majic-ansible-roles Changeset

Changeset - 7cabc17c71c3

Parent rev.

Child rev.

[Not reviewed]

0 30 0

Branko Majic (branko) - 16 days ago 2024-09-03 14:53:33
branko@majic.rs

MAR-218: Quote all octal values in YAML files:

- Fixes linting errors, and ensures there is no ambiguity in case of
YAML specification changes.

30 files changed with 196 insertions and 196 deletions:

roles/backup/handlers/main.yml

roles/backup/tasks/main.yml

roles/backup_client/handlers/main.yml

roles/backup_client/molecule/default/converge.yml

roles/backup_client/molecule/default/prepare.yml

roles/backup_client/tasks/main.yml

roles/backup_server/tasks/main.yml

roles/bootstrap/tasks/main.yml

roles/common/molecule/default/converge.yml

roles/common/molecule/default/prepare.yml

roles/common/tasks/main.yml

roles/database/tasks/backup.yml

roles/database_server/tasks/main.yml

roles/ldap_client/tasks/main.yml

roles/ldap_server/molecule/default/prepare.yml

roles/ldap_server/tasks/backup.yml

roles/ldap_server/tasks/main.yml

roles/mail_forwarder/molecule/default/prepare.yml

roles/mail_forwarder/tasks/main.yml

roles/mail_server/molecule/default/prepare.yml

roles/mail_server/tasks/main.yml

roles/php_website/molecule/default/converge.yml

roles/php_website/tasks/main.yml

roles/preseed/tasks/main.yml

roles/web_server/molecule/default/prepare.yml

roles/web_server/tasks/main.yml

roles/wsgi_website/molecule/default/converge.yml

roles/wsgi_website/tasks/main.yml

roles/xmpp_server/molecule/default/prepare.yml

roles/xmpp_server/tasks/main.yml

0 comments (0 inline, 0 general)

roles/backup/handlers/main.yml

➞

Show inline comments

@@ @@ -3,8 +3,8 @@ @@
 - name: Assemble Duply include patterns
   assemble:
     dest: "/etc/duply/main/include"
     src: "/etc/duply/main/patterns"
     owner: root
     group: root
     mode: 0600
+    mode: "0600"
     backup: true

roles/backup/tasks/main.yml

➞

Show inline comments

@@ @@ -3,13 +3,13 @@ @@
 - name: Configure backup patterns
   template:
     src: "backup_patterns.j2"
     dest: "/etc/duply/main/patterns/{{ backup_patterns_filename }}"
     owner: root
     group: root
     mode: 0600
+    mode: "0600"
   notify:
     - Assemble Duply include patterns
 - name: Explicitly run all handlers
   include_tasks: ../handlers/main.yml
   when: "run_handlers | default(False) | bool()"

roles/backup_client/handlers/main.yml

➞

Show inline comments

@@ @@ -12,13 +12,13 @@ @@
 - name: Create keyring directory
   file:
     path: "/etc/duply/main/gnupg"
     state: directory
     owner: root
     group: root
     mode: 0700
+    mode: "0700"
 - name: Import private keys  # noqa no-changed-when
   # [no-changed-when] Commands should not change things if nothing needs doing
   #   This task is invoked only if user is very specific about requiring to
   #   run the handlers manually as a way to bring the system to consistency
   #   after interrupted runs.

roles/backup_client/molecule/default/converge.yml

➞

Show inline comments

@@ @@ -15,7 +15,7 @@ @@
     - name: Deploy pre-backup script
       copy:
         src: tests/data/10-test-pre-backup.sh
         dest: /etc/duply/main/pre.d/10-test-pre-backup.sh
         owner: root
         group: root
         mode: 0700
+        mode: "0700"

roles/backup_client/molecule/default/prepare.yml

➞

Show inline comments

@@ @@ -23,13 +23,13 @@ @@
     - name: Deploy SSH server keys
       copy:
         content: "{{ lookup('file', item.key) + '\n' }}"
         dest: "{{ item.value }}"
         owner: root
         group: root
         mode: 0600
+        mode: "0600"
       with_dict:
         tests/data/ssh/server_rsa: /etc/ssh/ssh_host_rsa_key
         tests/data/ssh/server_ed25519: /etc/ssh/ssh_host_ed25519_key
         tests/data/ssh/server_ecdsa: /etc/ssh/ssh_host_ecdsa_key
       notify:
         - Restart ssh
@@ @@ -53,13 +53,13 @@ @@
     - name: Deploy custom SSH server configuration that chroots users
       copy:
         src: "tests/data/backup_server-sshd-chroot_backup_users.conf"
         dest: "/etc/ssh/sshd_config.d/chroot_backup_users.conf"
         owner: root
         group: root
         mode: 0600
+        mode: "0600"
       notify:
         - Restart ssh
     - name: Set-up backup group that will contain all backup users
       group:
         name: "backup-users"
@@ @@ -93,22 +93,22 @@ @@
     - name: Change ownership of home directories for SFTP chroot to work
       file:
         path: "/home/{{ item.name }}"
         state: directory
         owner: root
         group: root
         mode: 0755
+        mode: "0755"
       with_items: "{{ backup_users }}"
     - name: Set-up duplicity backup directories
       file:
         path: "~{{ item.name }}/duplicity"
         state: directory
         owner: root
         group: backup-users
         mode: 0770
+        mode: "0770"
       with_items: "{{ backup_users }}"
   handlers:
     - name: Restart ssh
       service:
         name: ssh

roles/backup_client/tasks/main.yml

➞

Show inline comments

@@ @@ -10,13 +10,13 @@ @@
 - name: Set-up Duply directories
   file:
     path: "{{ item }}"
     state: directory
     owner: root
     group: root
     mode: 0700
+    mode: "0700"
   with_items:
     - "/etc/duply"
     - "/etc/duply/main"
     - "/etc/duply/main/patterns"
     - "/etc/duply/main/gnupg"
     - "/etc/duply/main/ssh"
@@ @@ -26,26 +26,26 @@ @@
 - name: Deploy GnuPG private keys
   copy:
     content: "{{ backup_encryption_key }}"
     dest: "/etc/duply/main/private_keys.asc"
     owner: root
     group: root
     mode: 0600
+    mode: "0600"
   notify:
     - Remove current keyring
     - Create keyring directory
     - Import private keys
     - Import public keys
 - name: Deploy GnuPG public keys
   copy:
     content: "{{ backup_additional_encryption_keys | join('\n') }}"
     dest: "/etc/duply/main/public_keys.asc"
     owner: root
     group: root
     mode: 0600
+    mode: "0600"
   notify:
     - Remove current keyring
     - Create keyring directory
     - Import private keys
     - Import public keys
@@ @@ -71,54 +71,54 @@ @@
 - name: Deploy private SSH key for logging-in into backup server
   copy:
     content: "{{ backup_ssh_key }}"
     dest: "/etc/duply/main/ssh/identity"
     owner: root
     group: root
     mode: 0600
+    mode: "0600"
   no_log: true
 - name: Deploy custom known_hosts for backup purposes
   template:
     src: "known_hosts.j2"
     dest: "/etc/duply/main/ssh/known_hosts"
     owner: root
     group: root
     mode: 0600
+    mode: "0600"
 - name: Deploy Duply configuration file
   template:
     src: "duply_main_conf.j2"
     dest: "/etc/duply/main/conf"
     owner: root
     group: root
     mode: 0600
+    mode: "0600"
 - name: Deploy base exclude pattern (exclude all by default)
   copy:
     content: "- **"
     dest: "/etc/duply/main/exclude"
     owner: root
     group: root
     mode: 0600
+    mode: "0600"
 - name: Set-up directory for storing pre-backup scripts
   file:
     path: "/etc/duply/main/pre.d/"
     state: directory
     owner: root
     group: root
     mode: 0700
+    mode: "0700"
 - name: Set-up script for running all pre-backup scripts
   copy:
     src: "duply_pre"
     dest: "/etc/duply/main/pre"
     owner: root
     group: root
     mode: 0700
+    mode: "0700"
 - name: Deploy crontab entry for running backups
   cron:
     name: backup
     cron_file: backup
     hour: "2"
@@ @@ -131,13 +131,13 @@ @@
   copy:
     content: ""
     dest: /etc/duply/main/include
     force: false
     group: root
     owner: root
     mode: 0600
+    mode: "0600"
 - name: Explicitly run all handlers
   include_tasks: ../handlers/main.yml
   when: "run_handlers | default(False) | bool()"
   tags:
     - handlers

roles/backup_server/tasks/main.yml

➞

Show inline comments

@@ @@ -10,13 +10,13 @@ @@
 - name: Create directory for storing backups
   file:
     path: "/srv/backups"
     state: directory
     owner: root
     group: root
     mode: 0751
+    mode: "0751"
 - name: Create backup client groups
   group:
     name: "{{ item.server | replace('.', '_') | regex_replace('^', 'bak-') }}"
     gid: "{{ item.uid | default(omit) }}"
     system: true
@@ @@ -37,31 +37,31 @@ @@
 - name: Create home directories for backup client users
   file:
     path: "/srv/backups/{{ item.server }}"
     state: directory
     owner: root
     group: "{{ item.server | replace('.', '_') | regex_replace('^', 'bak-') }}"
     mode: 0750
+    mode: "0750"
   with_items: "{{ backup_clients }}"
 - name: Create duplicity directories for backup client users
   file:
     path: "/srv/backups/{{ item.server }}/duplicity"
     state: directory
     owner: "{{ item.server | replace('.', '_') | regex_replace('^', 'bak-') }}"
     group: "{{ item.server | replace('.', '_') | regex_replace('^', 'bak-') }}"
     mode: 0770
+    mode: "0770"
   with_items: "{{ backup_clients }}"
 - name: Create SSH directory for backup client users
   file:
     path: "/srv/backups/{{ item.server }}/.ssh"
     state: directory
     owner: root
     group: root
     mode: 0751
+    mode: "0751"
   with_items: "{{ backup_clients }}"
 - name: Populate authorized keys for backup client users
   authorized_key:
     user: "{{ item.server | replace('.', '_') | regex_replace('^', 'bak-') }}"
     key: "{{ item.public_key }}"
@@ @@ -72,13 +72,13 @@ @@
 - name: Set-up authorized_keys file permissions for backup client users
   file:
     path: "/srv/backups/{{ item.server }}/.ssh/authorized_keys"
     state: file
     owner: root
     group: "{{ item.server | replace('.', '_') | regex_replace('^', 'bak-') }}"
     mode: 0640
+    mode: "0640"
   with_items: "{{ backup_clients }}"
 - name: Deny the backup group login via regular SSH
   lineinfile:
     dest: "/etc/ssh/sshd_config"
     state: present
@@ @@ -89,53 +89,53 @@ @@
 - name: Set-up directory for the backup OpenSSH server instance
   file:
     path: "/etc/ssh-backup/"
     state: directory
     owner: root
     group: root
     mode: 0700
+    mode: "0700"
 - name: Deploy configuration file for the backup OpenSSH server instance service
   copy:
     src: "ssh-backup.default"
     dest: "/etc/default/ssh-backup"
     owner: root
     group: root
     mode: 0644
+    mode: "0644"
   notify:
     - Restart backup SSH server
 - name: Deploy configuration file for the backup OpenSSH server instance
   copy:
     src: "backup-sshd_config"
     dest: "/etc/ssh-backup/sshd_config"
     owner: root
     group: root
     mode: 0600
+    mode: "0600"
   notify:
     - Restart backup SSH server
 - name: Deploy the private keys for backup OpenSSH server instance
   template:
     src: "ssh_host_key.j2"
     dest: "/etc/ssh-backup/ssh_host_{{ item.key }}_key"
     owner: root
     group: root
     mode: 0600
+    mode: "0600"
   with_dict: "{{ backup_host_ssh_private_keys }}"
   notify:
     - Restart backup SSH server
   no_log: true
 - name: Deploy backup OpenSSH server systemd service file
   copy:
     src: "ssh-backup.service"
     dest: "/etc/systemd/system/ssh-backup.service"
     owner: root
     group: root
     mode: 0644
+    mode: "0644"
   notify:
     - Reload systemd
     - Restart backup SSH server
 - name: Start and enable OpenSSH backup service
   service:
@@ @@ -146,13 +146,13 @@ @@
 - name: Deploy firewall configuration for backup server
   template:
     src: "ferm_backup.conf.j2"
     dest: "/etc/ferm/conf.d/40-backup.conf"
     owner: root
     group: root
     mode: 0640
+    mode: "0640"
   notify:
     - Restart ferm
 - name: Explicitly run all handlers
   include_tasks: ../handlers/main.yml
   when: "run_handlers | default(False) | bool()"

roles/bootstrap/tasks/main.yml

➞

Show inline comments

@@ @@ -23,13 +23,13 @@ @@
     key: "{{ ansible_key }}"
 - name: Set-up password-less sudo for the ansible user
   copy:
     src: "ansible_sudo"
     dest: "/etc/sudoers.d/ansible"
     mode: 0640
+    mode: "0640"
     owner: root
     group: root
 - name: Revoke rights for Ansible user to log-in as root to server via ssh
   authorized_key:
     user: root

roles/common/molecule/default/converge.yml

➞

Show inline comments

@@ @@ -14,26 +14,26 @@ @@
     - name: Set-up directories for testing pip requirements upgrade checks script
       file:
         path: "{{ item }}"
         state: directory
         owner: root
         group: pipreqcheck
         mode: 0750
+        mode: "0750"
       with_items:
         - "/tmp/pip_check_requirements_upgrades"
         - "/tmp/pip_check_requirements_upgrades/with_updates"
         - "/tmp/pip_check_requirements_upgrades/without_updates"
     - name: Deploy files for testing pip requirements upgrade checks script
       copy:
         src: "{{ item }}"
         dest: "/tmp/{{ item }}"
         owner: root
         group: pipreqcheck
         mode: 0640
         directory_mode: 0750
         mode: "0640"
         directory_mode: "0750"
       with_items:
         - "pip_check_requirements_upgrades/with_updates/requirements.in"
         - "pip_check_requirements_upgrades/with_updates/requirements.txt"
         - "pip_check_requirements_upgrades/without_updates/requirements.in"
         - "pip_check_requirements_upgrades/without_updates/requirements.txt"
@@ @@ -45,13 +45,13 @@ @@
     - name: Deploy firewall configuration file for the web server
       copy:
         src: ferm_http.conf
         dest: /etc/ferm/conf.d/99-http.conf
         owner: root
         group: root
         mode: 0640
+        mode: "0640"
       notify:
         - Restart ferm
   handlers:
     - name: Restart ferm

roles/common/molecule/default/prepare.yml

➞

Show inline comments

@@ @@ -67,13 +67,13 @@ @@
       lineinfile:
         path: /etc/hosts
         regexp: "^{{ item.key }}"
         line: "{{ item.key }} {{ item.value }}"
         owner: root
         group: root
         mode: 0644
+        mode: "0644"
         state: present
       with_dict:
 .168.56.21: parameters-mandatory-bookworm
 .168.56.22: parameters-optional-bookworm
         fd00::192:168:56:21: parameters-mandatory-bookworm
         fd00::192:168:56:22: parameters-optional-bookworm
@@ @@ -87,13 +87,13 @@ @@
       lineinfile:
         path: /etc/hosts
         regexp: "^{{ item.key }}"
         line: "{{ item.key }} {{ item.value }}"
         owner: root
         group: root
         mode: 0644
+        mode: "0644"
         state: present
       with_dict:
 .168.56.3: client1
 .168.56.4: client2
     - name: Load legacy iptables to test their removal
@@ @@ -137,29 +137,29 @@ @@
     - name: Create deprecated directory for storing requirements files created using Python 3 (pip requirements upgrade checks)
       file:
         path: "/etc/pip_check_requirements_upgrades-py3"
         state: directory
         owner: root
         group: root
         mode: 0750
+        mode: "0750"
     - name: Create deprecated directory for Python 3 virtual environment (pip requirements upgrade checks)
       file:
         path: "/var/lib/pipreqcheck/virtualenv-py3/"
         state: directory
         owner: root
         group: root
         mode: 0750
+        mode: "0750"
     - name: Create deprecated cronjob file for Python 3 (pip requirements upgrade checks)
       file:
         path: "/etc/cron.d/check_pip_requirements-py3"
         state: touch
         owner: root
         group: root
         mode: 0644
+        mode: "0644"
     - name: Install the deprecated/obsolete NTP-related packages
       apt:
         name:
           - ntp
           - ntpdate

roles/common/tasks/main.yml

➞

Show inline comments

@@ @@ -26,13 +26,13 @@ @@
 - name: Enable use of proxy for retrieving system packages via apt
   template:
     src: "apt_proxy.j2"
     dest: "/etc/apt/apt.conf.d/00proxy"
     owner: root
     group: root
     mode: 0644
+    mode: "0644"
   when: apt_proxy is defined
 - name: Disable use of proxy for retrieving system packages via apt
   file:
     path: "/etc/apt/apt.conf.d/00proxy"
     state: absent
@@ @@ -41,13 +41,13 @@ @@
 - name: Deploy pam-auth-update configuration file for enabling pam_umask
   copy:
     src: "pam_umask"
     dest: "/usr/share/pam-configs/umask"
     owner: root
     group: root
     mode: 0644
+    mode: "0644"
   register: pam_umask
   notify:
     - Update PAM configuration
 - name: Update PAM configuration  # noqa no-handler
   # [no-handler] Tasks that run when changed should likely be handlers
@@ @@ -78,29 +78,29 @@ @@
 - name: Deploy bash profile configuration for fancier prompts
   template:
     src: "bash_prompt.sh.j2"
     dest: "/etc/profile.d/bash_prompt.sh"
     owner: root
     group: root
     mode: 0644
+    mode: "0644"
 - name: Deploy profile configuration that allows for user-specific profile.d files
   copy:
     src: "user_profile_d.sh"
     dest: "/etc/profile.d/z99-user_profile_d.sh"
     owner: root
     group: root
     mode: 0644
+    mode: "0644"
 - name: Replace default and skeleton bashrc
   copy:
     src: "{{ item.key }}"
     dest: "{{ item.value }}"
     owner: root
     group: root
     mode: 0644
+    mode: "0644"
   with_dict:
     bashrc: "/etc/bash.bashrc"
     skel_bashrc: "/etc/skel/.bashrc"
 - name: Calculate stock checksum for bashrc root account
   stat:
@@ @@ -110,13 +110,13 @@ @@
 - name: Replace stock bashrc for root account with skeleton one
   copy:
     src: "skel_bashrc"
     dest: "/root/.bashrc"
     owner: root
     group: root
     mode: 0640
+    mode: "0640"
   # Checksums: bookworm
   when: |
     root_bashrc_stat.stat.checksum == "1a422a148ad225aa5ba33f8dafd2b7cfcdbd701f"
 - name: Install sudo
   apt:
@@ @@ -136,13 +136,13 @@ @@
 - name: Disable electric-indent-mode for Emacs by default for all users
   copy:
     src: "01disable-electric-indent-mode.el"
     dest: "/etc/emacs/site-start.d/01disable-electric-indent-mode.el"
     owner: root
     group: root
     mode: 0644
+    mode: "0644"
   when: "['emacs24', 'emacs24-nox', 'emacs25', 'emacs25-nox', 'emacs', 'emacs-nox'] | intersect(common_packages) | length > 0"
 - name: Set-up operating system groups
   group:
     name: "{{ item.name }}"
     gid: "{{ item.gid | default(omit) }}"
@@ @@ -198,13 +198,13 @@ @@
 - name: Deploy CA certificates
   copy:
     content: "{{ item.value }}"
     dest: "/usr/local/share/ca-certificates/{{ item.key }}.crt"
     owner: root
     group: root
     mode: 0644
+    mode: "0644"
   with_dict: "{{ ca_certificates }}"
   register: deploy_ca_certificates_result
 - name: Update CA certificate cache  # noqa no-handler
   # [no-handler] Tasks that run when changed should likely be handlers
   #   CA certificate cache must be updated immediatelly in order for
@@ @@ -226,13 +226,13 @@ @@
 - name: Deploy the patched ferm binary that disables use of legacy iptables
   copy:
     src: ferm_binary
     dest: /usr/sbin/ferm
     owner: root
     group: root
     mode: 0755
+    mode: "0755"
   notify:
     - Restart ferm
 - name: Install ferm (for firewall management)
   apt:
     name: ferm
@@ @@ -241,31 +241,31 @@ @@
 - name: Configure ferm init script coniguration file
   copy:
     src: "ferm_default"
     dest: "/etc/default/ferm"
     owner: root
     group: root
     mode: 0644
+    mode: "0644"
   notify:
     - Restart ferm
 - name: Create directory for storing ferm configuration files
   file:
     dest: "/etc/ferm/conf.d/"
     state: directory
     owner: root
     group: root
     mode: 0750
+    mode: "0750"
 - name: Deploy main ferm configuration file
   copy:
     src: "ferm.conf"
     dest: "/etc/ferm/ferm.conf"
     owner: root
     group: root
     mode: 0640
+    mode: "0640"
   notify:
     - Restart ferm
 - name: Verify maintenance_allowed_sources parameter
   fail:
     msg: "Items in maintenance_allowed_sources must IPv4/IPv6 addresses or subnets: {{ item }}"
@@ @@ -275,13 +275,13 @@ @@
 - name: Deploy ferm base rules
   template:
     src: "00-base.conf.j2"
     dest: "/etc/ferm/conf.d/00-base.conf"
     owner: root
     group: root
     mode: 0640
+    mode: "0640"
   notify:
     - Restart ferm
 - name: Enable and start ferm
   service:
     name: ferm
@@ @@ -291,13 +291,13 @@ @@
 - name: Deploy script for flushing legacy iptables rules
   copy:
     src: "legacy_iptables_rules.sh"
     dest: "/usr/local/sbin/drop_legacy_iptables_rules.sh"
     owner: root
     group: root
     mode: 0755
+    mode: "0755"
 - name: Drop legacy iptables rules
   command: "/usr/local/sbin/drop_legacy_iptables_rules.sh remove"
   register: legacy_iptables_rules
   changed_when: "'Removed legacy iptables for families' in legacy_iptables_rules.stdout"
   notify:
@@ @@ -306,21 +306,21 @@ @@
 - name: Deploy script for validating server certificates
   copy:
     src: "check_certificate.sh"
     dest: "/usr/local/bin/check_certificate.sh"
     owner: root
     group: root
     mode: 0755
+    mode: "0755"
 - name: Set-up directory for holding configuration for certificate validation script
   file:
     path: "/etc/check_certificate"
     state: "directory"
     owner: root
     group: root
     mode: 0755
+    mode: "0755"
 - name: Deploy crontab entry for checking certificates
   cron:
     name: "check_certificate"
     cron_file: "check_certificate"
     hour: "0"
@@ @@ -407,13 +407,13 @@ @@
 - name: Create directory for Python virtual environment used for installing/running pip-tools
   file:
     path: "{{ item }}"
     state: directory
     owner: pipreqcheck
     group: pipreqcheck
     mode: 0750
+    mode: "0750"
   with_items:
     - "/var/lib/pipreqcheck"
     - "/var/lib/pipreqcheck/virtualenv"
 - name: Create Python virtual environment used for installing/running pip-tools
   command: "/usr/bin/virtualenv --python '{{ item.python_path }}' --prompt '{{ item.virtualenv_prompt }}' '{{ item.virtualenv_path }}'"
@@ @@ -431,44 +431,44 @@ @@
 - name: Create directory for storing pip requirements files
   file:
     path: "{{ item }}"
     state: "directory"
     owner: root
     group: pipreqcheck
     mode: 0750
+    mode: "0750"
   with_items:
     - "/etc/pip_check_requirements_upgrades"
 - name: Set-up directory for storing pip requirements file for pip-tools virtual environment itself
   file:
     path: "{{ item }}"
     state: "directory"
     owner: root
     group: pipreqcheck
     mode: 0750
+    mode: "0750"
   with_items:
     - "/etc/pip_check_requirements_upgrades/pipreqcheck"
 - name: Deploy .in file for pip requirements in pip-tools virtual environment
   template:
     src: "pipreqcheck_requirements.in.j2"
     dest: "{{ item.path }}"
     owner: root
     group: pipreqcheck
     mode: 0640
+    mode: "0640"
   with_items:
     - path: "/etc/pip_check_requirements_upgrades/pipreqcheck/requirements.in"
       requirements: "{{ pip_check_requirements_in }}"
 - name: Deploy requirements file for pipreqcheck virtual environment
   template:
     src: "pipreqcheck_requirements.txt.j2"
     dest: "{{ item.file }}"
     owner: root
     group: pipreqcheck
     mode: 0640
+    mode: "0640"
   with_items:
     - file: "/etc/pip_check_requirements_upgrades/pipreqcheck/requirements.txt"
       requirements: "{{ pip_check_requirements }}"
 - name: Install requirements in the pipreqcheck virtual environment
   pip:
@@ @@ -492,21 +492,21 @@ @@
 - name: Deploy script for checking available upgrades
   copy:
     src: "pip_check_requirements_upgrades.sh"
     dest: "/usr/local/bin/pip_check_requirements_upgrades.sh"
     owner: root
     group: root
     mode: 0755
+    mode: "0755"
 - name: Deploy crontab entry for checking pip requirements
   copy:
     src: "cron_check_pip_requirements"
     dest: "/etc/cron.d/check_pip_requirements"
     owner: root
     group: root
     mode: 0644
+    mode: "0644"
 - name: Install NTP packages
   apt:
     name:
       - ntpsec
       - ntpsec-ntpdate
@@ @@ -525,13 +525,13 @@ @@
 - name: Deploy NTP configuration
   template:
     src: "ntp.conf.j2"
     dest: "/etc/ntpsec/ntp.conf"
     owner: root
     group: root
     mode: 0644
+    mode: "0644"
   when: ntp_pools | length > 0
   notify:
     - Restart NTP server
 - name: Explicitly run all handlers
   include_tasks: ../handlers/main.yml

roles/database/tasks/backup.yml

➞

Show inline comments

@@ @@ -3,18 +3,18 @@ @@
 - name: Create directory for storing MariaDB database dumps
   file:
     path: "{{ item }}"
     state: directory
     owner: root
     group: root
     mode: 0700
+    mode: "0700"
   with_items:
     - "/srv/backup"
     - "/srv/backup/mariadb"
 - name: Deploy script for creating database backup dumps
   template:
     src: "dump_db.sh.j2"
     dest: "/etc/duply/main/pre.d/dump_{{ db_name }}.sh"
     owner: root
     group: root
     mode: 0700
+    mode: "0700"

roles/database_server/tasks/main.yml

➞

Show inline comments

@@ @@ -17,13 +17,13 @@ @@
 - name: Set UTF-8 encoding as default for MariaDB
   template:
     src: "utf8.cnf.j2"
     dest: "/etc/mysql/mariadb.conf.d/90-utf8.cnf"
     owner: root
     group: root
     mode: 0644
+    mode: "0644"
   register: mariadb_utf8_configuration
 - name: Restart MariaDB in order to use UTF-8 as default character set  # noqa no-handler
   # [no-handler] Tasks that run when changed should likely be handlers
   #   UTF-8 configuration must be applied immediatelly in order to ensure that
   #   subsequent tasks that create databases will end-up with correct (UTF-8)

roles/ldap_client/tasks/main.yml

➞

Show inline comments

@@ @@ -8,21 +8,21 @@ @@
 - name: Set-up LDAP client configuration directory
   file:
     path: /etc/ldap/
     state: directory
     owner: root
     group: root
     mode: 0755
+    mode: "0755"
 - name: Deploy LDAP client configuration file
   template:
     src: ldap.conf.j2
     dest: /etc/ldap/ldap.conf
     owner: root
     group: root
     mode: 0644
+    mode: "0644"
 - name: Explicitly run all handlers
   include_tasks: ../handlers/main.yml
   when: "run_handlers | default(False) | bool()"
   tags:
     - handlers

roles/ldap_server/molecule/default/prepare.yml

➞

Show inline comments

@@ @@ -52,13 +52,13 @@ @@
     - name: Deploy CA certificate
       copy:
         src: tests/data/x509/ca/level1.cert.pem
         dest: /etc/ssl/certs/testca.cert.pem
         owner: root
         group: root
         mode: 0644
+        mode: "0644"
     - name: Remove the ss utility (see https://github.com/philpep/testinfra/pull/320)
       file:
         path: "/bin/ss"
         state: absent
@@ @@ -84,13 +84,13 @@ @@
       lineinfile:
         path: /etc/hosts
         regexp: "^{{ item.key }}"
         line: "{{ item.key }} {{ item.value }}"
         owner: root
         group: root
         mode: 0644
+        mode: "0644"
         state: present
       with_dict:
 .168.56.21: parameters-mandatory-bookworm
 .168.56.22: parameters-optional-bookworm
 - name: Prepare, test fixtures
@@ @@ -102,13 +102,13 @@ @@
       lineinfile:
         path: /etc/hosts
         regexp: "^{{ item.key }}"
         line: "{{ item.key }} {{ item.value }}"
         owner: root
         group: root
         mode: 0644
+        mode: "0644"
         state: present
       with_dict:
 .0.2.1: parameters-optional
 - name: Prepare, test fixtures
   hosts: parameters-mandatory
@@ @@ -119,13 +119,13 @@ @@
       lineinfile:
         path: /etc/hosts
         regexp: "^{{ item.key }}"
         line: "{{ item.key }} {{ item.value }}"
         owner: root
         group: root
         mode: 0644
+        mode: "0644"
         state: present
       with_dict:
 .0.2.1: parameters-mandatory
 - name: Prepare, helpers
   hosts: backup-server

roles/ldap_server/tasks/backup.yml

➞

Show inline comments

@@ @@ -3,17 +3,17 @@ @@
 - name: Create directory for storing LDAP database dumps
   file:
     path: "{{ item }}"
     state: directory
     owner: root
     group: root
     mode: 0700
+    mode: "0700"
   with_items:
     - "/srv/backup"
 - name: Deploy script for creating LDAP database backup dumps
   copy:
     src: "ldapdump.sh"
     dest: "/etc/duply/main/pre.d/ldapdump.sh"
     owner: root
     group: root
     mode: 0700
+    mode: "0700"

roles/ldap_server/tasks/main.yml

➞

Show inline comments

@@ @@ -79,45 +79,45 @@ @@
 # against under Debian) picking a matching DH parameter from RFC-7919
 # (https://www.ietf.org/rfc/rfc7919.txt).
 - name: Generate the LDAP server Diffie-Hellman parameter
   openssl_dhparam:
     owner: root
     group: openldap
     mode: 0640
+    mode: "0640"
     path: "/etc/ssl/private/{{ ansible_fqdn }}_ldap.dh.pem"
     size: 2048
   notify:
     - Restart slapd
 - name: Deploy LDAP TLS private key
   template:
     src: "ldap_tls_key.j2"
     dest: "/etc/ssl/private/{{ ansible_fqdn }}_ldap.key"
     mode: 0640
+    mode: "0640"
     owner: root
     group: openldap
   notify:
     - Restart slapd
 - name: Deploy LDAP TLS certificate
   template:
     src: "ldap_tls_cert.j2"
     dest: "/etc/ssl/certs/{{ ansible_fqdn }}_ldap.pem"
     mode: 0644
+    mode: "0644"
     owner: root
     group: root
   notify:
     - Restart slapd
 - name: Deploy configuration file for checking certificate validity via cron
   copy:
     content: "/etc/ssl/certs/{{ ansible_fqdn }}_ldap.pem"
     dest: "/etc/check_certificate/{{ ansible_fqdn }}_ldap.conf"
     owner: root
     group: root
     mode: 0644
+    mode: "0644"
 # We need to have this hack around TLS configuration because OpenLDAP
 # expects both private key and certificate to be set at the same
 # time.
+#
 # OpenLDAP server behaviour is a bit weird around this thing, so here
@@ @@ -289,26 +289,26 @@ @@
 - name: Deploy firewall configuration for LDAP
   copy:
     src: "ferm_ldap.conf"
     dest: "/etc/ferm/conf.d/10-ldap.conf"
     owner: root
     group: root
     mode: 0640
+    mode: "0640"
   notify:
     - Restart ferm
 # @TODO: This whole thing could be dropped if newer version of Ansible
 #        was in use (where community collection has the ldap_search
 #        module.
 - name: Deploy temporary file with LDAP admin password
   template:
     src: "ldap_admin_password.j2"
     dest: "/root/.ldap_admin_password"
     owner: root
     group: root
     mode: 0400
+    mode: "0400"
   changed_when: false
 - name: Test if LDAP admin password needs to be changed
   command: "ldapwhoami -H ldapi:/// -D 'cn=admin,{{ ldap_server_int_basedn }}' -x -y /root/.ldap_admin_password"
   register: ldap_admin_password_check
   changed_when: ldap_admin_password_check.rc != 0

roles/mail_forwarder/molecule/default/prepare.yml

➞

Show inline comments

@@ @@ -51,13 +51,13 @@ @@
       lineinfile:
         path: /etc/hosts
         regexp: "^{{ item.key }}"
         line: "{{ item.key }} {{ item.value }}"
         owner: root
         group: root
         mode: 0644
+        mode: "0644"
         state: present
       with_dict:
 .168.56.11: "mail-server domain1"
 .168.56.12: "client1"
 .168.56.21: "parameters-mandatory-bookworm"
 .168.56.22: "parameters-optional-bookworm"
@@ @@ -86,13 +86,13 @@ @@
     - name: Deploy CA certificate
       copy:
         src: tests/data/x509/ca/level1.cert.pem
         dest: /usr/local/share/ca-certificates/testca.crt
         owner: root
         group: root
         mode: 0644
+        mode: "0644"
       notify:
         - Update CA certificate cache
   handlers:
     - name: Update CA certificate cache  # noqa no-changed-when
@@ @@ -108,23 +108,23 @@ @@
     - name: Deploy CA certificate
       copy:
         src: tests/data/x509/ca/level1.cert.pem
         dest: /usr/local/share/ca-certificates/testca.crt
         owner: root
         group: root
         mode: 0644
+        mode: "0644"
       notify:
         - Update CA certificate cache
     - name: Deploy SMTP private key and certificate
       copy:
         src: "tests/data/x509/server/{{ item }}"
         dest: "/etc/ssl/{{ item }}"
         owner: root
         group: root
         mode: 0600
+        mode: "0600"
       with_items:
         - mail-server_smtp.cert.pem
         - mail-server_smtp.key.pem
     - name: Install Postfix
       apt:
@@ @@ -140,13 +140,13 @@ @@
     - name: Deploy Postfix configuration
       copy:
         src: tests/data/main.cf
         dest: /etc/postfix/main.cf
         owner: root
         group: root
         mode: 0644
+        mode: "0644"
       notify:
         - Restart Postfix
     - name: Install tool for testing TCP connectivity
       apt:
         name: hping3

roles/mail_forwarder/tasks/main.yml

➞

Show inline comments

@@ @@ -19,41 +19,41 @@ @@
 - name: Deploy the SMTP relay TLS truststore
   copy:
     content: "{{ smtp_relay_truststore }}"
     dest: "/etc/ssl/certs/smtp_relay_truststore.pem"
     owner: root
     group: root
     mode: 0644
+    mode: "0644"
 - name: Generate the SMTP server Diffie-Hellman parameter
   openssl_dhparam:
     owner: root
     group: root
     mode: 0640
+    mode: "0640"
     path: "/etc/ssl/private/{{ ansible_fqdn }}_smtp.dh.pem"
     size: 2048
   notify:
     - Restart Postfix
 - name: Configure visible mail name of the system
   copy:
     content: "{{ inventory_hostname }}"
     dest: "/etc/mailname"
     owner: root
     group: root
     mode: 0644
+    mode: "0644"
   notify:
     - Restart Postfix
 - name: Deploy Postfix main configuration
   template:
     src: "main.cf.j2"
     dest: "/etc/postfix/main.cf"
     owner: root
     group: root
     mode: 0644
+    mode: "0644"
   notify:
     - Restart Postfix
 - name: Set-up local mail aliases
   lineinfile:
     dest: "/etc/aliases"
@@ @@ -105,13 +105,13 @@ @@
 - name: Deploy firewall configuration for mail forwader
   template:
     src: "ferm_mail.conf.j2"
     dest: "/etc/ferm/conf.d/20-mail.conf"
     owner: root
     group: root
     mode: 0640
+    mode: "0640"
   notify:
     - Restart ferm
 - name: Install SWAKS
   apt:
     name: swaks

roles/mail_server/molecule/default/prepare.yml

➞

Show inline comments

@@ @@ -80,13 +80,13 @@ @@
     - name: Set-up directory for ClamAV database sync tool virtual environment
       file:
         path: /var/lib/cvdupdate
         state: directory
         owner: vagrant
         group: vagrant
         mode: 0755
+        mode: "0755"
     - name: Create virtual environment for running ClamAV database sync tool
       become: true
       become_user: vagrant
       command:
         cmd: "/usr/bin/virtualenv --python /usr/bin/python3 --prompt '(cvdupdate) ' /var/lib/cvdupdate"
@@ @@ -95,33 +95,33 @@ @@
     - name: Deploy pip requirements file for running the ClamAV database sync tool
       copy:
         src: cvdupdate-requirements.txt
         dest: /var/lib/cvdupdate/requirements.txt
         owner: vagrant
         group: vagrant
         mode: 0644
+        mode: "0644"
     - name: Install requirements in the pipreqcheck virtual environment
       become: true
       become_user: vagrant
       pip:
         requirements: /var/lib/cvdupdate/requirements.txt
         virtualenv: /var/lib/cvdupdate
     - name: Allow traversal of Vagrant directory by the http server user
       file:
         path: /vagrant/
         mode: 0711
+        mode: "0711"
     - name: Create directory for storing ClamAV database files
       file:
         path: /vagrant/clamav-database
         state: directory
         owner: vagrant
         group: vagrant
         mode: 0755
+        mode: "0755"
     - name: Configure default location for storing ClamAV database files  # noqa no-changed-when
       # [no-changed-when] Commands should not change things if nothing needs doing
       #   Does not matter in test prepare step.
       become: true
       become_user: vagrant
@@ @@ -141,35 +141,35 @@ @@
         recurse: true
     - name: Deploy nginx TLS private key
       copy:
         dest: "/etc/ssl/private/nginx_https.key"
         content: "{{ clamav_database_http_server_tls_key }}"
         mode: 0640
+        mode: "0640"
         owner: root
         group: root
       notify:
         - Restart nginx
     - name: Deploy nginx TLS certificate
       copy:
         dest: "/etc/ssl/certs/nginx_https.pem"
         content: "{{ clamav_database_http_server_tls_certificate }}"
         mode: 0644
+        mode: "0644"
         owner: root
         group: root
       notify:
         - Restart nginx
     - name: Deploy nginx configuration for serving the ClamAV database files
       copy:
         src: clamav-database-nginx.conf
         dest: /etc/nginx/sites-available/default
         owner: root
         group: root
         mode: 0644
+        mode: "0644"
       notify:
         - Restart nginx
   handlers:
     - name: Restart nginx
@@ @@ -194,23 +194,23 @@ @@
           [system_default_sect]
           MinProtocol = TLSv1.1
           CipherString = DEFAULT@SECLEVEL=0
         owner: root
         group: root
         mode: 0644
+        mode: "0644"
         state: present
     - name: Set-up the hosts file
       lineinfile:
         path: /etc/hosts
         regexp: "^{{ item.key }}"
         line: "{{ item.key }} {{ item.value }}"
         owner: root
         group: root
         mode: 0644
+        mode: "0644"
         state: present
       with_dict:
         # Force mail servers to use local ClamAV database mirror.
 .168.56.11: "db.local.clamav.net database.clamav.net"
 .168.56.12: "ldap-server backup-server"
 .168.56.21: "client1 smtp-server-requiring-tls"
@@ @@ -282,26 +282,26 @@ @@
     - name: Deploy IMAP CLI configuration
       copy:
         src: "tests/data/{{ item }}"
         dest: "/home/vagrant/{{ item }}"
         owner: vagrant
         group: vagrant
         mode: 0600
+        mode: "0600"
       with_items:
         - imapcli-parameters-mandatory-john_doe.conf
         - imapcli-parameters-mandatory-jane_doe.conf
         - imapcli-parameters-optional-john_doe.conf
         - imapcli-parameters-optional-jane_doe.conf
     - name: Deploy CA certificate
       copy:
         src: tests/data/x509/ca/level1.cert.pem
         dest: /usr/local/share/ca-certificates/testca.crt
         owner: root
         group: root
         mode: 0644
+        mode: "0644"
       notify:
         - Update CA certificate cache
     - name: Install and configure Postfix for testing mail sending from managed servers
       block:
@@ @@ -319,13 +319,13 @@ @@
         - name: Configure Postfix
           template:
             src: "helper_smtp_main.cf.j2"
             dest: "/etc/postfix/main.cf"
             owner: root
             group: root
             mode: 0644
+            mode: "0644"
           notify:
             - Restart Postfix
         - name: Enable Postfix service
           service:
             name: postfix

roles/mail_server/tasks/main.yml

➞

Show inline comments

@@ @@ -40,75 +40,75 @@ @@
     groups: ssl-cert
 - name: Deploy SMTP TLS private key
   copy:
     dest: "/etc/ssl/private/{{ ansible_fqdn }}_smtp.key"
     content: "{{ smtp_tls_key }}"
     mode: 0640
+    mode: "0640"
     owner: root
     group: root
   notify:
     - Restart Postfix
 - name: Deploy SMTP TLS certificate
   copy:
     dest: "/etc/ssl/certs/{{ ansible_fqdn }}_smtp.pem"
     content: "{{ smtp_tls_certificate }}"
     mode: 0644
+    mode: "0644"
     owner: root
     group: root
   notify:
     - Restart Postfix
 - name: Generate the SMTP server Diffie-Hellman parameter
   openssl_dhparam:
     owner: root
     group: root
     mode: 0640
+    mode: "0640"
     path: "/etc/ssl/private/{{ ansible_fqdn }}_smtp.dh.pem"
     size: 2048
   notify:
     - Restart Postfix
 - name: Deploy IMAP TLS private key
   copy:
     dest: "/etc/ssl/private/{{ ansible_fqdn }}_imap.key"
     content: "{{ imap_tls_key }}"
     mode: 0640
+    mode: "0640"
     owner: root
     group: root
   notify:
     - Restart Dovecot
 - name: Deploy IMAP TLS certificate
   copy:
     dest: "/etc/ssl/certs/{{ ansible_fqdn }}_imap.pem"
     content: "{{ imap_tls_certificate }}"
     mode: 0644
+    mode: "0644"
     owner: root
     group: root
   notify:
     - Restart Dovecot
 - name: Generate the IMAP server Diffie-Hellman parameter
   openssl_dhparam:
     owner: root
     group: root
     mode: 0640
+    mode: "0640"
     path: "/etc/ssl/private/{{ ansible_fqdn }}_imap.dh.pem"
     size: 2048
   notify:
     - Restart Dovecot
 - name: Deploy configuration files for checking certificate validity via cron
   copy:
     content: "/etc/ssl/certs/{{ ansible_fqdn }}_{{ item }}.pem"
     dest: "/etc/check_certificate/{{ ansible_fqdn }}_{{ item }}.conf"
     owner: root
     group: root
     mode: 0644
+    mode: "0644"
   with_items:
     - smtp
     - imap
 - name: Install SWAKS
   apt:
@@ @@ -121,22 +121,22 @@ @@
     state: present
 - name: Configure ClamAV Milter
   copy:
     dest: "/etc/clamav/clamav-milter.conf"
     src: "clamav-milter.conf"
     mode: 0644
+    mode: "0644"
     owner: root
     group: root
   notify:
     - Restart ClamAV Milter
 - name: Set-up privileges for directories within Postfix chroot
   file:
     dest: "{{ item }}"
     mode: 0755
+    mode: "0755"
     state: directory
     owner: root
     group: root
   with_items:
     - /var/spool/postfix/var
     - /var/spool/postfix/var/run
@@ @@ -144,51 +144,51 @@ @@
 - name: Set-up privileges for directories within Postfix chroot
   file:
     dest: "{{ item }}"
     state: directory
     owner: clamav
     group: clamav
     mode: 0755
+    mode: "0755"
   with_items:
     - /var/spool/postfix/var/run/clamav
 - name: Deploy the LDAP TLS truststore in default location
   copy:
     content: "{{ mail_ldap_tls_truststore }}"
     dest: "/etc/ssl/certs/mail_ldap_tls_truststore.pem"
     owner: root
     group: root
     mode: 0644
+    mode: "0644"
 - name: Deploy the LDAP TLS truststore in Postfix chroot
   copy:
     content: "{{ mail_ldap_tls_truststore }}"
     dest: "/var/spool/postfix/etc/ssl/certs/mail_ldap_tls_truststore.pem"
     owner: root
     group: root
     mode: 0644
+    mode: "0644"
   notify:
     - Restart Postfix
 - name: Configure visible mail name of the system
   copy:
     content: "{{ inventory_hostname }}"
     dest: "/etc/mailname"
     owner: root
     group: root
     mode: 0644
+    mode: "0644"
   notify:
     - Restart Postfix
 - name: Deploy Postfix configurations files for LDAP look-ups
   template:
     src: "{{ item }}.cf.j2"
     dest: "/etc/postfix/{{ item }}.cf"
     owner: root
     group: postfix
     mode: 0640
+    mode: "0640"
   with_items:
     - ldap-virtual-alias-maps
     - ldap-virtual-mailbox-domains
     - ldap-virtual-mailbox-maps
   notify:
     - Restart Postfix
@@ @@ -196,13 +196,13 @@ @@
 - name: Deploy Postfix main configuration
   template:
     src: "main.cf.j2"
     dest: "/etc/postfix/main.cf"
     owner: root
     group: root
     mode: 0644
+    mode: "0644"
   notify:
     - Restart Postfix
 - name: Set-up local mail aliases
   lineinfile:
     dest: "/etc/aliases"
@@ @@ -238,33 +238,33 @@ @@
 - name: Deploy Dovecot configuration file with overrides
   template:
     src: "99-local.conf.j2"
     dest: "/etc/dovecot/conf.d/99-local.conf"
     owner: root
     group: root
     mode: 0644
+    mode: "0644"
   notify:
     - Restart Dovecot
 - name: Deploy Dovecot configuration file for LDAP look-ups
   template:
     src: "dovecot-ldap.conf.ext.j2"
     dest: "/etc/dovecot/dovecot-ldap.conf.ext"
     owner: root
     group: root
     mode: 0600
+    mode: "0600"
   notify:
     - Restart Dovecot
 - name: Deploy Postifx master process configuration
   template:
     src: "master.cf.j2"
     dest: "/etc/postfix/master.cf"
     owner: root
     group: root
     mode: 0644
+    mode: "0644"
   notify:
     - Restart Postfix
 - name: Enable and start ClamAV database update service (freshclam)
   service:
     name: clamav-freshclam
@@ @@ -317,13 +317,13 @@ @@
 - name: Deploy firewall configuration for mail server
   copy:
     src: "ferm_mail.conf"
     dest: "/etc/ferm/conf.d/20-mail.conf"
     owner: root
     group: root
     mode: 0640
+    mode: "0640"
   notify:
     - Restart ferm
 - name: Explicitly run all handlers
   include_tasks: ../handlers/main.yml
   when: "run_handlers | default(False) | bool()"

roles/php_website/molecule/default/converge.yml

➞

Show inline comments

@@ @@ -59,41 +59,41 @@ @@
     - name: Set-up directory where PHP files are hosted at
       file:
         path: /var/www/parameters-mandatory/htdocs
         state: directory
         owner: admin-parameters-mandatory
         group: web-parameters-mandatory
         mode: 0750
+        mode: "0750"
     - name: Deploy a couple of PHP pages for testing purposes
       copy:
         src: "tests/data/php/mandatory/{{ item }}"
         dest: "/var/www/parameters-mandatory/htdocs/{{ item }}"
         owner: admin-parameters-mandatory
         group: web-parameters-mandatory
         mode: 0640
+        mode: "0640"
       with_items:
         - index.php
         - index.php3
     # parameters-optional application
     - name: Set-up directory where PHP files are hosted at
       file:
         path: /var/www/parameters-optional.local/htdocs
         state: directory
         owner: admin-parameters-optional_local
         group: web-parameters-optional_local
         mode: 0750
+        mode: "0750"
     - name: Deploy a couple of PHP pages for testing purposes
       copy:
         src: "tests/data/php/optional/{{ item }}"
         dest: "/var/www/parameters-optional.local/htdocs/{{ item }}"
         owner: admin-parameters-optional_local
         group: web-parameters-optional_local
         mode: 0640
+        mode: "0640"
       with_items:
         - myindex.php
         - myindex.myphp
         - path.myphp
         - secretfile.txt
         - info.myphp

roles/php_website/tasks/main.yml

➞

Show inline comments

@@ @@ -19,13 +19,13 @@ @@
 - name: Set-up directory for storing user profile configuration files
   file:
     path: "{{ home }}/.profile.d"
     state: directory
     owner: "{{ admin }}"
     group: "{{ user }}"
     mode: 0750
+    mode: "0750"
 - name: Create PHP website user
   user:
     name: "{{ user }}"
     uid: "{{ uid | default(omit) }}"
     group: "{{ user }}"
@@ @@ -52,13 +52,13 @@ @@
 - name: Set-up forwarding for mails delivered to local application user/admin
   template:
     src: "forward.j2"
     dest: "{{ home }}/.forward"
     owner: root
     group: "{{ user }}"
     mode: 0640
+    mode: "0640"
 - name: Install extra packages for website
   apt:
     name: "{{ packages }}"
     state: present
@@ @@ -66,51 +66,51 @@ @@
   template:
     src: "fpm_site.conf.j2"
     dest: "{{ php_fpm_pool_directory }}/{{ fqdn }}.conf"
     validate: "{{ php_fpm_binary }} -t -y %s"
     owner: root
     group: root
     mode: 0640
+    mode: "0640"
   notify:
     - Restart PHP-FPM
 - name: Deploy nginx TLS private key for website
   copy:
     dest: "/etc/ssl/private/{{ fqdn }}_https.key"
     content: "{{ https_tls_key }}"
     owner: root
     group: root
     mode: 0640
+    mode: "0640"
   notify:
     - Restart nginx
 - name: Deploy nginx TLS certificate for website
   copy:
     dest: "/etc/ssl/certs/{{ fqdn }}_https.pem"
     content: "{{ https_tls_certificate }}"
     owner: root
     group: root
     mode: 0644
+    mode: "0644"
   notify:
     - Restart nginx
 - name: Deploy configuration file for checking certificate validity via cron
   copy:
     content: "/etc/ssl/certs/{{ fqdn }}_https.pem"
     dest: "/etc/check_certificate/{{ fqdn }}_https.conf"
     owner: root
     group: root
     mode: 0644
+    mode: "0644"
 - name: Deploy nginx configuration file for website
   template:
     src: "nginx_site.j2"
     dest: "/etc/nginx/sites-available/{{ fqdn }}"
     owner: root
     group: root
     mode: 0640
+    mode: "0640"
     validate: "/usr/local/bin/nginx_verify_site.sh -n '{{ fqdn }}' %s"
   notify:
     - Restart nginx
 - name: Enable website
   file:

roles/preseed/tasks/main.yml

➞

Show inline comments

 ---
 - name: Create directory for storing preseed configurations
   file:
     path: "{{ preseed_directory }}"
     mode: 0750
+    mode: "0750"
     state: directory
 - name: Create preseed configuration file
   template:
     src: "preseed.cfg.j2"
     dest: "{{ preseed_directory }}/{{ item }}.cfg"
     mode: 0640
+    mode: "0640"
   when: item != "localhost"
   with_items: "{{ groups['all'] }}"
 - name: Explicitly run all handlers
   include_tasks: ../handlers/main.yml
   when: "run_handlers | default(False) | bool()"

roles/web_server/molecule/default/prepare.yml

➞

Show inline comments

@@ @@ -73,13 +73,13 @@ @@
           [system_default_sect]
           MinProtocol = TLSv1.1
           CipherString = DEFAULT@SECLEVEL=0
         owner: root
         group: root
         mode: 0644
+        mode: "0644"
         state: present
 - name: Prepare, test fixtures
   hosts: all
   become: true
   tasks:
@@ @@ -88,13 +88,13 @@ @@
       lineinfile:
         path: /etc/hosts
         regexp: "^{{ item.key }}"
         line: "{{ item.key }} {{ item.value }}"
         owner: root
         group: root
         mode: 0644
+        mode: "0644"
         state: present
       with_dict:
 .168.56.11: "client"
 .168.56.21: "parameters-mandatory-bookworm"
 .168.56.22: "parameters-optional-bookworm"
@@ @@ -121,13 +121,13 @@ @@
     - name: Deploy CA certificate
       copy:
         src: tests/data/x509/ca/level1.cert.pem
         dest: /usr/local/share/ca-certificates/testca.crt
         owner: root
         group: root
         mode: 0644
+        mode: "0644"
       notify:
         - Update CA certificate cache
   handlers:
     - name: Update CA certificate cache  # noqa no-changed-when

roles/web_server/tasks/main.yml

➞

Show inline comments

@@ @@ -14,45 +14,45 @@ @@
     - Restart nginx
 - name: Deploy nginx TLS private key
   copy:
     dest: "/etc/ssl/private/{{ ansible_fqdn }}_https.key"
     content: "{{ default_https_tls_key }}"
     mode: 0640
+    mode: "0640"
     owner: root
     group: root
   notify:
     - Restart nginx
 - name: Deploy nginx TLS certificate
   copy:
     dest: "/etc/ssl/certs/{{ ansible_fqdn }}_https.pem"
     content: "{{ default_https_tls_certificate }}"
     mode: 0644
+    mode: "0644"
     owner: root
     group: root
   notify:
     - Restart nginx
 - name: Generate the HTTPS server Diffie-Hellman parameter
   openssl_dhparam:
     owner: root
     group: root
     mode: 0640
+    mode: "0640"
     path: "/etc/ssl/private/{{ ansible_fqdn }}_https.dh.pem"
     size: 2048
   notify:
     - Restart nginx
 - name: Deploy configuration file for checking certificate validity via cron
   copy:
     content: "/etc/ssl/certs/{{ ansible_fqdn }}_https.pem"
     dest: "/etc/check_certificate/{{ ansible_fqdn }}_https.conf"
     owner: root
     group: root
     mode: 0644
+    mode: "0644"
 - name: Remove TLS protocol configuration from the main configuration file
   lineinfile:
     dest: "/etc/nginx/nginx.conf"
     backrefs: true
     regexp: "^\\s*ssl_protocols"
@@ @@ -63,31 +63,31 @@ @@
 - name: Harden TLS by allowing only TLSv1.2 and PFS ciphers
   template:
     dest: "/etc/nginx/conf.d/tls.conf"
     src: "tls.conf.j2"
     owner: "root"
     group: "root"
     mode: 0644
+    mode: "0644"
   notify:
     - Restart nginx
 - name: Deploy script for verification of nginx vhost configurations
   copy:
     src: "nginx_verify_site.sh"
     dest: "/usr/local/bin/nginx_verify_site.sh"
     owner: root
     group: root
     mode: 0755
+    mode: "0755"
 - name: Deploy default vhost configuration
   template:
     src: "nginx-default.j2"
     dest: "/etc/nginx/sites-available/default"
     owner: root
     group: root
     mode: 0640
+    mode: "0640"
     validate: "/usr/local/bin/nginx_verify_site.sh -n default %s"
   notify:
     - Restart nginx
 - name: Enable default website
   file:
@@ @@ -100,13 +100,13 @@ @@
 - name: Deploy firewall configuration for web server
   copy:
     src: "ferm_http.conf"
     dest: "/etc/ferm/conf.d/30-web.conf"
     owner: root
     group: root
     mode: 0640
+    mode: "0640"
   notify:
     - Restart ferm
 - name: Remove the default Debian html files
   file:
     path: "{{ item }}"
@@ @@ -118,21 +118,21 @@ @@
 - name: Create directory for storing the default website page
   file:
     path: "/var/www/default/"
     state: directory
     owner: root
     group: www-data
     mode: 0750
+    mode: "0750"
 - name: Deploy the default index.html
   template:
     src: "index.html.j2"
     dest: /var/www/default/index.html
     owner: root
     group: www-data
     mode: 0640
+    mode: "0640"
 - name: Enable nginx service
   service:
     name: nginx
     enabled: true
     state: started
@@ @@ -153,45 +153,45 @@ @@
 - name: Create directories for storing per-site socket files
   file:
     path: "/run/{{ item }}"
     state: directory
     owner: root
     group: www-data
     mode: 0750
+    mode: "0750"
   with_items:
     - wsgi
     - php
 - name: Create directories for storing per-site socket files on boot
   copy:
     content: "d /run/{{ item.socket_dir }}/ 0750 root www-data - -"
     dest: "/etc/tmpfiles.d/{{ item.tmpfiles_d }}"
     owner: root
     group: root
     mode: 0644
+    mode: "0644"
   with_items:
     - socket_dir: wsgi
       tmpfiles_d: "wsgi.conf"
     - socket_dir: php
       tmpfiles_d: "{{ php_fpm_service_name }}.conf"
 - name: Create directory for storing PHP-FPM service configuration overrides
   file:
     path: "/etc/systemd/system/{{ php_fpm_service_name }}.service.d/"
     state: directory
     owner: root
     group: root
     mode: 0755
+    mode: "0755"
 - name: Configure PHP-FPM service to run with umask 0007
   copy:
     src: "php_fpm_umask.conf"
     dest: "/etc/systemd/system/{{ php_fpm_service_name }}.service.d/umask.conf"
     owner: root
     group: root
     mode: 0644
+    mode: "0644"
   notify:
     - Reload systemd
     - Restart PHP-FPM
 - name: Enable service used for running PHP web applications
   service:
@@ @@ -207,13 +207,13 @@ @@
 - name: Configure timezone for PHP
   template:
     src: "php_timezone.ini.j2"
     dest: "{{ item }}/30-timezone.ini"
     owner: root
     group: root
     mode: 0644
+    mode: "0644"
   with_items:
     - "{{ php_base_config_dir }}/cli/conf.d/"
     - "{{ php_base_config_dir }}/fpm/conf.d/"
   notify:
     - Restart PHP-FPM

roles/wsgi_website/molecule/default/converge.yml

➞

Show inline comments

@@ @@ -99,116 +99,116 @@ @@
     - name: Set-up directories where application files are hosted at
       file:
         path: "/var/www/parameters-mandatory/{{ item }}"
         state: directory
         owner: admin-parameters-mandatory
         group: web-parameters-mandatory
         mode: 02750
+        mode: "02750"
       with_items:
         - htdocs/static
         - htdocs/media
         - code
     - name: Deploy WSGI application
       copy:
         src: "tests/data/python/wsgi/testapp.py"
         dest: "/var/www/parameters-mandatory/code/testapp.py"
         owner: admin-parameters-mandatory
         group: web-parameters-mandatory
         mode: 0640
+        mode: "0640"
       notify:
         - Restart parameters-mandatory
     - name: Deploy a static file
       copy:
         src: "tests/data/static_file.txt"
         dest: "/var/www/parameters-mandatory/htdocs/static/static_file.txt"
         owner: admin-parameters-mandatory
         group: web-parameters-mandatory
         mode: 0640
+        mode: "0640"
     - name: Deploy a media file
       copy:
         src: "tests/data/media_file.txt"
         dest: "/var/www/parameters-mandatory/htdocs/media/media_file.txt"
         owner: admin-parameters-mandatory
         group: web-parameters-mandatory
         mode: 0640
+        mode: "0640"
     # parameters-optional application
     - name: Set-up directories where application files are hosted at
       file:
         path: "/var/www/parameters-optional.local/{{ item }}"
         state: directory
         owner: admin-parameters-optional_local
         group: web-parameters-optional_local
         mode: 02750
+        mode: "02750"
       with_items:
         - htdocs/static
         - htdocs/media
         - code
     - name: Deploy WSGI application
       copy:
         src: "tests/data/python/wsgi/testapp.py"
         dest: "/var/www/parameters-optional.local/code/testapp.py"
         owner: admin-parameters-optional_local
         group: web-parameters-optional_local
         mode: 0640
+        mode: "0640"
       notify:
         - Restart parameters-optional.local
     - name: Deploy a static file
       copy:
         src: "tests/data/static_file.txt"
         dest: "/var/www/parameters-optional.local/htdocs/static/static_file.txt"
         owner: admin-parameters-optional_local
         group: web-parameters-optional_local
         mode: 0640
+        mode: "0640"
     - name: Deploy a media file
       copy:
         src: "tests/data/media_file.txt"
         dest: "/var/www/parameters-optional.local/htdocs/media/media_file.txt"
         owner: admin-parameters-optional_local
         group: web-parameters-optional_local
         mode: 0640
+        mode: "0640"
     # parameters-paste-req application
     - name: Set-up directories where application files are hosted at
       file:
         path: "/var/www/parameters-paste-req/{{ item }}"
         state: directory
         owner: admin-parameters-paste-req
         group: web-parameters-paste-req
         mode: 02750
+        mode: "02750"
       with_items:
         - htdocs/static
         - htdocs/media
         - code
     - name: Deploy WSGI application
       copy:
         src: "tests/data/python/paste/{{ item }}"
         dest: "/var/www/parameters-paste-req/code/{{ item }}"
         owner: admin-parameters-paste-req
         group: web-parameters-paste-req
         mode: 0640
+        mode: "0640"
       with_items:
         - config.ini
         - testapp.py
         - wsgi.py
       notify:
         - Restart parameters-paste-req
     - name: Deploy a static file
       copy:
         src: "tests/data/static_file.txt"
         dest: "/var/www/parameters-paste-req/htdocs/static/static_file.txt"
         owner: admin-parameters-paste-req
         group: web-parameters-paste-req
         mode: 0640
+        mode: "0640"
     - name: Deploy a media file
       copy:
         src: "tests/data/media_file.txt"
         dest: "/var/www/parameters-paste-req/htdocs/media/media_file.txt"
         owner: admin-parameters-paste-req
         group: web-parameters-paste-req
         mode: 0640
+        mode: "0640"
   handlers:
     - name: Restart parameters-mandatory
       service:
         name: parameters-mandatory
         state: restarted

roles/wsgi_website/tasks/main.yml

➞

Show inline comments

@@ @@ -19,29 +19,29 @@ @@
 - name: Set-up directory for storing user profile configuration files
   file:
     path: "{{ home }}/.profile.d"
     state: directory
     owner: "{{ admin }}"
     group: "{{ user }}"
     mode: 0750
+    mode: "0750"
 - name: Deploy profile configuration file for auto-activating the virtual environment
   copy:
     src: "profile_virtualenv.sh"
     dest: "{{ home }}/.profile.d/virtualenv.sh"
     owner: root
     group: "{{ user }}"
     mode: 0640
+    mode: "0640"
 - name: Deploy profile configuration file for setting environment variables
   template:
     src: "environment.sh.j2"
     dest: "{{ home }}/.profile.d/environment.sh"
     owner: root
     group: "{{ user }}"
     mode: 0640
+    mode: "0640"
 - name: Create WSGI website user
   user:
     name: "{{ user }}"
     uid: "{{ uid | default(omit) }}"
     group: "{{ user }}"
@@ @@ -68,13 +68,13 @@ @@
 - name: Set-up forwarding for mails delivered to local application user/admin
   template:
     src: "forward.j2"
     dest: "{{ home }}/.forward"
     owner: root
     group: "{{ user }}"
     mode: 0640
+    mode: "0640"
 - name: Install extra packages for website
   apt:
     name: "{{ packages }}"
     state: present
   register: install_extra_packages
@@ @@ -125,13 +125,13 @@ @@
 - name: Create directory for storing the Python virtual environment
   file:
     path: "{{ home }}/virtualenv"
     state: directory
     owner: "{{ admin }}"
     group: "{{ user }}"
     mode: 02750
+    mode: "02750"
 - name: Create Python virtual environment
   command: '/usr/bin/virtualenv --python "{{ python_interpreter }}" --prompt "{{ virtualenv_prompt }}" "{{ home }}/virtualenv"'
   args:
     creates: "{{ home }}/virtualenv/bin/{{ python_interpreter | basename }}"
   become: true
@@ @@ -140,48 +140,48 @@ @@
 - name: Configure project directory for the Python virtual environment
   template:
     src: "venv_project.j2"
     dest: "{{ home }}/virtualenv/.project"
     owner: "{{ admin }}"
     group: "{{ user }}"
     mode: 0640
+    mode: "0640"
 - name: Deploy virtualenv wrapper
   template:
     src: "venv_exec.j2"
     dest: "{{ home }}/virtualenv/bin/exec"
     owner: "{{ admin }}"
     group: "{{ user }}"
     mode: 0750
+    mode: "0750"
 - name: Set-up directory for storing requirements file for upgrade checks
   file:
     path: "{{ pip_check_requirements_upgrades_directory }}/{{ fqdn }}"
     state: directory
     owner: root
     group: pipreqcheck
     mode: 0750
+    mode: "0750"
 - name: Deploy WSGI requirements files for upgrade checks
   template:
     src: "{{ item }}.j2"
     dest: "{{ pip_check_requirements_upgrades_directory }}/{{ fqdn }}/{{ item }}"
     owner: root
     group: pipreqcheck
     mode: 0640
+    mode: "0640"
   with_items:
     - wsgi_requirements.in
     - wsgi_requirements.txt
 - name: Deploy Gunicorn requirements file for installation purposes
   template:
     src: "wsgi_requirements.txt.j2"
     dest: "{{ home }}/.wsgi_requirements.txt"
     owner: "{{ admin }}"
     group: "{{ user }}"
     mode: 0640
+    mode: "0640"
 - name: Install Gunicorn via requirements file
   become: true
   become_user: "{{ admin }}"
   pip:
     requirements: "{{ home }}/.wsgi_requirements.txt"
@@ @@ -206,25 +206,25 @@ @@
 - name: Deploy systemd socket configuration for website
   template:
     src: "systemd_wsgi_website.socket.j2"
     dest: "/etc/systemd/system/{{ fqdn }}.socket"
     owner: root
     group: root
     mode: 0644
+    mode: "0644"
   register: deploy_systemd_socket_configuration
   notify:
     - Reload systemd
     - Restart WSGI services
 - name: Deploy systemd service configuration for website
   template:
     src: "systemd_wsgi_website.service.j2"
     dest: "/etc/systemd/system/{{ fqdn }}.service"
     owner: root
     group: root
     mode: 0644
+    mode: "0644"
   register: deploy_systemd_service_configuration
   notify:
     - Reload systemd
     - Restart WSGI services
 - name: Enable the website service
@@ @@ -236,49 +236,49 @@ @@
 - name: Create directory where static files can be served from
   file:
     path: "{{ home }}/htdocs/"
     state: directory
     owner: "{{ admin }}"
     group: "{{ user }}"
     mode: 02750
+    mode: "02750"
 - name: Deploy nginx TLS private key for website
   copy:
     dest: "/etc/ssl/private/{{ fqdn }}_https.key"
     content: "{{ https_tls_key }}"
     owner: root
     group: root
     mode: 0640
+    mode: "0640"
   notify:
     - Restart nginx
 - name: Deploy nginx TLS certificate for website
   copy:
     dest: "/etc/ssl/certs/{{ fqdn }}_https.pem"
     content: "{{ https_tls_certificate }}"
     owner: root
     group: root
     mode: 0644
+    mode: "0644"
   notify:
     - Restart nginx
 - name: Deploy configuration file for checking certificate validity via cron
   copy:
     content: "/etc/ssl/certs/{{ fqdn }}_https.pem"
     dest: "/etc/check_certificate/{{ fqdn }}_https.conf"
     owner: root
     group: root
     mode: 0644
+    mode: "0644"
 - name: Deploy nginx configuration file for website
   template:
     src: "nginx_site.j2"
     dest: "/etc/nginx/sites-available/{{ fqdn }}"
     owner: root
     group: root
     mode: 0640
+    mode: "0640"
     validate: "/usr/local/bin/nginx_verify_site.sh -n '{{ fqdn }}' %s"
   notify:
     - Restart nginx
 - name: Enable nginx website
   file:

roles/xmpp_server/molecule/default/prepare.yml

➞

Show inline comments

@@ @@ -91,23 +91,23 @@ @@
           [system_default_sect]
           MinProtocol = TLSv1.1
           CipherString = DEFAULT@SECLEVEL=0
         owner: root
         group: root
         mode: 0644
+        mode: "0644"
         state: present
     - name: Set-up the hosts file
       lineinfile:
         path: /etc/hosts
         regexp: "^{{ item.key }}"
         line: "{{ item.key }} {{ item.value }}"
         owner: root
         group: root
         mode: 0644
+        mode: "0644"
         state: present
       with_dict:
 .168.56.11: "ldap-server backup-server"
 .168.56.21: "client-bookworm"
 .168.56.31: "parameters-mandatory domain1 proxy.domain1 conference.domain1"
 .168.56.32: "parameters-optional domain2 proxy.domain2 conference.domain2 domain3 proxy.domain3 conference.domain3"
@@ @@ -125,13 +125,13 @@ @@
     - name: Deploy CA certificate
       copy:
         src: tests/data/x509/ca/level1.cert.pem
         dest: /usr/local/share/ca-certificates/testca.crt
         owner: root
         group: root
         mode: 0644
+        mode: "0644"
       notify:
         - Update CA certificate cache
     - name: Install console-based XMPP client (for interactive testing)
       apt:
         name: mcabber
@@ @@ -156,13 +156,13 @@ @@
     - name: Deploy mcabber configuration files
       template:
         src: tests/data/mcabber.cfg.j2
         dest: "~user/{{ item.jid }}.cfg"
         owner: user
         group: user
         mode: 0600
+        mode: "0600"
       with_items:
         - jid: john.doe@domain1
           password: johnpassword
           server: domain1
           security: tls
           nickname: john.doe
@@ @@ -277,7 +277,7 @@ @@
     - name: Deploy small Lua script for listing the enabled modules in Prosody
       copy:
         src: list_prosody_modules.lua
         dest: "/usr/local/bin/list_prosody_modules.lua"
         owner: root
         group: root
         mode: 0755
+        mode: "0755"

roles/xmpp_server/tasks/main.yml

➞

Show inline comments

@@ @@ -6,13 +6,13 @@ @@
 - name: Set-up the Debian backports repository
   template:
     src: backports.list.j2
     dest: /etc/apt/sources.list.d/backports.list
     owner: root
     group: root
     mode: 0644
+    mode: "0644"
   register: backports_repository_configuration
 - name: Update apt cache if backports repository configuration changed (for immediate use)  # noqa no-handler
   # [no-handler] Tasks that run when changed should likely be handlers
   #   Since apt_repository module is not reliable (does not deploy
   #   change when changing distro version etc), we have to use
@@ @@ -47,77 +47,77 @@ @@
 - name: Deploy XMPP TLS private key
   copy:
     dest: "/etc/ssl/private/{{ ansible_fqdn }}_xmpp.key"
     content: "{{ xmpp_tls_key }}"
     owner: root
     group: prosody
     mode: 0640
+    mode: "0640"
   notify:
     - Restart Prosody
 - name: Deploy XMPP TLS certificate
   copy:
     dest: "/etc/ssl/certs/{{ ansible_fqdn }}_xmpp.pem"
     content: "{{ xmpp_tls_certificate }}"
     owner: root
     group: root
     mode: 0644
+    mode: "0644"
   notify:
     - Restart Prosody
 - name: Generate the XMPP server Diffie-Hellman parameter
   openssl_dhparam:
     owner: root
     group: prosody
     mode: 0640
+    mode: "0640"
     path: "/etc/ssl/private/{{ ansible_fqdn }}_xmpp.dh.pem"
     size: 2048
   notify:
     - Restart Prosody
 - name: Deploy configuration file for checking certificate validity via cron
   copy:
     content: "/etc/ssl/certs/{{ ansible_fqdn }}_xmpp.pem"
     dest: "/etc/check_certificate/{{ ansible_fqdn }}_xmpp.conf"
     owner: root
     group: root
     mode: 0644
+    mode: "0644"
 - name: Deploy script for validating Prosody certificate
   copy:
     src: "check_prosody_certificate.sh"
     dest: "/usr/local/bin/check_prosody_certificate.sh"
     owner: root
     group: root
     mode: 0755
+    mode: "0755"
 - name: Set-up crontab task that runs the Prosody certificate checker script once a day
   copy:
     src: "cron_check_prosody_certificate"
     dest: "/etc/cron.d/check_prosody_certificate"
     owner: root
     group: root
     mode: 0644
+    mode: "0644"
 - name: Deploy LDAP client configuration (for validating LDAP server certificate)
   copy:
     src: prosody_ldaprc
     dest: "/var/lib/prosody/.ldaprc"
     owner: root
     group: prosody
     mode: 0640
+    mode: "0640"
   notify:
     - Restart Prosody
 - name: Deploy Prosody configuration file
   template:
     src: "prosody.cfg.lua.j2"
     dest: "/etc/prosody/prosody.cfg.lua"
     owner: root
     group: prosody
     mode: 0640
+    mode: "0640"
   notify:
     - Restart Prosody
 - name: Enable and start Prosody service
   service:
     name: prosody
@@ @@ -127,13 +127,13 @@ @@
 - name: Deploy firewall configuration for XMPP server
   copy:
     src: "ferm_xmpp.conf"
     dest: "/etc/ferm/conf.d/30-xmpp.conf"
     owner: root
     group: root
     mode: 0640
+    mode: "0640"
   notify:
     - Restart ferm
 - name: Explicitly run all handlers
   include_tasks: ../handlers/main.yml
   when: "run_handlers | default(False) | bool()"

0 comments (0 inline, 0 general)