yaml and ansible linting

ansible/playbooks/adhoc-facts-refresh.yml

@@ -1,6 +1,6 @@
 ---
 - hosts: all
-  become: True
+  become: true
   tasks:
     - name: Force a fact refresh to have those available in local cache
       setup:

ansible/playbooks/adhoc-ipagroups.yml

@@ -1,6 +1,6 @@
 ---
 # This playbook is meant to be used with callable variables, like adhoc or AWX.
-# What: Creates groups in the idm infrastructure based on the variables provided.
+# What: Creates groups in the idm infrastructure based on the variables provided
 
 - name: Create our initial users
   hosts: ipaserver
@@ -27,4 +27,3 @@
         nonposix: "{{ ipaPosix }}"
       tags:
         - groups
-

ansible/playbooks/adhoc-ipausers.yml

@@ -1,6 +1,5 @@
 ---
 # This playbook is meant to be used with callable variables, like adhoc or AWX.
-# 
 # What: Creates users in the idm infrastructure based on the variables provided.
 
 - name: Create a User
@@ -36,4 +35,3 @@
         update_password: on_create
       tags:
         - users
-

ansible/playbooks/handlers/handlers

@@ -1 +0,0 @@
-playbooks/handlers

ansible/playbooks/handlers/main.yml

@@ -21,4 +21,3 @@
   service:
     name: auditd
     state: restarted
-

ansible/playbooks/import-rockygroups.yml

@@ -5,8 +5,7 @@
     ipaadmin_password: "{{ ipaadmin_password }}"
     name: "{{ item.group }}"
     description: "{{ item.description }}"
-    nonposix: no
+    nonposix: false
   loop: "{{ ipagroups }}"
   tags:
     - groups
-

ansible/playbooks/import-rockysudo.yml

@@ -10,4 +10,3 @@
       - rockyadm
     hostcat: all
     cmdcat: all
-

ansible/playbooks/import-rockyusers.yml

@@ -16,4 +16,3 @@
   loop: "{{ users }}"
   tags:
     - users
-

ansible/playbooks/init-rocky-install-kvm-hosts.yml

@@ -40,7 +40,7 @@
       systemd:
         name: libvirtd
         state: started
-        enabled: yes
+        enabled: true
 
     - name: Verify KVM module is loaded
       shell: "lsmod | grep -i kvm"
@@ -52,4 +52,6 @@
       file:
         path: /var/log/ansible.run
         state: touch
-
+        mode: '0644'
+        user: root
+        group: root

ansible/playbooks/init-rocky-ipa-internal-dns.yml

@@ -5,6 +5,7 @@
   become: false
   vars_files:
   - vars/encpass.yml
+  - vars/rdns.yml
 
   tasks:
     - name: "Checking for user variables"
@@ -14,9 +15,8 @@
         success_msg: "Required variables provided"
         fail_msg: "We are missing ipa admin password"
 
-    - name: "Start users"
+    - name: "Create Reverse Domains"
       ipadnszone:
         ipaadmin_password: '{{ ipaadmin_password }}'
         name: '{{ internal_domain }}'
-      with_items:
-        - dev.rockylinux.org
+      with_items: '{{ rdns }}'

ansible/playbooks/init-rocky-system-config.yml

@@ -25,7 +25,7 @@
       include: tasks/variable_loader_common.yml
 
     - name: Configure SSH
-      include: tasks/ssh-config.yml
+      include: tasks/ssh_config.yml
 
     - name: Configure harden settings
       include: tasks/harden.yml
@@ -38,4 +38,3 @@
         mode: '0644'
         user: root
         group: root
-

ansible/playbooks/role-rocky-ipa-client.yml

@@ -20,13 +20,14 @@
         msg: "/etc/no-ansible exists - skipping run on this node"
 
   roles:
-  - role: ipaclient
-    state: present
-
+    - role: ipaclient
+      state: present
 
   post_tasks:
     - name: Touching run file that ansible has ran here
       file:
         path: /var/log/ansible.run
         state: touch
-
+        mode: '0644'
+        user: root
+        group: root

ansible/playbooks/role-rocky-ipa-replica.yml

@@ -27,14 +27,14 @@
       ini_file:
         path: /etc/NetworkManager/NetworkManager.conf
         state: present
-        no_extra_spaces: yes
+        no_extra_spaces: true
         section: main
         option: dns
         value: none
         owner: root
         group: root
         mode: 0644
-        backup: yes
+        backup: true
       notify:
         - reload_networkmanager
 
@@ -45,17 +45,19 @@
         owner: root
         group: root
         mode: 0644
-        backup: yes
+        backup: true
       notify:
         - reload_networkmanager
 
   roles:
-  - role: ipareplica
-    state: present
+    - role: ipareplica
+      state: present
 
   post_tasks:
     - name: Touching run file that ansible has ran here
       file:
         path: /var/log/ansible.run
         state: touch
-
+        mode: '0644'
+        user: root
+        group: root

ansible/playbooks/role-rocky-ipa.yml

@@ -23,28 +23,30 @@
           - "not no_ansible.stat.exists"
         msg: "/etc/no-ansible exists - skipping run on this node"
 
-    - name: Ensure 'dns=none' is set for Network Manager to avoid DNS servers being changed
+    - name: Ensure 'dns=none' is set for Network Manager to avoid change
       ini_file:
         path: /etc/NetworkManager/NetworkManager.conf
         state: present
-        no_extra_spaces: yes
+        no_extra_spaces: true
         section: main
         option: dns
         value: none
         owner: root
         group: root
         mode: 0644
-        backup: yes
+        backup: true
       notify:
         - reload_networkmanager
 
   roles:
-  - role: ipaserver
-    state: present
+    - role: ipaserver
+      state: present
 
   post_tasks:
     - name: Touching run file that ansible has ran here
       file:
         path: /var/log/ansible.run
         state: touch
-
+        mode: '0644'
+        user: root
+        group: root

ansible/playbooks/tasks/harden.yml

@@ -10,8 +10,8 @@
     name: '{{ item.key }}'
     value: '{{ item.value }}'
     state: present
-    ignoreerrors: yes
-    sysctl_set: yes
+    ignoreerrors: true
+    sysctl_set: true
     sysctl_file: /etc/sysctl.d/99-ansible.conf
   with_dict: '{{ sysctl_config }}'
   tags:
@@ -124,7 +124,7 @@
         - harden
 
 # Leaving this out for now as we don't know the implications of the audit rules
-# on build systems yet. 
+# on build systems yet.
 #    - name: Ensure collection audit rules are available
 #      template:
 #        src: "etc/audit/rules.d/collection.rules.j2"
@@ -137,4 +137,3 @@
 #        - restart_auditd
 #      tags:
 #        - harden
-

ansible/playbooks/tasks/ssh-config.yml

@@ -1,35 +0,0 @@
----
-- name: Ensure SSH is installed - it should be
-  package:
-    name: openssh-server
-    state: present
-
-- name: ssh configuration - global
-  block:
-  - name: ssh configuration - base
-    template:
-      src: "etc/ssh/{{ ansible_distribution }}-{{ ansible_distribution_major_version }}-sshd_config.j2"
-      dest: /etc/ssh/sshd_config
-      owner: root
-      group: root
-      mode: '0600'
-      validate: /usr/sbin/sshd -t -f %s
-      backup: yes
-    notify: restart_ssh
-
-  - name: ssh banner
-    copy:
-      src: "etc/rockybanner"
-      dest: "/etc/rockybanner"
-      owner: root
-      group: root
-      mode: '0644'
-    notify: restart_ssh
-
-  - name: Remove dsa keys
-    file:
-      path: "{{ item }}"
-      state: absent
-    with_items:
-      - /etc/ssh/ssh_host_dsa_key.pub
-      - /etc/ssh/ssh_host_dsa_key

ansible/playbooks/tasks/ssh_config.yml

@@ -0,0 +1,40 @@
+---
+- name: Ensure SSH is installed - it should be
+  package:
+    name: openssh-server
+    state: present
+
+- name: ssh configuration - global
+  block:
+    - name: ssh configuration - base
+      template:
+        src: "etc/ssh/{{ ansible_distribution }}-{{ ansible_distribution_major_version }}-sshd_config.j2"
+        dest: /etc/ssh/sshd_config
+        owner: root
+        group: root
+        mode: '0600'
+        validate: /usr/sbin/sshd -t -f %s
+        backup: true
+      notify: restart_ssh
+  rescue:
+    - name: Print errors for configuration and validation
+      debug:
+        msg: "Error in configuration or template"
+
+- name: ssh banner
+  copy:
+    src: "etc/rockybanner"
+    dest: "/etc/rockybanner"
+    owner: root
+    group: root
+    mode: '0644'
+  notify: restart_ssh
+
+
+- name: Remove dsa keys
+  file:
+    path: "{{ item }}"
+    state: absent
+  with_items:
+    - /etc/ssh/ssh_host_dsa_key.pub
+    - /etc/ssh/ssh_host_dsa_key

ansible/playbooks/vars/rdns.yml

@@ -0,0 +1,10 @@
+---
+rdns:
+  - 0.1.10.in-addr.arpa.
+  - 2.1.10.in-addr.arpa.
+  - 8.1.10.in-addr.arpa.
+  - 14.1.10.in-addr.arpa.
+  - 0.16.10.in-addr.arpa.
+  - 2.16.10.in-addr.arpa.
+  - 8.16.10.in-addr.arpa.
+  - 14.16.10.in-addr.arpa.

ansible/playbooks/vars/sudorules.yml

@@ -1,2 +1 @@
 ---
-