REFACTOR: files fixed according to ansible-lint

inventory/group_vars/all/main.yaml

@@ -1,3 +1,3 @@
 ---
 
-ansible_become_passwd: "{{ ansible_password }}"
+ansible_become_passwd: "{{ ansible_password }}"

inventory/group_vars/all/secrets template.yaml

@@ -12,4 +12,4 @@ ntfy_topic_token: t0ken
 # Home Assistant Webhook token
 ha_webhook_token: h@_t0ken
 # Proxmox API token secret
-proxmox_token_secret: t0ken_$ecret
+proxmox_token_secret: t0ken_$ecret

roles/basic_postinstall/tasks/create_new_user.yaml

@@ -1,7 +1,7 @@
 ---
 - name: Create a new user with a password, set shell
   remote_user: ansible
-  user: 
+  ansible.builtin.user:
     name: max
     groups: sshusers,sudo
     password: "{{ user_passwd_hash }}"
@@ -12,12 +12,12 @@
   ansible.posix.authorized_key:
     user: max
     state: present
-    key: "{{ lookup('file', lookup('env','HOME') + '/.ssh/ansible_key.pub') }}"
+    key: "{{ lookup('file', lookup('env', 'HOME') + '/.ssh/ansible_key.pub') }}"
 
 - name: Copy omz installation wrapper script to the target machine
   remote_user: ansible
-  copy:
-    src: ../files/install_omz.sh
+  ansible.builtin.copy:
+    src: "{{ role_path }}/files/install_omz.sh"
     dest: /home/max/install_omz.sh
     owner: max
     group: max
@@ -26,13 +26,14 @@
 # WARNING: UNPRIVILEGED USER (not ansible) COMMANDS
 - name: Install oh my zsh
   remote_user: max
-  become: no
-  command: /home/max/install_omz.sh 
+  become: false
+  ansible.builtin.command: /home/max/install_omz.sh
+  changed_when: true
 
 - name: Configure oh my zsh, by pushing the config file
   remote_user: ansible
-  copy:
-    src: ../files/.zshrc
+  ansible.builtin.copy:
+    src: "{{ role_path }}/files/.zshrc"
     dest: /home/max/.zshrc
     owner: max
     group: max
@@ -40,8 +41,8 @@
 
 - name: Configure vim, by pushing the config
   remote_user: ansible
-  copy:
-    src: ../files/.vimrc
+  ansible.builtin.copy:
+    src: "{{ role_path }}/files/.vimrc"
     dest: /home/max/.vimrc
     owner: max
     group: max
@@ -55,11 +56,11 @@
   ansible.posix.authorized_key:
     user: max
     state: absent
-    key: "{{ lookup('file', lookup('env','HOME') + '/.ssh/ansible_key.pub') }}"
+    key: "{{ lookup('file', lookup('env', 'HOME') + '/.ssh/ansible_key.pub') }}"
 
 - name: Set authorized key taken from file
   remote_user: ansible
   ansible.posix.authorized_key:
     user: max
     state: present
-    key: "{{ lookup('file', lookup('env','HOME') + '/.ssh/max_regular_key.pub') }}"
+    key: "{{ lookup('file', lookup('env', 'HOME') + '/.ssh/max_regular_key.pub') }}"

roles/basic_postinstall/tasks/main.yaml

@@ -15,4 +15,4 @@
   ansible.builtin.include_tasks: create_new_user.yaml
 
 - name: Set locale and time
-  ansible.builtin.include_tasks: set_locale_and_time.yaml
+  ansible.builtin.include_tasks: set_locale_and_time.yaml

roles/basic_postinstall/tasks/prepare_ansible_user.yaml

@@ -1,20 +1,20 @@
 ---
 ## Installing packages
 - name: Install sudo on apt systems
-  when: (ansible_facts['distribution'] == "Debian") or 
+  when: (ansible_facts['distribution'] == "Debian") or
         (ansible_facts['distribution'] == "Ubuntu")
-  apt:
+  ansible.builtin.apt:
     name:
       - sudo
-    update-cache: yes
+    update-cache: true
 
-- name: Update Alpine packages
+# The same commands for Alpine
+- name: Update and install packages on Alpine
   when: (ansible_facts['distribution'] == "Alpine")
-  command: /sbin/apk update
-
-- name: Install sudo package on Alpine
-  when: (ansible_facts['distribution'] == "Alpine")
-  command: /sbin/apk add sudo
+  community.general.apk:
+    name: sudo
+    update_cache: true
+  remote_user: ansible
 
 
 ## Creating and setting up the ansible user
@@ -26,16 +26,16 @@
 
 ## Add the user to sshusers (for ssh access) and sudo (gain root access)
 - name: Create a new user with a password for Ansible
-  user: 
+  ansible.builtin.user:
     name: ansible
     password: "{{ ansible_user_passwd_hash }}"
 
     groups: sshusers,sudo
-    append: yes
+    append: true
 
-## Since password authentication in SSH will be disabled, we need to add an authorized key 
+## Since password authentication in SSH will be disabled, we need to add an authorized key
 - name: Set authorized key taken from file
   ansible.posix.authorized_key:
     user: ansible
     state: present
-    key: "{{ ansible_ssh_key }}"
+    key: "{{ ansible_ssh_key }}"

roles/basic_postinstall/tasks/remove_packages.yaml

@@ -2,26 +2,30 @@
 # Remove multiple packages at once
 - name: Remove unnecessary packages
   remote_user: ansible
-  when: (ansible_facts['distribution'] == "Debian") or 
+  when: (ansible_facts['distribution'] == "Debian") or
         (ansible_facts['distribution'] == "Ubuntu")
-  apt:
+  ansible.builtin.apt:
     name:
       - nano
     state: absent
-  become: yes
+  become: true
 
 
 # Clean up all orphaned packages
 - name: Remove all orphaned dependencies
   remote_user: ansible
-  when: (ansible_facts['distribution'] == "Debian") or 
+  when: (ansible_facts['distribution'] == "Debian") or
         (ansible_facts['distribution'] == "Ubuntu")
-  apt:
-    autoremove: yes
-    purge: yes
+  ansible.builtin.apt:
+    autoremove: true
+    purge: true
 
 
 - name: Install sudo package on Alpine
   remote_user: ansible
   when: (ansible_facts['distribution'] == "Alpine")
-  command: /sbin/apk del nano
+  community.general.apk:
+    name:
+      - nano
+    state: absent
+  become: true

roles/basic_postinstall/tasks/set_locale_and_time.yaml

@@ -1,9 +1,9 @@
 ---
 - name: Generate locales
-  ansible.builtin.locale_gen:
+  community.general.locale_gen:
     name:
-        - en_US.UTF-8
-        - ru_RU.UTF-8
+      - en_US.UTF-8
+      - ru_RU.UTF-8
     state: present
 
 - name: Set locale
@@ -15,5 +15,5 @@
       LC_ALL=en_US.UTF-8
 
 - name: Set time
-  ansible.builtin.timezone:
-    name: Europe/Samara
+  community.general.timezone:
+    name: Europe/Samara

roles/common_healthcheck/tasks/main.yaml

@@ -2,14 +2,14 @@
 - name: Internet connection test block
   block:
     - name: Test reachability to ya.ru
-      become: yes # Usually it's not necessary, but sometimes there are some wierd issues with ping, especially on Alpine 
-      shell: ping -c 5 ya.ru > /dev/null
+      become: true # Usually it's not necessary, but sometimes there are some wierd issues with ping, especially on Alpine
+      ansible.builtin.shell: ping -c 5 ya.ru > /dev/null
       changed_when: false   # This task does not change the system
-  
+
   rescue:
-    # This won't work for now. CA certificate reissuing is required!git 
+    # This won't work for now. CA certificate reissuing is required!
     - name: Create a test file
-      become: no
+      become: false
       ansible.builtin.uri:
         url: "{{ ha_addr }}/api/webhook/{{ ha_webhook_token }}"
         ca_path: ../files/ca.pem
@@ -20,19 +20,25 @@
 - name: Disk free space test block
   block:
     - name: Test free disk space in root
-      become: no
-      shell: df -h / | tail -1 | awk '{gsub(/%/, "", $5); print $5}' 
-      register: result
-      failed_when: result.stdout | int > 85
+      become: false
+      ansible.builtin.shell: set -o pipefail && df -h / | tail -1 | awk '{gsub(/%/, "", $5); print $5}'
+      register: common_healthcheck_result
+      failed_when: common_healthcheck_result.stdout | int > 1
       changed_when: false   # This task does not change the system
-  
+
   rescue:
     - name: Notify with ntfy
-      become: no
-      ansible.builtin.command: |
-        curl -H "Authorization: Bearer {{ ntfy_topic_token }}" \
-        -d "{{ ansible_facts['hostname'] }}: Disk space is low" \
-        {{ ntfy_topic }}
-      delegate_to: 127.0.0.1 
-      failed_when: false 
+      become: false
+      ansible.builtin.uri:
+        url: "{{ ntfy_topic }}"
+        method: POST
+        body_format: json
+        status_code: [200, 202]
+        return_content: true
+        headers:
+          Authorization: "Bearer {{ ntfy_topic_token }}"
+        body:
+          - "{{ ansible_facts['hostname'] }}: Disk space is low"
+      delegate_to: 127.0.0.1
+      failed_when: false
       changed_when: false   # This task does not change the system