style

README.md

@@ -1,5 +1,3 @@
-# Ansible Collection
-
 Opinionated set of roles to configure reasonable defaults for newly provisioned virtual machines. The repository provides a ready-to-use Ansible Collection (`studiovitali.ansible`) containing reusable roles.
 
 Currently only supports Debian-based systems.

galaxy.yml

@@ -3,7 +3,7 @@
 namespace: studiovitali
 name: ansible
 readme: README.md
-version: 0.0.1
+version: 0.1.1
 authors:
   - Studio Vitali
 description: Studio Ansible collection containing common roles

roles/base/defaults/main.yml

@@ -9,6 +9,6 @@ base_packages:
   - rsync
   - unzip
   - unattended-upgrades
-  # - acl ## needed for Ansible to become unprivileged user
+  # - acl ## needed for ansible to become unprivileged user
   # - python3-pip
   # - wget

roles/base/handlers/main.yml

@@ -0,0 +1,13 @@
+---
+- name: Reboot system
+  block:
+    - name: Check if reboot is required
+      ansible.builtin.stat:
+        path: /var/run/reboot-required
+      register: reboot_required_file
+
+    - name: Reboot host if necessary
+      become: true
+      ansible.builtin.reboot:
+        post_reboot_delay: 10
+      when: reboot_required_file.stat.exists

roles/base/tasks/main.yml

@@ -1,18 +1,20 @@
 ---
 - name: Set system timezone
+  become: true
   community.general.timezone:
     # name: "{{ base_timezone }}"
     name: Europe/Zurich
-  become: true
 
 - name: Fully upgrade system
+  become: true
   ansible.builtin.apt:
     update_cache: true
     upgrade: dist
     cache_valid_time: 3600
-  become: true
+  notify: Reboot system
 
 - name: Install essential system utilities
+  become: true
   ansible.builtin.apt:
     # name: "{{ base_packages }}"
     name:
@@ -25,8 +27,7 @@
       - unattended-upgrades
     state: present
     update_cache: true
-  become: true
+
-#
 # - name: Enable unattended-upgrades
 #   ansible.builtin.copy:
 #     dest: /etc/apt/apt.conf.d/20auto-upgrades
@@ -34,4 +35,4 @@
 #       APT::Periodic::Update-Package-Lists "1";
 #       APT::Periodic::Unattended-Upgrade "1";
 #     mode: "0644"
-#   when: ansible_facts['os_family'] == "Debian"
+#   when: ansible_facts['os_family'] == "Debian"

roles/security/handlers/main.yml

@@ -1,5 +1,6 @@
 ---
 - name: Restart sshd
+  become: true
   ansible.builtin.service:
     name: ssh
     state: restarted

roles/security/tasks/main.yml

@@ -17,6 +17,7 @@
         owner: root
         group: root
         mode: "0644"
+        validate: /usr/sbin/sshd -t -f %s
       notify: Restart sshd
 
 - name: Enable fail2ban
@@ -32,4 +33,4 @@
       ansible.builtin.service:
         name: fail2ban
         state: started
-        enabled: yes
+        enabled: true