # tags supported inside systemd-resolved.yml
 #
 #    systemd-resolved
-- import_tasks: systemd-resolved.yml
+- name: (main.yml) Import systemd-resolved.yml tasks
+  ansible.builtin.import_tasks: systemd-resolved.yml
   tags:
     - systemd-resolved
   when:
@@ -52,7 +57,8 @@
 #   git-default-repositories
 #   git-file-server-repositories
 #   git-gateway-server-repositories
-- import_tasks: git.yml
+- name: (main.yml) Import git.yml tasks
+  ansible.builtin.import_tasks: git.yml
   tags: git
 
 
@@ -60,7 +66,8 @@
 #
 #    cups-server
 #    cups-client
-- import_tasks: cups-install.yml
+- name: (main.yml) Import cups-install.yml tasks
+  ansible.builtin.import_tasks: cups-install.yml
   tags:
     - cups
 
@@ -68,7 +75,8 @@
 # tags supported inside nis-user.yml:
 #
 #    nis-user
-- import_tasks: nis-user.yml
+- name: (main.yml) Import nis-user.yml tasks
+  ansible.builtin.import_tasks: nis-user.yml
   when: "groups['nis_server']|string is search(inventory_hostname)"
   tags:
     - nis-user
@@ -77,14 +85,16 @@
 # tags supported inside ntp.yml:
 #
 #    ntp-server
-- import_tasks: ntp.yml
+- name: (main.yml) Import ntp.yml tasks
+  ansible.builtin.import_tasks: ntp.yml
   tags:
     - ntp
 
 
 # tags supported inside pure-ftpd-install.yml:
 #
-- import_tasks: pure-ftpd-install.yml
+- name: (main.yml) Import pure-ftpd-install.yml tasks
+  ansible.builtin.import_tasks: pure-ftpd-install.yml
   when:
     - groups['ftp_server']|string is search(inventory_hostname)
   tags:
@@ -95,7 +105,8 @@
 #
 #    nfs-server
 #    nfs-client
-- import_tasks: nfs.yml
+- name: (main.yml) Import nfs.yml tasks
+  ansible.builtin.import_tasks: nfs.yml
   tags:
     - nfs
 
@@ -104,7 +115,8 @@
 #
 #    samba-server
 #    samba-client
-- import_tasks: samba-install.yml
+- name: (main.yml) Import samba-install.yml tasks
+  ansible.builtin.import_tasks: samba-install.yml
   tags:
     - samba-install
     - samba
@@ -112,14 +124,16 @@
 
 # tags supported inside samba-remove-user.yml:
 #
-- import_tasks: samba-remove-user.yml
+- name: (main.yml) Import samba-remove-user.yml tasks
+  ansible.builtin.import_tasks: samba-remove-user.yml
   tags:
     - samba-remove-user
 
 
 # tags supported inside system-remove-user.yml:
 #
-- import_tasks: system-remove-user.yml
+- name: (main.yml) Import system-remove-user.yml tasks
+  ansible.builtin.import_tasks: system-remove-user.yml
   tags:
     - system-remove-user
 
@@ -127,7 +141,8 @@
 # tags supported inside system-user.yml:
 #
 #    system-user
-- import_tasks: system-user.yml
+- name: (main.yml) Import system-user.yml tasks
+  ansible.builtin.import_tasks: system-user.yml
   when: "groups['file_server']|string is search(inventory_hostname)"
   tags:
     - system-user
@@ -136,7 +151,8 @@
 # tags supported inside nis-install-server.yml:
 #
 #    nis-install-server
-- import_tasks: nis-install-server.yml
+- name: (main.yml) Import nis-install-server.yml tasks
+  ansible.builtin.import_tasks: nis-install-server.yml
   when: "groups['nis_server']|string is search(inventory_hostname)"
   tags:
     - nis-install
@@ -146,7 +162,8 @@
 # tags supported inside nis-install-client.yml:
 #
 #    nis-install-client
-- import_tasks: nis-install-client.yml
+- name: (main.yml) Import nis-install-client.yml tasks
+  ansible.builtin.import_tasks: nis-install-client.yml
   when: "groups['nis_client']|string is search(inventory_hostname)"
   tags:
     - nis-install
@@ -156,7 +173,8 @@
 # tags supported inside samba-user.yml:
 #
 #    samba-user
-- import_tasks: samba-user.yml
+- name: (main.yml) Import samba-user.yml tasks
+  ansible.builtin.import_tasks: samba-user.yml
   when: "groups['samba_server']|string is search(inventory_hostname)"
   tags:
     - nis-samba-user
@@ -167,7 +185,8 @@
 #    profile
 #    bashrc
 #    vimrc
-- import_tasks: system-user-systemfiles.yml
+- name: (main.yml) Import system-user-systemfiles.yml tasks
+  ansible.builtin.import_tasks: system-user-systemfiles.yml
   when: "groups['file_server']|string is search(inventory_hostname)"
   tags:
     - user-systemfiles
@@ -178,7 +197,8 @@
 #    profile
 #    bashrc
 #    vimrc
-- import_tasks: nis-user-systemfiles.yml
+- name: (main.yml) Import nis-user-systemfiles.yml tasks
+  ansible.builtin.import_tasks: nis-user-systemfiles.yml
   when: "groups['nis_server']|string is search(inventory_hostname)"
   tags:
     - user-systemfiles
@@ -188,7 +208,8 @@
 # tags supported root-files-scripts.yml:
 
 #    wakeup_lan
-- import_tasks: root-files-scripts.yml
+- name: (main.yml) Import root-files-scripts.yml tasks
+  ansible.builtin.import_tasks: root-files-scripts.yml
   tags:
     - root-files-scripts
 
@@ -198,7 +219,8 @@
 #   sudoers-remove
 #   sudoers-file-configuration
 #   sudoers-global-configuration
-- import_tasks: sudoers-pc.yml
+- name: (main.yml) Import sudoers-pc.yml tasks
+  ansible.builtin.import_tasks: sudoers-pc.yml
   when: "groups['client_pc']|string is search(inventory_hostname)"
   tags:
     - sudoers
@@ -209,21 +231,21 @@
 #   sudoers-remove
 #   sudoers-file-configuration
 #   sudoers-global-configuration
-- import_tasks: sudoers-server.yml
+- name: (main.yml) Import sudoers-server.yml tasks
+  ansible.builtin.import_tasks: sudoers-server.yml
   when: "groups['file_server']|string is search(inventory_hostname)"
   tags:
     - sudoers
 
 
-- import_tasks: cron.yml
+- name: (main.yml) Import cron.yml tasks
+  ansible.builtin.import_tasks: cron.yml
   tags:
     - cron
 
-
-
 # tags supported inside mount_samba_shares.yml:
 #
-#- import_tasks: mount_samba_shares.yml
+# - import_tasks: mount_samba_shares.yml
 #  when: "groups['client_pc']|string is search(inventory_hostname)"
 #  tags:
 #    - samba-shares
@@ -236,7 +258,7 @@
 #   - Ubuntu 18.04LTSi
 
 - name: "For OS: Ubuntu 16.04LTS, Arch: amd64"
-  import_tasks: ubuntu-x11vnc-1604-amd64.yml
+  ansible.builtin.import_tasks: ubuntu-x11vnc-1604-amd64.yml
   when:
     - ansible_facts["distribution_version"] ==  "16.04"
     - ansible_architecture == "x86_64"
@@ -247,7 +269,7 @@
 
 
 - name: "For OS: Ubuntu 18.04LTS, Arch: amd64"
-  import_tasks: ubuntu-x11vnc-1804-amd64.yml
+  ansible.builtin.import_tasks: ubuntu-x11vnc-1804-amd64.yml
   when:
     - ansible_facts["distribution_version"] ==  "18.04"
     - ansible_architecture == "x86_64"
@@ -258,7 +280,7 @@
 
 
 - name: "For OS: Ubuntu 20.04LTS, Arch: amd64"
-  import_tasks: ubuntu-x11vnc-2004-amd64.yml
+  ansible.builtin.import_tasks: ubuntu-x11vnc-2004-amd64.yml
   when:
     - ansible_facts["distribution_version"] ==  "20.04"
     - ansible_architecture == "x86_64"
@@ -269,7 +291,7 @@
 
 
 - name: "For OS: Ubuntu 22.04LTS, Arch: amd64"
-  import_tasks: ubuntu-x11vnc-2204-amd64.yml
+  ansible.builtin.import_tasks: ubuntu-x11vnc-2204-amd64.yml
   when:
     - ansible_facts["distribution_version"] ==  "22.04"
     - ansible_architecture == "x86_64"
@@ -279,9 +301,8 @@
     - finish-client-install
 
 
-
-#- name: "Configure LUKS"
-#  import_tasks: luks.yml
-#  when: "groups['client_pc']|string is search(inventory_hostname)"
-#  tags:
+# - name: "Configure LUKS"
+#   import_tasks: luks.yml
+#   when: "groups['client_pc']|string is search(inventory_hostname)"
+#   tags:
 #    - luks

roles/common/tasks/mount_samba_shares.yml

@@ -2,7 +2,7 @@
 
 
 - name: (mount_samba_shares.yml) Ensure (user separated) base mount directories for samba shares exists
-  file:
+  ansible.builtin.file:
     path: "/mnt/{{ item.name }}"
     owner: "{{ item.name }}"
     group: "{{ item.name }}"
@@ -14,14 +14,14 @@
   when:
     - item.is_samba_user is defined and item.is_samba_user|bool
 
-#- name: (mount_samba_shares.yml) Ensure (user separated) mount directories for samba shares exists
+# - name: (mount_samba_shares.yml) Ensure (user separated) mount directories for samba shares exists
 #  file:
 #    path: "/mnt/{{ item.1 }}/{{ item.0.name }}"
 #    owner: "{{ item.1 }}"
 #    group: "{{ item.1 }}"
 #    mode: '0770'
 #    state: directory
-#  with_subelements: 
+#  with_subelements:
 #    - "{{ samba_shares }}"
 #    - user
 #  loop_control:

roles/common/tasks/nfs.yml

@@ -5,7 +5,7 @@
 # ---
 
 - name: (nfs.yml) Ensure NFS utilities (server) are installed.
-  apt:
+  ansible.builtin.apt:
     name:
       - nfs-common
       - nfs-kernel-server
@@ -17,7 +17,7 @@
     - nfs-server
 
 - name: (nfs.yml) Ensure directories to export exist
-  file:
+  ansible.builtin.file:
     path: '{{ item.src.split(":")[1] }}'
     owner: root
     group: root
@@ -32,12 +32,12 @@
     - nfs-server
 
 - name: (nfs.yml) Copy exports file.
-  template:
+  ansible.builtin.template:
     src: etc/exports.j2
     dest: /etc/exports
     owner: root
     group: root
-    mode: 0644
+    mode: "0644"
   when:
     - inventory_hostname in groups['nfs_server']
   notify: Reload nfs
@@ -45,15 +45,15 @@
     - nfs-server
 
 - name: Enable service rpc-statd and ensure it is not masked
-  systemd:
+  ansible.builtin.systemd:
     name: rpc-statd
-    enabled: yes
-    masked: no
+    enabled: true
+    masked: false
   when:
     - inventory_hostname in groups['nfs_server']
 
 - name: Make sure service rpc-statd is running
-  systemd:
+  ansible.builtin.systemd:
     state: started
     name: rpc-statd
   when:
@@ -66,24 +66,31 @@
 # ---
 
 - name: (nfs.yml) Check if file '/etc/default/nfs-kernel-server.ORIG' exists
-  stat:
+  ansible.builtin.stat:
     path: /etc/default/nfs-kernel-server
-  register: default_nfs_kernel_server_exists
+  register: common_default_nfs_kernel_server_exists
   when:
     - inventory_hostname in groups['nfs_server']
   tags:
     - nfs-server
 
 - name: (nfs.yml) Backup existing file /etc/default/nfs-kernel-server
-  command: cp -a /etc/default/nfs-kernel-server /etc/default/nfs-kernel-server.ORIG
+  ansible.builtin.copy:
+    src: /etc/default/nfs-kernel-server
+    dest: /etc/default/nfs-kernel-server.ORIG
+    remote_src: true
+    force: false
+    owner: root
+    group: root
+    mode: "0644"
   when:
     - inventory_hostname in groups['nfs_server']
-    - default_nfs_kernel_server_exists.stat.exists == False
+    - common_default_nfs_kernel_server_exists.stat.exists
   tags:
     - nfs-server
 
 - name: (nfs.yml) Adjust file /etc/default/nfs-kernel-server - set 'RPCNFSDCOUNT' (server)
-  replace:
+  ansible.builtin.replace:
     path: /etc/default/nfs-kernel-server
     regexp: '^RPCNFSDCOUNT=.*'
     replace: "RPCNFSDCOUNT={{ nfs_start_servers | default('16') }}"
@@ -97,10 +104,10 @@
 # ---
 
 - name: (nfs.yml) Ensure directory '/etc/nfs.conf.d' exists
-  file:
+  ansible.builtin.file:
     path: /etc/nfs.conf.d
     state: directory
-    mode: 0755
+    mode: "0755"
     group: root
     owner: root
   when:
@@ -110,12 +117,12 @@
 
 
 - name: (nfs.yml) Create/Update file '/etc/nfs.conf.d/20-start_servers.conf' from template '20-start_servers.conf.j2'
-  template:
+  ansible.builtin.template:
     src: etc/nfs.conf.d/20-start_servers.conf.j2
     dest: /etc/nfs.conf.d/20-start_servers.conf
     owner: root
     group: root
-    mode: 0644
+    mode: "0644"
   notify: "Restart nfs-kernel-server"
   when:
     - inventory_hostname in groups['nfs_server']
@@ -128,17 +135,17 @@
 # ---
 
 - name: (nfs.yml) Ensure NFS utilities (clients) are installed.
-  apt:
+  ansible.builtin.apt:
     pkg: nfs-common
     state: present
-  when: 
+  when:
     - ansible_facts['os_family'] == "Debian"
     - inventory_hostname in groups['nfs_client']
   tags:
     - nfs-client
 
 - name: (nfs.yml) NFS Mount exports from nfs server
-  mount:
+  ansible.posix.mount:
     path: "{{ item.path }}"
     src: "{{ item.src }}"
     fstype: nfs
@@ -153,6 +160,3 @@
     - inventory_hostname in groups['nfs_client']
   tags:
     - nfs-client
-
-
-

roles/common/tasks/nis-install-client.yml

@@ -5,29 +5,29 @@
 # ---
 
 - name: (nis-install-client.yml) Set (nis) default domain (/etc/defaultdomain)
-  template:
-    dest: /etc/defaultdomain  
+  ansible.builtin.template:
+    dest: /etc/defaultdomain
     src: etc/defaultdomain.j2
     owner: root
     group: root
-    mode: 0644
+    mode: "0644"
   tags:
     - nis-install
     - nis-install-client
 
 - name: (nis-install-client.yml) Create preconfigured /etc/yp.conf on nis clients
-  template:
+  ansible.builtin.template:
     dest: /etc/yp.conf
     src: etc/yp.conf.j2
     owner: root
     group: root
-    mode: 0644
+    mode: "0644"
   tags:
     - nis-install
     - nis-install-client
 
 - name: (nis-install-client.yml) Install nis common packages
-  package:
+  ansible.builtin.package:
     name: "{{ item }}"
     state: present
   with_items: "{{ nis_common_packages }}"
@@ -41,23 +41,30 @@
 # ---
 
 - name: (nis-install-client.yml) Check if file '/etc/default/nis.ORIG' exists
-  stat:
+  ansible.builtin.stat:
     path: /etc/default/nis.ORIG
-  register: default_nis_exists
+  register: common_default_nis_exists
   tags:
     - nis-install
     - nis-install-client
 
 - name: (nis-install-client.yml) Backup existing file /etc/default/nis
-  command: cp -a /etc/default/nis /etc/default/nis.ORIG
+  ansible.builtin.copy:
+    src: /etc/default/nis
+    dest: /etc/default/nis.ORIG
+    remote_src: true
+    force: false
+    owner: root
+    group: root
+    mode: "0644"
   when:
-    - default_nis_exists.stat.exists == False
+    - not common_default_nis_exists.stat.exists
   tags:
     - nis-install
     - nis-install-client
 
 - name: (nis-install-client.yml) Adjust file /etc/default/nis - set 'NISSERVER' (client)
-  replace:
+  ansible.builtin.replace:
     path: /etc/default/nis
     regexp: '^NISSERVER=.*'
     replace: 'NISSERVER=false'
@@ -66,7 +73,7 @@
     - nis-install-client
 
 - name: (nis-install-client.yml) Adjust file /etc/default/nis - set 'NISCLIENT' (client)
-  replace:
+  ansible.builtin.replace:
     path: /etc/default/nis
     regexp: '^NISCLIENT=.*'
     replace: 'NISCLIENT=true'
@@ -75,7 +82,7 @@
     - nis-install-client
 
 - name: (nis-install-client.yml) Adjust file /etc/default/nis - set 'YPBINDARGS' (client)
-  replace:
+  ansible.builtin.replace:
     path: /etc/default/nis
     regexp: '^YPBINDARGS=.*'
     replace: 'YPBINDARGS='
@@ -89,7 +96,7 @@
 # ---
 
 - name: (nis-install-client.yml) Add '+::::::' to file /etc/passwd
-  lineinfile:
+  ansible.builtin.lineinfile:
     path: /etc/passwd
     line: '+::::::'
     insertafter: EOF
@@ -103,7 +110,7 @@
     - nis-install-client
 
 - name: (nis-install-client.yml) Add '+:::' to file /etc/group
-  lineinfile:
+  ansible.builtin.lineinfile:
     path: /etc/group
     line: '+:::'
     insertafter: EOF
@@ -117,7 +124,7 @@
     - nis-install-client
 
 - name: (nis-install-client.yml) Add '+::::::::' to file /etc/shadow
-  lineinfile:
+  ansible.builtin.lineinfile:
     path: /etc/shadow
     line: '+::::::::'
     insertafter: EOF
@@ -136,23 +143,30 @@
 # ---
 
 - name: (nis-install-client.yml) Check if file '/etc/hosts.ORIG' exists
-  stat:
+  ansible.builtin.stat:
     path: /etc/hosts.ORIG
-  register: etc_hosts_orig_exists
+  register: common_etc_hosts_orig_exists
   tags:
     - nis-install
     - nis-install-client
 
 - name: (nis-install-client.yml) Backup existing file /etc/hosts
-  command: cp -a /etc/hosts /etc/hosts.ORIG
+  ansible.builtin.copy:
+    src: /etc/hosts
+    dest: /etc/hosts.ORIG
+    remote_src: true
+    force: false
+    owner: root
+    group: root
+    mode: "0644"
   when:
-    - etc_hosts_orig_exists.stat.exists == False
+    - not common_etc_hosts_orig_exists.stat.exists
   tags:
     - nis-install
     - nis-install-client
 
 - name: (nis-install-client.yml) Add nis-server to file /etc/hosts
-  lineinfile:
+  ansible.builtin.lineinfile:
     path: /etc/hosts
     line: '{{ nis_server_address }} {{ nis_server_name }} {{ nis_server_name.split(".")[0] }}'
     insertafter: EOF
@@ -170,23 +184,30 @@
 # ---
 
 - name: (nis-install-client.yml) Check if file '/etc/nsswitch.conf.ORIG' exists
-  stat:
+  ansible.builtin.stat:
     path: /etc/nsswitch.conf.ORIG
-  register: nsswitch_conf_orig_exists
+  register: common_nsswitch_conf_orig_exists
   tags:
-    - nis-install 
+    - nis-install
     - nis-install-client
 
 - name: (nis-install-client.yml) Backup existing file /etc/nsswitch.conf
-  command: cp -a /etc/nsswitch.conf /etc/nsswitch.conf.ORIG
+  ansible.builtin.copy:
+    src: /etc/nsswitch.conf
+    dest: /etc/nsswitch.conf.ORIG
+    remote_src: true
+    force: false
+    owner: root
+    group: root
+    mode: "0644"
   when:
-    - nsswitch_conf_orig_exists.stat.exists == False
+    - not common_nsswitch_conf_orig_exists.stat.exists
   tags:
     - nis-install
     - nis-install-client
 
 - name: (nis-install-client.yml) Adjust file /etc/nsswitch.conf (set hosts)
-  replace:
+  ansible.builtin.replace:
     path: /etc/nsswitch.conf
     regexp: '(hosts:\s+files)\s+((?!nis).*)$'
     replace: '\1 nis \2'
@@ -195,14 +216,14 @@
     - nis-install-client
 
 - name: (nis-install-client.yml) Adjust file /etc/nsswitch.conf (set passwd/group/shadow)
-  replace:
+  ansible.builtin.replace:
     path: /etc/nsswitch.conf
     regexp: '^({{ item }}:\s+((?!nis).)*)$'
     replace: '\1 nis'
   with_items:
-     - passwd
-     - group
-     - shadow
+    - passwd
+    - group
+    - shadow
   tags:
     - nis-install
     - nis-install-client
@@ -239,7 +260,7 @@
 # -    systemctl restart systemd-logind.service
 
 - name: (nis-install-client.yml) Ensure directory /etc/systemd/system/systemd-logind.service.d exists
-  file:
+  ansible.builtin.file:
     path: /etc/systemd/system/systemd-logind.service.d
     owner: root
     group: root
@@ -251,7 +272,7 @@
     - nis-install-client
 
 - name: (nis-install-client.yml) Ensure file /files/etc/systemd/system/systemd-logind.service.d/nis_allow_network.conf exists
-  copy:
+  ansible.builtin.copy:
     src: "{{ role_path + '/files/etc/systemd/system/systemd-logind.service.d/nis_allow_network.conf' }}"
     dest: /etc/systemd/system/systemd-logind.service.d/nis_allow_network.conf
     owner: root
@@ -281,7 +302,7 @@
 # -    cat /etc/systemd/system/rpcbind.socket.d/override.conf
 
 - name: (nis-install-client.yml) Ensure directory /etc/systemd/system/rpcbind.socket.d exists
-  file:
+  ansible.builtin.file:
     path: /etc/systemd/system/rpcbind.socket.d
     owner: root
     group: root
@@ -293,7 +314,7 @@
     - nis-install-client
 
 - name: (nis-install-client.yml) Ensure file /files/etc/systemd/system/rpcbind.socket.d/override.conf exists
-  copy:
+  ansible.builtin.copy:
     src: "{{ role_path + '/files/etc/systemd/system/rpcbind.socket.d/override.conf' }}"
     dest: /etc/systemd/system/rpcbind.socket.d/override.conf
     owner: root
@@ -307,12 +328,11 @@
     - nis-install-client
 
 - name: Make sure service rpcbind, nscd and ypbind are started and enabled
-  systemd:
+  ansible.builtin.systemd:
     name: "{{ item }}"
     state: restarted
     enabled: true
   with_items:
-     - rpcbind
-     - nscd
-     - ypbind
-
+    - rpcbind
+    - nscd
+    - ypbind

roles/common/tasks/nis-install-server.yml

@@ -5,39 +5,40 @@
 # ---
 
 - name: (nis-install-server.yml) Install nis common packages
-  package:
+  ansible.builtin.package:
     name: "{{ item }}"
     state: present
   with_items: "{{ nis_common_packages }}"
-  register: nis_installed
+  register: common_nis_installed
   tags:
     - nis-install
     - nis-install-server
 
 - name: (nis-install-server.yml) Set (nis) default domain (/etc/defaultdomain)
-  template:
+  ansible.builtin.template:
     dest: /etc/defaultdomain
     src: etc/defaultdomain.j2
     owner: root
     group: root
-    mode: 644
+    mode: "0644"
   tags:
     - nis-install
     - nis-install-server
 
 - name: (nis-install-server.yml) Create preconfigured /etc/yp.conf on nis clients
-  template:
+  ansible.builtin.template:
     dest: /etc/yp.conf
     src: etc/yp.conf.j2
     owner: root
     group: root
-    mode: 644
+    mode: "0644"
   tags:
     - nis-install
     - nis-install-client
 
 - name: (nis-install-server.yml) Set local host's domain name
-  command: domainname "{{ nis_domain }}"
+  ansible.builtin.command: domainname "{{ nis_domain }}"
+  changed_when: false
   tags:
     - nis-install
     - nis-install-server
@@ -51,9 +52,9 @@
 # ---
 
 - name: (nis-install-server.yml) Check if file '/etc/pam.d/common-password' exists
-  stat:
+  ansible.builtin.stat:
     path: /etc/pam.d/common-password
-  register: file_etc_pam_d_common_password
+  register: common_file_etc_pam_d_common_password
   tags:
     - nis-install
     - nis-install-server
@@ -62,53 +63,60 @@
     - ansible_facts['distribution_major_version']|int >= 11
 
 - name: (nis-install-server.yml) Check if default hash for password is 'yescrypt'
-  shell: "grep -i -q -E  '^password.+yescrypt' /etc/pam.d/common-password"
-  register: presence_of_passwprd_hashing_yescrypt
-  changed_when:
-    - presence_of_passwprd_hashing_yescrypt.rc < 1
+  ansible.builtin.command: grep -i -q -E '^password.+yescrypt' /etc/pam.d/common-password
+  register: common_presence_of_passwprd_hashing_yescrypt
+  changed_when: false
   failed_when:
-    - presence_of_passwprd_hashing_yescrypt.rc >= 2
+    - common_presence_of_passwprd_hashing_yescrypt.rc >= 2
   when:
     - ansible_facts['distribution'] == "Debian"
     - ansible_facts['distribution_major_version']|int >= 11
-    - file_etc_pam_d_common_password.stat.exists == True
-    #- ansible_distribution_major_version|int <= 12
+    - common_file_etc_pam_d_common_password.stat.exists
+    # - ansible_distribution_major_version|int <= 12
 
-- name: (nis-install-server.yml) Change default password hash for local system
-    accounts from SHA-512 to yescrypt
-  shell: perl -i -n -p -e "s/^(password.+)yescrypt/\1sha512/"
-    /etc/pam.d/common-password
+- name: (nis-install-server.yml) Change default password hash for local system accounts from yescrypt to SHA-512
+  ansible.builtin.replace:
+    path: /etc/pam.d/common-password
+    regexp: '^(password.+)yescrypt'
+    replace: '\1sha512'
   when:
     - ansible_facts['distribution'] == "Debian"
     - ansible_facts['distribution_major_version']|int >= 11
-    - file_etc_pam_d_common_password.stat.exists == True
-    - presence_of_passwprd_hashing_yescrypt is changed
-    #- ansible_facts['distribution_major_version']|int <= 12
+    - common_file_etc_pam_d_common_password.stat.exists
+    - common_presence_of_passwprd_hashing_yescrypt.rc == 0
+    # - ansible_facts['distribution_major_version']|int <= 12
 
 
-    # ---
-    # /etc/default/nis
-    # ---
+  # ---
+  # /etc/default/nis
+  # ---
 
 - name: (nis-install-server.yml) Check if file '/etc/default/nis.ORIG' exists
-  stat:
+  ansible.builtin.stat:
     path: /etc/default/nis.ORIG
-  register: default_nis_exists
+  register: common_default_nis_exists
   tags:
     - nis-install
     - nis-install-server
 
 - name: (nis-install-server.yml) Backup existing file /etc/default/nis
-  command: cp -a /etc/default/nis /etc/default/nis.ORIG
+  ansible.builtin.copy:
+    src: /etc/default/nis
+    dest: /etc/default/nis.ORIG
+    remote_src: true
+    force: false
+    owner: root
+    group: root
+    mode: "0644"
   when:
-    - default_nis_exists.stat.exists == False
+    - not common_default_nis_exists.stat.exists
   tags:
     - nis-install
     - nis-install-server
 
 - name: (nis-install-server.yml) Adjust file /etc/default/nis - set 'NISSERVER'
     (server)
-  replace:
+  ansible.builtin.replace:
     path: /etc/default/nis
     regexp: "^NISSERVER=.*"
     replace: "NISSERVER=master"
@@ -118,7 +126,7 @@
 
 - name: (nis-install-server.yml) Adjust file /etc/default/nis - set 'NISCLIENT'
     (server)
-  replace:
+  ansible.builtin.replace:
     path: /etc/default/nis
     regexp: "^NISCLIENT=.*"
     replace: "NISCLIENT=false"
@@ -131,24 +139,31 @@
 # ---
 
 - name: (nis-install-server.yml) Check if file '/etc/ypserv.securenets.ORIG' exists
-  stat:
+  ansible.builtin.stat:
     path: /etc/ypserv.securenets.ORIG
-  register: ypserv_securenets_orig_exists
+  register: common_ypserv_securenets_orig_exists
   tags:
     - nis-install
     - nis-install-server
 
 - name: (nis-install-server.yml) Backup existing file /etc/ypserv.securenets
-  command: cp -a /etc/ypserv.securenets /etc/ypserv.securenets.ORIG
+  ansible.builtin.copy:
+    src: /etc/ypserv.securenets
+    dest: /etc/ypserv.securenets.ORIG
+    remote_src: true
+    force: false
+    owner: root
+    group: root
+    mode: "0644"
   when:
-    - ypserv_securenets_orig_exists.stat.exists == False
+    - not common_ypserv_securenets_orig_exists.stat.exists
   tags:
     - nis-install
     - nis-install-server
 
 - name: (nis-install-server.yml) Comment line like '0.0.0.0 ..' to file
     /etc/ypserv.securenets
-  replace:
+  ansible.builtin.replace:
     path: /etc/ypserv.securenets
     regexp: "^(0.0.0.0\\s+.*)"
     replace: "#\\1"
@@ -158,7 +173,7 @@
 
 - name: (nis-install-server.yml) Add '255.255.0.0 192.168.0.0' to file
     /etc/ypserv.securenets
-  lineinfile:
+  ansible.builtin.lineinfile:
     path: /etc/ypserv.securenets
     line: "255.255.0.0 192.168.0.0"
     insertafter: EOF
@@ -172,7 +187,7 @@
 
 - name: (nis-install-server.yml) Add '255.0.0.0 10.0.0.0' to file
     /etc/ypserv.securenets
-  lineinfile:
+  ansible.builtin.lineinfile:
     path: /etc/ypserv.securenets
     line: "255.0.0.0 10.0.0.0"
     insertafter: EOF
@@ -185,8 +200,13 @@
     - nis-install-server
 
 - name: (nis-install-server.yml) Trigger '/usr/lib/yp/ypinit -m'
-  shell: printf '\n' | /usr/lib/yp/ypinit -m
-  when: nis_installed.changed
+  ansible.builtin.command: /usr/lib/yp/ypinit -m
+  args:
+    stdin: "\n"
+  changed_when: false
+  when:
+    - ansible_facts['distribution'] == "Debian"
+    - ansible_facts['distribution_major_version'] | int >= 11
   tags:
     - nis-install
     - nis-install-server
@@ -197,7 +217,7 @@
 
 - name: (nis-install-server.yml) Ensure directoriy 'nis_base_home' (usually
     /data/home) exists
-  file:
+  ansible.builtin.file:
     path: "{{ nis_base_home }}"
     owner: root
     group: root
@@ -230,9 +250,9 @@
 # ---
 
 - name: (nis-install-server.yml) Check if file '/etc/adduser.conf.ORIG exists'
-  stat:
+  ansible.builtin.stat:
     path: /etc/adduser.conf.ORIG
-  register: adduser_conf_exists
+  register: common_adduser_conf_exists
   when:
     - nis_base_home is defined
     - nis_base_home != '/home'
@@ -241,11 +261,18 @@
     - nis-install-server
 
 - name: (nis-install-server.yml) Backup existing file /etc/adduser.conf
-  command: cp -a /etc/adduser.conf /etc/adduser.conf.ORIG
+  ansible.builtin.copy:
+    src: /etc/adduser.conf
+    dest: /etc/adduser.conf.ORIG
+    remote_src: true
+    force: false
+    owner: root
+    group: root
+    mode: "0644"
   when:
     - nis_base_home is defined
     - nis_base_home != '/home'
-    - adduser_conf_exists.stat.exists == False
+    - not common_adduser_conf_exists.stat.exists
   tags:
     - nis-install
     - nis-install-server
@@ -267,23 +294,30 @@
 # ---
 
 - name: (nis-install-server.yml) Check if file '/var/yp/Makefile.ORIG exists'
-  stat:
+  ansible.builtin.stat:
     path: /var/yp/Makefile.ORIG
-  register: adduser_conf_exists
+  register: common_yp_makefile_orig_exists
   tags:
     - nis-install
     - nis-install-server
 
 - name: (nis-install-server.yml) Backup existing file /var/yp/Makefile
-  command: cp -a /var/yp/Makefile /var/yp/Makefile.ORIG
+  ansible.builtin.copy:
+    src: /var/yp/Makefile
+    dest: /var/yp/Makefile.ORIG
+    remote_src: true
+    force: false
+    owner: root
+    group: root
+    mode: "0644"
   when:
-    - adduser_conf_exists.stat.exists == False
+    - not common_yp_makefile_orig_exists.stat.exists
   tags:
     - nis-install
     - nis-install-server
 
 - name: (nis-install-server.yml) Adjust file  '/var/yp/Makefile'
-  replace:
+  ansible.builtin.replace:
     path: /var/yp/Makefile
     regexp: "^#?{{ item }}=.*"
     replace: "{{ item }}=true"

roles/common/tasks/nis-user-systemfiles.yml

@@ -5,36 +5,36 @@
 # ---
 
 # nis_users
-#- name: (nis-user-systemfiles.yml) Check if local template directory exists for default users
-#  local_action: stat path={{ inventory_dir }}/files/{{ nis_domain}}/homedirs/{{ item.name }}
+# - name: (nis-user-systemfiles.yml) Check if local template directory exists for default users
+#  local_action: stat path={{ inventory_dir }}/files/{{ nis_domain }}/homedirs/{{ item.name }}
 #  with_items: "{{ nis_user }}"
 #  loop_control:
 #    label: '{{ item.name }}'
-#  register: local_template_dir_nis_user
+#  register: common_local_template_dir_nis_user
 
 - name: (nis-user-systemfiles.yml) Check if local template directory exists for default users
   delegate_to: localhost
-  stat:
-    path: "{{ inventory_dir }}/files/{{ nis_domain}}/homedirs/{{ item.name }}"
+  ansible.builtin.stat:
+    path: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/{{ item.name }}"
   with_items: "{{ nis_user }}"
   loop_control:
     label: '{{ item.name }}'
-  register: local_template_dir_nis_user
+  register: common_local_template_dir_nis_user
 
-#- name: Print variable local_template_dir_nis_user
-#  debug: var=local_template_dir_nis_user.results
+# - name: Print variable common_local_template_dir_nis_user
+#  debug: var=common_local_template_dir_nis_user.results
 
-#- meta: end_play
+# - meta: end_play
 
 
-# -- 
-# Copy .profile 
-# --- 
+# --
+# Copy .profile
+# ---
 
 - name: (nis-user-systemfiles.yml) Check if users file '.profile.ORIG' exists
-  stat:
+  ansible.builtin.stat:
     path: "~{{ item.name }}/.profile.ORIG"
-  register: profile_user_orig_exists
+  register: common_profile_user_orig_exists
   loop: "{{ nis_user }}"
   loop_control:
     label: '{{ item.name }}'
@@ -42,12 +42,19 @@
     - profile
 
 - name: (nis-user-systemfiles.yml) Backup existing users .profile file
-  command: cp -a ~{{ item.item.name }}/.profile ~{{ item.item.name }}/.profile.ORIG
-  loop: "{{ profile_user_orig_exists.results }}"
+  ansible.builtin.copy:
+    src: "~{{ item.item.name }}/.profile"
+    dest: "~{{ item.item.name }}/.profile.ORIG"
+    remote_src: true
+    force: false
+    owner: "{{ item.item.name }}"
+    group: "{{ item.item.name }}"
+    mode: "0644"
+  loop: "{{ common_profile_user_orig_exists.results }}"
   loop_control:
     label: '{{ item.item.name }}'
   when:
-    - item.stat.exists == False
+    - not item.stat.exists
   tags:
     - profile
 
@@ -59,7 +66,7 @@
   delegate_to: localhost
   become: false
   loop: "{{ nis_user }}"
-  register: profile_template_stats
+  register: common_profile_template_stats
   loop_control:
     label: "{{ item.name }}"
 
@@ -72,7 +79,7 @@
     group: "{{ user.name }}"
     mode: "0644"
   become: true
-  loop: "{{ nis_user | zip(profile_template_stats.results) | list }}"
+  loop: "{{ nis_user | zip(common_profile_template_stats.results) | list }}"
   loop_control:
     label: "{{ user.name }}"
   when:
@@ -83,16 +90,14 @@
   tags: [bash]
 
 
-
-
 # --
 # Copy .bashrc
 # ---
 
 - name: (nis-user-systemfiles.yml) Check if users file '.bashrc.ORIG' exists
-  stat:
+  ansible.builtin.stat:
     path: "~{{ item.name }}/.bashrc.ORIG"
-  register: bashrc_user_orig_exists
+  register: common_bashrc_user_orig_exists
   loop: "{{ nis_user }}"
   loop_control:
     label: '{{ item.name }}'
@@ -100,11 +105,18 @@
     - bashrc
 
 - name: (nis-user-systemfiles.yml) Backup existing users .bashrc file
-  command: cp -a ~{{ item.item.name }}/.bashrc ~{{ item.item.name }}/.bashrc.ORIG
-  loop: "{{ bashrc_user_orig_exists.results }}"
+  ansible.builtin.copy:
+    src: "~{{ item.item.name }}/.bashrc"
+    dest: "~{{ item.item.name }}/.bashrc.ORIG"
+    remote_src: true
+    force: false
+    owner: "{{ item.item.name }}"
+    group: "{{ item.item.name }}"
+    mode: "0644"
+  loop: "{{ common_bashrc_user_orig_exists.results }}"
   loop_control:
     label: '{{ item.item.name }}'
-  when: item.stat.exists == False
+  when: not item.stat.exists
   tags:
     - bashrc
 
@@ -115,7 +127,7 @@
   delegate_to: localhost
   become: false
   loop: "{{ nis_user }}"
-  register: bashrc_stats
+  register: common_bashrc_stats
   loop_control:
     label: "{{ item.name }}"
 
@@ -128,7 +140,7 @@
     group: "{{ user.name }}"
     mode: "0644"
   become: true
-  loop: "{{ nis_user | zip(bashrc_stats.results) | list }}"
+  loop: "{{ nis_user | zip(common_bashrc_stats.results) | list }}"
   loop_control:
     label: "{{ user.name }}"
   when:
@@ -150,7 +162,7 @@
   delegate_to: localhost
   become: false
   loop: "{{ nis_user }}"
-  register: vimrc_stats
+  register: common_vimrc_stats
   loop_control:
     label: '{{ item.name }}'
 
@@ -162,7 +174,7 @@
     owner: "{{ user.name }}"
     group: "{{ user.name }}"
     mode: '0644'
-  loop: "{{ nis_user | zip(vimrc_stats.results) | list }}"
+  loop: "{{ nis_user | zip(common_vimrc_stats.results) | list }}"
   loop_control:
     label: "{{ user.name }}"
   when:
@@ -181,7 +193,7 @@
   delegate_to: localhost
   become: false
   loop: "{{ nis_user }}"
-  register: dotvim_stats
+  register: common_dotvim_stats
   loop_control:
     label: "{{ item.name }}"
 
@@ -193,7 +205,7 @@
     dest: "~{{ user.name }}/"
     mode: preserve           # oder weglassen; 0644 wäre für Verzeichnisse falsch
   become: true
-  loop: "{{ nis_user | zip(dotvim_stats.results) | list }}"
+  loop: "{{ nis_user | zip(common_dotvim_stats.results) | list }}"
   loop_control:
     label: "{{ user.name }}"
   when:
@@ -213,7 +225,7 @@
     recurse: true
     state: directory
   become: true
-  loop: "{{ nis_user | zip(dotvim_stats.results) | list }}"
+  loop: "{{ nis_user | zip(common_dotvim_stats.results) | list }}"
   loop_control:
     label: "{{ user.name }}"
   when:
@@ -222,4 +234,3 @@
     user: "{{ item.0 }}"
     stat_result: "{{ item.1 }}"
   tags: [vim]
-

roles/common/tasks/nis-user.yml

@@ -33,7 +33,7 @@
 # ---
 
 - name: (nis_user.yml) Ensure nis groups exists
-  group:
+  ansible.builtin.group:
     name: '{{ item.name }}'
     state: present
     gid: '{{ item.group_id | default(omit) }}'
@@ -45,18 +45,19 @@
   tags:
     - nis-user
     - system-user
-    
-#- meta: end_host
+
+# - meta: end_host
 
 - name: (nis_user.yml) Get database of nis (system) users
-  getent:
+  ansible.builtin.getent:
     database: passwd
   tags:
     - nis-user
     - system-user
 
 - name: (nis_user.yml) Add nis (system) users if not yet exists..
-  shell: "/root/bin/admin-stuff/add_new_user.sh {{ item.name }} '{{ item.password }}'"
+  ansible.builtin.command: "/root/bin/admin-stuff/add_new_user.sh {{ item.name }} '{{ item.password }}'"
+  changed_when: true
   loop: "{{ nis_user }}"
   loop_control:
     label: '{{ item.name }}'
@@ -69,17 +70,17 @@
     - system-user
 
 - name: (nis_user.yml) Ensure nis users exists
-  user:
+  ansible.builtin.user:
     name: '{{ item.name }}'
     state: present
     uid: '{{ item.user_id | default(omit) }}'
-    #group: '{{ item.0.name | default(omit) }}'
-    groups: "{{ item.groups|join(', ') }}"
+    # group: '{{ item.0.name | default(omit) }}'
+    groups: "{{ item.groups | join(', ') }}"
     home: '{{ nis_base_home }}/{{ item.name }}'
-    shell: '{{ item.shell|d("/bin/bash") }}'
+    shell: '{{ item.shell | d("/bin/bash") }}'
     password: "{{ item.password | password_hash('sha512') }}"
     update_password: on_create
-    append: yes
+    append: true
   loop: "{{ nis_user }}"
   loop_control:
     label: '{{ item.name }}'
@@ -90,42 +91,42 @@
 
 
 - name: (nis_user.yml) Check if directory ~/.config/autostart exists
-  stat:
+  ansible.builtin.stat:
     path: '{{ nis_base_home }}/{{ item.name }}/.config/autostart'
   loop: "{{ nis_user }}"
   loop_control:
     label: '{{ item.name }}'
-  register: home_config_autostart
+  register: common_home_config_autostart
   tags:
     - nis-user
     - x11vnc
 
 
 - name: (nis_user.yml) Ensure directory ~/.config/autostart if not exists
-  file:
+  ansible.builtin.file:
     path: '{{ nis_base_home }}/{{ item.item.name }}/.config/autostart'
     state: directory
     owner: "{{ item.item.name }}"
     group: "{{ item.item.name }}"
-    mode: 0700
-    recurse: yes
-  loop: "{{ home_config_autostart.results }}"
+    mode: "0700"
+    recurse: true
+  loop: "{{ common_home_config_autostart.results }}"
   loop_control:
     label: '{{ item.item.name }}'
-  when : not item.stat.exists|bool
+  when: not item.stat.exists|bool
   tags:
     - nis-user
     - x11vnc
 
 
-#- name: (nis_user.yml) Ensure directory ~/.config/autostart if not exists
+# - name: (nis_user.yml) Ensure directory ~/.config/autostart if not exists
 #  file:
 #    path: '{{ nis_base_home }}/{{ item.name }}/.config/autostart'
 #    state: directory
 #    owner: "{{ item.name }}"
 #    group: "{{ item.name }}"
-#    mode: 0700
-#    recurse: yes
+#    mode: "0700"
+#    recurse: true
 #  loop: "{{ nis_user }}"
 #  loop_control:
 #    label: '{{ item.name }}'
@@ -135,42 +136,40 @@
 
 
 - name: (nis_user.yml) Check if file ~/.config/autostart/x11vnc.desktop exists
-  stat:
+  ansible.builtin.stat:
     path: '{{ nis_base_home }}/{{ item.name }}/.config/autostart/x11vnc.desktop'
   loop: "{{ nis_user }}"
   loop_control:
     label: '{{ item.name }}'
-  register: home_config_autostart_x11vnc
+  register: common_home_config_autostart_x11vnc
   tags:
     - nis-user
     - x11vnc
 
 - name: (nis_user.yml) Ensure file ~/.config/autostart/x11vnc.desktop exists
-  copy:
+  ansible.builtin.copy:
     src: "{{ role_path + '/files/USER_HOME/.config/autostart/x11vnc.desktop' }}"
     dest: '{{ nis_base_home }}/{{ item.item.name }}/.config/autostart/x11vnc.desktop'
     owner: '{{ item.item.name }}'
     group: '{{ item.item.name }}'
-    mode: 0600
-  loop: "{{ home_config_autostart_x11vnc.results }}"
+    mode: "0600"
+  loop: "{{ common_home_config_autostart_x11vnc.results }}"
   loop_control:
     label: '{{ item.item.name }}'
   tags:
     - nis-user
     - x11vnc
 
-#- name: (nis_user.yml) Ensure file ~/.config/autostart/x11vnc.desktop exists
+# - name: (nis_user.yml) Ensure file ~/.config/autostart/x11vnc.desktop exists
 #  copy:
 #    src: "{{ role_path + '/files/USER_HOME/.config/autostart/x11vnc.desktop' }}"
 #    dest: '{{ nis_base_home }}/{{ item.name }}/.config/autostart/x11vnc.desktop'
 #    owner: '{{ item.name }}'
 #    group: '{{ item.name }}'
-#    mode: 0600
+#    mode: "0600"
 #  loop: "{{ nis_user }}"
 #  loop_control:
 #    label: '{{ item.name }}'
 #  tags:
 #    - nis-user
 #    - x11vnc
-
-

roles/common/tasks/ntp.yml

@@ -5,28 +5,27 @@
 # ---
 
 - name: (ntp.yml) Ensure ntpsec package is installed.
-  apt:
+  ansible.builtin.apt:
     name:
       - ntpsec
     state: present
   when:
     - ansible_facts.os_family == "Debian"
-    - groups['file_server']|string is search(inventory_hostname)
+    - groups['file_server'] | string is search(inventory_hostname)
   tags:
     - ntp-server
 
 - name: (ntp.yml) Check file '/etc/ntpsec/ntp.conf.ORIG' exists
-  stat:
+  ansible.builtin.stat:
     path: /etc/ntpsec/ntp.conf.ORIG
-  register: etc_ntpsec_conf_ORIG
+  register: common_etc_ntpsec_conf_orig
   when:
-    - groups['file_server']|string is search(inventory_hostname)
+    - groups['file_server'] | string is search(inventory_hostname)
   tags:
     - ntp-server
 
-
 - name: (ntp.yml) Ensure directory '/var/log/ntpsec' is present
-  file:
+  ansible.builtin.file:
     path: /var/log/ntpsec
     state: directory
     owner: ntpsec
@@ -37,23 +36,29 @@
 
 
 - name: (ntp.yml) Backup installation version of file '/etc/ntpsec/ntp.conf'
-  command: cp /etc/ntpsec/ntp.conf /etc/ntpsec/ntp.conf.ORIG
+  ansible.builtin.copy:
+    src: /etc/ntpsec/ntp.conf
+    dest: /etc/ntpsec/ntp.conf.ORIG
+    remote_src: true
+    owner: root
+    group: root
+    mode: "0644"
+    force: false
   when:
-    - groups['file_server']|string is search(inventory_hostname)
-    - etc_ntpsec_conf_ORIG.stat.exists == False
+    - groups['file_server'] | string is search(inventory_hostname)
+    - not common_etc_ntpsec_conf_orig.stat.exists
   tags:
     - ntp-server
 
 - name: (ntp.yml) Update '/etc/ntpsec/ntp.conf'
-  template:
+  ansible.builtin.template:
     src: "etc/ntpsec/ntp.conf.j2"
     dest: /etc/ntpsec/ntp.conf
     owner: root
     group: root
-    mode: 0644
+    mode: "0644"
   notify: Restart ntp
   when:
-    - groups['file_server']|string is search(inventory_hostname)
+    - groups['file_server'] | string is search(inventory_hostname)
   tags:
     - ntp-server
-

roles/common/tasks/pure-ftpd-install.yml

@@ -13,40 +13,42 @@
 # Install PureFTP Daemon
 # ---
 
-- include_tasks: pure-ftpd/setup.yml
+- name: (pure-ftpd-install.yml) Include pure-ftpd setup tasks.
+  ansible.builtin.include_tasks: pure-ftpd/setup.yml
 
 
 # ---
 # Configure PureFTP Daemon
 # ---
 
-- include_tasks: pure-ftpd/configure.yml
+- name: (pure-ftpd-install.yml) Include pure-ftpd configure tasks.
+  ansible.builtin.include_tasks: pure-ftpd/configure.yml
 
 
 # ---
 # Authentication Configuration
 # ---
 
-- include_tasks: pure-ftpd/authentication.yml
+- name: (pure-ftpd-install.yml) Include pure-ftpd authentication tasks.
+  ansible.builtin.include_tasks: pure-ftpd/authentication.yml
 
 
 # ---
 # Virtual user
 # ---
 
-- include_tasks: pure-ftpd/virtual-users.yml
+- name: (pure-ftpd-install.yml) Include pure-ftpd virtual user tasks.
+  ansible.builtin.include_tasks: pure-ftpd/virtual-users.yml
 
- 
 # ---
 # TLS Certificate
 # ---
 
-- include_tasks: pure-ftpd/tls-certificate.yml
-
+- name: (pure-ftpd-install.yml) Include pure-ftpd TLS certificate tasks.
+  ansible.builtin.include_tasks: pure-ftpd/tls-certificate.yml
 
 - name: (pure-ftpd-install.yml) Ensure Pure-FTPd service is started enabled on startup.
-  service:
+  ansible.builtin.service:
     name: pure-ftpd
     state: started
-    enabled: yes
-
+    enabled: true

roles/common/tasks/pure-ftpd/authentication.yml

@@ -5,16 +5,16 @@
 # ---
 
 - name: (pure-ftpd-install.yml) Get current authentications.
-  command: ls -1 {{ pureftpd_config_auth_dir }}
-  register: pureftpd_current_auth
+  ansible.builtin.command: ls -1 {{ pureftpd_config_auth_dir }}
+  register: common_pureftpd_current_auth
   changed_when: false
 
 - name: (pure-ftpd-install.yml) Define empty pureftpd_authentications variable.
-  set_fact:
-    pureftpd_authentications: []
+  ansible.builtin.set_fact:
+    common_pureftpd_authentications: []
 
 - name: (pure-ftpd-install.yml) Enable PureDB authentication.
-  file:
+  ansible.builtin.file:
     src: "{{ pureftpd_config_conf_dir }}/PureDB"
     dest: "{{ pureftpd_config_auth_dir }}/{{ pureftpd_auth_puredb }}pure"
     state: link
@@ -22,18 +22,18 @@
   notify: restart Pure-FTPd
 
 - name: (pure-ftpd-install.yml) Add PureDB to Pure-FTPd authentications.
-  set_fact:
-    pureftpd_authentications: "{{ pureftpd_authentications }} + ['{{ pureftpd_auth_puredb }}pure']"
+  ansible.builtin.set_fact:
+    common_pureftpd_authentications: "{{ common_pureftpd_authentications }} + ['{{ pureftpd_auth_puredb }}pure']"
   when: pureftpd_auth_puredb > 0 and pureftpd_config['PureDB'] is defined
 
 - name: (pure-ftpd-install.yml) Add PAM to Pure-FTPd authentications.
-  set_fact:
-    pureftpd_authentications: "{{ pureftpd_authentications }} + ['{{ pureftpd_auth_pam }}pam']"
+  ansible.builtin.set_fact:
+    common_pureftpd_authentications: "{{ common_pureftpd_authentications }} + ['{{ pureftpd_auth_pam }}pam']"
   when: pureftpd_auth_pam > 0 and pureftpd_config['PAMAuthentication'] is defined
 
 
 - name: (pure-ftpd-install.yml) Enable UNIX authentication.
-  file:
+  ansible.builtin.file:
     src: "{{ pureftpd_config_conf_dir }}/UnixAuthentication"
     dest: "{{ pureftpd_config_auth_dir }}/{{ pureftpd_auth_unix }}unix"
     state: link
@@ -41,13 +41,13 @@
   notify: restart Pure-FTPd
 
 - name: (pure-ftpd-install.yml) Add UnixAuthentication to Pure-FTPd authentications.
-  set_fact:
-    pureftpd_authentications: "{{ pureftpd_authentications }} + ['{{ pureftpd_auth_unix }}unix']"
+  ansible.builtin.set_fact:
+    common_pureftpd_authentications: "{{ common_pureftpd_authentications }} + ['{{ pureftpd_auth_unix }}unix']"
   when: pureftpd_auth_unix > 0 and pureftpd_config['UnixAuthentication'] is defined
 
 
 - name: (pure-ftpd-install.yml) Enable PAM authentication.
-  file:
+  ansible.builtin.file:
     src: "{{ pureftpd_config_conf_dir }}/PAMAuthentication"
     dest: "{{ pureftpd_config_auth_dir }}/{{ pureftpd_auth_pam }}pam"
     state: link
@@ -58,9 +58,9 @@
 # Delete unused authentification if exists
 
 - name: (pure-ftpd-install.yml) Delete old authentications.
-  file:
+  ansible.builtin.file:
     path: "{{ pureftpd_config_auth_dir }}/{{ item }}"
     state: absent
-  when: item not in pureftpd_authentications
-  with_items: "{{ pureftpd_current_auth.stdout_lines }}"
+  when: item not in common_pureftpd_authentications
+  with_items: "{{ common_pureftpd_current_auth.stdout_lines }}"
   notify: restart Pure-FTPd

roles/common/tasks/pure-ftpd/configure.yml

@@ -7,7 +7,7 @@
 # Remove old current configurations if exists
 
 - name: Upload Pure-FTPd global configuration file.
-  template:
+  ansible.builtin.template:
     src: etc/default/pure-ftpd-common.j2
     dest: "{{ pureftpd_global_config_file }}"
     owner: root
@@ -16,30 +16,30 @@
   notify: restart Pure-FTPd
 
 - name: (pure-ftpd-install.yml) Compile Pure-FTPd configurations (set fact..).
-  set_fact:
-    pureftpd_config_compiled: "{{ pureftpd_config }}"
+  ansible.builtin.set_fact:
+    common_pureftpd_config_compiled: "{{ pureftpd_config }}"
 
 - name: (pure-ftpd-install.yml) Get current configuration.
-  command: ls -1 {{ pureftpd_config_conf_dir }}
-  register: pureftpd_current_config
+  ansible.builtin.command: ls -1 {{ pureftpd_config_conf_dir }}
+  register: common_pureftpd_current_config
   changed_when: false
 
 - name: (pure-ftpd-install.yml) Delete old configuration.
-  file:
+  ansible.builtin.file:
     path: "{{ pureftpd_config_conf_dir }}/{{ item }}"
     state: absent
-  when: pureftpd_config_compiled[item] is not defined
-  with_items: "{{ pureftpd_current_config.stdout_lines }}"
+  when: common_pureftpd_config_compiled[item] is not defined
+  with_items: "{{ common_pureftpd_current_config.stdout_lines }}"
   notify: restart Pure-FTPd
 
 # write new configuration
 
 - name: (pure-ftpd-install.yml) Write configuration.
-  template:
+  ansible.builtin.template:
     src: etc/pure-ftpd/conf/config.j2
     dest: "{{ pureftpd_config_conf_dir }}/{{ item.key }}"
     owner: root
     group: root
     mode: '0644'
-  with_dict: '{{ pureftpd_config_compiled }}'
+  with_dict: '{{ common_pureftpd_config_compiled }}'
   notify: restart Pure-FTPd

roles/common/tasks/pure-ftpd/create-virtual-ftp-user.yml

@@ -1,34 +1,62 @@
 ---
 
 # ---
-# Add virtual ftp users 
+# Add virtual ftp users
 # ---
 
-- name: "(create-virtual-ftp-user.yml) Verify if virtual ftp user {{ user.name }} exists"
-  command: pure-pw show {{ user.name }}
-  register: pureftpd_virtual_user_exists
-  changed_when: "pureftpd_virtual_user_exists.rc != 0"
-  failed_when: 
-    - "pureftpd_virtual_user_exists.rc != 0"
-    - "pureftpd_virtual_user_exists.rc != 16"
-  ignore_errors: true
+- name: (create-virtual-ftp-user.yml) Verify if virtual ftp user exists for {{ user.name }}
+  ansible.builtin.command: pure-pw show {{ user.name }}
+  register: common_pureftpd_virtual_user_exists
+  changed_when: false
+  failed_when:
+    - common_pureftpd_virtual_user_exists.rc != 0
+    - common_pureftpd_virtual_user_exists.rc != 16
   loop_control:
     label: '{{ user.name }}'
 
-- name: "(create-virtual-ftp-user.yml) Create virtual ftp user {{ user.name }} ."
-  shell: "(echo {{ user.password }}; echo {{ user.password }}) | pure-pw useradd {{ user.name }} -u {{ user.uid | default(pureftpd_virtual_users_user) }} -g {{ user.gid | default(pureftpd_virtual_users_group) }} -d {{ user.homedir }} -n {{ user.quota_files | default('\"\"') }} -N {{ user.quota_size | default('\"\"') }} -t {{ user.bandwidth_dl | default('\"\"') }} -T {{ user.bandwidth_ul | default('\"\"') }} -q {{ user.ratio_ul | default('\"\"') }} -Q {{ user.ratio_dl | default('\"\"') }}"
-  #when: pureftpd_virtual_user_exists.failed is defined and pureftpd_virtual_user_exists.failed
-  when: pureftpd_virtual_user_exists.changed
+- name: (create-virtual-ftp-user.yml) Create virtual ftp user for {{ user.name }}
+  ansible.builtin.shell:
+    cmd: >-
+      set -o pipefail &&
+      (echo {{ user.password }}; echo {{ user.password }}) |
+      pure-pw useradd {{ user.name }}
+      -u {{ user.uid | default(pureftpd_virtual_users_user) }}
+      -g {{ user.gid | default(pureftpd_virtual_users_group) }}
+      -d {{ user.homedir }}
+      -n {{ user.quota_files | default('""') }}
+      -N {{ user.quota_size | default('""') }}
+      -t {{ user.bandwidth_dl | default('""') }}
+      -T {{ user.bandwidth_ul | default('""') }}
+      -q {{ user.ratio_ul | default('""') }}
+      -Q {{ user.ratio_dl | default('""') }}
+    executable: /bin/bash
+  when: common_pureftpd_virtual_user_exists.rc == 16
+  changed_when: true
   notify: reload Pure-FTPd users
 
-- name: "User {{ user.name }}: Update virtual user"
-  command: "pure-pw usermod {{ user.name }} -u {{ user.uid | default(pureftpd_virtual_users_user) }} -g {{ user.gid | default(pureftpd_virtual_users_group) }} -d {{ user.homedir }} -n {{ user.quota_files | default('\"\"') }} -N {{ user.quota_size | default('\"\"') }} -t {{ user.bandwidth_dl | default('\"\"') }} -T {{ user.bandwidth_ul | default('\"\"') }} -q {{ user.ratio_ul | default('\"\"') }} -Q {{ user.ratio_dl | default('\"\"') }}"
-  #when: pureftpd_virtual_user_exists.failed is defined and not pureftpd_virtual_user_exists.failed
-  when: not pureftpd_virtual_user_exists.changed
+- name: (create-virtual-ftp-user.yml) Update virtual ftp user for {{ user.name }}
+  ansible.builtin.command: >-
+    pure-pw usermod {{ user.name }}
+    -u {{ user.uid | default(pureftpd_virtual_users_user) }}
+    -g {{ user.gid | default(pureftpd_virtual_users_group) }}
+    -d {{ user.homedir }}
+    -n {{ user.quota_files | default('""') }}
+    -N {{ user.quota_size | default('""') }}
+    -t {{ user.bandwidth_dl | default('""') }}
+    -T {{ user.bandwidth_ul | default('""') }}
+    -q {{ user.ratio_ul | default('""') }}
+    -Q {{ user.ratio_dl | default('""') }}
+  when: common_pureftpd_virtual_user_exists.rc == 0
+  changed_when: true
   notify: reload Pure-FTPd users
 
-- name: "User {{ user.name }}: Update virtual user password"
-  shell: "(echo {{ user.password }}; echo {{ user.password }}) | pure-pw passwd {{ user.name }}"
-  when: not pureftpd_virtual_user_exists.changed
+- name: (create-virtual-ftp-user.yml) Update virtual ftp user password for {{ user.name }}
+  ansible.builtin.shell:
+    cmd: >-
+      set -o pipefail &&
+      (echo {{ user.password }}; echo {{ user.password }}) |
+      pure-pw passwd {{ user.name }}
+    executable: /bin/bash
+  when: common_pureftpd_virtual_user_exists.rc == 0
+  changed_when: true
   notify: reload Pure-FTPd users
-

roles/common/tasks/pure-ftpd/remove-virtual-user.yml

@@ -1,19 +1,19 @@
 ---
 
 # ---
-# Remove virtual ftp users 
+# Remove virtual ftp users
 # ---
 
-- name: "User {{ user.name }}: Verify if it exists"
-  command: pure-pw show {{ user.name }}
-  register: pureftpd_virtual_user_exists
-  changed_when: "pureftpd_virtual_user_exists.rc == 0"
-  failed_when: 
-    - "pureftpd_virtual_user_exists.rc != 0"
-    - "pureftpd_virtual_user_exists.rc != 16"
-  ignore_errors: true
+- name: (remove-virtual-user.yml) Verify virtual ftp user exists for {{ user.name }}
+  ansible.builtin.command: pure-pw show {{ user.name }}
+  register: common_pureftpd_virtual_user_exists
+  changed_when: false
+  failed_when:
+    - common_pureftpd_virtual_user_exists.rc != 0
+    - common_pureftpd_virtual_user_exists.rc != 16
 
-- name: "User {{ user.name }}: Remove virtual user"
-  shell: "pure-pw userdel {{ user.name }}"
-  when: pureftpd_virtual_user_exists.changed
+- name: (remove-virtual-user.yml) Remove virtual ftp user for {{ user.name }}
+  ansible.builtin.command: pure-pw userdel {{ user.name }}
+  when: common_pureftpd_virtual_user_exists.rc == 0
+  changed_when: true
   notify: reload Pure-FTPd users

roles/common/tasks/pure-ftpd/setup.yml

@@ -1,18 +1,18 @@
 ---
-  
+
 # ---
 # Install PureFTP Daemon
 # ---
 
 - name: (pure-ftpd-install.yml) Ensure Pure-FTPd is installed.
-  apt:
+  ansible.builtin.apt:
     name: "{{ pureftpd_packages }}"
     state: present
     cache_valid_time: 3600
-    update_cache: yes
+    update_cache: true
 
 - name: (pure-ftpd-install.yml) Upload Pure-FTPd global configuration file.
-  template:
+  ansible.builtin.template:
     src: etc/default/pure-ftpd-common.j2
     dest: "{{ pureftpd_global_config_file }}"
     owner: root

roles/common/tasks/pure-ftpd/tls-certificate.yml

@@ -1,40 +1,69 @@
 ---
- 
+
 # ---
 # TLS Certificate
 # ---
 
 # - method 'generate'
 
+- name: Build Pure-FTPd TLS subject.
+  ansible.builtin.set_fact:
+    common_pureftpd_tls_subject: >-
+      /C={{ pureftpd_tls_certificate_openssl.country | default('') }}
+      /ST={{ pureftpd_tls_certificate_openssl.state | default('') }}
+      /L={{ pureftpd_tls_certificate_openssl.locality | default('') }}
+      /O={{ pureftpd_tls_certificate_openssl.organization | default('') }}
+      /OU={{ pureftpd_tls_certificate_openssl.unit | default('') }}
+      /CN={{ pureftpd_tls_certificate_openssl.fqdn }}
+  when:
+    - pureftpd_tls_certificate_method == 'generate'
+    - pureftpd_tls_certificate_openssl | length > 0
+
 - name: Generate Pure-FTPd TLS certificate.
-  command: openssl req -x509 -nodes -newkey rsa:{{ pureftpd_tls_certificate_openssl.size | default(4096) }} -sha256 -days {{ pureftpd_tls_certificate_openssl.days | default(365) }} -keyout {{ pureftpd_tls_certificate_pem }} -out {{ pureftpd_tls_certificate_pem }} -subj "/C={{ pureftpd_tls_certificate_openssl.country | default('') }}/ST={{ pureftpd_tls_certificate_openssl.state | default('') }}/L={{ pureftpd_tls_certificate_openssl.locality | default('') }}/O={{ pureftpd_tls_certificate_openssl.organization | default('') }}/OU={{ pureftpd_tls_certificate_openssl.unit | default('') }}/CN={{ pureftpd_tls_certificate_openssl.fqdn }}"
+  ansible.builtin.command:
+    argv:
+      - openssl
+      - req
+      - -x509
+      - -nodes
+      - -newkey
+      - rsa:{{ pureftpd_tls_certificate_openssl.size | default(4096) }}
+      - -sha256
+      - -days
+      - '{{ pureftpd_tls_certificate_openssl.days | default(365) }}'
+      - -keyout
+      - '{{ pureftpd_tls_certificate_pem }}'
+      - -out
+      - '{{ pureftpd_tls_certificate_pem }}'
+      - -subj
+      - '{{ common_pureftpd_tls_subject }}'
   args:
     creates: "{{ pureftpd_tls_certificate_pem }}"
-  when: 
+  when:
     - pureftpd_tls_certificate_method == 'generate'
     - pureftpd_tls_certificate_openssl | length > 0
   notify: restart Pure-FTPd
 
 - name: Ensure Pure-FTPd TLS certificate permissions.
-  file:
+  ansible.builtin.file:
     path: "{{ pureftpd_tls_certificate_pem }}"
     owner: root
     group: root
     mode: '0600'
     state: file
-  when: 
+  when:
     - pureftpd_tls_certificate_method == 'generate'
     - pureftpd_tls_certificate_openssl | length > 0
 
 # - final checks
 
 - name: (pure-ftpd-install.yml) Verify TLS certificate exists.
-  stat:
+  ansible.builtin.stat:
     path: "{{ pureftpd_tls_certificate_pem }}"
-  register: pureftpd_tls_certificate
+  register: common_pureftpd_tls_certificate
 
 - name: (pure-ftpd-install.yml) Fail when no certificate is found.
-  fail:
+  ansible.builtin.fail:
     msg: |
         The certificate file was not found at {{ pureftpd_tls_certificate_pem }}
-  when: not pureftpd_tls_certificate.stat.exists | default(False)
+  when: not common_pureftpd_tls_certificate.stat.exists | default(false)

roles/common/tasks/pure-ftpd/virtual-users.yml

@@ -3,44 +3,45 @@
 # Default virtual users/group
 
 - name: (pure-ftpd-install.yml) Ensure Pure-FTPd group exists.
-  group:
+  ansible.builtin.group:
     name: "{{ pureftpd_virtual_users_group }}"
     gid: "{{ pureftpd_virtual_users_gid | default(omit) }}"
-    system: no
+    system: false
     state: present
   when: pureftpd_virtual_users | length > 0
 
 - name: (pure-ftpd-install.yml) Ensure Pure-FTPd user exists.
-  user:
+  ansible.builtin.user:
     name: "{{ pureftpd_virtual_users_user }}"
     uid: "{{ pureftpd_virtual_users_uid | default(omit) }}"
     group: "{{ pureftpd_virtual_users_group }}"
     home: /dev/null
     shell: /usr/sbin/nologin
-    system: no
+    system: false
     state: present
   when: pureftpd_virtual_users | length > 0
 
 # user databas
 
 - name: (pure-ftpd-install.yml) Verify virtual users database existence.
-  stat:
+  ansible.builtin.stat:
     path: "{{ pureftpd_config_dir }}/pureftpd.passwd"
-  register: pureftpd_virtual_users_database
+  register: common_pureftpd_virtual_users_database
 
 - name: (pure-ftpd-install.yml) Ensure virtual users database exists.
-  file:
+  ansible.builtin.file:
     path: "{{ pureftpd_config_dir }}/pureftpd.passwd"
     owner: root
     group: root
     mode: '0600'
     state: touch
-  when: (pureftpd_virtual_users | length > 0) and not pureftpd_virtual_users_database.stat.exists | default(False)
+  when: (pureftpd_virtual_users | length > 0) and not common_pureftpd_virtual_users_database.stat.exists | default(false)
 
 
 # - Cretate virtual user
 
-- include_tasks: create-virtual-ftp-user.yml
+- name: (pure-ftpd-install.yml) Include create virtual ftp user task.
+  ansible.builtin.include_tasks: create-virtual-ftp-user.yml
   vars:
     user: "{{ item }}"
   with_items: "{{ pureftpd_virtual_users }}"
@@ -50,7 +51,8 @@
 
 # Remove virtual user
 # -
-- include_tasks: remove-virtual-user.yml
+- name: (pure-ftpd-install.yml) Include remove virtual ftp user task.
+  ansible.builtin.include_tasks: remove-virtual-user.yml
   vars:
     user: "{{ item }}"
   with_items: "{{ pureftpd_virtual_deleted_users }}"

roles/common/tasks/root-files-scripts.yml

@@ -1,51 +1,57 @@
 ---
 
 - name: (root_files_scripts.yml) Ensure directory /root/bin exists
-  file:
+  ansible.builtin.file:
     path: /root/bin
     owner: root
     group: root
     mode: '0700'
     state: directory
   when:
-    - groups['file_server']|string is search(inventory_hostname)
+    - groups['file_server'] | string is search(inventory_hostname)
 
 - name: (root_files_scripts.yml) Ensure script 'wakeup_lan.sh' is present
-  template:
+  ansible.builtin.template:
     src: "{{ role_path + '/files/' + nis_domain + '/root/bin/wakeup_lan.sh' }}"
     dest: /root/bin/wakeup_lan.sh
     owner: root
     group: root
-    mode: 0755
+    mode: "0755"
   when:
-    - groups['file_server']|string is search(inventory_hostname)
+    - groups['file_server'] | string is search(inventory_hostname)
   tags:
     - wakeup_lan
 
 - name: (root_files_scripts.yml) Check file '/etc/motd.ORIG' exists
-  stat:
+  ansible.builtin.stat:
     path: /etc/motd.ORIG
-  register: etc_motd_ORIG
+  register: common_etc_motd_orig
   when:
-    - "groups['file_server']|string is search(inventory_hostname)"
+    - groups['file_server'] | string is search(inventory_hostname)
   tags:
     - etc_motd
 
 - name: (basic.yml) Backup installation version of file '/etc/motd'
-  command: cp -a /etc/motd /etc/motd.ORIG
+  ansible.builtin.copy:
+    src: /etc/motd
+    dest: /etc/motd.ORIG
+    remote_src: true
+    owner: root
+    group: root
+    mode: "0644"
+    force: false
   when:
-    - "groups['file_server']|string is search(inventory_hostname)"
-    - etc_motd_ORIG.stat.exists == False
+    - groups['file_server'] | string is search(inventory_hostname)
+    - not common_etc_motd_orig.stat.exists
   tags:
     - etc_motd
 
-
 - name: (root_files_scripts.yml) Write new '/etc/motd' file..
-  shell: >
+  ansible.builtin.shell: >
     figlet '{{ nis_server_name.split(".")[0] }}' > /etc/motd
+  changed_when: true
   when:
-    - "groups['file_server']|string is search(inventory_hostname)"
-    - etc_motd_ORIG.stat.exists == False
+    - groups['file_server'] | string is search(inventory_hostname)
+    - not common_etc_motd_orig.stat.exists
   tags:
     - etc_motd
-

roles/common/tasks/samba-install.yml

@@ -4,7 +4,7 @@
 # ---
 
 - name: (samba-install.yml) Ensure samba packages server (buster) are installed.
-  package:
+  ansible.builtin.package:
     pkg: "{{ apt_install_server_samba }}"
     state: present
   when:
@@ -13,7 +13,7 @@
     - samba-server
 
 - name: (samba-install.yml) Ensure quarantine directory exists
-  file:
+  ansible.builtin.file:
     path: /data/samba/QUARANTINE
     owner: root
     group: root
@@ -28,13 +28,13 @@
     - samba-virusfilter
 
 - name: (samba-install.yml) Ensure samba share directories exists
-  file:
+  ansible.builtin.file:
     path: "{{ item.path }}"
     owner: "root"
     group: "{{ item.group_write_list }}"
     mode: "{{ item.dir_create_mask | default('2770', true) }}"
     state: directory
-    recurse: no
+    recurse: false
   with_items: "{{ samba_shares }}"
   loop_control:
     label: "{{ item.name }}"
@@ -48,7 +48,7 @@
 # ---
 
 - name: (samba-install.yml) Ensure virusfilter (ClamAV) packages are installed
-  package:
+  ansible.builtin.package:
     pkg: "{{ apt_install_server_samba_virusfilter }}"
     state: present
   when:
@@ -60,12 +60,12 @@
     - samba-virusfilter
 
 - name: (samba-config-server.yml) Check if ClamAV virus databases are present
-  find:
+  ansible.builtin.find:
     paths: /var/lib/clamav
     patterns:
       - "*.cvd"
       - "*.cld"
-  register: clamav_db_files
+  register: common_clamav_db_files
   when:
     - inventory_hostname in groups['samba_server']
     - samba_shares | selectattr('vfs_object_virusfilter', 'defined') | selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0
@@ -74,23 +74,23 @@
     - samba-virusfilter
 
 - name: (samba-config-server.yml) Stop clamav-freshclam service before initial database download
-  service:
+  ansible.builtin.service:
     name: clamav-freshclam
     state: stopped
   failed_when: false
   when:
     - inventory_hostname in groups['samba_server']
     - samba_shares | selectattr('vfs_object_virusfilter', 'defined') | selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0
-    - clamav_db_files.files | length == 0
+    - common_clamav_db_files.files | length == 0
   tags:
     - samba-server
     - samba-virusfilter
 
 - name: (samba-config-server.yml) Ensure clamav-daemon service is started before database update
-  service:
+  ansible.builtin.service:
     name: clamav-daemon
     state: started
-    enabled: yes
+    enabled: true
   failed_when: false
   when:
     - inventory_hostname in groups['samba_server']
@@ -100,20 +100,21 @@
     - samba-virusfilter
 
 - name: (samba-config-server.yml) Download initial ClamAV virus databases via freshclam
-  command: freshclam
+  ansible.builtin.command: freshclam
+  changed_when: true
   when:
     - inventory_hostname in groups['samba_server']
     - samba_shares | selectattr('vfs_object_virusfilter', 'defined') | selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0
-    - clamav_db_files.files | length == 0
+    - common_clamav_db_files.files | length == 0
   tags:
     - samba-server
     - samba-virusfilter
 
 - name: (samba-config-server.yml) Ensure clamav-daemon service is enabled and started
-  service:
+  ansible.builtin.service:
     name: clamav-daemon
     state: started
-    enabled: yes
+    enabled: true
   when:
     - inventory_hostname in groups['samba_server']
     - samba_shares | selectattr('vfs_object_virusfilter', 'defined') | selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0
@@ -122,10 +123,10 @@
     - samba-virusfilter
 
 - name: (samba-config-server.yml) Ensure clamav-freshclam service is enabled and started
-  service:
+  ansible.builtin.service:
     name: clamav-freshclam
     state: started
-    enabled: yes
+    enabled: true
   when:
     - inventory_hostname in groups['samba_server']
     - samba_shares | selectattr('vfs_object_virusfilter', 'defined') | selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0
@@ -134,10 +135,10 @@
     - samba-virusfilter
 
 - name: (samba-install.yml) Ensure clamav user is member of all NIS groups
-  user:
+  ansible.builtin.user:
     name: clamav
     groups: "{{ item.name }}"
-    append: yes
+    append: true
   loop: "{{ nis_groups }}"
   loop_control:
     label: "{{ item.name }}"
@@ -151,10 +152,10 @@
     - samba-virusfilter
 
 - name: (samba-config-server.yml) Ensure clamav user is member of all NIS user groups (homes virusfilter)
-  user:
+  ansible.builtin.user:
     name: clamav
     groups: "{{ item.name }}"
-    append: yes
+    append: true
   loop: "{{ nis_user }}"
   loop_control:
     label: "{{ item.name }}"
@@ -173,7 +174,7 @@
   loop: "{{ nis_user }}"
   loop_control:
     label: "{{ item.name }}"
-  register: samba_user_getent
+  register: common_samba_user_getent
   when:
     - inventory_hostname in groups['samba_server']
     - samba_homes_virusfilter | default(false) | bool
@@ -183,11 +184,11 @@
     - samba-virusfilter
 
 - name: (samba-config-server.yml) Ensure home directories are group-traversable for clamd (homes virusfilter)
-  file:
+  ansible.builtin.file:
     path: "{{ item.ansible_facts.getent_passwd[item.item.name][4] }}"
     mode: "0750"
     state: directory
-  loop: "{{ samba_user_getent.results | default([]) }}"
+  loop: "{{ common_samba_user_getent.results | default([]) }}"
   loop_control:
     label: "{{ item.item.name }}"
   when:
@@ -199,7 +200,7 @@
     - samba-virusfilter
 
 - name: (samba-config-server.yml) Configure AppArmor local profile for clamd (data paths)
-  template:
+  ansible.builtin.template:
     src: etc/apparmor.d/local/usr.sbin.clamd.j2
     dest: /etc/apparmor.d/local/usr.sbin.clamd
     owner: root
@@ -217,7 +218,7 @@
     - samba-virusfilter
 
 - name: (samba-config-server.yml) Ensure AllowAllMatchScan is enabled in clamd.conf
-  lineinfile:
+  ansible.builtin.lineinfile:
     path: /etc/clamav/clamd.conf
     regexp: "^#?\\s*AllowAllMatchScan\\s"
     line: "AllowAllMatchScan true"
@@ -236,29 +237,36 @@
 # ---
 
 - name: (samba-install.yml) Check if file '/etc/samba/smb.conf.ORIG exists'
-  stat:
+  ansible.builtin.stat:
     path: /etc/samba/smb.conf.ORIG
-  register: smb_conf_exists
+  register: common_smb_conf_exists
   when:
     - inventory_hostname in groups['samba_server']
   tags:
     - samba-server
 
 - name: (samba-install.yml) Backup existing file /etc/samba/smb.conf
-  command: cp -a /etc/samba/smb.conf /etc/samba/smb.conf.ORIG
+  ansible.builtin.copy:
+    src: /etc/samba/smb.conf
+    dest: /etc/samba/smb.conf.ORIG
+    remote_src: true
+    owner: root
+    group: root
+    mode: "0644"
+    force: false
   when:
     - inventory_hostname in groups['samba_server']
-    - smb_conf_exists.stat.exists == False
+    - not common_smb_conf_exists.stat.exists
   tags:
     - samba-server
 
 - name: (samba-install.yml) /etc/samba/smb.conf
-  template:
+  ansible.builtin.template:
     dest: /etc/samba/smb.conf
     src: etc/samba/smb.conf.j2
     owner: root
     group: root
-    mode: 644
+    mode: "0644"
   when:
     - inventory_hostname in groups['samba_server']
   notify:
@@ -268,12 +276,12 @@
     - samba-server
 
 - name: (samba-install.yml) Ensure file /etc/samba/users.map exists
-  copy:
+  ansible.builtin.copy:
     src: "{{ role_path + '/files/etc/samba/users.map' }}"
     dest: /etc/samba/users.map
     owner: root
     group: root
-    mode: 644
+    mode: "0644"
   when:
     - inventory_hostname in groups['samba_server']
   notify:
@@ -287,9 +295,9 @@
 # ---
 
 - name: (samba-install.yml) Check if file '/root/bin/samba/clean_samba_trash.sh' exists
-  stat:
+  ansible.builtin.stat:
     path: /root/bin/samba/clean_samba_trash.sh
-  register: clean_samba_trash_exists
+  register: common_clean_samba_trash_exists
   when:
     - inventory_hostname in groups['samba_server']
   tags:
@@ -297,12 +305,15 @@
     - samba-cron
 
 - name: (samba-install.yml) Adjust configuration for script 'clean_samba_trash.sh'
-  template:
+  ansible.builtin.template:
     dest: /root/bin/samba/conf/clean_samba_trash.conf
     src: root/bin/samba/conf/clean_samba_trash.conf.j2
+    owner: root
+    group: root
+    mode: "0644"
   when:
     - inventory_hostname in groups['samba_server']
-    - clean_samba_trash_exists.stat.exists|bool
+    - common_clean_samba_trash_exists.stat.exists | bool
   tags:
     - samba-server
     - samba-cron
@@ -314,7 +325,7 @@
     state: absent
   check_mode: true
   changed_when: false
-  register: clean_samba_trash_dirs
+  register: common_clean_samba_trash_dirs
   when:
     - inventory_hostname in groups['samba_server']
   tags: [samba-server, samba-cron]
@@ -331,8 +342,8 @@
     job: "{{ samba_cronjob_trash_dirs.job }}"
   when:
     - inventory_hostname in groups['samba_server']
-    - clean_samba_trash_exists.stat.exists | bool
-    - (clean_samba_trash_dirs.found | int) > 0
+    - common_clean_samba_trash_exists.stat.exists | bool
+    - (common_clean_samba_trash_dirs.found | int) > 0
   tags: [samba-server, samba-cron]
 
 # ---
@@ -342,7 +353,7 @@
 - name: (samba-config-server.yml) Check if file '/root/bin/samba/set_permissions_samba_shares.sh' exists
   ansible.builtin.stat:
     path: /root/bin/samba/set_permissions_samba_shares.sh
-  register: set_permissions_on_samba_shares_exists
+  register: common_set_permissions_on_samba_shares_exists
   when:
     - inventory_hostname in groups['samba_server']
   tags: [samba-server, samba-cron]
@@ -351,9 +362,12 @@
   ansible.builtin.template:
     dest: /root/bin/samba/conf/set_permissions_samba_shares.conf
     src: root/bin/samba/conf/set_permissions_samba_shares.conf.j2
+    owner: root
+    group: root
+    mode: "0644"
   when:
     - inventory_hostname in groups['samba_server']
-    - set_permissions_on_samba_shares_exists.stat.exists | bool
+    - common_set_permissions_on_samba_shares_exists.stat.exists | bool
   tags: [samba-server, samba-cron]
 
 - name: (samba-config-server.yml) Creates a cron job for setting permissions to samba dirs
@@ -368,7 +382,7 @@
     job: "{{ samba_cronjob_permissions.job }}"
   when:
     - inventory_hostname in groups['samba_server']
-    - (clean_samba_trash_dirs.found | int) > 0 # << int -> bool
+    - (common_clean_samba_trash_dirs.found | int) > 0 # << int -> bool
   tags: [samba-server, samba-cron]
 
 # ---
@@ -376,7 +390,7 @@
 # ---
 
 - name: (samba-install.yml) Ensure samba packages clients are installed.
-  package:
+  ansible.builtin.package:
     pkg: "{{ apt_install_client_samba }}"
     state: present
   when:

roles/common/tasks/samba-remove-user.yml

@@ -6,11 +6,15 @@
 
 
 - name: (samba-remove-user.yml) Check if samba user exists for removable system user
-  shell: pdbedit -w -L | awk -F":" '{ print $1 }' | grep '{{ item.name }}'
-  register: samba_remove_system_users_present
-  changed_when: "samba_remove_system_users_present.rc == 0"
-  failed_when: "samba_remove_system_users_present.rc > 1"
-  with_items: 
+  ansible.builtin.shell:
+    cmd: >-
+      set -o pipefail &&
+      pdbedit -w -L | awk -F":" '{ print $1 }' | grep '{{ item.name }}'
+    executable: /bin/bash
+  register: common_samba_remove_system_users_present
+  changed_when: false
+  failed_when: common_samba_remove_system_users_present.rc > 1
+  with_items:
     - "{{ remove_system_users }}"
   loop_control:
     label: '{{ item.name }}'
@@ -19,23 +23,27 @@
 
 
 - name: (samba-remove-user.yml) Remove (old) system users from samba
-  shell: >
-    smbpasswd -s -x {{ item.item.name }}
-  with_items: 
-    - "{{ samba_remove_system_users_present.results }}"
+  ansible.builtin.command: smbpasswd -s -x {{ item.item.name }}
+  changed_when: true
+  with_items:
+    - "{{ common_samba_remove_system_users_present.results }}"
   loop_control:
     label: '{{ item.item.name }}'
-  when: 
-    - item.changed
+  when:
+    - item.rc == 0
   tags:
     - samba-user
 
 
 - name: (samba-remove-user.yml) Check if samba user exists for removable nis user
-  shell: pdbedit -w -L | awk -F":" '{ print $1 }' | grep '{{ item.name }}'
-  register: samba_remove_nis_users_present
-  changed_when: "samba_remove_nis_users_present.rc == 0"
-  failed_when: "samba_remove_nis_users_present.rc > 1"
+  ansible.builtin.shell:
+    cmd: >-
+      set -o pipefail &&
+      pdbedit -w -L | awk -F":" '{ print $1 }' | grep '{{ item.name }}'
+    executable: /bin/bash
+  register: common_samba_remove_nis_users_present
+  changed_when: false
+  failed_when: common_samba_remove_nis_users_present.rc > 1
   with_items:
     - "{{ remove_nis_users }}"
   loop_control:
@@ -45,13 +53,13 @@
 
 
 - name: (samba-remove-user.yml) Remove (old) nis users from samba
-  shell: >
-    smbpasswd -s -x {{ item.item.name }}
+  ansible.builtin.command: smbpasswd -s -x {{ item.item.name }}
+  changed_when: true
   with_items:
-    - "{{ samba_remove_nis_users_present.results }}"
+    - "{{ common_samba_remove_nis_users_present.results }}"
   loop_control:
     label: '{{ item.item.name }}'
   when:
-    - item.changed
+    - item.rc == 0
   tags:
     - samba-user

roles/common/tasks/samba-user.yml

@@ -5,26 +5,33 @@
 # ---
 
 - name: (samba-user.yml) Check if samba user exists for nis user
-  shell: pdbedit -w -L | awk -F":" '{ print $1 }' | grep -e "^{{ item.name }}"
-  register: samba_nis_user_present
-  changed_when: "samba_nis_user_present.rc == 1"
-  failed_when: "samba_nis_user_present.rc > 1"
+  ansible.builtin.shell:
+    cmd: >-
+      set -o pipefail &&
+      pdbedit -w -L | awk -F":" '{ print $1 }' | grep -e "^{{ item.name }}"
+    executable: /bin/bash
+  register: common_samba_nis_user_present
+  changed_when: false
+  failed_when: common_samba_nis_user_present.rc > 1
   loop: "{{ nis_user }}"
   loop_control:
     label: '{{ item.name }}'
   when:
-    - item.is_samba_user is defined and item.is_samba_user|bool
+    - item.is_samba_user is defined and item.is_samba_user | bool
   tags:
     - samba-user
 
 - name: (samba-user.yml) Add nis user to samba (with nis users password)
-  shell: >
-    (echo '{{ item.item.password }}'; echo '{{ item.item.password }}') 
-    | smbpasswd -s -a {{ item.item.name }}
-  loop: "{{ samba_nis_user_present.results }}"
-  when: item.changed
+  ansible.builtin.shell:
+    cmd: >-
+      set -o pipefail &&
+      (echo '{{ item.item.password }}'; echo '{{ item.item.password }}') |
+      smbpasswd -s -a {{ item.item.name }}
+    executable: /bin/bash
+  changed_when: true
+  loop: "{{ common_samba_nis_user_present.results }}"
+  when: item.rc == 1
   loop_control:
     label: '{{ item.item.name }}'
   tags:
     - samba-user
-

roles/common/tasks/sshd.yml

@@ -6,40 +6,40 @@
 # ---
 
 - name: (sshd.yml) Set fact_sshd_kexalgorithms (comma separated list)
-  set_fact:
-    fact_sshd_kexalgorithms: "{{ sshd_kexalgorithms | join (',') }}"
+  ansible.builtin.set_fact:
+    common_fact_sshd_kexalgorithms: "{{ sshd_kexalgorithms | join(',') }}"
   when:
     - sshd_kexalgorithms is defined and sshd_kexalgorithms | length > 0
   tags:
     - sshd-config
 
 - name: (sshd.yml) Set fact_sshd_ciphers (comma separated list)
-  set_fact:
-    fact_sshd_ciphers: "{{ sshd_ciphers | join (',') }}"
+  ansible.builtin.set_fact:
+    common_fact_sshd_ciphers: "{{ sshd_ciphers | join(',') }}"
   when:
     - sshd_ciphers is defined and sshd_ciphers | length > 0
   tags:
     - sshd-config
 
-- name: (sshd.yml) Set fact_sshd_macs 
-  set_fact:
-    fact_sshd_macs: "{{ sshd_macs | join (',') }}"
+- name: (sshd.yml) Set fact_sshd_macs
+  ansible.builtin.set_fact:
+    common_fact_sshd_macs: "{{ sshd_macs | join(',') }}"
   when:
     - sshd_macs is defined and sshd_macs | length > 0
   tags:
     - sshd-config
 
 - name: (sshd.yml) Set fact_sshd_hostkeyalgorithms (blank separated list)
-  set_fact:
-    fact_sshd_hostkeyalgorithms: "{{ sshd_hostkeyalgorithms | join (',') }}"
+  ansible.builtin.set_fact:
+    common_fact_sshd_hostkeyalgorithms: "{{ sshd_hostkeyalgorithms | join(',') }}"
   when:
     - sshd_hostkeyalgorithms is defined and sshd_hostkeyalgorithms | length > 0
   tags:
     - sshd-config
 
 - name: (sshd.yml) Set fact_sshd_allowed_users (blank separated list)
-  set_fact:
-    fact_sshd_allowed_users: "{{ sshd_allowed_users | join (' ') }}"
+  ansible.builtin.set_fact:
+    common_fact_sshd_allowed_users: "{{ sshd_allowed_users | join(' ') }}"
   when:
     - sshd_allowed_users is defined and sshd_allowed_users | length > 0
   tags:
@@ -50,28 +50,35 @@
 # ---
 
 - name: (sshd.yml) Check file '/etc/ssh/sshd_config.ORIG' exists
-  stat:
+  ansible.builtin.stat:
     path: /etc/ssh/sshd_config.ORIG
-  register: etc_sshd_sshd_config_ORIG
+  register: common_etc_sshd_sshd_config_orig
   tags:
     - sshd-config
 
 - name: (sshd.yml) Backup installation version of file '/etc/ssh/sshd_config'
-  command: cp -a /etc/ssh/sshd_config /etc/ssh/sshd_config.ORIG
-  when: etc_sshd_sshd_config_ORIG.stat.exists == False
+  ansible.builtin.copy:
+    src: /etc/ssh/sshd_config
+    dest: /etc/ssh/sshd_config.ORIG
+    remote_src: true
+    owner: root
+    group: root
+    mode: "0644"
+    force: false
+  when: not common_etc_sshd_sshd_config_orig.stat.exists
   tags:
     - sshd-config
 
 
 - name: (sshd.yml) Create new sshd_config from template sshd_config.j2
-  template:
+  ansible.builtin.template:
     src: etc/ssh/sshd_config.ubuntu.j2
     dest: /etc/ssh/sshd_config
     owner: root
     group: root
-    mode: 0644
+    mode: "0644"
     validate: 'sshd -f %s -T'
-    #backup: yes
+    # backup: yes
   notify: "Restart ssh"
   when:
     - ansible_facts['distribution'] == "Ubuntu"
@@ -80,12 +87,12 @@
 
 
 - name: (sshd.yml) Create/Update new sshd_config from template sshd_config.j2
-  template:
+  ansible.builtin.template:
     src: etc/ssh/sshd_config.j2
     dest: /etc/ssh/sshd_config
     owner: root
     group: root
-    mode: 0644
+    mode: "0644"
     validate: 'sshd -f %s -T'
   notify: "Restart ssh"
   when:
@@ -96,12 +103,12 @@
     - sshd-config
 
 - name: (sshd.yml) Create/Update sshd_config for chrooted sftp_group from template sshd_config.j2
-  template:
+  ansible.builtin.template:
     src: etc/ssh/sshd_config.j2
     dest: /etc/ssh/sshd_config
     owner: root
     group: root
-    mode: 0644
+    mode: "0644"
     validate: 'sshd -f %s -T -C user=sftp_users'
   notify: "Restart ssh"
   when:
@@ -113,21 +120,21 @@
 
 
 - name: (sshd.yml) Check if sshd_config contains activ parameter 'Subsystem sftp'..
-  lineinfile:
+  ansible.builtin.lineinfile:
     path: /etc/ssh/sshd_config
     regexp: '^Subsystem\s+sftp(.+)$'
     state: absent
-  check_mode: yes
+  check_mode: true
   changed_when: false
   register: sshd_config_sftp
   tags:
     - sshd-config
 
 - name: (sshd.yml) Ensure directory '/etc/ssh/sshd_config.d' exists
-  file:
+  ansible.builtin.file:
     path: /etc/ssh/sshd_config.d
     state: directory
-    mode: 0755
+    mode: "0755"
     group: root
     owner: root
   when:
@@ -137,12 +144,12 @@
     - sshd-config
 
 - name: (sshd.yml) Create/Update file '/etc/ssh/sshd_config.d/50-sshd-local.conf' from template sshd_config.j2
-  template:
+  ansible.builtin.template:
     src: etc/ssh/sshd_config.j2
     dest: /etc/ssh/sshd_config.d/50-sshd-local.conf
     owner: root
     group: root
-    mode: 0644
+    mode: "0644"
   notify: "Restart ssh"
   when:
     - ansible_facts['distribution'] == "Debian"

roles/common/tasks/sudoers-pc.yml

@@ -1,28 +1,28 @@
 ---
 
 - name: (sudoers-pc.yml) update specific sudoers configuration files (/etc/sudoers.d/)
-  template:
+  ansible.builtin.template:
     src: etc/sudoers.d/50-user.pc.j2
     dest: /etc/sudoers.d/50-user
     validate: visudo -cf %s
     owner: root
     group: root
-    mode: 0440
+    mode: "0440"
   tags:
     - sudoers-file-configuration
 
 - name: (sudoers-pc.yml) update global sudoers configuration file
-  template:
+  ansible.builtin.template:
     src: etc/sudoers.pc.j2
     dest: /etc/sudoers
     owner: root
     group: root
-    mode: 0440
+    mode: "0440"
     validate: visudo -cf %s
   tags:
     - sudoers-global-configuration
 
-#- name: (sudoers-pc.yml) Ensure all sudo_users are in sudo group
+# - name: (sudoers-pc.yml) Ensure all sudo_users are in sudo group
 #  user:
 #    name: "{{ item }}"
 #    groups: sudo
@@ -32,7 +32,10 @@
 #    - sudo-users
 
 - name: (sudoers-pc.yml) Ensure all sudo_users are in sudo group
-  shell: usermod -a -G sudo "{{ item }}"
+  ansible.builtin.user:
+    name: "{{ item }}"
+    groups: sudo
+    append: true
   with_items: "{{ sudo_pc_users }}"
   tags:
     - sudo-users

roles/common/tasks/sudoers-server.yml

@@ -1,6 +1,6 @@
 ---
 
-#- name: (sudoers-server.yml) include variables
+# - name: (sudoers-server.yml) include variables
 #  include_vars: "{{ item }}"
 #  with_first_found:
 #    - "sudoers-{{ inventory_hostname }}.yml"
@@ -11,47 +11,47 @@
 #    - sudoers-remove
 #    - sudoers-file-configuration
 #    - sudoers-global-configuration
-    
+
 - name: (sudoers-server.yml) Remove user entries in file /etc/sudoers
-  lineinfile:
+  ansible.builtin.lineinfile:
     dest: /etc/sudoers
     state: absent
     regexp: '^{{ item }}'
     owner: root
     group: root
-    mode: 0440
+    mode: "0440"
     validate: visudo -cf %s
   with_items: '{{ sudoers_server_remove_user }}'
   tags:
     - sudoers-remove
 
 - name: (sudoers-server.yml) update specific sudoers configuration files (/etc/sudoers.d/)
-  template:
+  ansible.builtin.template:
     src: etc/sudoers.d/50-user.server.j2
     dest: /etc/sudoers.d/50-user
-    #validate: visudo -cf %s
+    # validate: visudo -cf %s
     owner: root
     group: root
-    mode: 0440
+    mode: "0440"
   tags:
     - sudoers-file-configuration
 
 - name: (sudoers-server.yml) update global sudoers configuration file
-  template:
+  ansible.builtin.template:
     src: etc/sudoers.server.j2
     dest: /etc/sudoers
     owner: root
     group: root
-    mode: 0440
-    #validate: visudo -cf %s
+    mode: "0440"
+    # validate: visudo -cf %s
   tags:
     - sudoers-global-configuration
 
 - name: (sudoers-server.yml) Ensure all sudo_users are in sudo group
-  user:
+  ansible.builtin.user:
     name: "{{ item }}"
     groups: sudo
-    append: yes
+    append: true
   with_items: "{{ sudo_server_users }}"
   tags:
     - sudo-users

roles/common/tasks/system-remove-user.yml

@@ -5,10 +5,10 @@
 # ---
 
 - name: (system-remove-user.yml) Remove (old) users from system
-  user:
+  ansible.builtin.user:
     name: '{{ item.name }}'
     state: absent
-  with_items: 
+  with_items:
     - "{{ remove_nis_users }}"
   loop_control:
     label: '{{ item.name }}'
@@ -17,10 +17,10 @@
     - system-user
 
 - name: (system-remove-user.yml) Remove home directory from deleted users
-  file:
+  ansible.builtin.file:
     path: '{{ nis_base_home }}/{{ item.name }}'
     state: absent
-  with_items: 
+  with_items:
     - "{{ remove_nis_users }}"
   loop_control:
     label: '{{ item.name }}'

roles/common/tasks/system-user-systemfiles.yml

@@ -6,16 +6,22 @@
 
 # system_user
 - name: (system-user-systemfiles.yml) Check if local template directory exists for default users
-  local_action: stat path={{ inventory_dir }}/files/{{ nis_domain }}/homedirs/{{ item.name }}
+  ansible.builtin.stat:
+    path: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/{{ item.name }}"
+  delegate_to: localhost
+  become: false
   with_items: "{{ system_users }}"
   loop_control:
     label: '{{ item.name }}'
-  register: local_template_dir_system_users
+  register: common_local_template_dir_system_users
 
 # root
 - name: (system-user-systemfiles.yml) Check if local template directory exists for root
-  local_action: stat path={{ inventory_dir }}/files/{{ nis_domain }}/homedirs/root
-  register: local_template_dir_root
+  ansible.builtin.stat:
+    path: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/root"
+  delegate_to: localhost
+  become: false
+  register: common_local_template_dir_root
 
 
 # --
@@ -23,9 +29,9 @@
 # ---
 
 - name: (user-systemfiles.yml) Check if users file '.profile.ORIG' exists
-  stat:
+  ansible.builtin.stat:
     path: "~{{ item.name }}/.profile.ORIG"
-  register: profile_user_orig_exists
+  register: common_profile_user_orig_exists
   loop: "{{ system_users }}"
   loop_control:
     label: '{{ item.name }}'
@@ -33,12 +39,19 @@
     - profile
 
 - name: (user-systemfiles.yml) Backup existing users .profile file
-  command: cp -a ~{{ item.item.name }}/.profile ~{{ item.item.name }}/.profile.ORIG
-  loop: "{{ profile_user_orig_exists.results }}"
+  ansible.builtin.copy:
+    src: "~{{ item.item.name }}/.profile"
+    dest: "~{{ item.item.name }}/.profile.ORIG"
+    remote_src: true
+    owner: "{{ item.item.name }}"
+    group: "{{ item.item.name }}"
+    mode: "0644"
+    force: false
+  loop: "{{ common_profile_user_orig_exists.results }}"
   loop_control:
     label: '{{ item.item.name }}'
   when:
-    - item.stat.exists == False
+    - not item.stat.exists
   tags:
     - profile
 
@@ -49,17 +62,17 @@
   delegate_to: localhost
   become: false
   loop: "{{ default_user }}"
-  register: profile_stats
+  register: common_profile_stats
   loop_control:
     label: "{{ item.name }}"
 
 # 2) Prüfe ob eine lokale default _baschrc existiert
-- name: stat DEFAULT _profile
+- name: Stat DEFAULT _profile
   ansible.builtin.stat:
     path: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/DEFAULT/_profile"
   delegate_to: localhost
   become: false
-  register: default_profile_stat
+  register: common_default_profile_stat
 
 # 2) Falls User _profile vorhanden, kopieren
 - name: (system-user-systemfiles.yml) copy .profile if it exists
@@ -70,7 +83,7 @@
     group: "{{ user.name }}"
     mode: "0644"
   become: true
-  loop: "{{ default_user | zip(profile_stats.results) | list }}"
+  loop: "{{ default_user | zip(common_profile_stats.results) | list }}"
   loop_control:
     label: "{{ user.name }}"
   when:
@@ -89,12 +102,12 @@
     group: "{{ user.name }}"
     mode: "0644"
   become: true
-  loop: "{{ default_user | zip(profile_stats.results) | list }}"
+  loop: "{{ default_user | zip(common_profile_stats.results) | list }}"
   loop_control:
     label: "{{ user.name }}"
   when:
     - not stat_result.stat.exists
-    - default_profile_stat.stat.exists | bool
+    - common_default_profile_stat.stat.exists | bool
   vars:
     user: "{{ item.0 }}"
     stat_result: "{{ item.1 }}"
@@ -105,15 +118,22 @@
 # ---
 
 - name: (system-user-systemfiles.yml) Check if file '/root/.profile.ORIG' exists
-  stat:
+  ansible.builtin.stat:
     path: /root/.profile.ORIG
-  register: profile_root_orig_exists
+  register: common_profile_root_orig_exists
   tags:
     - bash
 
 - name: (system-user-systemfiles.yml) Backup /root/.profile file
-  command: cp /root/.profile /root/.profile.ORIG
-  when: profile_root_orig_exists.stat.exists == False
+  ansible.builtin.copy:
+    src: /root/.profile
+    dest: /root/.profile.ORIG
+    remote_src: true
+    owner: root
+    group: root
+    mode: "0644"
+    force: false
+  when: not common_profile_root_orig_exists.stat.exists
   tags:
     - bash
 
@@ -123,10 +143,10 @@
     path: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/root/_profile"
   delegate_to: localhost
   become: false
-  register: profile_root_stat
+  register: common_profile_root_stat
 
 # 2) Wenn vorhanden, kopieren wir sie nach /root/.profile auf dem Zielhost
-- name: copy root .profile if it exists
+- name: Copy root .profile if it exists
   ansible.builtin.copy:
     src: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/root/_profile"
     dest: /root/.profile
@@ -134,7 +154,7 @@
     group: root
     mode: '0644'
   become: true
-  when: profile_root_stat.stat.exists
+  when: common_profile_root_stat.stat.exists
   tags:
     - bash
 
@@ -144,9 +164,9 @@
 # ---
 
 - name: (system-user-systemfiles.yml) Check if users file '.bashrc.ORIG' exists
-  stat:
+  ansible.builtin.stat:
     path: "~{{ item.name }}/.bashrc.ORIG"
-  register: bashrc_user_orig_exists
+  register: common_bashrc_user_orig_exists
   loop: "{{ system_users }}"
   loop_control:
     label: '{{ item.name }}'
@@ -154,11 +174,18 @@
     - bashrc
 
 - name: (system-user-systemfiles.yml) Backup existing users .bashrc file
-  command: cp -a ~{{ item.item.name }}/.bashrc ~{{ item.item.name }}/.bashrc.ORIG
-  loop: "{{ bashrc_user_orig_exists.results }}"
+  ansible.builtin.copy:
+    src: "~{{ item.item.name }}/.bashrc"
+    dest: "~{{ item.item.name }}/.bashrc.ORIG"
+    remote_src: true
+    owner: "{{ item.item.name }}"
+    group: "{{ item.item.name }}"
+    mode: "0644"
+    force: false
+  loop: "{{ common_bashrc_user_orig_exists.results }}"
   loop_control:
     label: '{{ item.item.name }}'
-  when: item.stat.exists == False
+  when: not item.stat.exists
   tags:
     - bashrc
 
@@ -169,17 +196,17 @@
   delegate_to: localhost
   become: false
   loop: "{{ default_user }}"
-  register: bashrc_stats
+  register: common_bashrc_stats
   loop_control:
     label: "{{ item.name }}"
 
 # 2) Prüfe ob eine lokale default _baschrc existiert
-- name: stat DEFAULT _bashrc
+- name: Stat DEFAULT _bashrc
   ansible.builtin.stat:
     path: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/DEFAULT/_bashrc"
   delegate_to: localhost
   become: false
-  register: default_bashrc_stat
+  register: common_default_bashrc_stat
 
 # 2) Falls User _bashrc vorhanden, kopieren
 - name: (system-user-systemfiles.yml) copy .bashrc if it exists
@@ -190,7 +217,7 @@
     group: "{{ user.name }}"
     mode: "0644"
   become: true
-  loop: "{{ default_user | zip(bashrc_stats.results) | list }}"
+  loop: "{{ default_user | zip(common_bashrc_stats.results) | list }}"
   loop_control:
     label: "{{ user.name }}"
   when:
@@ -209,12 +236,12 @@
     group: "{{ user.name }}"
     mode: "0644"
   become: true
-  loop: "{{ default_user | zip(bashrc_stats.results) | list }}"
+  loop: "{{ default_user | zip(common_bashrc_stats.results) | list }}"
   loop_control:
     label: "{{ user.name }}"
   when:
     - not stat_result.stat.exists
-    - default_bashrc_stat.stat.exists | bool
+    - common_default_bashrc_stat.stat.exists | bool
   vars:
     user: "{{ item.0 }}"
     stat_result: "{{ item.1 }}"
@@ -225,28 +252,35 @@
 # ---
 
 - name: (system-user-systemfiles.yml) Check if file '/root/.bashrc.ORIG' exists
-  stat:
+  ansible.builtin.stat:
     path: /root/.bashrc.ORIG
-  register: bashrc_root_orig_exists
+  register: common_bashrc_root_orig_exists
   tags:
     - bash
 
 - name: (system-user-systemfiles.yml) Backup /root/.bashrc file
-  command: cp /root/.bashrc /root/.bashrc.ORIG
-  when: bashrc_root_orig_exists.stat.exists == False
+  ansible.builtin.copy:
+    src: /root/.bashrc
+    dest: /root/.bashrc.ORIG
+    remote_src: true
+    owner: root
+    group: root
+    mode: "0644"
+    force: false
+  when: not common_bashrc_root_orig_exists.stat.exists
   tags:
     - bash
 
 # 1) Prüfen ob die _bashrc für root auf dem Control-Node existiert
-- name: stat root _bashrc on control node
+- name: Stat root _bashrc on control node
   ansible.builtin.stat:
     path: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/root/_bashrc"
   delegate_to: localhost
   become: false
-  register: bashrc_root_stat
+  register: common_bashrc_root_stat
 
 # 2) Wenn vorhanden, kopieren wir sie nach /root/.bashrc auf dem Zielhost
-- name: copy root .bashrc if it exists
+- name: Copy root .bashrc if it exists
   ansible.builtin.copy:
     src: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/root/_bashrc"
     dest: /root/.bashrc
@@ -254,7 +288,7 @@
     group: root
     mode: '0644'
   become: true
-  when: bashrc_root_stat.stat.exists
+  when: common_bashrc_root_stat.stat.exists
   tags:
     - bash
 
@@ -269,19 +303,19 @@
   delegate_to: localhost
   become: false
   loop: "{{ default_user }}"
-  register: vimrc_stats
+  register: common_vimrc_stats
   loop_control:
     label: '{{ item.name }}'
 
 # 2. Falls vorhanden, Datei kopieren
-- name: (system-user-systemfiles.yml) copy .vimrc if it exists
+- name: (system-user-systemfiles.yml) Copy .vimrc if it exists
   ansible.builtin.copy:
     src: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/{{ user.name }}/_vimrc"
     dest: "~{{ user.name }}/.vimrc"
     owner: "{{ user.name }}"
     group: "{{ user.name }}"
     mode: '0644'
-  loop: "{{ default_user | zip(vimrc_stats.results) | list }}"
+  loop: "{{ default_user | zip(common_vimrc_stats.results) | list }}"
   loop_control:
     label: "{{ user.name }}"
   when:
@@ -300,7 +334,7 @@
   delegate_to: localhost
   become: false
   loop: "{{ default_user }}"
-  register: dotvim_stats
+  register: common_dotvim_stats
   loop_control:
     label: "{{ item.name }}"
 
@@ -312,7 +346,7 @@
     dest: "~{{ user.name }}/"
     mode: preserve           # oder weglassen; 0644 wäre für Verzeichnisse falsch
   become: true
-  loop: "{{ default_user | zip(dotvim_stats.results) | list }}"
+  loop: "{{ default_user | zip(common_dotvim_stats.results) | list }}"
   loop_control:
     label: "{{ user.name }}"
   when:
@@ -332,7 +366,7 @@
     recurse: true
     state: directory
   become: true
-  loop: "{{ default_user | zip(dotvim_stats.results) | list }}"
+  loop: "{{ default_user | zip(common_dotvim_stats.results) | list }}"
   loop_control:
     label: "{{ user.name }}"
   when:
@@ -353,10 +387,10 @@
     path: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/root/_vimrc"
   delegate_to: localhost
   become: false
-  register: vimrc_root_stat
+  register: common_vimrc_root_stat
 
 # 2) Wenn vorhanden, kopieren wir sie nach /root/.vimrc auf dem Zielhost
-- name: (system-user-systemfiles.yml)copy root .vimrc if it exists
+- name: (system-user-systemfiles.yml) Copy root .vimrc if it exists
   ansible.builtin.copy:
     src: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/root/_vimrc"
     dest: /root/.vimrc
@@ -365,17 +399,17 @@
     mode: '0644'
   become: true
   when:
-    - vimrc_root_stat.stat.exists
+    - common_vimrc_root_stat.stat.exists
   tags:
     - bash
 
- # 1) Lokal prüfen, ob ./files/{{ nis_domain }}/homedirs/root/.vim existiert
+# 1) Lokal prüfen, ob ./files/{{ nis_domain }}/homedirs/root/.vim existiert
 - name: (system-user-systemfiles.yml) stat local .vim for root
   ansible.builtin.stat:
     path: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/root/.vim"
   delegate_to: localhost
   become: false
-  register: root_dotvim_stat
+  register: common_root_dotvim_stat
   tags: [vim]
 
 
@@ -387,11 +421,11 @@
     mode: preserve         # oder weglassen; nicht 0644 bei Verzeichnissen
   become: true
   when:
-    - root_dotvim_stat.stat.exists | bool
+    - common_root_dotvim_stat.stat.exists | bool
   tags: [vim]
 
 # 2) Wenn vorhanden, nach /root/ kopieren
-#- name: (system-user-systemfiles.yml) rsync root .vim if it exists
+# - name: (system-user-systemfiles.yml) rsync root .vim if it exists
 #  ansible.posix.synchronize:
 #    src: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/root/.vim/"
 #    dest: "/root/.vim/"
@@ -400,7 +434,7 @@
 #    rsync_path: "sudo -n rsync"   # -n = kein Passwort-Prompt; erfordert NOPASSWD
 #  delegate_to: localhost
 #  when:
-#    - root_dotvim_stat.stat.exists | bool
+#    - common_root_dotvim_stat.stat.exists | bool
 #  tags: [vim]
 
 # 3) Ownership sicherstellen (rekursiv)
@@ -413,5 +447,5 @@
     state: directory
   become: true
   when:
-    - root_dotvim_stat.stat.exists | bool
+    - common_root_dotvim_stat.stat.exists | bool
   tags: [vim]

roles/common/tasks/system-user.yml

@@ -5,10 +5,10 @@
 # ---
 
 - name: (user.yml) Remove (old) users from system
-  user:
+  ansible.builtin.user:
     name: '{{ item.name }}'
     state: absent
-  with_items: 
+  with_items:
     - "{{ remove_system_users }}"
   loop_control:
     label: '{{ item.name }}'
@@ -16,10 +16,10 @@
     - system-user
 
 - name: (user.yml) Remove home directory from deleted users
-  file:
+  ansible.builtin.file:
     path: '{{ base_home }}/{{ item.name }}'
     state: absent
-  with_items: 
+  with_items:
     - "{{ remove_system_users }}"
   loop_control:
     label: '{{ item.name }}'
@@ -31,7 +31,7 @@
 # ---
 
 - name: (user.yml) Ensure system groups exists
-  group:
+  ansible.builtin.group:
     name: '{{ item.name }}'
     state: present
     gid: '{{ item.group_id | default(omit) }}'
@@ -42,17 +42,17 @@
   notify: Renew nis databases
   tags:
     - system-user
-    
-#- meta: end_host
+
+# - meta: end_host
 
 - name: (system-user.yml) Get database of nis (system) users
-  getent:
+  ansible.builtin.getent:
     database: passwd
   tags:
     - system-user
-
 - name: (system-user.yml) Add (system) users if not yet exists..
-  shell: "/root/bin/admin-stuff/add_new_user.sh {{ item.name }} '{{ item.password }}'"
+  ansible.builtin.command: "/root/bin/admin-stuff/add_new_user.sh {{ item.name }} '{{ item.password }}'"
+  changed_when: true
   loop: "{{ system_users }}"
   loop_control:
     label: '{{ item.name }}'
@@ -62,4 +62,3 @@
   notify: Renew nis databases
   tags:
     - system-user
-

roles/common/tasks/systemd-resolved.yml

@@ -4,79 +4,73 @@
 # Set some facts
 # ---
 
-- name: (systemd-resolved.yml) Set fact_resolved_nameserver (blank separated list)
-  set_fact:
-    fact_resolved_nameserver: "{{ resolved_nameserver | join (' ') }}"
+- name: (systemd-resolved.yml) Set common_fact_resolved_nameserver (blank separated list)
+  ansible.builtin.set_fact:
+    common_fact_resolved_nameserver: "{{ resolved_nameserver | join(' ') }}"
   when:
     - resolved_nameserver is defined and resolved_nameserver | length > 0
   tags:
     - systemd-resolved
 
-- name: (systemd-resolved.yml) Set fact_resolved_fallback_nameserver (blank separated list)
-  set_fact:
-    fact_resolved_fallback_nameserver: "{{ resolved_fallback_nameserver | join (' ') }}"
+- name: (systemd-resolved.yml) Set common_fact_resolved_fallback_nameserver (blank separated list)
+  ansible.builtin.set_fact:
+    common_fact_resolved_fallback_nameserver: "{{ resolved_fallback_nameserver | join(' ') }}"
   when:
     - resolved_fallback_nameserver is defined and resolved_fallback_nameserver | length > 0
   tags:
     - systemd-resolved
 
-- name: (systemd-resolved.yml) Set fact_resolved_domains (blank separated list)
-  set_fact:
-    fact_resolved_domains: "{{ resolved_domains | join (' ') }}"
+- name: (systemd-resolved.yml) Set common_fact_resolved_domains (blank separated list)
+  ansible.builtin.set_fact:
+    common_fact_resolved_domains: "{{ resolved_domains | join(' ') }}"
   when:
     - resolved_domains is defined and resolved_domains | length > 0
   tags:
     - systemd-resolved
 
-
-
 # ---
 # Install/Enable systemd-resolved package
 # ---
 
-- name: (systemd-resolved.yml) Ensure  systemd-resolved package is installed.
-  package:
+- name: (systemd-resolved.yml) Ensure systemd-resolved package is installed.
+  ansible.builtin.package:
     pkg: systemd-resolved
     state: present
   when:
-    - systemd_resolved is defined and systemd_resolved|bool
+    - systemd_resolved is defined and systemd_resolved | bool
   tags:
     - systemd-resolved
 
-- name: (systemd-services.yml) Enable service
-  systemd:
+- name: (systemd-services.yml) Enable systemd-resolved service
+  ansible.builtin.systemd:
     name: systemd-resolved
     enabled: true
   when:
-    - systemd_resolved is defined and systemd_resolved|bool
+    - systemd_resolved is defined and systemd_resolved | bool
   tags:
     - systemd-resolved
 
-
-
 # ---
 # Create configuration for systemd-resolved
 # ---
 
 - name: (systemd-resolved.yml) Ensure directory '/etc/systemd/resolved.conf.d' exists
-  file:
+  ansible.builtin.file:
     path: /etc/systemd/resolved.conf.d
     state: directory
-    mode: 0755
+    mode: "0755"
     group: root
     owner: root
 
-- name: (systemd-resolved.yml) Create/Update file '/etc/systemd/resolved.conf.d/50-resolved-local.conf' from template sshd_config.j2
-  template:
+- name: (systemd-resolved.yml) Create/update file '/etc/systemd/resolved.conf.d/50-resolved-local.conf'
+  ansible.builtin.template:
     src: etc/systemd/resolved.conf.d/50-resolved-local.conf
     dest: /etc/systemd/resolved.conf.d/50-resolved-local.conf
     owner: root
     group: root
-    mode: 0644
+    mode: "0644"
 
-- name: Restart  systemd-resolved service
+- name: (systemd-resolved.yml) Restart systemd-resolved service
   ansible.builtin.service:
     name: systemd-resolved
     state: restarted
-
-

roles/common/tasks/ubuntu-x11vnc-1604-amd64.yml

@@ -1,55 +1,62 @@
 ---
-  # Title: app-x11vnc-server
-  #
-  # Author: Luc Rutten
-  # Version: 1.0
-  # File: tasks/main.yml
-  #
-  # Description:
-  #   Remote support
-  #
-  # Source:
-  #   - http://c-nergy.be/blog/?p=8984
+# Title: app-x11vnc-server
+#
+# Author: Luc Rutten
+# Version: 1.0
+# File: tasks/main.yml
+#
+# Description:
+#   Remote support
+#
+# Source:
+#   - http://c-nergy.be/blog/?p=8984
 
-  - name: "(ubuntu-x11vnc-1604-amd64.yml) check if x11vnc is already installed, if not found skipping...."
-    stat:
-      path: /usr/bin/x11vnc
-    register: x11vnc_active
- 
-  - name: "(ubuntu-x11vnc-1604-amd64.yml) Install packages"
-    apt:
-      name: ['x11vnc']
-      update_cache: yes
-      state: present
-    when: x11vnc_active.stat.exists == False
+- name: "(ubuntu-x11vnc-1604-amd64.yml) Check if x11vnc is already installed, if not found skipping...."
+  ansible.builtin.stat:
+    path: /usr/bin/x11vnc
+  register: common_x11vnc_active
 
-  - name: "(ubuntu-x11vnc-1604-amd64.yml) Store password"
-    shell: "x11vnc -storepasswd {{ vnc_password }} /etc/x11vnc.pass"
+- name: "(ubuntu-x11vnc-1604-amd64.yml) Install packages"
+  ansible.builtin.apt:
+    name: ['x11vnc']
+    update_cache: true
+    state: present
+  when: not common_x11vnc_active.stat.exists
 
-  - name: "(ubuntu-x11vnc-1604-amd64.yml) Set permissions on /etc/x11vnc.pass"
-    file:
-     path: /etc/x11vnc.pass
-     mode: 0644
+- name: "(ubuntu-x11vnc-1604-amd64.yml) Store password"
+  ansible.builtin.command: x11vnc -storepasswd {{ vnc_password }} /etc/x11vnc.pass
+  changed_when: true
 
-  - name: "(ubuntu-x11vnc-1604-amd64.yml) Transfer x11vnc.service.j2 to /lib/systemd/system/x11vnc.service"
-    template:
-      src: lib/systemd/system/x11vnc.service.j2
-      dest: /lib/systemd/system/x11vnc.service
+- name: "(ubuntu-x11vnc-1604-amd64.yml) Set permissions on /etc/x11vnc.pass"
+  ansible.builtin.file:
+    path: /etc/x11vnc.pass
+    owner: root
+    group: root
+    mode: "0644"
+    state: file
+
+- name: "(ubuntu-x11vnc-1604-amd64.yml) Transfer x11vnc.service.j2 to /lib/systemd/system/x11vnc.service"
+  ansible.builtin.template:
+    src: lib/systemd/system/x11vnc.service.j2
+    dest: /lib/systemd/system/x11vnc.service
+    owner: root
+    group: root
+    mode: "0644"
 
 #  - name: "(ubuntu-x11vnc-1604-amd64.yml) Start x11vnc service"
 #    shell: service x11vnc start
 
-  - name: (ubuntu-x11vnc-1604-amd64.yml) Start x11vnc service
-    service:
-      name: x11vnc
-      state: started
+- name: (ubuntu-x11vnc-1604-amd64.yml) Start x11vnc service
+  ansible.builtin.service:
+    name: x11vnc
+    state: started
 
-  - name: "(ubuntu-x11vnc-1604-amd64.yml) Enable x11vnc service on boot"
-    systemd:
-      name: x11vnc.service
-      daemon_reload: yes
-      enabled: yes
-      state: started
+- name: "(ubuntu-x11vnc-1604-amd64.yml) Enable x11vnc service on boot"
+  ansible.builtin.systemd:
+    name: x11vnc.service
+    daemon_reload: true
+    enabled: true
+    state: started
 
 #  - name: "(ubuntu-x11vnc-1604-amd64.yml) Blocks x11vnc in GreenOS Desktop Environment for enduser "
 #    file:
@@ -57,4 +64,3 @@
 #      mode: 0740
 #      owner: root
 #      group: administrator
-

roles/common/tasks/ubuntu-x11vnc-1804-amd64.yml

@@ -1,61 +1,68 @@
 ---
-  # Title: app-x11vnc-server
-  #
-  # Author: Luc Rutten
-  # Version: 1.0
-  # File: tasks/main.yml
-  #
-  # Description:
-  #   Remote support
-  #
-  # Source:
-  #   - http://c-nergy.be/blog/?p=8984
+# Title: app-x11vnc-server
+#
+# Author: Luc Rutten
+# Version: 1.0
+# File: tasks/main.yml
+#
+# Description:
+#   Remote support
+#
+# Source:
+#   - http://c-nergy.be/blog/?p=8984
 
-  - name: "(ubuntu-x11vnc-1804-amd64.yml) Install packages"
-    apt:
-      name: "{{ packages }}"
-      update_cache: yes
-      state: present
-    vars:
-      packages:
-        - x11vnc
+- name: "(ubuntu-x11vnc-1804-amd64.yml) Install packages"
+  ansible.builtin.apt:
+    name: "{{ packages }}"
+    update_cache: true
+    state: present
+  vars:
+    packages:
+      - x11vnc
 
-  - name: "(ubuntu-x11vnc-1804-amd64.yml) get numeric id for group 'gdm'"
-    shell: echo "$(id -u gdm)"
-    register: grp_id_gdm
+- name: "(ubuntu-x11vnc-1804-amd64.yml) Get numeric id for group 'gdm'"
+  ansible.builtin.command: id -u gdm
+  register: common_grp_id_gdm
+  changed_when: false
 
-  - name: Check if file '/etc/gdm3/custom.conf' exists
-    stat:
-      path: /etc/gdm3/custom.conf
-    register: etc_gdm_custom_conf_exists
+- name: Check if file '/etc/gdm3/custom.conf' exists
+  ansible.builtin.stat:
+    path: /etc/gdm3/custom.conf
+  register: common_etc_gdm_custom_conf_exists
 
-  - name: Adjust file '/etc/gdm3/custom.conf'
-    lineinfile:
-      dest: /etc/gdm3/custom.conf
-      state: present
-      regexp: '^WaylandEnable'
-      line: 'WaylandEnable=false'
-      insertafter: '^#?\s*WaylandEnable'
-    when:
-      - etc_gdm_custom_conf_exists.stat.exists
+- name: Adjust file '/etc/gdm3/custom.conf'
+  ansible.builtin.lineinfile:
+    dest: /etc/gdm3/custom.conf
+    state: present
+    regexp: '^WaylandEnable'
+    line: 'WaylandEnable=false'
+    insertafter: '^#?\s*WaylandEnable'
+  when:
+    - common_etc_gdm_custom_conf_exists.stat.exists
 
-  - name: "(ubuntu-x11vnc-1804-amd64.yml) Store password"
-    raw: "x11vnc -storepasswd {{ vnc_password }} /etc/x11vnc.pass"
+- name: "(ubuntu-x11vnc-1804-amd64.yml) Store password"
+  ansible.builtin.command: x11vnc -storepasswd {{ vnc_password }} /etc/x11vnc.pass
+  changed_when: true
 
-  - name: "(ubuntu-x11vnc-1804-amd64.yml) Set permissions on /etc/x11vnc.pass"
-    file:
-     path: "/etc/x11vnc.pass"
-     mode: 0644
+- name: "(ubuntu-x11vnc-1804-amd64.yml) Set permissions on /etc/x11vnc.pass"
+  ansible.builtin.file:
+    path: /etc/x11vnc.pass
+    owner: root
+    group: root
+    mode: "0644"
+    state: file
 
-  - name: "(ubuntu-x11vnc-1804-amd64.yml) Transfer x11vnc.service.j2 to /lib/systemd/system/x11vnc.service"
-    template:
-      src: lib/systemd/system/x11vnc-gdm3.service-ALT.j2
-      dest: /lib/systemd/system/x11vnc.service
-
-  - name: "(ubuntu-x11vnc-1804-amd64.yml) Enable service"
-    systemd:
-      name: x11vnc.service
-      daemon_reload: yes
-      enabled: yes
-      state: restarted
+- name: "(ubuntu-x11vnc-1804-amd64.yml) Transfer x11vnc.service.j2 to /lib/systemd/system/x11vnc.service"
+  ansible.builtin.template:
+    src: lib/systemd/system/x11vnc-gdm3.service-ALT.j2
+    dest: /lib/systemd/system/x11vnc.service
+    owner: root
+    group: root
+    mode: "0644"
 
+- name: "(ubuntu-x11vnc-1804-amd64.yml) Enable service"
+  ansible.builtin.systemd:
+    name: x11vnc.service
+    daemon_reload: true
+    enabled: true
+    state: restarted

roles/common/tasks/ubuntu-x11vnc-2004-amd64.yml

@@ -1,66 +1,71 @@
 ---
-  # Title: app-x11vnc-server
-  #
-  # Author: Luc Rutten
-  # Version: 1.0
-  # File: tasks/main.yml
-  #
-  # Description:
-  #   Remote support
-  #
-  # Source:
-  #   - http://c-nergy.be/blog/?p=8984
+# Title: app-x11vnc-server
+#
+# Author: Luc Rutten
+# Version: 1.0
+# File: tasks/main.yml
+#
+# Description:
+#   Remote support
+#
+# Source:
+#   - http://c-nergy.be/blog/?p=8984
 
-  - name: "(ubuntu-x11vnc-2004-amd64.yml) Install packages"
-    apt:
-      name: "{{ packages }}"
-      update_cache: yes
-      state: present
-    vars:
-      packages:
-        - x11vnc
+- name: "(ubuntu-x11vnc-2004-amd64.yml) Install packages"
+  ansible.builtin.apt:
+    name: "{{ packages }}"
+    update_cache: true
+    state: present
+  vars:
+    packages:
+      - x11vnc
 
-  - name: "(ubuntu-x11vnc-2004-amd64.yml) get numeric id for group 'gdm'"
-    shell: echo "$(id -u gdm)"
-    register: grp_id_gdm
+- name: "(ubuntu-x11vnc-2004-amd64.yml) Get numeric id for group 'gdm'"
+  ansible.builtin.command: id -u gdm
+  register: common_grp_id_gdm
+  changed_when: false
 
-  - name: "(ubuntu-x11vnc-2004-amd64.yml) Store password"
-    raw: "x11vnc -storepasswd {{ vnc_password }} /etc/x11vnc.pass"
+- name: "(ubuntu-x11vnc-2004-amd64.yml) Store password"
+  ansible.builtin.command: x11vnc -storepasswd {{ vnc_password }} /etc/x11vnc.pass
+  changed_when: true
 
-  - name: Check if file '/etc/gdm3/custom.conf' exists
-    stat:
-      path: /etc/gdm3/custom.conf
-    register: etc_gdm_custom_conf_exists
+- name: Check if file '/etc/gdm3/custom.conf' exists
+  ansible.builtin.stat:
+    path: /etc/gdm3/custom.conf
+  register: common_etc_gdm_custom_conf_exists
 
-  - name: Adjust file '/etc/gdm3/custom.conf'
-    lineinfile:
-      dest: /etc/gdm3/custom.conf
-      state: present
-      regexp: '^WaylandEnable'
-      line: 'WaylandEnable=false'
-      insertafter: '^#?\s*WaylandEnable'
-    when:
-      - etc_gdm_custom_conf_exists.stat.exists
+- name: Adjust file '/etc/gdm3/custom.conf'
+  ansible.builtin.lineinfile:
+    dest: /etc/gdm3/custom.conf
+    state: present
+    regexp: '^WaylandEnable'
+    line: 'WaylandEnable=false'
+    insertafter: '^#?\s*WaylandEnable'
+  when:
+    - common_etc_gdm_custom_conf_exists.stat.exists
 
+- name: "(ubuntu-x11vnc-2004-amd64.yml) Set permissions on /etc/x11vnc.pass"
+  ansible.builtin.file:
+    path: /etc/x11vnc.pass
+    owner: root
+    group: root
+    mode: "0644"
+    state: file
 
-  - name: "(ubuntu-x11vnc-2004-amd64.yml) Set permissions on /etc/x11vnc.pass"
-    file:
-      path: /etc/x11vnc.pass
-      owner: root
-      group: root
-      mode: 0644
+- name: "(ubuntu-x11vnc-2004-amd64.yml) Transfer x11vnc.service.j2 to /lib/systemd/system/x11vnc.service"
+  ansible.builtin.template:
+    src: lib/systemd/system/x11vnc-gdm3.service.j2
+    dest: /lib/systemd/system/x11vnc.service
+    owner: root
+    group: root
+    mode: "0644"
 
-  - name: "(ubuntu-x11vnc-2004-amd64.yml) Transfer x11vnc.service.j2 to /lib/systemd/system/x11vnc.service"
-    template:
-      src: lib/systemd/system/x11vnc-gdm3.service.j2
-      dest: /lib/systemd/system/x11vnc.service
-
-  - name: "(ubuntu-x11vnc-2004-amd64.yml) Enable service"
-    systemd:
-      name: x11vnc.service
-      daemon_reload: yes
-      enabled: yes
-      state: restarted
+- name: "(ubuntu-x11vnc-2004-amd64.yml) Enable service"
+  ansible.builtin.systemd:
+    name: x11vnc.service
+    daemon_reload: true
+    enabled: true
+    state: restarted
 
 #  - name: "(ubuntu-x11vnc-2004-amd64.yml) Remove whisker menu entry for allusers (except owner and group)"
 #    file:
@@ -68,4 +73,3 @@
 #      mode: 0750
 #      owner: root
 #      group: root
-

roles/common/tasks/ubuntu-x11vnc-2204-amd64.yml

@@ -1,66 +1,71 @@
 ---
-  # Title: app-x11vnc-server
-  #
-  # Author: Luc Rutten
-  # Version: 1.0
-  # File: tasks/main.yml
-  #
-  # Description:
-  #   Remote support
-  #
-  # Source:
-  #   - http://c-nergy.be/blog/?p=8984
+# Title: app-x11vnc-server
+#
+# Author: Luc Rutten
+# Version: 1.0
+# File: tasks/main.yml
+#
+# Description:
+#   Remote support
+#
+# Source:
+#   - http://c-nergy.be/blog/?p=8984
 
-  - name: "(ubuntu-x11vnc-2204-amd64.yml) Install packages"
-    apt:
-      name: "{{ packages }}"
-      update_cache: yes
-      state: present
-    vars:
-      packages:
-        - x11vnc
+- name: "(ubuntu-x11vnc-2204-amd64.yml) Install packages"
+  ansible.builtin.apt:
+    name: "{{ packages }}"
+    update_cache: true
+    state: present
+  vars:
+    packages:
+      - x11vnc
 
-  - name: "(ubuntu-x11vnc-2204-amd64.yml) get numeric id for group 'gdm'"
-    shell: echo "$(id -u gdm)"
-    register: grp_id_gdm
+- name: "(ubuntu-x11vnc-2204-amd64.yml) Get numeric id for group 'gdm'"
+  ansible.builtin.command: id -u gdm
+  register: common_grp_id_gdm
+  changed_when: false
 
-  - name: "(ubuntu-x11vnc-2204-amd64.yml) Store password"
-    raw: "x11vnc -storepasswd {{ vnc_password }} /etc/x11vnc.pass"
+- name: "(ubuntu-x11vnc-2204-amd64.yml) Store password"
+  ansible.builtin.command: x11vnc -storepasswd {{ vnc_password }} /etc/x11vnc.pass
+  changed_when: true
 
-  - name: Check if file '/etc/gdm3/custom.conf' exists
-    stat:
-      path: /etc/gdm3/custom.conf
-    register: etc_gdm_custom_conf_exists
+- name: Check if file '/etc/gdm3/custom.conf' exists
+  ansible.builtin.stat:
+    path: /etc/gdm3/custom.conf
+  register: common_etc_gdm_custom_conf_exists
 
-  - name: Adjust file '/etc/gdm3/custom.conf'
-    lineinfile:
-      dest: /etc/gdm3/custom.conf
-      state: present
-      regexp: '^WaylandEnable'
-      line: 'WaylandEnable=false'
-      insertafter: '^#?\s*WaylandEnable'
-    when:
-      - etc_gdm_custom_conf_exists.stat.exists
+- name: Adjust file '/etc/gdm3/custom.conf'
+  ansible.builtin.lineinfile:
+    dest: /etc/gdm3/custom.conf
+    state: present
+    regexp: '^WaylandEnable'
+    line: 'WaylandEnable=false'
+    insertafter: '^#?\s*WaylandEnable'
+  when:
+    - common_etc_gdm_custom_conf_exists.stat.exists
 
+- name: "(ubuntu-x11vnc-2204-amd64.yml) Set permissions on /etc/x11vnc.pass"
+  ansible.builtin.file:
+    path: /etc/x11vnc.pass
+    owner: root
+    group: root
+    mode: "0644"
+    state: file
 
-  - name: "(ubuntu-x11vnc-2204-amd64.yml) Set permissions on /etc/x11vnc.pass"
-    file:
-      path: /etc/x11vnc.pass
-      owner: root
-      group: root
-      mode: 0644
+- name: "(ubuntu-x11vnc-2204-amd64.yml) Transfer x11vnc.service.j2 to /lib/systemd/system/x11vnc.service"
+  ansible.builtin.template:
+    src: lib/systemd/system/x11vnc-gdm3.service.j2
+    dest: /lib/systemd/system/x11vnc.service
+    owner: root
+    group: root
+    mode: "0644"
 
-  - name: "(ubuntu-x11vnc-2204-amd64.yml) Transfer x11vnc.service.j2 to /lib/systemd/system/x11vnc.service"
-    template:
-      src: lib/systemd/system/x11vnc-gdm3.service.j2
-      dest: /lib/systemd/system/x11vnc.service
-
-  - name: "(ubuntu-x11vnc-2204-amd64.yml) Enable service"
-    systemd:
-      name: x11vnc.service
-      daemon_reload: yes
-      enabled: yes
-      state: restarted
+- name: "(ubuntu-x11vnc-2204-amd64.yml) Enable service"
+  ansible.builtin.systemd:
+    name: x11vnc.service
+    daemon_reload: true
+    enabled: true
+    state: restarted
 
 #  - name: "(ubuntu-x11vnc-2204-amd64.yml) Remove whisker menu entry for allusers (except owner and group)"
 #    file:
@@ -68,4 +73,3 @@
 #      mode: 0750
 #      owner: root
 #      group: root
-

roles/common/tasks/ubuntu-x11vnc-2404-amd64.yml

@@ -1,66 +1,71 @@
 ---
-  # Title: app-x11vnc-server
-  #
-  # Author: Luc Rutten
-  # Version: 1.0
-  # File: tasks/main.yml
-  #
-  # Description:
-  #   Remote support
-  #
-  # Source:
-  #   - http://c-nergy.be/blog/?p=8984
+# Title: app-x11vnc-server
+#
+# Author: Luc Rutten
+# Version: 1.0
+# File: tasks/main.yml
+#
+# Description:
+#   Remote support
+#
+# Source:
+#   - http://c-nergy.be/blog/?p=8984
 
-  - name: "(ubuntu-x11vnc-2404-amd64.yml) Install packages"
-    apt:
-      name: "{{ packages }}"
-      update_cache: yes
-      state: present
-    vars:
-      packages:
-        - x11vnc
+- name: "(ubuntu-x11vnc-2404-amd64.yml) Install packages"
+  ansible.builtin.apt:
+    name: "{{ packages }}"
+    update_cache: true
+    state: present
+  vars:
+    packages:
+      - x11vnc
 
-  - name: "(ubuntu-x11vnc-2404-amd64.yml) get numeric id for group 'gdm'"
-    shell: echo "$(id -u gdm)"
-    register: grp_id_gdm
+- name: "(ubuntu-x11vnc-2404-amd64.yml) Get numeric id for group 'gdm'"
+  ansible.builtin.command: id -u gdm
+  register: common_grp_id_gdm
+  changed_when: false
 
-  - name: "(ubuntu-x11vnc-2404-amd64.yml) Store password"
-    raw: "x11vnc -storepasswd {{ vnc_password }} /etc/x11vnc.pass"
+- name: "(ubuntu-x11vnc-2404-amd64.yml) Store password"
+  ansible.builtin.command: x11vnc -storepasswd {{ vnc_password }} /etc/x11vnc.pass
+  changed_when: true
 
-  - name: Check if file '/etc/gdm3/custom.conf' exists
-    stat:
-      path: /etc/gdm3/custom.conf
-    register: etc_gdm_custom_conf_exists
+- name: Check if file '/etc/gdm3/custom.conf' exists
+  ansible.builtin.stat:
+    path: /etc/gdm3/custom.conf
+  register: common_etc_gdm_custom_conf_exists
 
-  - name: Adjust file '/etc/gdm3/custom.conf'
-    lineinfile:
-      dest: /etc/gdm3/custom.conf
-      state: present
-      regexp: '^WaylandEnable'
-      line: 'WaylandEnable=false'
-      insertafter: '^#?\s*WaylandEnable'
-    when:
-      - etc_gdm_custom_conf_exists.stat.exists
+- name: Adjust file '/etc/gdm3/custom.conf'
+  ansible.builtin.lineinfile:
+    dest: /etc/gdm3/custom.conf
+    state: present
+    regexp: '^WaylandEnable'
+    line: 'WaylandEnable=false'
+    insertafter: '^#?\s*WaylandEnable'
+  when:
+    - common_etc_gdm_custom_conf_exists.stat.exists
 
+- name: "(ubuntu-x11vnc-2404-amd64.yml) Set permissions on /etc/x11vnc.pass"
+  ansible.builtin.file:
+    path: /etc/x11vnc.pass
+    owner: root
+    group: root
+    mode: "0644"
+    state: file
 
-  - name: "(ubuntu-x11vnc-2404-amd64.yml) Set permissions on /etc/x11vnc.pass"
-    file:
-      path: /etc/x11vnc.pass
-      owner: root
-      group: root
-      mode: 0644
+- name: "(ubuntu-x11vnc-2404-amd64.yml) Transfer x11vnc.service.j2 to /lib/systemd/system/x11vnc.service"
+  ansible.builtin.template:
+    src: lib/systemd/system/x11vnc-gdm3.service.j2
+    dest: /lib/systemd/system/x11vnc.service
+    owner: root
+    group: root
+    mode: "0644"
 
-  - name: "(ubuntu-x11vnc-2404-amd64.yml) Transfer x11vnc.service.j2 to /lib/systemd/system/x11vnc.service"
-    template:
-      src: lib/systemd/system/x11vnc-gdm3.service.j2
-      dest: /lib/systemd/system/x11vnc.service
-
-  - name: "(ubuntu-x11vnc-2404-amd64.yml) Enable service"
-    systemd:
-      name: x11vnc.service
-      daemon_reload: yes
-      enabled: yes
-      state: restarted
+- name: "(ubuntu-x11vnc-2404-amd64.yml) Enable service"
+  ansible.builtin.systemd:
+    name: x11vnc.service
+    daemon_reload: true
+    enabled: true
+    state: restarted
 
 #  - name: "(ubuntu-x11vnc-2404-amd64.yml) Remove whisker menu entry for allusers (except owner and group)"
 #    file:
@@ -68,4 +73,3 @@
 #      mode: 0750
 #      owner: root
 #      group: root
-

roles/common/templates/etc/apt/deb822/backports.sources.j2

@@ -0,0 +1,12 @@
+# {{ ansible_managed }}
+#
+# Managed by Ansible: deb822 definition for the Debian backports repository.
+# It enables deb-src only when apt_src_enable is true and sets Signed-By only
+# when apt_deb822_use_signed_by is enabled.
+Types: {{ 'deb deb-src' if apt_src_enable | default(true) | bool else 'deb' }}
+URIs: {{ apt_debian_mirror }}
+Suites: {{ ansible_facts['distribution_release'] }}-backports
+Components: main contrib non-free non-free-firmware
+{% if apt_deb822_use_signed_by | default(true) | bool %}
+Signed-By: {{ apt_deb822_signed_by_keyring | default('/usr/share/keyrings/debian-archive-keyring.gpg') }}
+{% endif %}

roles/common/templates/etc/apt/deb822/debian.sources.j2

@@ -0,0 +1,10 @@
+# {{ ansible_managed }}
+#
+# Verwaltet via Ansible - Debian Basis & Updates fuer {{ ansible_facts['distribution_release'] }}
+Types: {{ 'deb deb-src' if apt_src_enable | default(true) | bool else 'deb' }}
+URIs: {{ apt_debian_mirror }}
+Suites: {{ ansible_facts['distribution_release'] }} {{ ansible_facts['distribution_release'] }}-updates
+Components: main contrib non-free non-free-firmware
+{% if apt_deb822_use_signed_by | default(true) | bool %}
+Signed-By: {{ apt_deb822_signed_by_keyring | default('/usr/share/keyrings/debian-archive-keyring.gpg') }}
+{% endif %}

roles/common/templates/etc/apt/deb822/security.sources.j2

@@ -0,0 +1,10 @@
+# {{ ansible_managed }}
+#
+# Verwaltet via Ansible - Security fuer {{ ansible_facts['distribution_release'] }}
+Types: {{ 'deb deb-src' if apt_src_enable | default(true) | bool else 'deb' }}
+URIs: http://security.debian.org/debian-security
+Suites: {{ ansible_facts['distribution_release'] }}-security
+Components: main contrib non-free non-free-firmware
+{% if apt_deb822_use_signed_by | default(true) | bool %}
+Signed-By: {{ apt_deb822_signed_by_keyring | default('/usr/share/keyrings/debian-archive-keyring.gpg') }}
+{% endif %}

roles/common/templates/etc/samba/smb.conf.j2

@@ -533,6 +533,20 @@
    virusfilter:scan on open = yes
    virusfilter:scan on close = yes
 
+{%      set virusfilter_include_files = item.vfs_object_virusfilter_include_files | default([]) %}
+{%      set virusfilter_exclude_files = item.vfs_object_virusfilter_exlude_files | default(item.vfs_object_virusfilter_exclude_files | default([])) %}
+{%      if virusfilter_include_files | length > 0 %}
+   # Nur diese Dateiendungen vom Virusfilter pruefen.
+   virusfilter:include files = \.({{ virusfilter_include_files | join('|') }})$
+{%         if virusfilter_exclude_files | length > 0 %}
+   # Include und Exclude sind gesetzt: Include hat Vorrang, Exclude wird ignoriert.
+   #virusfilter:exclude files = \.({{ virusfilter_exclude_files | join('|') }})$
+{%         endif %}
+{%      elif virusfilter_exclude_files | length > 0 %}
+   # Diese Dateiendungen von der Viruspruefung ausschliessen.
+   virusfilter:exclude files = \.({{ virusfilter_exclude_files | join('|') }})$
+{%      endif %}
+
    # Fehlercode bei infizierter Datei (beim Öffnen)
    virusfilter:infected file errno on open = EACCES
 

roles/common/templates/etc/ssh/sshd_config.j2

@@ -177,8 +177,8 @@ HostbasedAuthentication no
 # The allow/deny directives are processed in the following order: DenyUsers, 
 # AllowUsers, DenyGroups, and finally AllowGroups.
 # By default, login is allowed for all users.
-{% if (fact_sshd_allowed_users is defined) and fact_sshd_allowed_users %}
-AllowUsers {{ fact_sshd_allowed_users }}
+{% if (common_fact_sshd_allowed_users is defined) and common_fact_sshd_allowed_users %}
+AllowUsers {{ common_fact_sshd_allowed_users }}
 {% else %}
 #AllowUsers back chris sysadm cityslang christoph
 {% endif %}
@@ -239,8 +239,8 @@ UsePAM {{ sshd_use_pam }}
 #
 # The list of available key exchange algorithms may also be obtained using "ssh -Q kex".
 #
-{% if (fact_sshd_kexalgorithms is defined) and fact_sshd_kexalgorithms %}
-KexAlgorithms {{ fact_sshd_kexalgorithms }}
+{% if (common_fact_sshd_kexalgorithms is defined) and common_fact_sshd_kexalgorithms %}
+KexAlgorithms {{ common_fact_sshd_kexalgorithms }}
 {% else %}
 #KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1
 {% endif %}
@@ -273,8 +273,8 @@ KexAlgorithms {{ fact_sshd_kexalgorithms }}
 #
 # The list of available ciphers may also be obtained using "ssh -Q cipher".
 #
-{% if (fact_sshd_ciphers is defined) and fact_sshd_ciphers %}
-Ciphers {{ fact_sshd_ciphers }}
+{% if (common_fact_sshd_ciphers is defined) and common_fact_sshd_ciphers %}
+Ciphers {{ common_fact_sshd_ciphers }}
 {% else %}
 #Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
 {% endif %}
@@ -317,8 +317,8 @@ Ciphers {{ fact_sshd_ciphers }}
 #
 # The list of available MAC algorithms may also be obtained using "ssh -Q mac".
 #
-{% if (fact_sshd_macs is defined) and fact_sshd_macs %}
-MACs {{ fact_sshd_macs }}
+{% if (common_fact_sshd_macs is defined) and common_fact_sshd_macs %}
+MACs {{ common_fact_sshd_macs }}
 {% else %}
 #MACs umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,mac-sha2-256,hmac-sha2-512,hmac-sha1
 {% endif %}
@@ -337,8 +337,8 @@ MACs {{ fact_sshd_macs }}
 #    ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
 #
 # The list of available key types may also be obtained using "ssh -Q key".
-{% if (fact_sshd_hostkeyalgorithms is defined) and fact_sshd_hostkeyalgorithms %}
-HostKeyAlgorithms {{ fact_sshd_hostkeyalgorithms }}
+{% if (common_fact_sshd_hostkeyalgorithms is defined) and common_fact_sshd_hostkeyalgorithms %}
+HostKeyAlgorithms {{ common_fact_sshd_hostkeyalgorithms }}
 {% endif %}
 
 

roles/common/templates/etc/ssh/sshd_config.ubuntu.j2

@@ -171,8 +171,8 @@ HostbasedAuthentication no
 # The allow/deny directives are processed in the following order: DenyUsers, 
 # AllowUsers, DenyGroups, and finally AllowGroups.
 # By default, login is allowed for all users.
-{% if (fact_sshd_allowed_users is defined) and fact_sshd_allowed_users %}
-AllowUsers {{ fact_sshd_allowed_users }}
+{% if (common_fact_sshd_allowed_users is defined) and common_fact_sshd_allowed_users %}
+AllowUsers {{ common_fact_sshd_allowed_users }}
 {% else %}
 #AllowUsers back chris sysadm cityslang christoph
 {% endif %}

roles/common/templates/etc/systemd/resolved.conf.d/50-resolved-local.conf

@@ -5,20 +5,20 @@
 # *** ---------------------------------------------- ***
 
 [Resolve]
-{% if (fact_resolved_nameserver is defined) and fact_resolved_nameserver %}
-DNS={{ fact_resolved_nameserver}}
+{% if (common_fact_resolved_nameserver is defined) and common_fact_resolved_nameserver %}
+DNS={{ common_fact_resolved_nameserver }}
 {% else %}
 #DNS=
 {% endif -%}
 
-{% if (fact_resolved_fallback_nameserver is defined) and fact_resolved_fallback_nameserver %}
-FallbackDNS={{ fact_resolved_fallback_nameserver }}
+{% if (common_fact_resolved_fallback_nameserver is defined) and common_fact_resolved_fallback_nameserver %}
+FallbackDNS={{ common_fact_resolved_fallback_nameserver }}
 {% else %}
 #FallbackDNS=
 {% endif -%}
 
-{% if (fact_resolved_domains is defined) and fact_resolved_domains %}
-Domains={{ fact_resolved_domains }}
+{% if (common_fact_resolved_domains is defined) and common_fact_resolved_domains %}
+Domains={{ common_fact_resolved_domains }}
 {% else %}
 #Domains=
 {% endif -%}

roles/network_interfaces/tasks/interfaces.yml

@@ -14,7 +14,7 @@
     - network-interfaces
 
 - name: (interfaces.yml) Ensure interfaces file is latest
-  template:
+  ansible.builtin.template:
     src: "etc/network/interfaces.j2"
     dest: /etc/network/interfaces
   with_items: network_interfaces
@@ -22,7 +22,7 @@
     - network-interfaces
 
 - name: (interfaces.yml) Ensure imported device files at interfaces.d are latest
-  template:
+  ansible.builtin.template:
     src: "etc/network/interfaces.d/device.j2"
     dest: "{{ network_interface_path }}/device-{{ item.0 }}"
   with_items: