feat: use ansible block

tasks/apt/cleanup.yaml

@@ -1,18 +1,22 @@
 ---
 
-# clean apt cache
+# apt cleanup
-- name: "apt - clean cache"
+- name: "apt cleanup"
+  block:
+
+    # clean apt cache
+    - name: "apt - clean cache"
       ansible.builtin.apt:
         clean: true
       changed_when: false
       failed_when: false
-  tags: "apt-cleanup"
       when: 'ansible_os_family == "Debian"'
 
-# run fstrim if target is a VM
+    # run fstrim if target is a VM
-- name: "fstrim"
+    - name: "fstrim"
       ansible.builtin.command: "fstrim /"
       changed_when: false
       failed_when: false
-  tags: "apt-cleanup"
       when: 'type == "vm"'
+
+  tags: "apt-cleanup"

tasks/apt/config.yaml

@@ -1,7 +1,11 @@
 ---
 
-# configure apt auto update
+# apt config
-- name: "apt - config - configure apt periodic"
+- name: "apt config"
+  block:
+
+    # configure apt auto update
+    - name: "apt - config - configure apt periodic"
       ansible.builtin.template:
         src: "templates/apt/conf.d/10periodic.j2"
         dest: "/etc/apt/apt.conf.d/10periodic"
@@ -9,10 +13,8 @@
         group: "root"
         mode: "0644"
       when: 'ansible_os_family == "Debian"'
-  tags:
-    - "apt"
 
-- name: "apt - config - configure apt unatteded updates"
+    - name: "apt - config - configure apt unatteded updates"
       ansible.builtin.template:
         src: "templates/apt/conf.d/50unattended-upgrades.{{ ansible_distribution }}.j2"
         dest: "/etc/apt/apt.conf.d/50unattended-upgrades"
@@ -20,5 +22,6 @@
         group: "root"
         mode: "0644"
       when: 'ansible_os_family == "Debian"'
+
   tags:
     - "apt"

tasks/apt/packages.yaml

@@ -1,7 +1,11 @@
 ---
 
-# install packages
+# apt packages
-- name: "apt - install - packages"
+- name: "apt packages"
+  block:
+
+    # install packages
+    - name: "apt - install - packages"
       ansible.builtin.apt:
         name: "{{ apt_default_install }}"
         state: "present"
@@ -10,11 +14,9 @@
       loop: "{{ apt_default_packages_install }}"
       loop_control:
         loop_var: "apt_default_install"
-  tags:
-    - "apt"
 
-# purge packages
+    # purge packages
-- name: "apt - delete - packages"
+    - name: "apt - delete - packages"
       ansible.builtin.apt:
         name: "{{ apt_default_delete }}"
         state: "absent"
@@ -23,5 +25,6 @@
       loop: "{{ apt_default_packages_delete }}"
       loop_control:
         loop_var: "apt_default_delete"
+
   tags:
   - "apt"

tasks/apt/sources.yaml

@@ -1,7 +1,11 @@
 ---
 
-# configure apt sources
+# manage apt sources
-- name: "apt - config - configure apt sources"
+- name: "manage apt sources"
+  block:
+
+    # configure apt sources
+    - name: "apt - config - configure apt sources"
       ansible.builtin.template:
         src: "templates/apt/sources.d/sources.list.{{ ansible_distribution }}.j2"
         dest: "/etc/apt/sources.list"
@@ -12,11 +16,9 @@
         - 'ansible_os_family == "Debian"'
         - 'ansible_distribution_major_version <= "23"'
       notify: "apt force cache update"
-  tags:
-    - "apt"
 
-# configure apt sources
+    # configure apt sources
-- name: "apt - config - configure apt sources"
+    - name: "apt - config - configure apt sources"
       ansible.builtin.template:
         src: "templates/apt/sources.d/{{ ansible_distribution }}.sources.j2"
         dest: "/etc/apt/sources.list.d/ubuntu.sources"
@@ -27,16 +29,15 @@
         - 'ansible_distribution == "Ubuntu"'
         - 'ansible_distribution_major_version >= "24"'
       notify: "apt force cache update"
-  tags:
-    - "apt"
 
-# delete unused sources.list
+    # delete unused sources.list
-- name: "apt - config - remove old sources.list"
+    - name: "apt - config - remove old sources.list"
       ansible.builtin.file:
         path: "/etc/apt/sources.list"
         state: "absent"
       when:
         - 'ansible_distribution == "Ubuntu"'
         - 'ansible_distribution_major_version >= "24"'
+
   tags:
     - "apt"

tasks/firewall/firewall-rules-routed.yaml

@@ -1,7 +1,11 @@
 ---
 
 # basic firewall rules
-- name: "firewall - allow incoming routed traffic"
+- name: "basic firewall rules"
+  block:
+
+    # basic firewall rules
+    - name: "firewall - allow incoming routed traffic"
       community.general.ufw:
         rule: "allow"
         route: "yes"
@@ -10,10 +14,8 @@
       with_nested:
         - "{{ __rule['source_nets'] }}"
         - "{{ __rule['destination_nets'] }}"
-  tags:
-    - "firewall"
 
-- name: "firewall - allow outgoing routed traffic"
+    - name: "firewall - allow outgoing routed traffic"
       community.general.ufw:
         rule: "allow"
         route: "yes"
@@ -22,5 +24,6 @@
       with_nested:
         - "{{ __rule['source_nets'] }}"
         - "{{ __rule['destination_nets'] }}"
+        
   tags:
     - "firewall"

tasks/main.yaml

@@ -1,35 +1,18 @@
 ---
 
-# check os support
+# import ossupport and load variables
-- name: "check for os support"
+- name: "import ossupport and load variables"
-  ansible.builtin.import_tasks: "ossupport.yaml"
+  block:
-  tags:
-    - "apt"
-    - "apt-cleanup"
-    - "cron"
-    - "environment-file"
-    - "hostname"
-    - "firewall"
-    - "journald"
-    - "locale"
-    - "lldp"
-    - "lxd"
-    - "motd"
-    - "ntp"
-    - "telemetry"
-    - "snap"
-    - "sshd"
-    - "swap"
-    - "sysctl"
-    - "systemctl"
-    - "syslog"
-    - "timezone"
-    - "usermanagement"
 
-# load os variables
+    # check os support
-- name: "include os specific vars"
+    - name: "check for os support"
+      ansible.builtin.import_tasks: "ossupport.yaml"
+
+    # load os variables
+    - name: "include os specific vars"
       ansible.builtin.include_vars: "{{ ansible_os_family }}.yaml"
       when: "os_support"
+
   tags:
     - "apt"
     - "apt-cleanup"

tasks/motd.yaml

@@ -1,37 +1,34 @@
 ---
 
-# find old motd files
+- name: "manage motd"
-- name: "motd - find old scripts"
+  block:
+
+    # find old motd files
+    - name: "motd - find old scripts"
       ansible.builtin.find:
         paths: "/etc/update-motd.d/"
         file_type: "file"
         excludes:
           - "10-custom-motd"
       register: "old_motd"
-  tags:
-    - "motd"
 
-# remove old custom motd files
+    # remove old custom motd files
-- name: "motd - cleanup directory"
+    - name: "motd - cleanup directory"
       ansible.builtin.file:
         path: "{{ item.path }}"
         state: "absent"
       loop: "{{ old_motd.files }}"
       when: "old_motd.files|length > 0"
-  tags:
-    - "motd"
 
-# remove old motd files
+    # remove old motd files
-- name: "motd - cleanup main file"
+    - name: "motd - cleanup main file"
       ansible.builtin.file:
         path: "/etc/motd"
         state: "absent"
       when: "inventory_hostname != 'bastion.siempie.internal'"
-  tags:
-    - "motd"
 
-# configure motd
+    # configure motd
-- name: "motd - siempie"
+    - name: "motd - siempie"
       ansible.builtin.template:
         src: "templates/motd/motd.sh.j2"
         dest: "/etc/update-motd.d/10-custom-motd"
@@ -39,5 +36,6 @@
         group: "root"
         mode: "0755"
       when: 'ansible_os_family == "Debian"'
+
   tags:
     - "motd"

tasks/ntp.yaml

@@ -1,16 +1,17 @@
 ---
 
-# install chrony
+- name: "manage ntp"
-- name: "ntp - install - chrony debian"
+  block:
+
+    # install chrony
+    - name: "ntp - install - chrony debian"
       ansible.builtin.apt:
         name: "chrony"
         state: "present"
       when: 'ansible_os_family == "Debian"'
-  tags:
-    - "ntp"
 
-# configure chrony
+    # configure chrony
-- name: "ntp - config - configure chrony"
+    - name: "ntp - config - configure chrony"
       ansible.builtin.template:
         src: "templates/chrony/chrony.conf.j2"
         dest: "/etc/chrony/chrony.conf"
@@ -19,5 +20,6 @@
         mode: "0644"
       when: 'ansible_os_family == "Debian"'
       notify: "restart chrony"
+
   tags:
     - "ntp"

tasks/snap/snap_daemon.yaml

@@ -1,38 +1,37 @@
 ---
 
-# set defaults
+# manage snapd
-- name: "set facts"
+- name: "manage snapd"
+  block: 
+
+    # set defaults
+    - name: "set facts"
       ansible.builtin.set_fact:
         __snapd_service: "{{ snapd_service | default('false') }}"
-  tags:
-    - "snap"
 
-# purge snapd
+    # purge snapd
-- name: "snapd - purge - package"
+    - name: "snapd - purge - package"
       ansible.builtin.apt:
         name: "snapd"
         state: "absent"
         purge: "yes"
       when: "not __snapd_service"
-  tags:
-    - "snap"
 
-# install snapd
+    # install snapd
-- name: "snapd - install - package"
+    - name: "snapd - install - package"
       ansible.builtin.apt:
         name: "snapd"
         state: "present"
         cache_valid_time: "120"
       when: "__snapd_service"
-  tags:
-    - "snap"
 
-# enable snapd
+    # enable snapd
-- name: "snapd - enable snapd service"
+    - name: "snapd - enable snapd service"
       ansible.builtin.service:
         name: "snapd"
         state: "started"
         enabled: true
       when: "__snapd_service"
+
   tags:
     - "snap"

tasks/swap.yaml

@@ -1,48 +1,42 @@
 ---
 
-# enable or disable swap
+# manage swap
-- name: "swap - set variable"
+- name: "manage swap"
+  block:
+
+    # enable or disable swap
+    - name: "swap - set variable"
       ansible.builtin.set_fact:
         __swap: "{{ swap | default('true') }}"
-  tags:
-    - "swap"
 
-# verify swapfile
+    # verify swapfile
-- name: "swap - verify swapfile"
+    - name: "swap - verify swapfile"
       ansible.builtin.stat:
         path: "{{ swap_file_location | default('/swapfile') }}"
       register: "swap_file_check"
-  tags:
-    - "swap"
 
-## create swap
+    ## create swap
-# create swap file
+    # create swap file
-- name: "swap - create swap file"
+    - name: "swap - create swap file"
       ansible.builtin.command: "fallocate -l {{ swap_file_size }} {{ swap_file_location }}"
       when: "not swap_file_check.stat.exists and __swap"
-  tags:
-    - "swap"
 
-# set swap file permissions
+    # set swap file permissions
-- name: "swap - set permissions "
+    - name: "swap - set permissions "
       ansible.builtin.file:
         path: "{{ swap_file_location }}"
         owner: "root"
         group: "root"
         mode: "0600"
       when: "__swap"
-  tags:
-    - "swap"
 
-# 'format' swapfile
+    # 'format' swapfile
-- name: "swap - format swap file"
+    - name: "swap - format swap file"
       ansible.builtin.command: "mkswap {{ swap_file_location }}"
       when: "not swap_file_check.stat.exists and __swap"
-  tags:
-    - "swap"
 
-# configure fstab
+    # configure fstab
-- name: "swap - configure fstab"
+    - name: "swap - configure fstab"
       ansible.posix.mount:
         name: "swapfile"
         src: "{{ swap_file_location | default('/swapfile') }}"
@@ -52,35 +46,27 @@
         dump: "0"
         state: "present"
       when: "__swap"
-  tags:
-    - "swap"
 
-# enable swap
+    # enable swap
-- name: "swap - enable swap"
+    - name: "swap - enable swap"
       ansible.builtin.command: "swapon -a"
       when: "not swap_file_check.stat.exists and __swap"
-  tags:
-    - "swap"
 
-## delete swap
+    ## delete swap
-# disable swap
+    # disable swap
-- name: "swap - disable swap"
+    - name: "swap - disable swap"
       ansible.builtin.command: "swapoff -a"
       when: "swap_file_check.stat.exists and not __swap"
-  tags:
-    - "swap"
 
-# delete swap file
+    # delete swap file
-- name: "swap - delete swap file"
+    - name: "swap - delete swap file"
       ansible.builtin.file:
         path: "{{ swap_file_location }}"
         state: "absent"
       when: "swap_file_check.stat.exists and not __swap"
-  tags:
-    - "swap"
 
-# configure fstab
+    # configure fstab
-- name: "swap - configure fstab"
+    - name: "swap - configure fstab"
       ansible.posix.mount:
         name: "swapfile"
         src: "{{ swap_file_location | default('/swapfile') }}"
@@ -90,5 +76,6 @@
         dump: "0"
         state: "absent"
       when: "not __swap"
+
   tags:
     - "swap"

tasks/syslog/config.yaml

@@ -1,7 +1,11 @@
 ---
 
-# configure rsyslogd - debian
+# manage syslog
-- name: "syslog - config - rsyslog - debian"
+- name: "manage syslog"
+  block:
+
+    # configure rsyslogd - debian
+    - name: "syslog - config - rsyslog - debian"
       ansible.builtin.template:
         src: "templates/syslog/rsyslog/rsyslog.debian.conf.j2"
         dest: "/etc/rsyslog.conf"
@@ -10,11 +14,9 @@
         mode: "0644"
       when: 'ansible_distribution == "Debian"'
       notify: "restart rsyslog"
-  tags:
-    - "syslog"
 
-# configure rsyslogd - ubuntu
+    # configure rsyslogd - ubuntu
-- name: "syslog - config - rsyslog - ubuntu"
+    - name: "syslog - config - rsyslog - ubuntu"
       ansible.builtin.template:
         src: "templates/syslog/rsyslog/rsyslog.ubuntu.conf.j2"
         dest: "/etc/rsyslog.conf"
@@ -23,11 +25,9 @@
         mode: "0644"
       when: 'ansible_distribution == "Ubuntu"'
       notify: "restart rsyslog"
-  tags:
-    - "syslog"
 
-# configure rsyslogd - apt
+    # configure rsyslogd - apt
-- name: "syslog - config - apt"
+    - name: "syslog - config - apt"
       ansible.builtin.template:
         src: "templates/syslog/rsyslog.d/apt.conf.j2"
         dest: "/etc/rsyslog.d/apt.conf"
@@ -36,11 +36,9 @@
         mode: "0644"
       when: 'ansible_os_family == "Debian"'
       notify: "restart rsyslog"
-  tags:
-    - "syslog"
 
-# configure rsyslogd - observium
+    # configure rsyslogd - observium
-- name: "syslog - config - remote-logging"
+    - name: "syslog - config - remote-logging"
       ansible.builtin.template:
         src: "templates/syslog/rsyslog.d/remote-logging.j2"
         dest: "/etc/rsyslog.d/remote-logging.conf"
@@ -49,5 +47,6 @@
         mode: "0644"
       when: 'ansible_os_family == "Debian"'
       notify: "restart rsyslog"
+
   tags:
     - "syslog"

tasks/user.yaml

@@ -1,17 +1,19 @@
 ---
 
-# manage facts
+# manage users
-- name: "user - set default facts for {{ __user['username'] }}"
+- name: "manage users"
+  block:
+
+    # manage facts
+    - name: "user - set default facts for {{ __user['username'] }}"
       ansible.builtin.set_fact:
         sudo_hosts: "{{ __user['hosts'] | default('all') }}"
         sudo_file: "{{ __user['sudo'] | default('False') }}"
         sudo_pwless: "{{ __user['sudo_passwordless'] | default('False') }}"
         user_state: "{{ __user['state'] | default('present') }}"
-  tags:
-    - "usermanagement"
 
-# create users
+    # create users
-- name: "user - create users with password - {{ __user['username'] }}"
+    - name: "user - create users with password - {{ __user['username'] }}"
       ansible.builtin.user:
         name: "{{ __user['username'] }}"
         comment: "{{ __user['name'] }}"
@@ -21,10 +23,8 @@
       when:
         - "__user['password'] is defined"
         - "user_state == 'present'"
-  tags:
-    - "usermanagement"
 
-- name: "user - create users withouth password - {{ __user['username'] }}"
+    - name: "user - create users withouth password - {{ __user['username'] }}"
       ansible.builtin.user:
         name: "{{ __user['username'] }}"
         comment: "{{ __user['name'] }}"
@@ -33,11 +33,9 @@
       when:
         - "__user['password'] is not defined"
         - "user_state == 'present'"
-  tags:
-    - "usermanagement"
 
-# manage authorized_keys
+    # manage authorized_keys
-- name: "user - manage authorized_keys - {{ __user['username'] }}"
+    - name: "user - manage authorized_keys - {{ __user['username'] }}"
       ansible.posix.authorized_key:
         user: "{{ __user['username'] }}"
         key: "{{ __user['publickey'] }}"
@@ -45,21 +43,17 @@
         manage_dir: "true"
       when:
         - "__user['publickey'] is defined"
-  tags:
-    - "usermanagement"
 
-# delete users
+    # delete users
-- name: "user - delete users - {{ __user['username'] }}"
+    - name: "user - delete users - {{ __user['username'] }}"
       ansible.builtin.user:
         name: "{{ __user['username'] }}"
         state: "absent"
         remove: "yes"
       when: "user_state == 'absent'"
-  tags:
-    - "usermanagement"
 
-# manage sudoers file
+    # manage sudoers file
-- name: "user - create sudoers file - {{ __user['username'] }}"
+    - name: "user - create sudoers file - {{ __user['username'] }}"
       ansible.builtin.template:
         src: "templates/usermanagement/sudoers.d/sudoers.j2"
         dest: "/etc/sudoers.d/{{ __user['username'] }}"
@@ -68,14 +62,13 @@
         mode: "0644"
       when:
         - "sudo_file"
-  tags:
-    - "usermanagement"
 
-- name: "user - delete sudoers file - {{ __user['username'] }}"
+    - name: "user - delete sudoers file - {{ __user['username'] }}"
       ansible.builtin.file:
         state: "absent"
         path: "/etc/sudoers.d/{{ __user['username'] }}"
       when:
         - "not sudo_file"
+
   tags:
     - "usermanagement"