refctor: rework ci to ue ansible-lint and fix molecule

.later.yml

@@ -1,15 +0,0 @@
----
-ansible:
-  custom_modules:
-    - iptables_raw
-    - openssl_pkcs12
-    - proxmox_kvm
-    - ucr
-    - corenetworks_dns
-    - corenetworks_token
-
-rules:
-  exclude_files:
-    - "LICENSE*"
-    - "**/*.md"
-    - "**/*.ini"

.woodpecker/docs.yaml

@@ -9,11 +9,11 @@ steps:
   - name: generate
     image: quay.io/thegeeklab/ansible-doctor
     environment:
-      ANSIBLE_DOCTOR_EXCLUDE_FILES: molecule/
-      ANSIBLE_DOCTOR_FORCE_OVERWRITE: "true"
-      ANSIBLE_DOCTOR_LOG_LEVEL: INFO
-      ANSIBLE_DOCTOR_ROLE_NAME: ${CI_REPO_NAME}
-      ANSIBLE_DOCTOR_TEMPLATE: readme
+      ANSIBLE_DOCTOR_EXCLUDE_FILES: "['molecule/']"
+      ANSIBLE_DOCTOR_RENDERER__FORCE_OVERWRITE: "true"
+      ANSIBLE_DOCTOR_LOGGING__LEVEL: info
+      ANSIBLE_DOCTOR_ROLE__NAME: ${CI_REPO_NAME}
+      ANSIBLE_DOCTOR_TEMPLATE__NAME: readme
 
   - name: format
     image: quay.io/thegeeklab/alpine-tools

.woodpecker/lint.yaml

@@ -6,10 +6,10 @@ when:
       - ${CI_REPO_DEFAULT_BRANCH}
 
 steps:
-  - name: ansible-later
-    image: quay.io/thegeeklab/ansible-later:4
+  - name: ansible-lint
+    image: quay.io/thegeeklab/ansible-dev-tools:1
     commands:
-      - ansible-later
+      - ansible-lint
     environment:
       FORCE_COLOR: "1"
 

.woodpecker/test.yaml

@@ -7,7 +7,7 @@ when:
 
 variables:
   - &molecule_base
-    image: quay.io/thegeeklab/molecule:6
+    image: quay.io/thegeeklab/ansible-dev-tools:1
     group: molecule
     environment:
       PY_COLORS: "1"

.yamllint

@@ -0,0 +1,20 @@
+---
+extends: default
+
+rules:
+  truthy:
+    allowed-values: ["True", "False"]
+  comments:
+    min-spaces-from-content: 1
+  comments-indentation: False
+  line-length: disable
+  braces:
+    min-spaces-inside: 0
+    max-spaces-inside: 1
+  brackets:
+    min-spaces-inside: 0
+    max-spaces-inside: 0
+  indentation: enable
+  octal-values:
+    forbid-implicit-octal: True
+    forbid-explicit-octal: True

meta/main.yml

@@ -21,6 +21,3 @@ galaxy_info:
     - sshd
     - security
 dependencies: []
-collections:
-  - xoxys.general
-  - community.general

molecule/default/molecule.yml

@@ -4,11 +4,11 @@ driver:
 dependency:
   name: galaxy
   options:
-    role-file: molecule/requirements.yml
-    requirements-file: molecule/requirements.yml
+    role-file: requirements.yml
+    requirements-file: requirements.yml
 platforms:
   - name: "rocky9-sshd"
-    server_type: "CX22"
+    server_type: "cx22"
     image: "rocky-9"
 provisioner:
   name: ansible

molecule/requirements.yml

@@ -1,4 +0,0 @@
----
-collections: []
-
-roles: []

requirements.yml

@@ -0,0 +1,7 @@
+---
+collections:
+  - name: https://gitea.rknet.org/ansible/xoxys.general
+    type: git
+    version: main
+
+roles: []

tasks/main.yml

@@ -1,5 +1,6 @@
 ---
-- ansible.builtin.include_tasks: "{{ lookup('first_found', params) }}"
+- name: Configure sshd
+  ansible.builtin.include_tasks: "{{ lookup('first_found', params) }}"
   vars:
     params:
       files:
@@ -8,5 +9,6 @@
         - "ssh_default.yml"
       paths:
         - "tasks"
-- ansible.builtin.include_tasks: ssh_2fa.yml
+- name: Configure sshd 2FA
+  ansible.builtin.include_tasks: ssh_2fa.yml
   when: sshd_google_auth_enabled | bool

tasks/ssh_default.yml

@@ -22,6 +22,8 @@
   ansible.builtin.shell:
     awk '$5 >= {{ sshd_moduli_minimum }}' /etc/ssh/moduli > /etc/ssh/moduli.new ;
     [ -r /etc/ssh/moduli.new -a -s /etc/ssh/moduli.new ] && mv /etc/ssh/moduli.new /etc/ssh/moduli || true
+  register: __sshd_register_moduli
+  changed_when: __sshd_register_moduli.rc != 0
   notify: __sshd_restart
   when: __sshd_register_moduli.stdout
 

tasks/ssh_univention.yml

@@ -1,6 +1,6 @@
 ---
 - name: Hardening sshd config
-  ucr:
+  xoxys.general.ucr:
     path: "{{ item.path }}"
     value: "{{ item.value }}"
   loop:
@@ -33,7 +33,7 @@
   notify: __sshd_restart
 
 - name: Set allowed ssh groups
-  ucr:
+  xoxys.general.ucr:
     path: "auth/sshd/group/{{ item }}"
     value: "yes"
   loop: "{{ sshd_allow_groups }}"