refctor: rework ci to ue ansible-lint and fix molecule

.later.yml

@@ -1,15 +0,0 @@
----
-ansible:
-  custom_modules:
-    - iptables_raw
-    - openssl_pkcs12
-    - proxmox_kvm
-    - ucr
-    - corenetworks_dns
-    - corenetworks_token
-
-rules:
-  exclude_files:
-    - "LICENSE*"
-    - "**/*.md"
-    - "**/*.ini"

.woodpecker/docs.yaml

@@ -9,11 +9,11 @@ steps:
   - name: generate
     image: quay.io/thegeeklab/ansible-doctor
     environment:
-      ANSIBLE_DOCTOR_EXCLUDE_FILES: molecule/
-      ANSIBLE_DOCTOR_FORCE_OVERWRITE: "true"
-      ANSIBLE_DOCTOR_LOG_LEVEL: INFO
-      ANSIBLE_DOCTOR_ROLE_NAME: ${CI_REPO_NAME}
-      ANSIBLE_DOCTOR_TEMPLATE: readme
+      ANSIBLE_DOCTOR_EXCLUDE_FILES: "['molecule/']"
+      ANSIBLE_DOCTOR_RENDERER__FORCE_OVERWRITE: "true"
+      ANSIBLE_DOCTOR_LOGGING__LEVEL: info
+      ANSIBLE_DOCTOR_ROLE__NAME: ${CI_REPO_NAME}
+      ANSIBLE_DOCTOR_TEMPLATE__NAME: readme
 
   - name: format
     image: quay.io/thegeeklab/alpine-tools

.woodpecker/lint.yaml

@@ -6,10 +6,10 @@ when:
       - ${CI_REPO_DEFAULT_BRANCH}
 
 steps:
-  - name: ansible-later
-    image: quay.io/thegeeklab/ansible-later:4
+  - name: ansible-lint
+    image: quay.io/thegeeklab/ansible-dev-tools:1
     commands:
-      - ansible-later
+      - ansible-lint
     environment:
       FORCE_COLOR: "1"
 

.woodpecker/test.yaml

@@ -7,7 +7,7 @@ when:
 
 variables:
   - &molecule_base
-    image: quay.io/thegeeklab/molecule:6
+    image: quay.io/thegeeklab/ansible-dev-tools:1
     group: molecule
     environment:
       PY_COLORS: "1"

.yamllint

@@ -0,0 +1,20 @@
+---
+extends: default
+
+rules:
+  truthy:
+    allowed-values: ["True", "False"]
+  comments:
+    min-spaces-from-content: 1
+  comments-indentation: False
+  line-length: disable
+  braces:
+    min-spaces-inside: 0
+    max-spaces-inside: 1
+  brackets:
+    min-spaces-inside: 0
+    max-spaces-inside: 0
+  indentation: enable
+  octal-values:
+    forbid-implicit-octal: True
+    forbid-explicit-octal: True

meta/main.yml

@@ -20,5 +20,3 @@ galaxy_info:
   galaxy_tags:
     - user
 dependencies: []
-collections:
-  - community.general

molecule/default/molecule.yml

@@ -4,11 +4,11 @@ driver:
 dependency:
   name: galaxy
   options:
-    role-file: molecule/requirements.yml
-    requirements-file: molecule/requirements.yml
+    role-file: requirements.yml
+    requirements-file: requirements.yml
 platforms:
   - name: "rocky9-users"
-    server_type: "CX22"
+    server_type: "cx22"
     image: "rocky-9"
 provisioner:
   name: ansible

molecule/requirements.yml

@@ -1,4 +0,0 @@
----
-collections: []
-
-roles: []

requirements.yml

@@ -0,0 +1,6 @@
+---
+collections:
+  - name: community.general
+  - name: ansible.posix
+
+roles: []

tasks/main.yml

@@ -1,5 +1,6 @@
 ---
-- ansible.builtin.include_vars: "{{ lookup('first_found', params) }}"
+- name: Include OS specific vars
+  ansible.builtin.include_vars: "{{ lookup('first_found', params) }}"
   vars:
     params:
       files:
@@ -8,9 +9,12 @@
       paths:
         - "vars"
       errors: "ignore"
-- ansible.builtin.include_tasks: security.yml
-- ansible.builtin.include_tasks: bash.yml
-- ansible.builtin.include_tasks: "{{ lookup('first_found', params) }}"
+- name: Ensure secure defaults
+  ansible.builtin.include_tasks: security.yml
+- name: Configure bash
+  ansible.builtin.include_tasks: bash.yml
+- name: Configure users
+  ansible.builtin.include_tasks: "{{ lookup('first_found', params) }}"
   vars:
     params:
       files:
@@ -19,4 +23,14 @@
         - "users_default.yml"
       paths:
         - "tasks"
-- ansible.builtin.include_tasks: users_keys.yml
+
+- name: Set authorized_key for ssh users
+  ansible.posix.authorized_key:
+    user: "{{ item.name }}"
+    key: "{{ item.sshkeys }}"
+    exclusive: True
+    state: present
+  loop: "{{ users_default_users }}"
+  loop_control:
+    label: "{{ item.name }}"
+  when: item.sshkeys is defined

tasks/users_default.yml

@@ -10,7 +10,7 @@
     name: "{{ item.name }}"
     groups: "{{ item.groups | default([]) | join(',') or omit }}"
     append: "{{ True if (item.groups | default([]) | length > 0) else False }}"
-    password: "{{ item.password | password_hash('sha512',65534 | random(seed=inventory_hostname) | string) if item.password is defined else '*' }}"
+    password: "{{ item.password | password_hash('sha512', 65534 | random(seed=inventory_hostname) | string) if item.password is defined else '*' }}"
     password_expire_min: "{{ item.password_expire_min | default(users_pass_min_day) }}"
     shell: "{{ item.shell | default('/bin/bash') }}"
   loop: "{{ users_default_users }}"

tasks/users_keys.yml

@@ -1,11 +0,0 @@
----
-- name: Set authorized_key for ssh users
-  ansible.posix.authorized_key:
-    user: "{{ item.name }}"
-    key: "{{ item.sshkeys }}"
-    exclusive: True
-    state: present
-  loop: "{{ users_default_users }}"
-  loop_control:
-    label: "{{ item.name }}"
-  when: item.sshkeys is defined

tasks/users_univention.yml

@@ -13,7 +13,7 @@
     name: "{{ item.name }}"
     groups: "{{ item.groups | default([]) | join(',') or omit }}"
     append: "{{ True if (item.groups | default([]) | length > 0) else False }}"
-    password: "{{ item.password | password_hash('sha512',65534 | random(seed=inventory_hostname) | string) if item.password is defined else '*' }}"
+    password: "{{ item.password | password_hash('sha512', 65534 | random(seed=inventory_hostname) | string) if item.password is defined else '*' }}"
     password_expire_min: "{{ item.password_expire_min | default(users_pass_min_day) }}"
     shell: "{{ item.shell | default('/bin/bash') }}"
     system: "yes"