From 37b75ecf81c832141c02dc338f39abef4d0e131d Mon Sep 17 00:00:00 2001 From: Martin Bauer Date: Tue, 8 Sep 2026 17:28:12 +0200 Subject: [PATCH] Fix remaining ansible-lint violations: file permissions, var-naming, package pinning MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - risky-file-permissions (32): add explicit mode: to copy/template/file tasks, matching the umask-derived permissions they already had (0644 for configs and systemd units, 0755 for created directories) — no functional change. - var-naming (28): prefix role-scoped vars with their role name across pi_dhtsensor, pi_dhtsensor_circuitpython, pi_shairport, pi_squeezelite, pi_squeezelite_custom, pi_sispmctl, pi_standard_setup, and pi_sysdweb's sysdweb_name (shared by 9 consuming roles). Updated every dependent template, task reference, and matching inventory.yml override, and verified resolved values with ansible-inventory before/after. - Fixes a latent bug found while renaming: pi_standard_setup's "Get/Change WiFi country" tasks reused the name wifi_country for both the role default and a register, so the register silently clobbered the default before do_wifi_country ever read it. Split into distinct names so the intended default value is used. - package-latest (2): pin docker-ce/docker-compose-plugin installs in server_debian_docker to state: present. - no-handler (1): move pi_lirc's "Reboot if boot overlay changed" into a proper handler notified by the boot-overlay task. ansible-lint now passes clean at the production profile. Co-Authored-By: Claude Sonnet 5 --- inventory.yml | 20 ++++++------ roles/bluetooth_monitor/tasks/main.yml | 3 +- roles/pi_alsasetup/tasks/main.yml | 1 + roles/pi_dhtsensor/README.md | 2 +- roles/pi_dhtsensor/defaults/main.yml | 4 +-- roles/pi_dhtsensor/tasks/main.yml | 4 ++- .../pi_dhtsensor/templates/dht22_sensing.json | 4 +-- roles/pi_dhtsensor_circuitpython/README.md | 2 +- .../defaults/main.yml | 4 +-- .../pi_dhtsensor_circuitpython/tasks/main.yml | 4 ++- .../templates/dht22_sensing.json | 4 +-- roles/pi_irserver/tasks/main.yml | 5 ++- roles/pi_lirc/handlers/main.yml | 3 ++ roles/pi_lirc/tasks/main.yml | 10 +++--- roles/pi_musicmouse/tasks/main.yml | 4 +++ roles/pi_shairport/README.md | 2 +- roles/pi_shairport/defaults/main.yml | 4 +-- roles/pi_shairport/tasks/main.yml | 3 +- .../templates/shairport-sync.conf | 2 +- roles/pi_sispmctl/tasks/main.yml | 9 +++--- roles/pi_squeezelite/README.md | 2 +- roles/pi_squeezelite/defaults/main.yml | 2 +- roles/pi_squeezelite/tasks/main.yml | 3 +- .../pi_squeezelite/templates/squeezelite.cfg | 2 +- roles/pi_squeezelite_custom/tasks/main.yml | 3 +- .../templates/squeezelite.service | 2 +- roles/pi_squeezeserver/tasks/main.yml | 3 +- roles/pi_standard_setup/README.md | 3 +- roles/pi_standard_setup/defaults/main.yml | 10 +++--- roles/pi_standard_setup/tasks/main.yml | 32 +++++++++++-------- roles/pi_sysdweb/README.md | 2 +- roles/pi_sysdweb/tasks/main.yml | 11 ++++--- roles/server_debian_docker/tasks/main.yml | 4 +-- roles/server_exthdd_mount/tasks/main.yml | 3 ++ roles/server_link_aggregation/tasks/main.yml | 1 + 35 files changed, 105 insertions(+), 72 deletions(-) create mode 100644 roles/pi_lirc/handlers/main.yml diff --git a/inventory.yml b/inventory.yml index b8f30e1..584ab23 100644 --- a/inventory.yml +++ b/inventory.yml @@ -11,11 +11,11 @@ all: octopi: sensor_room_name_ascii: prusaprinter sensor_room_name: prusaprinter - dht_pin: 26 + pi_dhtsensor_dht_pin: 26 main_user: root bedroompi: squeezelite_name: BedroomPi - shairport_name: BedroomPi + pi_shairport_name: BedroomPi alsa_card_name: Codec sensor_room_name_ascii: schlafzimmer sensor_room_name: Schlafzimmer @@ -24,7 +24,7 @@ all: main_user: root kitchenpi: squeezelite_name: KitchenPi - shairport_name: KitchenPi + pi_shairport_name: KitchenPi alsa_card_name: 0 sensor_room_name_ascii: kueche sensor_room_name: Küche @@ -32,15 +32,15 @@ all: main_user: root esszimmerradio: # oben, eltern squeezelite_name: Esszimmer - shairport_name: _Oben_Esszimmer + pi_shairport_name: _Oben_Esszimmer # alsa_card_name: Device - squeezeserver: 192.168.178.100 + pi_squeezelite_squeezeserver: 192.168.178.100 configure_wifi: true alsa_card_name: 1 main_user: root musikserverwohnzimmeroben: # oben, eltern squeezelite_name: Wohnzimmer - shairport_name: _Oben_Wohnzimmer + pi_shairport_name: _Oben_Wohnzimmer alsa_card_name: sndrpihifiberry sensor_room_name_ascii: wohnzimmeroben sensor_room_name: WohnzimmerOben @@ -48,7 +48,7 @@ all: main_user: root musicmouse: squeezelite_name: MusicMouse - shairport_name: MusicMouse + pi_shairport_name: MusicMouse alsa_card_name: sndrpihifiberry hifiberry_overlay: hifiberry-dacplus sensor_room_name: Kinderzimmer @@ -56,7 +56,7 @@ all: main_user: root newrpi: squeezelite_name: MyTestRaspberry - shairport_name: MyTestRaspberry + pi_shairport_name: MyTestRaspberry alsa_card_name: 0 sensor_room_name_ascii: testraum sensor_room_name: Test Raum @@ -73,12 +73,12 @@ all: vars: ansible_user: root ansible_python_interpreter: /usr/bin/python3 - squeezeserver: 192.168.178.80 + pi_squeezelite_squeezeserver: 192.168.178.80 router_ip: 192.168.178.1 home_assistant_url: https://ha.bauer.tech home_assistant_token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJkM2QxYjAwYjkxZjY0MWVhYjA4YmZhMDYwYTg3YjRhNyIsImlhdCI6MTcwNDI3MDU5MSwiZXhwIjoyMDE5NjMwNTkxfQ.dzvejgEQd9hf-Yftzd7NkR5pv76GaLFczeOy-a2pa1o configure_wifi: false - wifi_ssid: BauerWLAN + pi_standard_setup_wifi_ssid: BauerWLAN my_btmonitor_mqtt_username: my_btmonitor my_btmonitor_mqtt_password: 8aBIAC14jaKKbla diff --git a/roles/bluetooth_monitor/tasks/main.yml b/roles/bluetooth_monitor/tasks/main.yml index 11e9da7..aeb87ac 100644 --- a/roles/bluetooth_monitor/tasks/main.yml +++ b/roles/bluetooth_monitor/tasks/main.yml @@ -20,6 +20,7 @@ ansible.builtin.copy: src: my_btmonitor.service dest: /etc/systemd/system/ + mode: "0644" - name: Add script to autostart and start now ansible.builtin.systemd: name: my_btmonitor @@ -30,4 +31,4 @@ # include_role: # name: pi_sysdweb # vars: -# sysdweb_name: my_btmonitor +# pi_sysdweb_name: my_btmonitor diff --git a/roles/pi_alsasetup/tasks/main.yml b/roles/pi_alsasetup/tasks/main.yml index 51a94ae..454cba9 100644 --- a/roles/pi_alsasetup/tasks/main.yml +++ b/roles/pi_alsasetup/tasks/main.yml @@ -3,3 +3,4 @@ ansible.builtin.template: src: asound.conf dest: /etc/asound.conf + mode: "0644" diff --git a/roles/pi_dhtsensor/README.md b/roles/pi_dhtsensor/README.md index c897653..db58779 100644 --- a/roles/pi_dhtsensor/README.md +++ b/roles/pi_dhtsensor/README.md @@ -4,4 +4,4 @@ Installs the DHT22 temperature/humidity sensor polling script based on the legacy `Adafruit_DHT` library (removing the circuitpython variant/ `libgpiod2` if present — mutually exclusive with `pi_dhtsensor_circuitpython`). -**Key vars:** `dht_pin`, `dht_polling_sleep_time_seconds` +**Key vars:** `pi_dhtsensor_dht_pin`, `pi_dhtsensor_dht_polling_sleep_time_seconds` diff --git a/roles/pi_dhtsensor/defaults/main.yml b/roles/pi_dhtsensor/defaults/main.yml index 92ab6c6..b4a6224 100644 --- a/roles/pi_dhtsensor/defaults/main.yml +++ b/roles/pi_dhtsensor/defaults/main.yml @@ -1,3 +1,3 @@ --- -dht_pin: 12 -dht_polling_sleep_time_seconds: 20 +pi_dhtsensor_dht_pin: 12 +pi_dhtsensor_dht_polling_sleep_time_seconds: 20 diff --git a/roles/pi_dhtsensor/tasks/main.yml b/roles/pi_dhtsensor/tasks/main.yml index 3030b22..cadbc62 100644 --- a/roles/pi_dhtsensor/tasks/main.yml +++ b/roles/pi_dhtsensor/tasks/main.yml @@ -23,6 +23,7 @@ ansible.builtin.template: src: dht22_sensing.json dest: /etc/dht22_sensing.json + mode: "0644" - name: Install script ansible.builtin.copy: src: dht22_sensing.py @@ -33,6 +34,7 @@ ansible.builtin.copy: src: dht22_sensing.service dest: /etc/systemd/system/ + mode: "0644" - name: Add script to autostart and start now ansible.builtin.systemd: name: dht22_sensing @@ -43,4 +45,4 @@ ansible.builtin.include_role: name: pi_sysdweb vars: - sysdweb_name: dht22_sensing + pi_sysdweb_name: dht22_sensing diff --git a/roles/pi_dhtsensor/templates/dht22_sensing.json b/roles/pi_dhtsensor/templates/dht22_sensing.json index 8c24dea..d2929f7 100644 --- a/roles/pi_dhtsensor/templates/dht22_sensing.json +++ b/roles/pi_dhtsensor/templates/dht22_sensing.json @@ -1,8 +1,8 @@ { "ha_url": "{{home_assistant_url}}", "token": "{{home_assistant_token}}", - "dht_pin": "{{dht_pin}}", - "polling_sleep_time_seconds": "{{dht_polling_sleep_time_seconds}}", + "dht_pin": "{{pi_dhtsensor_dht_pin}}", + "polling_sleep_time_seconds": "{{pi_dhtsensor_dht_polling_sleep_time_seconds}}", "ha_temp_sensor_name": "{{sensor_room_name_ascii|lower}}_dht22_temperatur", "ha_temp_friendly_name": "{{sensor_room_name}} Temperatur", diff --git a/roles/pi_dhtsensor_circuitpython/README.md b/roles/pi_dhtsensor_circuitpython/README.md index 24faaef..ec0ec0f 100644 --- a/roles/pi_dhtsensor_circuitpython/README.md +++ b/roles/pi_dhtsensor_circuitpython/README.md @@ -5,4 +5,4 @@ Installs the DHT22 temperature/humidity sensor polling script based on to the `pi_dhtsensor` role's legacy `Adafruit_DHT` library. Mutually exclusive with `pi_dhtsensor`. -**Key vars:** `dht_pin`, `dht_polling_sleep_time_seconds` +**Key vars:** `pi_dhtsensor_circuitpython_dht_pin`, `pi_dhtsensor_circuitpython_dht_polling_sleep_time_seconds` diff --git a/roles/pi_dhtsensor_circuitpython/defaults/main.yml b/roles/pi_dhtsensor_circuitpython/defaults/main.yml index 95dbc48..7791f3e 100644 --- a/roles/pi_dhtsensor_circuitpython/defaults/main.yml +++ b/roles/pi_dhtsensor_circuitpython/defaults/main.yml @@ -1,3 +1,3 @@ --- -dht_pin: "D12" -dht_polling_sleep_time_seconds: 20 +pi_dhtsensor_circuitpython_dht_pin: "D12" +pi_dhtsensor_circuitpython_dht_polling_sleep_time_seconds: 20 diff --git a/roles/pi_dhtsensor_circuitpython/tasks/main.yml b/roles/pi_dhtsensor_circuitpython/tasks/main.yml index 911fd59..7ce114c 100644 --- a/roles/pi_dhtsensor_circuitpython/tasks/main.yml +++ b/roles/pi_dhtsensor_circuitpython/tasks/main.yml @@ -12,6 +12,7 @@ ansible.builtin.template: src: dht22_sensing.json dest: /etc/dht22_sensing.json + mode: "0644" - name: Install script ansible.builtin.copy: src: dht22_sensing.py @@ -22,6 +23,7 @@ ansible.builtin.copy: src: dht22_sensing.service dest: /lib/systemd/system/ + mode: "0644" - name: Add script to autostart and start now ansible.builtin.systemd: name: dht22_sensing @@ -32,4 +34,4 @@ ansible.builtin.include_role: name: pi_sysdweb vars: - sysdweb_name: dht22_sensing + pi_sysdweb_name: dht22_sensing diff --git a/roles/pi_dhtsensor_circuitpython/templates/dht22_sensing.json b/roles/pi_dhtsensor_circuitpython/templates/dht22_sensing.json index 8c24dea..398c5d0 100644 --- a/roles/pi_dhtsensor_circuitpython/templates/dht22_sensing.json +++ b/roles/pi_dhtsensor_circuitpython/templates/dht22_sensing.json @@ -1,8 +1,8 @@ { "ha_url": "{{home_assistant_url}}", "token": "{{home_assistant_token}}", - "dht_pin": "{{dht_pin}}", - "polling_sleep_time_seconds": "{{dht_polling_sleep_time_seconds}}", + "dht_pin": "{{pi_dhtsensor_circuitpython_dht_pin}}", + "polling_sleep_time_seconds": "{{pi_dhtsensor_circuitpython_dht_polling_sleep_time_seconds}}", "ha_temp_sensor_name": "{{sensor_room_name_ascii|lower}}_dht22_temperatur", "ha_temp_friendly_name": "{{sensor_room_name}} Temperatur", diff --git a/roles/pi_irserver/tasks/main.yml b/roles/pi_irserver/tasks/main.yml index 256d59d..0a41d98 100644 --- a/roles/pi_irserver/tasks/main.yml +++ b/roles/pi_irserver/tasks/main.yml @@ -8,14 +8,17 @@ ansible.builtin.file: path: /usr/bin/remotes state: directory + mode: "0755" - name: Copy hauppauge remote ansible.builtin.copy: src: hauppauge.rem dest: /usr/bin/remotes/ + mode: "0644" - name: Copy irserver systemd file ansible.builtin.copy: src: irserver.service dest: /lib/systemd/system/ + mode: "0644" - name: Enable irserver autostart ansible.builtin.systemd: name: irserver @@ -26,4 +29,4 @@ ansible.builtin.include_role: name: pi_sysdweb vars: - sysdweb_name: irserver + pi_sysdweb_name: irserver diff --git a/roles/pi_lirc/handlers/main.yml b/roles/pi_lirc/handlers/main.yml new file mode 100644 index 0000000..fc61ab8 --- /dev/null +++ b/roles/pi_lirc/handlers/main.yml @@ -0,0 +1,3 @@ +--- +- name: Reboot if boot overlay changed + ansible.builtin.reboot: diff --git a/roles/pi_lirc/tasks/main.yml b/roles/pi_lirc/tasks/main.yml index 5d15429..5d3f21e 100644 --- a/roles/pi_lirc/tasks/main.yml +++ b/roles/pi_lirc/tasks/main.yml @@ -6,31 +6,31 @@ ansible.builtin.copy: src: lirc_options.conf dest: /etc/lirc/lirc_options.conf + mode: "0644" - name: Install config file lircd.conf ansible.builtin.copy: src: lircd.conf dest: /etc/lirc/lircd.conf + mode: "0644" - name: Install remote file ansible.builtin.copy: src: hauppauge.conf dest: /etc/lirc/hauppauge.conf + mode: "0644" - name: Activate overlay in boot config ansible.builtin.lineinfile: path: /boot/firmware/config.txt regexp: "^#?dtoverlay=gpio-ir" line: "dtoverlay=gpio-ir,gpio_pin=17" - register: boot_overlay + notify: Reboot if boot overlay changed - name: Restart lircd ansible.builtin.systemd: name: lircd state: started enabled: "yes" daemon_reload: "yes" -- name: Reboot if boot overlay changed - ansible.builtin.reboot: - when: boot_overlay.changed - name: Add to sysdweb ansible.builtin.include_role: name: pi_sysdweb vars: - sysdweb_name: lircd + pi_sysdweb_name: lircd diff --git a/roles/pi_musicmouse/tasks/main.yml b/roles/pi_musicmouse/tasks/main.yml index 47e428e..40f920a 100644 --- a/roles/pi_musicmouse/tasks/main.yml +++ b/roles/pi_musicmouse/tasks/main.yml @@ -21,14 +21,17 @@ ansible.builtin.file: path: /media/musicmouse state: directory + mode: "0755" - name: Install config file ansible.builtin.copy: src: config.yml dest: /media/musicmouse/config.yml + mode: "0644" - name: Install systemd service file ansible.builtin.copy: src: musicmouse.service dest: /etc/systemd/system/ + mode: "0644" - name: Add script to autostart and start now ansible.builtin.systemd: name: musicmouse @@ -39,6 +42,7 @@ ansible.builtin.copy: src: smb.conf dest: /etc/samba/ + mode: "0644" - name: Restart samba ansible.builtin.systemd: name: smbd diff --git a/roles/pi_shairport/README.md b/roles/pi_shairport/README.md index 55afa81..d53584f 100644 --- a/roles/pi_shairport/README.md +++ b/roles/pi_shairport/README.md @@ -3,4 +3,4 @@ Builds and installs shairport-sync (AirPlay receiver) from source, copies its config, and patches the systemd service to run as root. -**Key vars:** `shairport_sync_version`, `shairport_name` +**Key vars:** `pi_shairport_sync_version`, `pi_shairport_name` diff --git a/roles/pi_shairport/defaults/main.yml b/roles/pi_shairport/defaults/main.yml index e241a02..cb8c0ba 100644 --- a/roles/pi_shairport/defaults/main.yml +++ b/roles/pi_shairport/defaults/main.yml @@ -1,3 +1,3 @@ --- -shairport_sync_version: "3.3.5" -shairport_name: Unnamed Raspberry with shairport +pi_shairport_sync_version: "3.3.5" +pi_shairport_name: Unnamed Raspberry with shairport diff --git a/roles/pi_shairport/tasks/main.yml b/roles/pi_shairport/tasks/main.yml index 28b6db9..27a6c38 100644 --- a/roles/pi_shairport/tasks/main.yml +++ b/roles/pi_shairport/tasks/main.yml @@ -25,6 +25,7 @@ ansible.builtin.template: src: shairport-sync.conf dest: /etc/shairport-sync.conf + mode: "0644" - name: Modify service file to run as root ansible.builtin.lineinfile: path: /lib/systemd/system/shairport-sync.service @@ -40,4 +41,4 @@ ansible.builtin.include_role: name: pi_sysdweb vars: - sysdweb_name: shairport-sync + pi_sysdweb_name: shairport-sync diff --git a/roles/pi_shairport/templates/shairport-sync.conf b/roles/pi_shairport/templates/shairport-sync.conf index 9aa7f10..dffb1af 100644 --- a/roles/pi_shairport/templates/shairport-sync.conf +++ b/roles/pi_shairport/templates/shairport-sync.conf @@ -1,6 +1,6 @@ general = { - name = "{{shairport_name}}"; + name = "{{ pi_shairport_name }}"; }; alsa = diff --git a/roles/pi_sispmctl/tasks/main.yml b/roles/pi_sispmctl/tasks/main.yml index 2c431b6..38eaa62 100644 --- a/roles/pi_sispmctl/tasks/main.yml +++ b/roles/pi_sispmctl/tasks/main.yml @@ -2,7 +2,7 @@ - name: Check if sispmctl already exists ansible.builtin.stat: path: /usr/bin/sispmctl - register: sispmctl_file + register: pi_sispmctl_file - name: Install dependencies ansible.builtin.apt: name: "libusb-dev" @@ -12,15 +12,16 @@ ansible.builtin.unarchive: src: sispmctl-4.7.tar.gz dest: /tmp - when: not sispmctl_file.stat.exists + when: not pi_sispmctl_file.stat.exists - name: Build and install ansible.builtin.shell: cd /tmp/sispmctl*/ && ./configure --prefix=/usr && make install - when: not sispmctl_file.stat.exists + when: not pi_sispmctl_file.stat.exists changed_when: true - name: Install systemd service file ansible.builtin.copy: src: sispmctl.service dest: /lib/systemd/system/ + mode: "0644" - name: Add script to autostart and start now ansible.builtin.systemd: name: sispmctl @@ -31,4 +32,4 @@ ansible.builtin.include_role: name: pi_sysdweb vars: - sysdweb_name: sispmctl + pi_sysdweb_name: sispmctl diff --git a/roles/pi_squeezelite/README.md b/roles/pi_squeezelite/README.md index 11d8720..865f393 100644 --- a/roles/pi_squeezelite/README.md +++ b/roles/pi_squeezelite/README.md @@ -3,4 +3,4 @@ Installs the distro-packaged `squeezelite` client (Logitech Media Server player), installs its config file, and registers it with `pi_sysdweb`. -**Key vars:** `squeezeserver` +**Key vars:** `pi_squeezelite_squeezeserver` diff --git a/roles/pi_squeezelite/defaults/main.yml b/roles/pi_squeezelite/defaults/main.yml index 93e415c..3f9d28a 100644 --- a/roles/pi_squeezelite/defaults/main.yml +++ b/roles/pi_squeezelite/defaults/main.yml @@ -1,2 +1,2 @@ --- -squeezeserver: 192.168.178.80 +pi_squeezelite_squeezeserver: 192.168.178.80 diff --git a/roles/pi_squeezelite/tasks/main.yml b/roles/pi_squeezelite/tasks/main.yml index 41e67a7..465c312 100644 --- a/roles/pi_squeezelite/tasks/main.yml +++ b/roles/pi_squeezelite/tasks/main.yml @@ -9,9 +9,10 @@ ansible.builtin.template: src: squeezelite.cfg dest: /etc/default/squeezelite + mode: "0644" notify: Restart-squeezelite - name: Add to sysdweb ansible.builtin.include_role: name: pi_sysdweb vars: - sysdweb_name: squeezelite + pi_sysdweb_name: squeezelite diff --git a/roles/pi_squeezelite/templates/squeezelite.cfg b/roles/pi_squeezelite/templates/squeezelite.cfg index d7bca15..b2317d5 100644 --- a/roles/pi_squeezelite/templates/squeezelite.cfg +++ b/roles/pi_squeezelite/templates/squeezelite.cfg @@ -1,3 +1,3 @@ SL_NAME="{{squeezelite_name}}" SL_SOUNDCARD="softvol_squeezelite" -SB_SERVER_IP="{{squeezeserver}}" +SB_SERVER_IP="{{ pi_squeezelite_squeezeserver }}" diff --git a/roles/pi_squeezelite_custom/tasks/main.yml b/roles/pi_squeezelite_custom/tasks/main.yml index 71bcd2e..0e9105e 100644 --- a/roles/pi_squeezelite_custom/tasks/main.yml +++ b/roles/pi_squeezelite_custom/tasks/main.yml @@ -27,6 +27,7 @@ ansible.builtin.template: src: squeezelite.service dest: /lib/systemd/system/ + mode: "0644" - name: Enable sysdweb autostart ansible.builtin.systemd: name: squeezelite @@ -37,7 +38,7 @@ ansible.builtin.include_role: name: pi_sysdweb vars: - sysdweb_name: squeezelite + pi_sysdweb_name: squeezelite # build with adapted Makefile.rpi: # OPTS = -DRESAMPLE -DDSD -DUSE_SSL -DLINKALL -I./include -I./include/opus -I./include/alac -I/usr/local/include -s -mfpu=vfp diff --git a/roles/pi_squeezelite_custom/templates/squeezelite.service b/roles/pi_squeezelite_custom/templates/squeezelite.service index 416daf3..c253d00 100644 --- a/roles/pi_squeezelite_custom/templates/squeezelite.service +++ b/roles/pi_squeezelite_custom/templates/squeezelite.service @@ -3,7 +3,7 @@ Description=Squeezelite After=network.target [Service] -ExecStart=/opt/squeezelite -n {{squeezelite_name}} -s {{squeezeserver}} -o softvol_squeezelite +ExecStart=/opt/squeezelite -n {{squeezelite_name}} -s {{ pi_squeezelite_squeezeserver }} -o softvol_squeezelite Restart=on-failure [Install] diff --git a/roles/pi_squeezeserver/tasks/main.yml b/roles/pi_squeezeserver/tasks/main.yml index 921da28..25f9a5b 100644 --- a/roles/pi_squeezeserver/tasks/main.yml +++ b/roles/pi_squeezeserver/tasks/main.yml @@ -18,6 +18,7 @@ ansible.builtin.copy: src: logitechmediaserver_8.4.0_arm.deb dest: /tmp + mode: "0644" - name: Install squeezeserver package ansible.builtin.apt: deb: /tmp/logitechmediaserver_8.4.0_arm.deb @@ -30,7 +31,7 @@ ansible.builtin.include_role: name: pi_sysdweb vars: - sysdweb_name: logitechmediaserver + pi_sysdweb_name: logitechmediaserver - name: Forward port 80 to 9000 ansible.builtin.iptables: table: nat diff --git a/roles/pi_standard_setup/README.md b/roles/pi_standard_setup/README.md index 312a19f..5b1d713 100644 --- a/roles/pi_standard_setup/README.md +++ b/roles/pi_standard_setup/README.md @@ -5,6 +5,7 @@ Pi model, adds a root SSH key, disables the SSH locale-forwarding warning, optionally configures wifi and the hostname, and rotates the default `pi`/`raspberry` credentials via the `keepass` lookup plugin. -**Key vars:** `wifi_ssid`, `new_hostname`, `timezone`, `wifi_country`, +**Key vars:** `pi_standard_setup_wifi_ssid`, `pi_standard_setup_new_hostname`, +`pi_standard_setup_timezone`, `pi_standard_setup_wifi_country`, `ansible_ssh_pass` (the OS-default password, used only to reach a freshly-flashed Pi for the first time before its password is rotated) diff --git a/roles/pi_standard_setup/defaults/main.yml b/roles/pi_standard_setup/defaults/main.yml index 49663da..2c0d840 100644 --- a/roles/pi_standard_setup/defaults/main.yml +++ b/roles/pi_standard_setup/defaults/main.yml @@ -1,11 +1,11 @@ --- -wifi_ssid: "" # put SSID here to configure wifi +pi_standard_setup_wifi_ssid: "" # put SSID here to configure wifi ansible_user: "root" # "User to connect with, put in 'pi' here if you connect the first time, else leave empty" -new_hostname: "" # set this to change the hostname +pi_standard_setup_new_hostname: "" # set this to change the hostname -timezone: "Europe/Berlin" -wifi_country: "DE" -wifi_pass_url: "bauer_wifi" # has to be in keepass with url "wifi_pass_url" +pi_standard_setup_timezone: "Europe/Berlin" +pi_standard_setup_wifi_country: "DE" +pi_standard_setup_wifi_pass_url: "bauer_wifi" # has to be in keepass with url "wifi_pass_url" ansible_ssh_pass: "raspberry" ansible_become_password: "raspberry" ansible_become: true diff --git a/roles/pi_standard_setup/tasks/main.yml b/roles/pi_standard_setup/tasks/main.yml index 9a0a65c..c694f62 100644 --- a/roles/pi_standard_setup/tasks/main.yml +++ b/roles/pi_standard_setup/tasks/main.yml @@ -7,10 +7,10 @@ - name: Detect Raspi Model ansible.builtin.slurp: src: /sys/firmware/devicetree/base/model - register: raspberry_model + register: pi_standard_setup_raspberry_model - name: Show Raspi Model ansible.builtin.debug: - msg: "{{ raspberry_model.content | b64decode }}" + msg: "{{ pi_standard_setup_raspberry_model.content | b64decode }}" - name: Add authorized SSH key to root account ansible.posix.authorized_key: user: root @@ -30,24 +30,24 @@ notify: Restart sshd - name: Get hostname ansible.builtin.command: "raspi-config nonint get_hostname" - register: pi_hostname + register: pi_standard_setup_pi_hostname changed_when: false -- name: Change hostname {{ new_hostname }} - ansible.builtin.command: "raspi-config nonint do_hostname {{ new_hostname }}" - when: new_hostname | bool and pi_hostname.stdout != new_hostname - register: set_hostname +- name: Change hostname {{ pi_standard_setup_new_hostname }} + ansible.builtin.command: "raspi-config nonint do_hostname {{ pi_standard_setup_new_hostname }}" + when: pi_standard_setup_new_hostname | bool and pi_standard_setup_pi_hostname.stdout != pi_standard_setup_new_hostname + register: pi_standard_setup_set_hostname changed_when: true notify: Reboot - name: Get hostname ansible.builtin.command: "raspi-config nonint get_hostname" - register: pi_hostname + register: pi_standard_setup_pi_hostname changed_when: false - name: Set boot mode to CLI ansible.builtin.command: "raspi-config nonint do_boot_behaviour B1" changed_when: true # I2 Change Timezone - name: Change timezone - ansible.builtin.command: "raspi-config nonint do_change_timezone {{ timezone }}" + ansible.builtin.command: "raspi-config nonint do_change_timezone {{ pi_standard_setup_timezone }}" changed_when: true - name: Change locale ansible.builtin.command: "raspi-config nonint do_change_locale en_US.UTF-8" @@ -72,22 +72,24 @@ ansible.builtin.copy: src: vimrc dest: /root/.vimrc + mode: "0644" - name: Copy git config ansible.builtin.copy: src: gitconfig dest: /root/.gitconfig + mode: "0644" # Wifi - name: Get WiFi country ansible.builtin.command: "raspi-config nonint get_wifi_country" - register: wifi_country + register: pi_standard_setup_current_wifi_country changed_when: false ignore_errors: true # to avoid error when WiFi is not present - name: Change WiFi country - ansible.builtin.command: "raspi-config nonint do_wifi_country {{ wifi_country }}" + ansible.builtin.command: "raspi-config nonint do_wifi_country {{ pi_standard_setup_wifi_country }}" when: configure_wifi changed_when: true - name: Set WiFi credentials - ansible.builtin.command: "raspi-config nonint do_wifi_ssid_passphrase {{ wifi_ssid }} {{ lookup('keepass', 'bauer_wifi') }}" + ansible.builtin.command: "raspi-config nonint do_wifi_ssid_passphrase {{ pi_standard_setup_wifi_ssid }} {{ lookup('keepass', 'bauer_wifi') }}" when: configure_wifi changed_when: true - name: Install watchdog @@ -95,7 +97,7 @@ name: watchdog cache_valid_time: "7200" state: present - when: not wifi_ssid is defined + when: not pi_standard_setup_wifi_ssid is defined - name: Configure watchdog ansible.builtin.blockinfile: path: /etc/watchdog.conf @@ -115,8 +117,9 @@ # Message of the day - name: Set Message of the day ansible.builtin.copy: - src: motd/{{ pi_hostname.stdout }} + src: motd/{{ pi_standard_setup_pi_hostname.stdout }} dest: /etc/motd + mode: "0644" # LED off script - name: Copy led off script ansible.builtin.copy: @@ -127,6 +130,7 @@ ansible.builtin.copy: src: raspi-leds-off.service dest: /lib/systemd/system/ + mode: "0644" - name: Activate led off servic ansible.builtin.systemd: name: raspi-leds-off diff --git a/roles/pi_sysdweb/README.md b/roles/pi_sysdweb/README.md index 0826a8c..29daec6 100644 --- a/roles/pi_sysdweb/README.md +++ b/roles/pi_sysdweb/README.md @@ -3,4 +3,4 @@ Installs `sysdweb` (a small web UI for managing systemd units) and creates its service user. Other roles register their services with it. -**Key vars:** `sysdweb_name` +**Key vars:** `pi_sysdweb_name` diff --git a/roles/pi_sysdweb/tasks/main.yml b/roles/pi_sysdweb/tasks/main.yml index c230804..10d9168 100644 --- a/roles/pi_sysdweb/tasks/main.yml +++ b/roles/pi_sysdweb/tasks/main.yml @@ -19,6 +19,7 @@ ansible.builtin.blockinfile: path: /etc/sysdweb.conf create: true + mode: "0644" marker: "# {mark} ansible user" block: | [DEFAULT] @@ -27,15 +28,17 @@ ansible.builtin.blockinfile: path: /etc/sysdweb.conf create: true - marker: "# {mark} ansible managed for {{ sysdweb_name }}" + mode: "0644" + marker: "# {mark} ansible managed for {{ pi_sysdweb_name }}" block: | - [{{ sysdweb_name }}] - title = {{ sysdweb_name }} - unit = {{ sysdweb_name }}.service + [{{ pi_sysdweb_name }}] + title = {{ pi_sysdweb_name }} + unit = {{ pi_sysdweb_name }}.service - name: Install systemd service file ansible.builtin.copy: src: sysdweb-system.service dest: /etc/systemd/system/ + mode: "0644" - name: Enable sysdweb autostart ansible.builtin.systemd: name: sysdweb-system diff --git a/roles/server_debian_docker/tasks/main.yml b/roles/server_debian_docker/tasks/main.yml index cad7acb..b1b2d9e 100644 --- a/roles/server_debian_docker/tasks/main.yml +++ b/roles/server_debian_docker/tasks/main.yml @@ -9,7 +9,7 @@ - python3-pip - virtualenv - python3-setuptools - state: latest + state: present update_cache: true - name: Add Docker GPG apt Key @@ -27,7 +27,7 @@ name: - docker-ce - docker-compose-plugin - state: latest + state: present update_cache: true - name: Add core to docker group diff --git a/roles/server_exthdd_mount/tasks/main.yml b/roles/server_exthdd_mount/tasks/main.yml index 2dad193..7b1f152 100644 --- a/roles/server_exthdd_mount/tasks/main.yml +++ b/roles/server_exthdd_mount/tasks/main.yml @@ -3,14 +3,17 @@ ansible.builtin.copy: src: media-passport4.mount dest: /etc/systemd/system + mode: "0644" - name: Automount passport5 systemd file ansible.builtin.copy: src: media-passport5.mount dest: /etc/systemd/system + mode: "0644" - name: Create udev rules ansible.builtin.copy: src: 99-automounts.rules dest: /etc/udev/rules.d + mode: "0644" - name: Systemd reread configs ansible.builtin.systemd: daemon_reload: true diff --git a/roles/server_link_aggregation/tasks/main.yml b/roles/server_link_aggregation/tasks/main.yml index e653d5f..9f7fc3b 100644 --- a/roles/server_link_aggregation/tasks/main.yml +++ b/roles/server_link_aggregation/tasks/main.yml @@ -7,3 +7,4 @@ ansible.builtin.copy: src: interfaces dest: /etc/network/interfaces + mode: "0644"