Fix remaining ansible-lint violations: file permissions, var-naming, package pinning

- risky-file-permissions (32): add explicit mode: to copy/template/file tasks,
  matching the umask-derived permissions they already had (0644 for configs
  and systemd units, 0755 for created directories) — no functional change.
- var-naming (28): prefix role-scoped vars with their role name across
  pi_dhtsensor, pi_dhtsensor_circuitpython, pi_shairport, pi_squeezelite,
  pi_squeezelite_custom, pi_sispmctl, pi_standard_setup, and pi_sysdweb's
  sysdweb_name (shared by 9 consuming roles). Updated every dependent
  template, task reference, and matching inventory.yml override, and
  verified resolved values with ansible-inventory before/after.
- Fixes a latent bug found while renaming: pi_standard_setup's "Get/Change
  WiFi country" tasks reused the name wifi_country for both the role default
  and a register, so the register silently clobbered the default before
  do_wifi_country ever read it. Split into distinct names so the intended
  default value is used.
- package-latest (2): pin docker-ce/docker-compose-plugin installs in
  server_debian_docker to state: present.
- no-handler (1): move pi_lirc's "Reboot if boot overlay changed" into a
  proper handler notified by the boot-overlay task.

ansible-lint now passes clean at the production profile.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

roles/pi_standard_setup/README.md

@@ -5,6 +5,7 @@ Pi model, adds a root SSH key, disables the SSH locale-forwarding warning,
 optionally configures wifi and the hostname, and rotates the default
 `pi`/`raspberry` credentials via the `keepass` lookup plugin.
 
-**Key vars:** `wifi_ssid`, `new_hostname`, `timezone`, `wifi_country`,
+**Key vars:** `pi_standard_setup_wifi_ssid`, `pi_standard_setup_new_hostname`,
+`pi_standard_setup_timezone`, `pi_standard_setup_wifi_country`,
 `ansible_ssh_pass` (the OS-default password, used only to reach a
 freshly-flashed Pi for the first time before its password is rotated)

roles/pi_standard_setup/defaults/main.yml

@@ -1,11 +1,11 @@
 ---
-wifi_ssid: "" # put SSID here to configure wifi
+pi_standard_setup_wifi_ssid: "" # put SSID here to configure wifi
 ansible_user: "root" # "User to connect with, put in 'pi' here if you connect the first time, else leave empty"
-new_hostname: "" # set this to change the hostname
+pi_standard_setup_new_hostname: "" # set this to change the hostname
 
-timezone: "Europe/Berlin"
-wifi_country: "DE"
-wifi_pass_url: "bauer_wifi" # has to be in keepass with url "wifi_pass_url"
+pi_standard_setup_timezone: "Europe/Berlin"
+pi_standard_setup_wifi_country: "DE"
+pi_standard_setup_wifi_pass_url: "bauer_wifi" # has to be in keepass with url "wifi_pass_url"
 ansible_ssh_pass: "raspberry"
 ansible_become_password: "raspberry"
 ansible_become: true

roles/pi_standard_setup/tasks/main.yml

@@ -7,10 +7,10 @@
 - name: Detect Raspi Model
   ansible.builtin.slurp:
     src: /sys/firmware/devicetree/base/model
-  register: raspberry_model
+  register: pi_standard_setup_raspberry_model
 - name: Show Raspi Model
   ansible.builtin.debug:
-    msg: "{{ raspberry_model.content | b64decode }}"
+    msg: "{{ pi_standard_setup_raspberry_model.content | b64decode }}"
 - name: Add authorized SSH key to root account
   ansible.posix.authorized_key:
     user: root
@@ -30,24 +30,24 @@
   notify: Restart sshd
 - name: Get hostname
   ansible.builtin.command: "raspi-config nonint get_hostname"
-  register: pi_hostname
+  register: pi_standard_setup_pi_hostname
   changed_when: false
-- name: Change hostname  {{ new_hostname }}
-  ansible.builtin.command: "raspi-config nonint do_hostname {{ new_hostname }}"
-  when: new_hostname | bool and pi_hostname.stdout != new_hostname
-  register: set_hostname
+- name: Change hostname  {{ pi_standard_setup_new_hostname }}
+  ansible.builtin.command: "raspi-config nonint do_hostname {{ pi_standard_setup_new_hostname }}"
+  when: pi_standard_setup_new_hostname | bool and pi_standard_setup_pi_hostname.stdout != pi_standard_setup_new_hostname
+  register: pi_standard_setup_set_hostname
   changed_when: true
   notify: Reboot
 - name: Get hostname
   ansible.builtin.command: "raspi-config nonint get_hostname"
-  register: pi_hostname
+  register: pi_standard_setup_pi_hostname
   changed_when: false
 - name: Set boot mode to CLI
   ansible.builtin.command: "raspi-config nonint do_boot_behaviour B1"
   changed_when: true
 # I2 Change Timezone
 - name: Change timezone
-  ansible.builtin.command: "raspi-config nonint do_change_timezone {{ timezone }}"
+  ansible.builtin.command: "raspi-config nonint do_change_timezone {{ pi_standard_setup_timezone }}"
   changed_when: true
 - name: Change locale
   ansible.builtin.command: "raspi-config nonint do_change_locale en_US.UTF-8"
@@ -72,22 +72,24 @@
   ansible.builtin.copy:
     src: vimrc
     dest: /root/.vimrc
+    mode: "0644"
 - name: Copy git config
   ansible.builtin.copy:
     src: gitconfig
     dest: /root/.gitconfig
+    mode: "0644"
 # Wifi
 - name: Get WiFi country
   ansible.builtin.command: "raspi-config nonint get_wifi_country"
-  register: wifi_country
+  register: pi_standard_setup_current_wifi_country
   changed_when: false
   ignore_errors: true # to avoid error when WiFi is not present
 - name: Change WiFi country
-  ansible.builtin.command: "raspi-config nonint do_wifi_country {{ wifi_country }}"
+  ansible.builtin.command: "raspi-config nonint do_wifi_country {{ pi_standard_setup_wifi_country }}"
   when: configure_wifi
   changed_when: true
 - name: Set WiFi credentials
-  ansible.builtin.command: "raspi-config nonint do_wifi_ssid_passphrase {{ wifi_ssid }} {{ lookup('keepass', 'bauer_wifi') }}"
+  ansible.builtin.command: "raspi-config nonint do_wifi_ssid_passphrase {{ pi_standard_setup_wifi_ssid }} {{ lookup('keepass', 'bauer_wifi') }}"
   when: configure_wifi
   changed_when: true
 - name: Install watchdog
@@ -95,7 +97,7 @@
     name: watchdog
     cache_valid_time: "7200"
     state: present
-  when: not wifi_ssid is defined
+  when: not pi_standard_setup_wifi_ssid is defined
 - name: Configure watchdog
   ansible.builtin.blockinfile:
     path: /etc/watchdog.conf
@@ -115,8 +117,9 @@
 # Message of the day
 - name: Set Message of the day
   ansible.builtin.copy:
-    src: motd/{{ pi_hostname.stdout }}
+    src: motd/{{ pi_standard_setup_pi_hostname.stdout }}
     dest: /etc/motd
+    mode: "0644"
 # LED off script
 - name: Copy led off script
   ansible.builtin.copy:
@@ -127,6 +130,7 @@
   ansible.builtin.copy:
     src: raspi-leds-off.service
     dest: /lib/systemd/system/
+    mode: "0644"
 - name: Activate led off servic
   ansible.builtin.systemd:
     name: raspi-leds-off