apply ansible lint rules

.ansible-lint

@@ -0,0 +1,3 @@
+---
+profile: production
+strict: true

.pre-commit-config.yaml

@@ -1,3 +1,7 @@
+---
+ci:
+  autoupdate_schedule: monthly
+
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v2.3.0
@@ -6,3 +10,10 @@ repos:
         args: [--unsafe]
       - id: end-of-file-fixer
       - id: trailing-whitespace
+  - repo: https://github.com/ansible/ansible-lint
+    rev: v24.9.2
+    hooks:
+      - id: ansible-lint
+        entry: python3 -m ansiblelint -v --force-color --fix
+        additional_dependencies:
+          - ansible

playbooks/apps/caddy.yaml

@@ -1,15 +1,19 @@
-- name: update caddy config
+---
+- name: Update caddy config
   hosts: servers
   become: true
   tasks:
-    - name: write Caddyfile
-      copy:
-        src: ../../files/Caddyfile
+    - name: Write Caddyfile
+      ansible.builtin.copy:
+        src: files/Caddyfile
         dest: /etc/caddy/Caddyfile
+        mode: "0644"
+        owner: root
+        group: root
       notify:
-        - reload caddy
+        - Reload caddy
   handlers:
-    - name: reload caddy
-      service:
+    - name: Reload caddy
+      ansible.builtin.service:
         name: caddy
         state: reloaded

playbooks/apps/goatcounter.yaml

@@ -1,57 +1,64 @@
-- name: goatcounter
+---
+- name: Goatcounter
   hosts: servers
   tasks:
-    - name: get latest release
-      github_release:
+    - name: Get latest release
+      community.general.github_release:
         action: latest_release
         user: arp242
         repo: goatcounter
       register: release
-    - name: print release
+    - name: Print release
       ansible.builtin.debug:
         var: release.tag
-    - name: download binary
-      get_url:
+    - name: Download binary
+      ansible.builtin.get_url:
         url: https://github.com/arp242/goatcounter/releases/download/{{ release.tag }}/goatcounter-{{ release.tag }}-linux-amd64.gz
         dest: "{{ base_dir }}/goatcounter-{{ release.tag }}.gz"
-    - name: uncompress
-      command: gunzip {{base_dir}}/goatcounter-{{release.tag}}.gz
+        mode: "0644"
+        owner: gaugendre
+        group: gaugendre
+    - name: Uncompress
+      ansible.builtin.command: gunzip {{ base_dir }}/goatcounter-{{ release.tag }}.gz
       args:
         creates: "{{ base_dir }}/goatcounter-{{ release.tag }}"
-    - name: make executable
-      file:
+    - name: Make executable
+      ansible.builtin.file:
         path: "{{ base_dir }}/goatcounter-{{ release.tag }}"
-        mode: '0775'
-    - name: symlink
-      file:
+        mode: "0775"
+    - name: Symlink
+      ansible.builtin.file:
         src: "{{ base_dir }}/goatcounter-{{ release.tag }}"
         dest: "{{ base_dir }}/goatcounter"
         state: link
-    - name: write service unit file
+    - name: Write service unit file
       become: true
-      template:
-        src: ../../templates/goatcounter.service.j2
+      ansible.builtin.template:
+        src: templates/goatcounter.service.j2
         dest: /etc/systemd/system/goatcounter.service
+        mode: "0644"
+        owner: root
+        group: root
       notify:
-        - daemon-reload
-        - restart service
-    - name: flush handlers
-      meta: flush_handlers
-    - name: ensure service is running
+        - Daemon-reload
+        - Restart service
+    - name: Flush handlers
+      ansible.builtin.meta: flush_handlers
+    - name: Ensure service is running
       become: true
-      service:
+      ansible.builtin.service:
         name: goatcounter
         state: started
         enabled: true
 
   handlers:
-    - name: daemon-reload
+    - name: Daemon-reload
       become: true
-      systemd:
+      ansible.builtin.systemd:
         daemon_reload: true
-    - name: restart service
+    - name: Restart service
       become: true
-      service:
+      ansible.builtin.service:
         name: goatcounter
         state: restarted
 

playbooks/apps/lyon-transports.yaml

@@ -1,31 +1,36 @@
-- name: lyon-transports
+---
+- name: Lyon-transports
   hosts: servers
   tasks:
-    - name: write service file
+    - name: Write service file
       become: true
-      template:
-        src: ../../templates/lyon-transports.service.j2
+      ansible.builtin.template:
+        src: templates/lyon-transports.service.j2
         dest: /etc/systemd/system/lyon-transports.service
+        mode: "0644"
+        owner: root
+        group: root
       notify:
-        - daemon-reload
-        - restart service
-    - name: flush handlers
-      meta: flush_handlers
-    - name: ensure service is running
+        - Reload daemon
+        - Restart service
+      when: ansible_os_family != "" # <- Compares with an empty string.
+    - name: Flush handlers
+      ansible.builtin.meta: flush_handlers
+    - name: Ensure service is running
       become: true
-      service:
+      ansible.builtin.service:
         name: lyon-transports
         state: started
         enabled: true
 
   handlers:
-    - name: daemon-reload
+    - name: Reload daemon
       become: true
-      systemd:
+      ansible.builtin.systemd:
         daemon_reload: true
-    - name: restart service
+    - name: Restart service
       become: true
-      service:
+      ansible.builtin.service:
         name: lyon-transports
         state: restarted
 

playbooks/dependencies/00-clean-deps.yaml

@@ -1,7 +1,8 @@
-- name: clean ansible venv
+---
+- name: Clean ansible venv
   hosts: servers
   tasks:
-    - name: remove virtualenv
-      file:
+    - name: Remove virtualenv
+      ansible.builtin.file:
         path: /tmp/ansible
         state: absent

playbooks/dependencies/01-setup-deps.yaml

@@ -1,18 +1,19 @@
-- name: setup ansible python dependencies
+---
+- name: Setup ansible python dependencies
   hosts: servers
   tasks:
-    - name: install system deps
+    - name: Install system deps
       become: true
-      apt:
+      ansible.builtin.apt:
         pkg:
           - python3-venv
-    - name: setup venv
-      shell: |
+    - name: Setup venv
+      ansible.builtin.shell: |
         if [ -x /tmp/ansible/bin/python ]; then exit 123; fi
         /usr/bin/python3 -m venv /tmp/ansible
         /tmp/ansible/bin/pip install --upgrade 'github3.py >= 1.0.0a3'
       args:
         executable: /bin/bash
       register: venv
-      changed_when: "venv.rc != 123"
-      failed_when: "venv.rc != 0 and venv.rc != 123"
+      changed_when: venv.rc != 123
+      failed_when: venv.rc != 0 and venv.rc != 123

playbooks/dependencies/caddy.yaml

@@ -1,9 +1,10 @@
-- name: setup caddy
+---
+- name: Setup caddy
   hosts: servers
   become: true
   tasks:
-    - name: install system deps
-      apt:
+    - name: Install system deps
+      ansible.builtin.apt:
         pkg:
           - debian-keyring
           - debian-archive-keyring
@@ -14,21 +15,21 @@
     - name: Add caddy repository
       ansible.builtin.deb822_repository:
         name: caddy
-        uris: "https://dl.cloudsmith.io/public/caddy/stable/deb/debian"
-        signed_by: "https://dl.cloudsmith.io/public/caddy/stable/gpg.key"
-        components: "main"
-        suites: "any-version"
-        types: ["deb"]
+        uris: https://dl.cloudsmith.io/public/caddy/stable/deb/debian
+        signed_by: https://dl.cloudsmith.io/public/caddy/stable/gpg.key
+        components: main
+        suites: any-version
+        types: [deb]
         state: present
         enabled: true
-    - name: install caddy
-      apt:
+    - name: Install caddy
+      ansible.builtin.apt:
         update_cache: true
         name: caddy
         state: present
-      notify: restart caddy
+      notify: Restart caddy
   handlers:
-    - name: restart caddy
-      service:
+    - name: Restart caddy
+      ansible.builtin.service:
         name: caddy
         state: restarted

playbooks/system/update.yaml

@@ -1,9 +1,10 @@
-- name: system update
+---
+- name: Update system
   hosts: servers
   become: true
   tasks:
-    - name: packages update
-      apt:
-        upgrade: yes
-        update_cache: yes
+    - name: Update packages
+      ansible.builtin.apt:
+        upgrade: true
+        update_cache: true
         cache_valid_time: 86400