Refactor template tasks to use ansible.builtin.template for consistency across playbooks

apt-migrate-to-trixie.yml

@@ -1,121 +0,0 @@
----
-
-# ---
-# deb822 ist das neue Konfigurationsformats für APT-Quellen (Repositories).
-# Es basiert auf der Debian Control Syntax nach RFC 822 – daher der Name
-# ---
-
-- name: Nur APT auf Debian 13 (Trixie) migrieren
-  hosts: all
-  become: true
-  gather_facts: true
-
-  vars:
-    target_release: trixie
-    debian_mirror: "http://deb.debian.org/debian"
-    security_mirror: "http://security.debian.org/debian-security"
-    components: "main contrib non-free non-free-firmware"
-    enable_backports: true         # auf false setzen, wenn du keine Backports willst
-    pin_backports_low: true        # Backports nur auf Anfrage
-    # Nur manuelle Installation/Upgrade aus Backports:
-    #    backports_pin_priority: 100
-    #
-    # Automatische Updates für bereits installierte Backports-Pakete.
-    #    backports_pin_priority: 500 (>= 500)
-    #
-    backports_pin_priority: 100    # 100 = nie automatisch bevorzugen
-    apt_cache_valid_time: 3600
-    # Für offizielle Debian-Repos brauchst es kein Signed-By, weil debian-archive-keyring 
-    # ohnehin systemweit vertrauenswürdig ist.
-    #
-    use_signed_by: true  # oder false, wenn du Option A willst
-    # Wenn Signed-By explizit gesetzt werden soll, dann nutze den Keyring-Pfad und stelle sicher, 
-    # dass das Paket installiert ist.
-    signed_by_keyring: "/usr/share/keyrings/debian-archive-keyring.gpg"
-
-  pre_tasks:
-    - name: Sicherstellen, dass wir Debian sind
-      assert:
-        that:
-          - ansible_facts['os_family'] == "Debian"
-        fail_msg: "Dieses Playbook ist nur für Debian geeignet."
-
-  tasks:
-
-    - name: Keyring für Debian-Archive sicherstellen (falls Signed-By genutzt)
-      ansible.builtin.apt:
-        name: debian-archive-keyring
-        state: present
-      when: use_signed_by
-
-    - name: (Optional) Alte /etc/apt/sources.list sichern
-      ansible.builtin.copy:
-        src: /etc/apt/sources.list
-        dest: /etc/apt/sources.list.before-trixie
-        remote_src: true
-        force: false
-      ignore_errors: true
-
-    - name: Alte /etc/apt/sources.list deaktivieren (leere Kommentar-Datei)
-      ansible.builtin.copy:
-        dest: /etc/apt/sources.list
-        content: |
-          # Verwaltet via Ansible. Repositories liegen in /etc/apt/sources.list.d/*.sources (deb822).
-          # Zielrelease: {{ target_release }}
-        owner: root
-        group: root
-        mode: "0644"
-
-    - name: Debian-Repo (deb + deb-src) als deb822 anlegen
-      ansible.builtin.template:
-        src: templates/apt-migrate-to-trixie/debian.sources.j2
-        dest: /etc/apt/sources.list.d/debian.sources
-        owner: root
-        group: root
-        mode: "0644"
-
-    - name: Security-Repo (deb + deb-src) als deb822 anlegen
-      ansible.builtin.template:
-        src: templates/apt-migrate-to-trixie/security.sources.j2
-        dest: /etc/apt/sources.list.d/security.sources
-        owner: root
-        group: root
-        mode: "0644"
-
-    - name: Backports-Repo (optional) als deb822 anlegen/entfernen
-      ansible.builtin.template:
-        src: templates/apt-migrate-to-trixie/backports.sources.j2
-        dest: /etc/apt/sources.list.d/backports.sources
-        owner: root
-        group: root
-        mode: "0644"
-      when: enable_backports
-    - name: Backports-Repo entfernen wenn deaktiviert
-      ansible.builtin.file:
-        path: /etc/apt/sources.list.d/backports.sources
-        state: absent
-      when: not enable_backports
-
-    - name: Optionales Backports-Pinning setzen
-      ansible.builtin.template:
-        src: templates/apt-migrate-to-trixie/99-backports.j2
-        dest: /etc/apt/preferences.d/99-backports
-        owner: root
-        group: root
-        mode: "0644"
-      when: enable_backports and pin_backports_low
-
-    - name: APT-Cache aktualisieren
-      ansible.builtin.apt:
-        update_cache: yes
-        cache_valid_time: "{{ apt_cache_valid_time }}"
-
-    - name: Verifikation - zeigen, ob Suites auf trixie stehen
-      ansible.builtin.command: apt-cache policy
-      register: apt_policy
-      changed_when: false
-
-    - name: Ausgabe anzeigen (nur Info)
-      ansible.builtin.debug:
-        msg: "{{ apt_policy.stdout.split('\n') | select('search', 'trixie') | list | join('\n') }}"
-

group_vars/akb.yml

@@ -420,6 +420,8 @@ nis_user:
     password: '20-wieb.ke/24_%'
 
 
+samba_homes_virusfilter: true
+
 # ==========
 # vars used by roles/common/tasks/samba-install.yml
 # ==========

group_vars/flr.yml

@@ -382,6 +382,7 @@ nis_user:
 
   - name: kirstin
     groups:
+      - amif
       - team
       - aktion-mensch
     is_samba_user: true
@@ -419,6 +420,12 @@ nis_user:
     is_samba_user: true
     password: '20_son+keng-25.%'
 
+  - name: victoria
+    groups:
+      - amif
+    is_samba_user: true
+    password: '20.vic-to-ria/25%'
+
   - name: vincent
     groups:
       - team
@@ -440,7 +447,7 @@ nis_user:
     is_samba_user: true
     password: '20-ver-wal-tung%23!'
 
-
+samba_homes_virusfilter: true
 
 
 # ==========

group_vars/mbr.yml

@@ -163,6 +163,8 @@ nis_groups:
     group_id: 2100
   - name: direx-personal-finanzen
     group_id: 2110
+  - name: projektleitung
+    group_id: 2200
 
 
 
@@ -401,9 +403,22 @@ nis_user:
       - regishut-personal-finanzen
       - direx
       - direx-personal-finanzen
+      - projektleitung
     is_samba_user: true
     password: '8!Varianten'
 
+  - name: hendrik.roth
+    groups:
+      - all-users
+      - buero-scan
+      - bgn-finanzen-personal
+      - mbr-finanzen-personal
+      - rias-berlin-finanzen-personal
+      - regishut-personal-finanzen
+      - direx-personal-finanzen
+    is_samba_user: true
+    password: 'H-S.tG3/wV46'
+
   - name: janine.budich
     groups:
       - all-users
@@ -424,6 +439,7 @@ nis_user:
       - regishut-personal-finanzen
       - direx
       - direx-personal-finanzen
+      - projektleitung
     is_samba_user: true
     password: 'LoS_r3f_20_AS!'
 
@@ -438,6 +454,18 @@ nis_user:
     is_samba_user: true
     password: 'AfZg3-9S/4IX'
 
+  - name: olga.masson
+    groups:
+      - all-users
+      - buero-scan
+      - bgn-finanzen-personal
+      - mbr-finanzen-personal
+      - rias-berlin-finanzen-personal
+      - regishut-personal-finanzen
+      - direx-personal-finanzen
+    is_samba_user: true
+    password: '6.7.mQ-sPE.o'
+
   - name: swetlana.nikitenko
     groups:
       - all-users
@@ -494,6 +522,7 @@ nis_user:
       - bgn
       - bgn-finanzen-personal
       - mbr-buero
+      - projektleitung
     is_samba_user: true
     password: 'C+j3.w5.NJCI'
 
@@ -506,6 +535,7 @@ nis_user:
       - mbr-finanzen-personal
       - technik
       - vdk
+      - projektleitung
     is_samba_user: true
     password: 'nA-y.I6ReJ-M'
 
@@ -575,6 +605,7 @@ nis_user:
       - mbr-buero
       - direx
       - direx-personal-finanzen
+      - projektleitung
     is_samba_user: true
     password: '5xp5ll9ar13us!'
 
@@ -669,6 +700,14 @@ nis_user:
     is_samba_user: true
     password: 't32_aHxV.'
 
+  - name: katharina.mueller
+    groups:
+      - all-users
+      - buero-scan
+      - mbr-buero
+    is_samba_user: true
+    password: '6.3b-5Vy/7-3'
+
   - name: kathrin.hain
     groups:
       - ag-antisem
@@ -722,6 +761,7 @@ nis_user:
       - buero-scan
       - ag-antisem
       - mbr-buero
+      - projektleitung
     is_samba_user: true
     password: 'V1v@H@f3rdr1nk'
 
@@ -730,6 +770,7 @@ nis_user:
       - all-users
       - buero-scan
       - mbr-buero
+      - technik
     is_samba_user: true
     password: 'I.E7X.cUd-cc'
 
@@ -782,6 +823,14 @@ nis_user:
     is_samba_user: true
     password: 'q9.mL5-a-aYA'
 
+  - name: tirza.seene
+    groups:
+      - all-users
+      - buero-scan
+      - mbr-buero
+    is_samba_user: true
+    password: '7a9-7Rz-Rc2p'
+
 # ---
 # RIAS Berlin und Bund
 # ---
@@ -832,6 +881,7 @@ nis_user:
       - rias-bund
       - rias-berlin
       - rias-berlin-finanzen-personal
+      - projektleitung
     is_samba_user: true
     password: '-a2%3bTzkW.A'
 
@@ -894,6 +944,7 @@ nis_user:
       - regishut
       - regishut-personal-finanzen
       - direx-personal-finanzen
+      - projektleitung
     is_samba_user: true
     password: 'bbMIQ.3/gZ3s'
 
@@ -951,6 +1002,8 @@ nis_user:
     password: 'RmMq-3Z--2.2'
 
 
+samba_homes_virusfilter: true
+
 
 # ==========
 # vars used by roles/common/tasks/samba-install.yml
@@ -1050,6 +1103,16 @@ samba_shares:
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
+  - name: Projektleitung
+    path: /data/shares/Projektleitung
+    group_valid_users: projektleitung
+    group_write_list: projektleitung
+    file_create_mask: '0660'
+    dir_create_mask: '2770'
+    vfs_object_virusfilter: true
+    vfs_object_recycle: true
+    recycle_path: '@Recycle.Bin'
+
 # ---
 # VDK
 # ---

group_vars/sprachenatelier.yml

@@ -177,6 +177,13 @@ nis_user:
     is_samba_user: true
     password: 'spa2014'
 
+  - name: genia
+    groups:
+      - intern
+      - buero
+    is_samba_user: true
+    password: '240481'
+
   - name: isadora
     groups:
       - intern
@@ -340,100 +347,7 @@ nis_user:
     is_samba_user: true
     password: '300195'
 
-
+samba_homes_virusfilter: true
-# deleted users
-#
-#  - name: marei
-#    groups:
-#      - intern
-#      - buero
-#    is_samba_user: true
-#    password: '220792'
-#
-#  - name: virginia
-#    groups:
-#      - intern
-#      - buero
-#    is_samba_user: true
-#    password: '160292'
-#
-#  - name: alina
-#    groups:
-#      - intern
-#      - buero
-#    is_samba_user: true
-#    password: '140686'
-#
-#  - name: hannah
-#    groups:
-#      - intern
-#      - buero
-#    is_samba_user: true
-#    password: '28031973'
-#
-#  - name: kristin
-#    groups:
-#      - intern
-#      - buero
-#    is_samba_user: true
-#    password: '49371'
-#
-#  - name: thea
-#    groups:
-#      - intern
-#      - buero
-#    is_samba_user: true
-#    password: '060995'
-#
-#  - name: katrine
-#    groups:
-#      - intern
-#      - buero
-#    is_samba_user: true
-#    password: '200290'
-#
-#  - name: daniel
-#    groups:
-#      - intern
-#      - buero
-#    is_samba_user: true
-#    password: '210984'
-#
-#  - name: andrea
-#    groups:
-#      - intern
-#      - buero
-#      - lpadmin
-#    is_samba_user: true
-#    password: 'kurse2010'
-#
-#  - name: tali
-#    groups:
-#      - intern
-#      - buero
-#    is_samba_user: true
-#    password: '220686'
-#
-#  - name: eva
-#    groups:
-#      - intern
-#      - buero
-#    is_samba_user: true
-#    password: '250791'
-#
-#  - name: mariam
-#    groups:
-#      - intern
-#      - buero
-#    is_samba_user: true
-#    password: '240991'
-#
-#  - name: simone
-#    groups:
-#      - intern
-#      - buero
-#    is_samba_user: true
-#    password: '031189'
 
 
 # ==========

roles/common/tasks/apt.yml

@@ -1,7 +1,16 @@
 ---
+- name: (apt.yml) Delete Hetzner files 'hetzner-mirror.list' and 'hetzner-security-updates.list'
+  file:
+    path: "{{ item }}"
+    state: absent
+  with_items:
+    - /etc/apt/sources.list.d/hetzner-mirror.list
+    - /etc/apt/sources.list.d/hetzner-security-updates.list
+  tags:
+    - apt-configuration
 
 - name: (apt.yml) update configuration file - /etc/apt/sources.list
-  template:
+  ansible.builtin.template:
     src: "etc/apt/sources.list.{{ ansible_facts['distribution'] }}.j2"
     dest: /etc/apt/sources.list
     owner: root
@@ -9,12 +18,143 @@
     mode: 0644
   register: apt_config_updated
   when:
-    - ansible_facts['distribution'] == "Debian"
     - apt_manage_sources_list|bool
+    - ansible_facts['distribution'] == 'Debian'
     - (ansible_facts['distribution_major_version'] | int) < 13
   tags:
     - apt-configuration
 
+- name: (apt.yml) Ensure Debian archive keyring is present for deb822 Signed-By (Debian >= 13)
+  apt:
+    name: debian-archive-keyring
+    state: present
+  when:
+    - apt_manage_sources_list|bool
+    - ansible_facts['distribution'] == 'Debian'
+    - (ansible_facts['distribution_major_version'] | int) >= 13
+    - apt_deb822_use_signed_by | default(true) | bool
+  tags:
+    - apt-configuration
+
+- name: (apt.yml) backup legacy /etc/apt/sources.list before deb822 migration (Debian >= 13)
+  copy:
+    src: /etc/apt/sources.list
+    dest: /etc/apt/sources.list.before-deb822
+    remote_src: true
+    force: false
+    owner: root
+    group: root
+    mode: "0644"
+  when:
+    - apt_manage_sources_list|bool
+    - ansible_facts['distribution'] == 'Debian'
+    - (ansible_facts['distribution_major_version'] | int) >= 13
+  failed_when:
+    - apt_sources_list_backup.failed
+    - "'No such file or directory' not in (apt_sources_list_backup.msg | default(''))"
+  register: apt_sources_list_backup
+  tags:
+    - apt-configuration
+
+- name: (apt.yml) replace /etc/apt/sources.list with deb822 notice (Debian >= 13)
+  copy:
+    dest: /etc/apt/sources.list
+    content: |
+      # {{ ansible_managed }}
+      #
+      # Verwaltet via Ansible. Repositories liegen in /etc/apt/sources.list.d/*.sources (deb822).
+      # Zielrelease: {{ ansible_facts['distribution_release'] }}
+    owner: root
+    group: root
+    mode: "0644"
+  register: apt_config_updated_sources_list
+  when:
+    - apt_manage_sources_list|bool
+    - ansible_facts['distribution'] == 'Debian'
+    - (ansible_facts['distribution_major_version'] | int) >= 13
+  tags:
+    - apt-configuration
+
+- name: (apt.yml) configure deb822 Debian repository (Debian >= 13)
+  ansible.builtin.template:
+    src: "etc/apt/deb822/debian.sources.j2"
+    dest: /etc/apt/sources.list.d/debian.sources
+    owner: root
+    group: root
+    mode: "0644"
+  register: apt_config_updated_debian_sources
+  when:
+    - apt_manage_sources_list|bool
+    - ansible_facts['distribution'] == 'Debian'
+    - (ansible_facts['distribution_major_version'] | int) >= 13
+  tags:
+    - apt-configuration
+
+- name: (apt.yml) configure deb822 security repository (Debian >= 13)
+  ansible.builtin.template:
+    src: "etc/apt/deb822/security.sources.j2"
+    dest: /etc/apt/sources.list.d/security.sources
+    owner: root
+    group: root
+    mode: "0644"
+  register: apt_config_updated_security_sources
+  when:
+    - apt_manage_sources_list|bool
+    - ansible_facts['distribution'] == 'Debian'
+    - (ansible_facts['distribution_major_version'] | int) >= 13
+  tags:
+    - apt-configuration
+
+- name: (apt.yml) configure deb822 backports repository (Debian >= 13)
+  ansible.builtin.template:
+    src: "etc/apt/deb822/backports.sources.j2"
+    dest: /etc/apt/sources.list.d/backports.sources
+    owner: root
+    group: root
+    mode: "0644"
+  register: apt_config_updated_backports_sources
+  when:
+    - apt_manage_sources_list|bool
+    - ansible_facts['distribution'] == 'Debian'
+    - (ansible_facts['distribution_major_version'] | int) >= 13
+    - apt_backports_enable | default(false) | bool
+  tags:
+    - apt-configuration
+
+# If 'backports' was enabled in a previous run but is now disabled.
+#
+- name: (apt.yml) remove deb822 backports repository when disabled (Debian >= 13)
+  file:
+    path: /etc/apt/sources.list.d/backports.sources
+    state: absent
+  register: apt_config_removed_backports_sources
+  when:
+    - apt_manage_sources_list|bool
+    - ansible_facts['distribution'] == 'Debian'
+    - (ansible_facts['distribution_major_version'] | int) >= 13
+    - not (apt_backports_enable | default(false) | bool)
+  tags:
+    - apt-configuration
+
+# Collect change states from all Debian >=13 deb822 source tasks so apt update
+# can force a fresh cache refresh when repository files changed.
+- name: (apt.yml) aggregate deb822 source changes (Debian >= 13)
+  set_fact:
+    apt_config_updated:
+      changed: >-
+        {{
+          (apt_config_updated_sources_list.changed | default(false))
+          or (apt_config_updated_debian_sources.changed | default(false))
+          or (apt_config_updated_security_sources.changed | default(false))
+          or (apt_config_updated_backports_sources.changed | default(false))
+          or (apt_config_removed_backports_sources.changed | default(false))
+        }}
+  when:
+    - apt_manage_sources_list|bool
+    - ansible_facts['distribution'] == 'Debian'
+    - (ansible_facts['distribution_major_version'] | int) >= 13
+  tags:
+    - apt-configuration
 
 - name: (apt.yml) apt update
   apt:
@@ -30,7 +170,6 @@
     - apt-compiler-pkgs
     - apt-webserver-pkgs
 
-
 - name: (apt.yml) Configure any half-installed packages 'dpkg --configure -a'
   ansible.builtin.command: dpkg --configure -a
   register: _dpkg_configure
@@ -44,7 +183,6 @@
     - apt-compiler-pkgs
     - apt-webserver-pkgs
 
-
 - name: (apt.yml) apt upgrade
   apt:
     upgrade: "{{ apt_upgrade_type }}"
@@ -58,7 +196,6 @@
     - apt-compiler-pkgs
     - apt-webserver-pkgs
 
-
 - name: (apt.yml) Initial install debian packages (stretch)
   apt:
     name: "{{ apt_initial_install_stretch }}"
@@ -70,7 +207,6 @@
   tags:
     - apt-initial-install
 
-
 - name: (apt.yml) Initial install debian packages (buster)
   apt:
     name: "{{ apt_initial_install_buster }}"
@@ -82,7 +218,6 @@
   tags:
     - apt-initial-install
 
-
 - name: (apt.yml) Initial install debian packages (bullseye)
   apt:
     name: "{{ apt_initial_install_bullseye }}"
@@ -94,7 +229,6 @@
   tags:
     - apt-initial-install
 
-
 - name: (apt.yml) Initial install debian packages (bookworm)
   apt:
     name: "{{ apt_initial_install_bookworm }}"
@@ -106,7 +240,6 @@
   tags:
     - apt-initial-install
 
-
 - name: (apt.yml) Initial install debian packages (trixie)
   apt:
     name: "{{ apt_initial_install_trixie }}"
@@ -118,7 +251,6 @@
   tags:
     - apt-initial-install
 
-
 - name: (apt.yml) Initial install ubuntu packages (bionic)
   apt:
     name: "{{ apt_initial_install_bionic }}"
@@ -159,7 +291,6 @@
   tags:
     - apt-initial-install
 
-
 # ---
 # Microcode
 # ---
@@ -178,7 +309,6 @@
     - apt-initial-install
     - apt-microcode
 
-
 - name: (apt.yml) Install CPU microcode (debian buster/bullseye/bookworm/trixie)
   apt:
     name: "{{ microcode_intel_package }}"
@@ -193,7 +323,6 @@
     - apt-initial-install
     - apt-microcode
 
-
 - name: (apt.yml) Install CPU microcode for AMD CPU (debian buster)
   apt:
     name: "{{ microcode_amd_package }}"
@@ -208,7 +337,6 @@
     - apt-initial-install
     - apt-microcode
 
-
 - name: (apt.yml) Install CPU microcode for Intel CPU (ubuntu bionic)
   apt:
     name: "{{ microcode_intel_package }}"
@@ -222,7 +350,6 @@
     - apt-initial-install
     - apt-microcode
 
-
 - name: (apt.yml) Install CPU microcode for AMD CPU (ubuntu bionic)
   apt:
     name: "{{ microcode_amd_package }}"
@@ -237,7 +364,6 @@
     - apt-initial-install
     - apt-microcode
 
-
 - name: (apt.yml) Install CPU microcode for Intel CPU (ubuntu xenial)
   apt:
     name: "{{ microcode_intel_package }}"
@@ -251,7 +377,6 @@
     - apt-initial-install
     - apt-microcode
 
-
 - name: (apt.yml) Install CPU microcode for Intel AMD (ubuntu xenial)
   apt:
     name: "{{ microcode_amd_package }}"
@@ -266,7 +391,6 @@
     - apt-initial-install
     - apt-microcode
 
-
 - name: (apt.yml) Install CPU microcode for Intel CPU (ubuntu jammy/noble)
   apt:
     name: "{{ microcode_intel_package }}"
@@ -280,7 +404,6 @@
     - apt-initial-install
     - apt-microcode
 
-
 - name: (apt.yml) Install CPU microcode for Intel AMD (ubuntu jammy/noble)
   apt:
     name: "{{ microcode_amd_package }}"
@@ -301,33 +424,31 @@
 
 - name: (apt.yml) Install Firmware packages (Ubuntu)
   apt:
-     name: "{{ firmware_packages_ubuntu }}"
+    name: "{{ firmware_packages_ubuntu }}"
-     state: present
+    state: present
-     default_release: "{{ ansible_facts['distribution_release'] }}"
+    default_release: "{{ ansible_facts['distribution_release'] }}"
   when:
     - ansible_facts['distribution'] == "Ubuntu"
   tags:
     - apt-initial-install
     - apt-firmware
 
-
 - name: (apt.yml) Install Firmware packages (Debian)
   apt:
-     name: "{{ firmware_packages_debian }}"
+    name: "{{ firmware_packages_debian }}"
-     state: present
+    state: present
-     default_release: "{{ ansible_facts['distribution_release'] }}"
+    default_release: "{{ ansible_facts['distribution_release'] }}"
   when:
     - ansible_facts['distribution'] == "Debian"
   tags:
     - apt-initial-install
     - apt-firmware
 
-
 - name: (apt.yml) Install non-free Firmware packages (Debian)
   apt:
-     name: "{{ firmware_non_free_packages_debian }}"
+    name: "{{ firmware_non_free_packages_debian }}"
-     state: present
+    state: present
-     default_release: "{{ ansible_facts['distribution_release'] }}"
+    default_release: "{{ ansible_facts['distribution_release'] }}"
   when:
     - ansible_facts['distribution'] == "Debian"
     - apt_debian_contrib_nonfree_enable
@@ -335,7 +456,6 @@
     - apt-initial-install
     - apt-firmware
 
-
 # ---
 # unwanted packages
 # ---

roles/common/tasks/basic.yml

@@ -172,7 +172,7 @@
     - unattended-upgrades
 
 - name: (basic.yml) copy apt-listchanges.conf
-  template:
+  ansible.builtin.template:
     src: etc/apt/listchanges.conf.j2
     dest: /etc/apt/listchanges.conf
     owner: root
@@ -184,7 +184,7 @@
     - unattended-upgrades
 
 - name: (basic.yml) copy unattended-upgrades conf
-  template:
+  ansible.builtin.template:
     src: etc/apt/apt.conf.d/50unattended-upgrades.j2
     dest: /etc/apt/apt.conf.d/50unattended-upgrades
     backup: yes

roles/common/tasks/cron.yml

@@ -1,48 +1,45 @@
 ---
-
 - name: (cron.yml) Set env entries in user crontabs
   cron:
-    name: '{{ item.name }}'
+    name: "{{ item.name }}"
-    env: 'yes'
+    env: "yes"
-    user: '{{ item.user | default("root", true) }}'
+    user: '{{ item.user | default("root") }}'
-    job: '{{ item.job }}'
+    job: "{{ item.job }}"
-    insertafter: '{{ item.insertafter | default(omit) }}'
+    insertafter: "{{ item.insertafter | default(omit) }}"
-  loop: "{{ cron_env_entries }}"
+  loop: "{{ cron_env_entries | default([]) }}"
   loop_control:
-    label: '{{ item.name }}'
+    label: "{{ item.name }}"
   when: item.job is defined
   tags:
     - user_crontab
 
-
 - name: (cron.yml) Set special time entries in user crontabs
   cron:
-    name: '{{ item.name }}'
+    name: "{{ item.name }}"
-    special_time: '{{ item.special_time }}'
+    special_time: "{{ item.special_time }}"
-    user: '{{ item.user | default("root", true) }}'
+    user: '{{ item.user | default("root") }}'
-    job: '{{ item.job }}'
+    job: "{{ item.job }}"
     state: present
-  loop: "{{ cron_user_special_time_entries }}"
+  loop: "{{ cron_user_special_time_entries | default([]) }}"
   loop_control:
-    label: '{{ item.name }}'
+    label: "{{ item.name }}"
   when: item.job is defined
   tags:
     - user_crontab
 
-
 - name: (cron.yml) Set normal entries in user crontabs
   cron:
-    name: '{{ item.name }}'
+    name: "{{ item.name }}"
-    minute: '{{ item.minute | default(omit) }}'
+    minute: "{{ item.minute | default(omit) }}"
-    hour: '{{ item.hour | default(omit) }}'
+    hour: "{{ item.hour | default(omit) }}"
-    day: '{{ day | default(omit) }}'
+    day: "{{ item.day | default(omit) }}"
-    weekday: '{{ item.weekday | default(omit) }}'
+    weekday: "{{ item.weekday | default(omit) }}"
-    month: '{{ item.month | default(omit) }}'
+    month: "{{ item.month | default(omit) }}"
-    user: '{{ item.user | default("root", true) }}'
+    user: '{{ item.user | default("root") }}'
-    job: '{{ item.job }}'
+    job: "{{ item.job }}"
-  loop: "{{ cron_user_entries }}"
+  loop: "{{ cron_user_entries | default([]) }}"
   loop_control:
-    label: '{{ item.name }}'
+    label: "{{ item.name }}"
   when: item.job is defined
   tags:
     - user_crontab

roles/common/tasks/cups-install.yml

@@ -49,7 +49,7 @@
     - cups-client
 
 - name: (cups.yml) update configuration file server - /etc/cups/cups-browsed.conf
-  template:
+  ansible.builtin.template:
     src: "etc/cups/cups-browsed.conf.server.j2"
     dest: /etc/cups/cups-browsed.conf
     owner: root
@@ -63,7 +63,7 @@
     - cups-server
 
 - name: (cups.yml) update configuration file client - /etc/cups/cups-browsed.conf
-  template:
+  ansible.builtin.template:
     src: "etc/cups/cups-browsed.conf.client.j2"
     dest: /etc/cups/cups-browsed.conf
     owner: root
@@ -94,7 +94,7 @@
     - cups-client
 
 - name: (cups.yml) update configuration file server - /etc/cups/cupsd.conf
-  template:
+  ansible.builtin.template:
     src: "etc/cups/cupsd.conf.server.j2"
     dest: /etc/cups/cupsd.conf
     owner: root
@@ -108,7 +108,7 @@
     - cups-server
 
 - name: (cups.yml) update configuration file client - /etc/cups/cupsd.conf
-  template:
+  ansible.builtin.template:
     src: "etc/cups/cupsd.conf.client.j2"
     dest: /etc/cups/cupsd.conf
     owner: root
@@ -138,7 +138,7 @@
     - cups-client
 
 - name: (cups.yml) update configuration file server - /etc/cups/cups-files.conf
-  template:
+  ansible.builtin.template:
     src: "etc/cups/cups-files.conf.j2"
     dest: /etc/cups/cups-files.conf
     owner: root

roles/common/tasks/nfs.yml

@@ -32,7 +32,7 @@
     - nfs-server
 
 - name: (nfs.yml) Copy exports file.
-  template:
+  ansible.builtin.template:
     src: etc/exports.j2
     dest: /etc/exports
     owner: root
@@ -110,7 +110,7 @@
 
 
 - name: (nfs.yml) Create/Update file '/etc/nfs.conf.d/20-start_servers.conf' from template '20-start_servers.conf.j2'
-  template:
+  ansible.builtin.template:
     src: etc/nfs.conf.d/20-start_servers.conf.j2
     dest: /etc/nfs.conf.d/20-start_servers.conf
     owner: root

roles/common/tasks/nis-install-client.yml

@@ -5,7 +5,7 @@
 # ---
 
 - name: (nis-install-client.yml) Set (nis) default domain (/etc/defaultdomain)
-  template:
+  ansible.builtin.template:
     dest: /etc/defaultdomain  
     src: etc/defaultdomain.j2
     owner: root
@@ -16,7 +16,7 @@
     - nis-install-client
 
 - name: (nis-install-client.yml) Create preconfigured /etc/yp.conf on nis clients
-  template:
+  ansible.builtin.template:
     dest: /etc/yp.conf
     src: etc/yp.conf.j2
     owner: root

roles/common/tasks/nis-install-server.yml

@@ -15,7 +15,7 @@
     - nis-install-server
 
 - name: (nis-install-server.yml) Set (nis) default domain (/etc/defaultdomain)
-  template:
+  ansible.builtin.template:
     dest: /etc/defaultdomain
     src: etc/defaultdomain.j2
     owner: root
@@ -26,7 +26,7 @@
     - nis-install-server
 
 - name: (nis-install-server.yml) Create preconfigured /etc/yp.conf on nis clients
-  template:
+  ansible.builtin.template:
     dest: /etc/yp.conf
     src: etc/yp.conf.j2
     owner: root

roles/common/tasks/ntp.yml

@@ -45,7 +45,7 @@
     - ntp-server
 
 - name: (ntp.yml) Update '/etc/ntpsec/ntp.conf'
-  template:
+  ansible.builtin.template:
     src: "etc/ntpsec/ntp.conf.j2"
     dest: /etc/ntpsec/ntp.conf
     owner: root

roles/common/tasks/pure-ftpd/configure.yml

@@ -7,7 +7,7 @@
 # Remove old current configurations if exists
 
 - name: Upload Pure-FTPd global configuration file.
-  template:
+  ansible.builtin.template:
     src: etc/default/pure-ftpd-common.j2
     dest: "{{ pureftpd_global_config_file }}"
     owner: root
@@ -35,7 +35,7 @@
 # write new configuration
 
 - name: (pure-ftpd-install.yml) Write configuration.
-  template:
+  ansible.builtin.template:
     src: etc/pure-ftpd/conf/config.j2
     dest: "{{ pureftpd_config_conf_dir }}/{{ item.key }}"
     owner: root

roles/common/tasks/pure-ftpd/setup.yml

@@ -12,7 +12,7 @@
     update_cache: yes
 
 - name: (pure-ftpd-install.yml) Upload Pure-FTPd global configuration file.
-  template:
+  ansible.builtin.template:
     src: etc/default/pure-ftpd-common.j2
     dest: "{{ pureftpd_global_config_file }}"
     owner: root

roles/common/tasks/root-files-scripts.yml

@@ -11,7 +11,7 @@
     - groups['file_server']|string is search(inventory_hostname)
 
 - name: (root_files_scripts.yml) Ensure script 'wakeup_lan.sh' is present
-  template:
+  ansible.builtin.template:
     src: "{{ role_path + '/files/' + nis_domain + '/root/bin/wakeup_lan.sh' }}"
     dest: /root/bin/wakeup_lan.sh
     owner: root

roles/common/tasks/samba-install.yml

@@ -198,15 +198,16 @@
     - samba-server
     - samba-virusfilter
 
-
 - name: (samba-config-server.yml) Configure AppArmor local profile for clamd (data paths)
-  template:
+  ansible.builtin.template:
     src: etc/apparmor.d/local/usr.sbin.clamd.j2
     dest: /etc/apparmor.d/local/usr.sbin.clamd
     owner: root
     group: root
     mode: "0644"
-  notify: Reload AppArmor profile clamd
+  notify:
+    - Reload AppArmor profile clamd
+    - Restart clamav-daemon
   when:
     - inventory_hostname in groups['samba_server']
     - samba_shares | selectattr('vfs_object_virusfilter', 'defined') |
@@ -214,7 +215,7 @@
   tags:
     - samba-server
     - samba-virusfilter
-  
+
 - name: (samba-config-server.yml) Ensure AllowAllMatchScan is enabled in clamd.conf
   lineinfile:
     path: /etc/clamav/clamd.conf
@@ -252,7 +253,7 @@
     - samba-server
 
 - name: (samba-install.yml) /etc/samba/smb.conf
-  template:
+  ansible.builtin.template:
     dest: /etc/samba/smb.conf
     src: etc/samba/smb.conf.j2
     owner: root
@@ -296,7 +297,7 @@
     - samba-cron
 
 - name: (samba-install.yml) Adjust configuration for script 'clean_samba_trash.sh'
-  template:
+  ansible.builtin.template:
     dest: /root/bin/samba/conf/clean_samba_trash.conf
     src: root/bin/samba/conf/clean_samba_trash.conf.j2
   when:
@@ -316,7 +317,7 @@
   register: clean_samba_trash_dirs
   when:
     - inventory_hostname in groups['samba_server']
-  tags: [ samba-server, samba-cron ]
+  tags: [samba-server, samba-cron]
 
 - name: (samba-config-server.yml) Creates a cron job for cleaning up samba trash dirs
   ansible.builtin.cron:
@@ -332,7 +333,7 @@
     - inventory_hostname in groups['samba_server']
     - clean_samba_trash_exists.stat.exists | bool
     - (clean_samba_trash_dirs.found | int) > 0
-  tags: [ samba-server, samba-cron ]
+  tags: [samba-server, samba-cron]
 
 # ---
 # Cronjob for setting permissions on samba shares
@@ -344,7 +345,7 @@
   register: set_permissions_on_samba_shares_exists
   when:
     - inventory_hostname in groups['samba_server']
-  tags: [ samba-server, samba-cron ]
+  tags: [samba-server, samba-cron]
 
 - name: (samba-config-server.yml) Adjust configuration for script 'set_permissions_samba_shares.sh'
   ansible.builtin.template:
@@ -353,7 +354,7 @@
   when:
     - inventory_hostname in groups['samba_server']
     - set_permissions_on_samba_shares_exists.stat.exists | bool
-  tags: [ samba-server, samba-cron ]
+  tags: [samba-server, samba-cron]
 
 - name: (samba-config-server.yml) Creates a cron job for setting permissions to samba dirs
   ansible.builtin.cron:
@@ -368,7 +369,7 @@
   when:
     - inventory_hostname in groups['samba_server']
     - (clean_samba_trash_dirs.found | int) > 0 # << int -> bool
-  tags: [ samba-server, samba-cron ]
+  tags: [samba-server, samba-cron]
 
 # ---
 # Samba clients

roles/common/tasks/sshd.yml

@@ -64,7 +64,7 @@
 
 
 - name: (sshd.yml) Create new sshd_config from template sshd_config.j2
-  template:
+  ansible.builtin.template:
     src: etc/ssh/sshd_config.ubuntu.j2
     dest: /etc/ssh/sshd_config
     owner: root
@@ -80,7 +80,7 @@
 
 
 - name: (sshd.yml) Create/Update new sshd_config from template sshd_config.j2
-  template:
+  ansible.builtin.template:
     src: etc/ssh/sshd_config.j2
     dest: /etc/ssh/sshd_config
     owner: root
@@ -96,7 +96,7 @@
     - sshd-config
 
 - name: (sshd.yml) Create/Update sshd_config for chrooted sftp_group from template sshd_config.j2
-  template:
+  ansible.builtin.template:
     src: etc/ssh/sshd_config.j2
     dest: /etc/ssh/sshd_config
     owner: root
@@ -137,7 +137,7 @@
     - sshd-config
 
 - name: (sshd.yml) Create/Update file '/etc/ssh/sshd_config.d/50-sshd-local.conf' from template sshd_config.j2
-  template:
+  ansible.builtin.template:
     src: etc/ssh/sshd_config.j2
     dest: /etc/ssh/sshd_config.d/50-sshd-local.conf
     owner: root

roles/common/tasks/sudoers-pc.yml

@@ -1,7 +1,7 @@
 ---
 
 - name: (sudoers-pc.yml) update specific sudoers configuration files (/etc/sudoers.d/)
-  template:
+  ansible.builtin.template:
     src: etc/sudoers.d/50-user.pc.j2
     dest: /etc/sudoers.d/50-user
     validate: visudo -cf %s
@@ -12,7 +12,7 @@
     - sudoers-file-configuration
 
 - name: (sudoers-pc.yml) update global sudoers configuration file
-  template:
+  ansible.builtin.template:
     src: etc/sudoers.pc.j2
     dest: /etc/sudoers
     owner: root

roles/common/tasks/sudoers-server.yml

@@ -26,7 +26,7 @@
     - sudoers-remove
 
 - name: (sudoers-server.yml) update specific sudoers configuration files (/etc/sudoers.d/)
-  template:
+  ansible.builtin.template:
     src: etc/sudoers.d/50-user.server.j2
     dest: /etc/sudoers.d/50-user
     #validate: visudo -cf %s
@@ -37,7 +37,7 @@
     - sudoers-file-configuration
 
 - name: (sudoers-server.yml) update global sudoers configuration file
-  template:
+  ansible.builtin.template:
     src: etc/sudoers.server.j2
     dest: /etc/sudoers
     owner: root

roles/common/tasks/systemd-resolved.yml

@@ -67,7 +67,7 @@
     owner: root
 
 - name: (systemd-resolved.yml) Create/Update file '/etc/systemd/resolved.conf.d/50-resolved-local.conf' from template sshd_config.j2
-  template:
+  ansible.builtin.template:
     src: etc/systemd/resolved.conf.d/50-resolved-local.conf
     dest: /etc/systemd/resolved.conf.d/50-resolved-local.conf
     owner: root

roles/common/tasks/ubuntu-x11vnc-1604-amd64.yml

@@ -32,7 +32,7 @@
      mode: 0644
 
   - name: "(ubuntu-x11vnc-1604-amd64.yml) Transfer x11vnc.service.j2 to /lib/systemd/system/x11vnc.service"
-    template:
+    ansible.builtin.template:
       src: lib/systemd/system/x11vnc.service.j2
       dest: /lib/systemd/system/x11vnc.service
 

roles/common/tasks/ubuntu-x11vnc-1804-amd64.yml

@@ -48,7 +48,7 @@
      mode: 0644
 
   - name: "(ubuntu-x11vnc-1804-amd64.yml) Transfer x11vnc.service.j2 to /lib/systemd/system/x11vnc.service"
-    template:
+    ansible.builtin.template:
       src: lib/systemd/system/x11vnc-gdm3.service-ALT.j2
       dest: /lib/systemd/system/x11vnc.service
 

roles/common/tasks/ubuntu-x11vnc-2004-amd64.yml

@@ -51,7 +51,7 @@
       mode: 0644
 
   - name: "(ubuntu-x11vnc-2004-amd64.yml) Transfer x11vnc.service.j2 to /lib/systemd/system/x11vnc.service"
-    template:
+    ansible.builtin.template:
       src: lib/systemd/system/x11vnc-gdm3.service.j2
       dest: /lib/systemd/system/x11vnc.service
 

roles/common/tasks/ubuntu-x11vnc-2204-amd64.yml

@@ -51,7 +51,7 @@
       mode: 0644
 
   - name: "(ubuntu-x11vnc-2204-amd64.yml) Transfer x11vnc.service.j2 to /lib/systemd/system/x11vnc.service"
-    template:
+    ansible.builtin.template:
       src: lib/systemd/system/x11vnc-gdm3.service.j2
       dest: /lib/systemd/system/x11vnc.service
 

roles/common/tasks/ubuntu-x11vnc-2404-amd64.yml

@@ -51,7 +51,7 @@
       mode: 0644
 
   - name: "(ubuntu-x11vnc-2404-amd64.yml) Transfer x11vnc.service.j2 to /lib/systemd/system/x11vnc.service"
-    template:
+    ansible.builtin.template:
       src: lib/systemd/system/x11vnc-gdm3.service.j2
       dest: /lib/systemd/system/x11vnc.service
 

roles/common/templates/etc/apt/deb822/backports.sources.j2

@@ -0,0 +1,12 @@
+# {{ ansible_managed }}
+#
+# Managed by Ansible: deb822 definition for the Debian backports repository.
+# It enables deb-src only when apt_src_enable is true and sets Signed-By only
+# when apt_deb822_use_signed_by is enabled.
+Types: {{ 'deb deb-src' if apt_src_enable | default(true) | bool else 'deb' }}
+URIs: {{ apt_debian_mirror }}
+Suites: {{ ansible_facts['distribution_release'] }}-backports
+Components: main contrib non-free non-free-firmware
+{% if apt_deb822_use_signed_by | default(true) | bool %}
+Signed-By: {{ apt_deb822_signed_by_keyring | default('/usr/share/keyrings/debian-archive-keyring.gpg') }}
+{% endif %}

roles/common/templates/etc/apt/deb822/debian.sources.j2

@@ -0,0 +1,10 @@
+# {{ ansible_managed }}
+#
+# Verwaltet via Ansible - Debian Basis & Updates fuer {{ ansible_facts['distribution_release'] }}
+Types: {{ 'deb deb-src' if apt_src_enable | default(true) | bool else 'deb' }}
+URIs: {{ apt_debian_mirror }}
+Suites: {{ ansible_facts['distribution_release'] }} {{ ansible_facts['distribution_release'] }}-updates
+Components: main contrib non-free non-free-firmware
+{% if apt_deb822_use_signed_by | default(true) | bool %}
+Signed-By: {{ apt_deb822_signed_by_keyring | default('/usr/share/keyrings/debian-archive-keyring.gpg') }}
+{% endif %}

roles/common/templates/etc/apt/deb822/security.sources.j2

@@ -0,0 +1,10 @@
+# {{ ansible_managed }}
+#
+# Verwaltet via Ansible - Security fuer {{ ansible_facts['distribution_release'] }}
+Types: {{ 'deb deb-src' if apt_src_enable | default(true) | bool else 'deb' }}
+URIs: http://security.debian.org/debian-security
+Suites: {{ ansible_facts['distribution_release'] }}-security
+Components: main contrib non-free non-free-firmware
+{% if apt_deb822_use_signed_by | default(true) | bool %}
+Signed-By: {{ apt_deb822_signed_by_keyring | default('/usr/share/keyrings/debian-archive-keyring.gpg') }}
+{% endif %}

roles/common/templates/etc/samba/smb.conf.j2

@@ -342,7 +342,10 @@
    virusfilter:cache entry limit = 1000
    virusfilter:cache time limit = 60
 
-   virusfilter:max file size = 26214400
+   # Dateigröße: Was wird gescannt?
+   #virusfilter:max file size = 52428800   # 50 MB max
+   #virusfilter:max file size = 26214400   # 25 MB max
+   virusfilter:max file size = 15728640   # 15 MB max
    virusfilter:min file size = 10
 
    virusfilter:scan on open = yes
@@ -522,13 +525,28 @@
 
    # Dateigröße: Was wird gescannt?
    #virusfilter:max file size = 52428800   # 50 MB max
-   virusfilter:max file size = 26214400   # 25 MB max
+   #virusfilter:max file size = 26214400   # 25 MB max
+   virusfilter:max file size = 15728640   # 15 MB max
    virusfilter:min file size = 10         # unter 10 Byte ignorieren
 
    # Scan-Zeitpunkt: nur beim Öffnen, nicht beim Schließen
    virusfilter:scan on open = yes
    virusfilter:scan on close = yes
 
+{%      set virusfilter_include_files = item.vfs_object_virusfilter_include_files | default([]) %}
+{%      set virusfilter_exclude_files = item.vfs_object_virusfilter_exlude_files | default(item.vfs_object_virusfilter_exclude_files | default([])) %}
+{%      if virusfilter_include_files | length > 0 %}
+   # Nur diese Dateiendungen vom Virusfilter pruefen.
+   virusfilter:include files = \.({{ virusfilter_include_files | join('|') }})$
+{%         if virusfilter_exclude_files | length > 0 %}
+   # Include und Exclude sind gesetzt: Include hat Vorrang, Exclude wird ignoriert.
+   #virusfilter:exclude files = \.({{ virusfilter_exclude_files | join('|') }})$
+{%         endif %}
+{%      elif virusfilter_exclude_files | length > 0 %}
+   # Diese Dateiendungen von der Viruspruefung ausschliessen.
+   virusfilter:exclude files = \.({{ virusfilter_exclude_files | join('|') }})$
+{%      endif %}
+
    # Fehlercode bei infizierter Datei (beim Öffnen)
    virusfilter:infected file errno on open = EACCES
 

roles/network_interfaces/tasks/interfaces.yml

@@ -14,7 +14,7 @@
     - network-interfaces
 
 - name: (interfaces.yml) Ensure interfaces file is latest
-  template:
+  ansible.builtin.template:
     src: "etc/network/interfaces.j2"
     dest: /etc/network/interfaces
   with_items: network_interfaces
@@ -22,7 +22,7 @@
     - network-interfaces
 
 - name: (interfaces.yml) Ensure imported device files at interfaces.d are latest
-  template:
+  ansible.builtin.template:
     src: "etc/network/interfaces.d/device.j2"
     dest: "{{ network_interface_path }}/device-{{ item.0 }}"
   with_items: