Fix remaining ansible-lint violations: file permissions, var-naming, package pinning

- risky-file-permissions (32): add explicit mode: to copy/template/file tasks,
  matching the umask-derived permissions they already had (0644 for configs
  and systemd units, 0755 for created directories) — no functional change.
- var-naming (28): prefix role-scoped vars with their role name across
  pi_dhtsensor, pi_dhtsensor_circuitpython, pi_shairport, pi_squeezelite,
  pi_squeezelite_custom, pi_sispmctl, pi_standard_setup, and pi_sysdweb's
  sysdweb_name (shared by 9 consuming roles). Updated every dependent
  template, task reference, and matching inventory.yml override, and
  verified resolved values with ansible-inventory before/after.
- Fixes a latent bug found while renaming: pi_standard_setup's "Get/Change
  WiFi country" tasks reused the name wifi_country for both the role default
  and a register, so the register silently clobbered the default before
  do_wifi_country ever read it. Split into distinct names so the intended
  default value is used.
- package-latest (2): pin docker-ce/docker-compose-plugin installs in
  server_debian_docker to state: present.
- no-handler (1): move pi_lirc's "Reboot if boot overlay changed" into a
  proper handler notified by the boot-overlay task.

ansible-lint now passes clean at the production profile.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

inventory.yml

@@ -11,11 +11,11 @@ all:
         octopi:
           sensor_room_name_ascii: prusaprinter
           sensor_room_name: prusaprinter
-          dht_pin: 26
+          pi_dhtsensor_dht_pin: 26
           main_user: root
         bedroompi:
           squeezelite_name: BedroomPi
-          shairport_name: BedroomPi
+          pi_shairport_name: BedroomPi
           alsa_card_name: Codec
           sensor_room_name_ascii: schlafzimmer
           sensor_room_name: Schlafzimmer
@@ -24,7 +24,7 @@ all:
           main_user: root
         kitchenpi:
           squeezelite_name: KitchenPi
-          shairport_name: KitchenPi
+          pi_shairport_name: KitchenPi
           alsa_card_name: 0
           sensor_room_name_ascii: kueche
           sensor_room_name: Küche
@@ -32,15 +32,15 @@ all:
           main_user: root
         esszimmerradio: # oben, eltern
           squeezelite_name: Esszimmer
-          shairport_name: _Oben_Esszimmer
+          pi_shairport_name: _Oben_Esszimmer
           # alsa_card_name: Device
-          squeezeserver: 192.168.178.100
+          pi_squeezelite_squeezeserver: 192.168.178.100
           configure_wifi: true
           alsa_card_name: 1
           main_user: root
         musikserverwohnzimmeroben: # oben, eltern
           squeezelite_name: Wohnzimmer
-          shairport_name: _Oben_Wohnzimmer
+          pi_shairport_name: _Oben_Wohnzimmer
           alsa_card_name: sndrpihifiberry
           sensor_room_name_ascii: wohnzimmeroben
           sensor_room_name: WohnzimmerOben
@@ -48,7 +48,7 @@ all:
           main_user: root
         musicmouse:
           squeezelite_name: MusicMouse
-          shairport_name: MusicMouse
+          pi_shairport_name: MusicMouse
           alsa_card_name: sndrpihifiberry
           hifiberry_overlay: hifiberry-dacplus
           sensor_room_name: Kinderzimmer
@@ -56,7 +56,7 @@ all:
           main_user: root
         newrpi:
           squeezelite_name: MyTestRaspberry
-          shairport_name: MyTestRaspberry
+          pi_shairport_name: MyTestRaspberry
           alsa_card_name: 0
           sensor_room_name_ascii: testraum
           sensor_room_name: Test Raum
@@ -73,12 +73,12 @@ all:
   vars:
     ansible_user: root
     ansible_python_interpreter: /usr/bin/python3
-    squeezeserver: 192.168.178.80
+    pi_squeezelite_squeezeserver: 192.168.178.80
     router_ip: 192.168.178.1
     home_assistant_url: https://ha.bauer.tech
     home_assistant_token:
       eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJkM2QxYjAwYjkxZjY0MWVhYjA4YmZhMDYwYTg3YjRhNyIsImlhdCI6MTcwNDI3MDU5MSwiZXhwIjoyMDE5NjMwNTkxfQ.dzvejgEQd9hf-Yftzd7NkR5pv76GaLFczeOy-a2pa1o
     configure_wifi: false
-    wifi_ssid: BauerWLAN
+    pi_standard_setup_wifi_ssid: BauerWLAN
     my_btmonitor_mqtt_username: my_btmonitor
     my_btmonitor_mqtt_password: 8aBIAC14jaKKbla

roles/bluetooth_monitor/tasks/main.yml

@@ -20,6 +20,7 @@
   ansible.builtin.copy:
     src: my_btmonitor.service
     dest: /etc/systemd/system/
+    mode: "0644"
 - name: Add script to autostart and start now
   ansible.builtin.systemd:
     name: my_btmonitor
@@ -30,4 +31,4 @@
 #   include_role:
 #     name: pi_sysdweb
 #   vars:
-#     sysdweb_name: my_btmonitor
+#     pi_sysdweb_name: my_btmonitor

roles/pi_alsasetup/tasks/main.yml

@@ -3,3 +3,4 @@
   ansible.builtin.template:
     src: asound.conf
     dest: /etc/asound.conf
+    mode: "0644"

roles/pi_dhtsensor/README.md

@@ -4,4 +4,4 @@ Installs the DHT22 temperature/humidity sensor polling script based on the
 legacy `Adafruit_DHT` library (removing the circuitpython variant/
 `libgpiod2` if present — mutually exclusive with `pi_dhtsensor_circuitpython`).
 
-**Key vars:** `dht_pin`, `dht_polling_sleep_time_seconds`
+**Key vars:** `pi_dhtsensor_dht_pin`, `pi_dhtsensor_dht_polling_sleep_time_seconds`

roles/pi_dhtsensor/defaults/main.yml

@@ -1,3 +1,3 @@
 ---
-dht_pin: 12
+pi_dhtsensor_dht_pin: 12
-dht_polling_sleep_time_seconds: 20
+pi_dhtsensor_dht_polling_sleep_time_seconds: 20

roles/pi_dhtsensor/tasks/main.yml

@@ -23,6 +23,7 @@
   ansible.builtin.template:
     src: dht22_sensing.json
     dest: /etc/dht22_sensing.json
+    mode: "0644"
 - name: Install script
   ansible.builtin.copy:
     src: dht22_sensing.py
@@ -33,6 +34,7 @@
   ansible.builtin.copy:
     src: dht22_sensing.service
     dest: /etc/systemd/system/
+    mode: "0644"
 - name: Add script to autostart and start now
   ansible.builtin.systemd:
     name: dht22_sensing
@@ -43,4 +45,4 @@
   ansible.builtin.include_role:
     name: pi_sysdweb
   vars:
-    sysdweb_name: dht22_sensing
+    pi_sysdweb_name: dht22_sensing

roles/pi_dhtsensor/templates/dht22_sensing.json

@@ -1,8 +1,8 @@
 {
   "ha_url": "{{home_assistant_url}}",
   "token": "{{home_assistant_token}}",
-  "dht_pin": "{{dht_pin}}",
+  "dht_pin": "{{pi_dhtsensor_dht_pin}}",
-  "polling_sleep_time_seconds": "{{dht_polling_sleep_time_seconds}}",
+  "polling_sleep_time_seconds": "{{pi_dhtsensor_dht_polling_sleep_time_seconds}}",
 
   "ha_temp_sensor_name": "{{sensor_room_name_ascii|lower}}_dht22_temperatur",
   "ha_temp_friendly_name": "{{sensor_room_name}} Temperatur",

roles/pi_dhtsensor_circuitpython/README.md

@@ -5,4 +5,4 @@ Installs the DHT22 temperature/humidity sensor polling script based on
 to the `pi_dhtsensor` role's legacy `Adafruit_DHT` library. Mutually
 exclusive with `pi_dhtsensor`.
 
-**Key vars:** `dht_pin`, `dht_polling_sleep_time_seconds`
+**Key vars:** `pi_dhtsensor_circuitpython_dht_pin`, `pi_dhtsensor_circuitpython_dht_polling_sleep_time_seconds`

roles/pi_dhtsensor_circuitpython/defaults/main.yml

@@ -1,3 +1,3 @@
 ---
-dht_pin: "D12"
+pi_dhtsensor_circuitpython_dht_pin: "D12"
-dht_polling_sleep_time_seconds: 20
+pi_dhtsensor_circuitpython_dht_polling_sleep_time_seconds: 20

roles/pi_dhtsensor_circuitpython/tasks/main.yml

@@ -12,6 +12,7 @@
   ansible.builtin.template:
     src: dht22_sensing.json
     dest: /etc/dht22_sensing.json
+    mode: "0644"
 - name: Install script
   ansible.builtin.copy:
     src: dht22_sensing.py
@@ -22,6 +23,7 @@
   ansible.builtin.copy:
     src: dht22_sensing.service
     dest: /lib/systemd/system/
+    mode: "0644"
 - name: Add script to autostart and start now
   ansible.builtin.systemd:
     name: dht22_sensing
@@ -32,4 +34,4 @@
   ansible.builtin.include_role:
     name: pi_sysdweb
   vars:
-    sysdweb_name: dht22_sensing
+    pi_sysdweb_name: dht22_sensing

roles/pi_dhtsensor_circuitpython/templates/dht22_sensing.json

@@ -1,8 +1,8 @@
 {
   "ha_url": "{{home_assistant_url}}",
   "token": "{{home_assistant_token}}",
-  "dht_pin": "{{dht_pin}}",
+  "dht_pin": "{{pi_dhtsensor_circuitpython_dht_pin}}",
-  "polling_sleep_time_seconds": "{{dht_polling_sleep_time_seconds}}",
+  "polling_sleep_time_seconds": "{{pi_dhtsensor_circuitpython_dht_polling_sleep_time_seconds}}",
 
   "ha_temp_sensor_name": "{{sensor_room_name_ascii|lower}}_dht22_temperatur",
   "ha_temp_friendly_name": "{{sensor_room_name}} Temperatur",

roles/pi_irserver/tasks/main.yml

@@ -8,14 +8,17 @@
   ansible.builtin.file:
     path: /usr/bin/remotes
     state: directory
+    mode: "0755"
 - name: Copy hauppauge remote
   ansible.builtin.copy:
     src: hauppauge.rem
     dest: /usr/bin/remotes/
+    mode: "0644"
 - name: Copy irserver systemd file
   ansible.builtin.copy:
     src: irserver.service
     dest: /lib/systemd/system/
+    mode: "0644"
 - name: Enable irserver autostart
   ansible.builtin.systemd:
     name: irserver
@@ -26,4 +29,4 @@
   ansible.builtin.include_role:
     name: pi_sysdweb
   vars:
-    sysdweb_name: irserver
+    pi_sysdweb_name: irserver

roles/pi_lirc/handlers/main.yml

@@ -0,0 +1,3 @@
+---
+- name: Reboot if boot overlay changed
+  ansible.builtin.reboot:

roles/pi_lirc/tasks/main.yml

@@ -6,31 +6,31 @@
   ansible.builtin.copy:
     src: lirc_options.conf
     dest: /etc/lirc/lirc_options.conf
+    mode: "0644"
 - name: Install config file lircd.conf
   ansible.builtin.copy:
     src: lircd.conf
     dest: /etc/lirc/lircd.conf
+    mode: "0644"
 - name: Install remote file
   ansible.builtin.copy:
     src: hauppauge.conf
     dest: /etc/lirc/hauppauge.conf
+    mode: "0644"
 - name: Activate overlay in boot config
   ansible.builtin.lineinfile:
     path: /boot/firmware/config.txt
     regexp: "^#?dtoverlay=gpio-ir"
     line: "dtoverlay=gpio-ir,gpio_pin=17"
-  register: boot_overlay
+  notify: Reboot if boot overlay changed
 - name: Restart lircd
   ansible.builtin.systemd:
     name: lircd
     state: started
     enabled: "yes"
     daemon_reload: "yes"
-- name: Reboot if boot overlay changed
-  ansible.builtin.reboot:
-  when: boot_overlay.changed
 - name: Add to sysdweb
   ansible.builtin.include_role:
     name: pi_sysdweb
   vars:
-    sysdweb_name: lircd
+    pi_sysdweb_name: lircd

roles/pi_musicmouse/tasks/main.yml

@@ -21,14 +21,17 @@
   ansible.builtin.file:
     path: /media/musicmouse
     state: directory
+    mode: "0755"
 - name: Install config file
   ansible.builtin.copy:
     src: config.yml
     dest: /media/musicmouse/config.yml
+    mode: "0644"
 - name: Install systemd service file
   ansible.builtin.copy:
     src: musicmouse.service
     dest: /etc/systemd/system/
+    mode: "0644"
 - name: Add script to autostart and start now
   ansible.builtin.systemd:
     name: musicmouse
@@ -39,6 +42,7 @@
   ansible.builtin.copy:
     src: smb.conf
     dest: /etc/samba/
+    mode: "0644"
 - name: Restart samba
   ansible.builtin.systemd:
     name: smbd

roles/pi_shairport/README.md

@@ -3,4 +3,4 @@
 Builds and installs shairport-sync (AirPlay receiver) from source, copies
 its config, and patches the systemd service to run as root.
 
-**Key vars:** `shairport_sync_version`, `shairport_name`
+**Key vars:** `pi_shairport_sync_version`, `pi_shairport_name`

roles/pi_shairport/defaults/main.yml

@@ -1,3 +1,3 @@
 ---
-shairport_sync_version: "3.3.5"
+pi_shairport_sync_version: "3.3.5"
-shairport_name: Unnamed Raspberry with shairport
+pi_shairport_name: Unnamed Raspberry with shairport

roles/pi_shairport/tasks/main.yml

@@ -25,6 +25,7 @@
   ansible.builtin.template:
     src: shairport-sync.conf
     dest: /etc/shairport-sync.conf
+    mode: "0644"
 - name: Modify service file to run as root
   ansible.builtin.lineinfile:
     path: /lib/systemd/system/shairport-sync.service
@@ -40,4 +41,4 @@
   ansible.builtin.include_role:
     name: pi_sysdweb
   vars:
-    sysdweb_name: shairport-sync
+    pi_sysdweb_name: shairport-sync

roles/pi_shairport/templates/shairport-sync.conf

@@ -1,6 +1,6 @@
 general =
 {
-  	name = "{{shairport_name}}";
+  	name = "{{ pi_shairport_name }}";
 };
 
 alsa =

roles/pi_sispmctl/tasks/main.yml

@@ -2,7 +2,7 @@
 - name: Check if sispmctl already exists
   ansible.builtin.stat:
     path: /usr/bin/sispmctl
-  register: sispmctl_file
+  register: pi_sispmctl_file
 - name: Install dependencies
   ansible.builtin.apt:
     name: "libusb-dev"
@@ -12,15 +12,16 @@
   ansible.builtin.unarchive:
     src: sispmctl-4.7.tar.gz
     dest: /tmp
-  when: not sispmctl_file.stat.exists
+  when: not pi_sispmctl_file.stat.exists
 - name: Build and install
   ansible.builtin.shell: cd /tmp/sispmctl*/ && ./configure --prefix=/usr && make install
-  when: not sispmctl_file.stat.exists
+  when: not pi_sispmctl_file.stat.exists
   changed_when: true
 - name: Install systemd service file
   ansible.builtin.copy:
     src: sispmctl.service
     dest: /lib/systemd/system/
+    mode: "0644"
 - name: Add script to autostart and start now
   ansible.builtin.systemd:
     name: sispmctl
@@ -31,4 +32,4 @@
   ansible.builtin.include_role:
     name: pi_sysdweb
   vars:
-    sysdweb_name: sispmctl
+    pi_sysdweb_name: sispmctl

roles/pi_squeezelite/README.md

@@ -3,4 +3,4 @@
 Installs the distro-packaged `squeezelite` client (Logitech Media Server
 player), installs its config file, and registers it with `pi_sysdweb`.
 
-**Key vars:** `squeezeserver`
+**Key vars:** `pi_squeezelite_squeezeserver`

roles/pi_squeezelite/defaults/main.yml

@@ -1,2 +1,2 @@
 ---
-squeezeserver: 192.168.178.80
+pi_squeezelite_squeezeserver: 192.168.178.80

roles/pi_squeezelite/tasks/main.yml

@@ -9,9 +9,10 @@
   ansible.builtin.template:
     src: squeezelite.cfg
     dest: /etc/default/squeezelite
+    mode: "0644"
   notify: Restart-squeezelite
 - name: Add to sysdweb
   ansible.builtin.include_role:
     name: pi_sysdweb
   vars:
-    sysdweb_name: squeezelite
+    pi_sysdweb_name: squeezelite

roles/pi_squeezelite/templates/squeezelite.cfg

@@ -1,3 +1,3 @@
 SL_NAME="{{squeezelite_name}}"
 SL_SOUNDCARD="softvol_squeezelite"
-SB_SERVER_IP="{{squeezeserver}}"
+SB_SERVER_IP="{{ pi_squeezelite_squeezeserver }}"

roles/pi_squeezelite_custom/tasks/main.yml

@@ -27,6 +27,7 @@
   ansible.builtin.template:
     src: squeezelite.service
     dest: /lib/systemd/system/
+    mode: "0644"
 - name: Enable sysdweb autostart
   ansible.builtin.systemd:
     name: squeezelite
@@ -37,7 +38,7 @@
   ansible.builtin.include_role:
     name: pi_sysdweb
   vars:
-    sysdweb_name: squeezelite
+    pi_sysdweb_name: squeezelite
 
 # build with adapted Makefile.rpi:
 # OPTS = -DRESAMPLE -DDSD -DUSE_SSL -DLINKALL -I./include -I./include/opus -I./include/alac -I/usr/local/include -s -mfpu=vfp

roles/pi_squeezelite_custom/templates/squeezelite.service

@@ -3,7 +3,7 @@ Description=Squeezelite
 After=network.target
 
 [Service]
-ExecStart=/opt/squeezelite -n {{squeezelite_name}} -s {{squeezeserver}} -o softvol_squeezelite
+ExecStart=/opt/squeezelite -n {{squeezelite_name}} -s {{ pi_squeezelite_squeezeserver }} -o softvol_squeezelite
 Restart=on-failure
 
 [Install]

roles/pi_squeezeserver/tasks/main.yml

@@ -18,6 +18,7 @@
   ansible.builtin.copy:
     src: logitechmediaserver_8.4.0_arm.deb
     dest: /tmp
+    mode: "0644"
 - name: Install squeezeserver package
   ansible.builtin.apt:
     deb: /tmp/logitechmediaserver_8.4.0_arm.deb
@@ -30,7 +31,7 @@
   ansible.builtin.include_role:
     name: pi_sysdweb
   vars:
-    sysdweb_name: logitechmediaserver
+    pi_sysdweb_name: logitechmediaserver
 - name: Forward port 80 to 9000
   ansible.builtin.iptables:
     table: nat

roles/pi_standard_setup/README.md

@@ -5,6 +5,7 @@ Pi model, adds a root SSH key, disables the SSH locale-forwarding warning,
 optionally configures wifi and the hostname, and rotates the default
 `pi`/`raspberry` credentials via the `keepass` lookup plugin.
 
-**Key vars:** `wifi_ssid`, `new_hostname`, `timezone`, `wifi_country`,
+**Key vars:** `pi_standard_setup_wifi_ssid`, `pi_standard_setup_new_hostname`,
+`pi_standard_setup_timezone`, `pi_standard_setup_wifi_country`,
 `ansible_ssh_pass` (the OS-default password, used only to reach a
 freshly-flashed Pi for the first time before its password is rotated)

roles/pi_standard_setup/defaults/main.yml

@@ -1,11 +1,11 @@
 ---
-wifi_ssid: "" # put SSID here to configure wifi
+pi_standard_setup_wifi_ssid: "" # put SSID here to configure wifi
 ansible_user: "root" # "User to connect with, put in 'pi' here if you connect the first time, else leave empty"
-new_hostname: "" # set this to change the hostname
+pi_standard_setup_new_hostname: "" # set this to change the hostname
 
-timezone: "Europe/Berlin"
+pi_standard_setup_timezone: "Europe/Berlin"
-wifi_country: "DE"
+pi_standard_setup_wifi_country: "DE"
-wifi_pass_url: "bauer_wifi" # has to be in keepass with url "wifi_pass_url"
+pi_standard_setup_wifi_pass_url: "bauer_wifi" # has to be in keepass with url "wifi_pass_url"
 ansible_ssh_pass: "raspberry"
 ansible_become_password: "raspberry"
 ansible_become: true

roles/pi_standard_setup/tasks/main.yml

@@ -7,10 +7,10 @@
 - name: Detect Raspi Model
   ansible.builtin.slurp:
     src: /sys/firmware/devicetree/base/model
-  register: raspberry_model
+  register: pi_standard_setup_raspberry_model
 - name: Show Raspi Model
   ansible.builtin.debug:
-    msg: "{{ raspberry_model.content | b64decode }}"
+    msg: "{{ pi_standard_setup_raspberry_model.content | b64decode }}"
 - name: Add authorized SSH key to root account
   ansible.posix.authorized_key:
     user: root
@@ -30,24 +30,24 @@
   notify: Restart sshd
 - name: Get hostname
   ansible.builtin.command: "raspi-config nonint get_hostname"
-  register: pi_hostname
+  register: pi_standard_setup_pi_hostname
   changed_when: false
-- name: Change hostname  {{ new_hostname }}
+- name: Change hostname  {{ pi_standard_setup_new_hostname }}
-  ansible.builtin.command: "raspi-config nonint do_hostname {{ new_hostname }}"
+  ansible.builtin.command: "raspi-config nonint do_hostname {{ pi_standard_setup_new_hostname }}"
-  when: new_hostname | bool and pi_hostname.stdout != new_hostname
+  when: pi_standard_setup_new_hostname | bool and pi_standard_setup_pi_hostname.stdout != pi_standard_setup_new_hostname
-  register: set_hostname
+  register: pi_standard_setup_set_hostname
   changed_when: true
   notify: Reboot
 - name: Get hostname
   ansible.builtin.command: "raspi-config nonint get_hostname"
-  register: pi_hostname
+  register: pi_standard_setup_pi_hostname
   changed_when: false
 - name: Set boot mode to CLI
   ansible.builtin.command: "raspi-config nonint do_boot_behaviour B1"
   changed_when: true
 # I2 Change Timezone
 - name: Change timezone
-  ansible.builtin.command: "raspi-config nonint do_change_timezone {{ timezone }}"
+  ansible.builtin.command: "raspi-config nonint do_change_timezone {{ pi_standard_setup_timezone }}"
   changed_when: true
 - name: Change locale
   ansible.builtin.command: "raspi-config nonint do_change_locale en_US.UTF-8"
@@ -72,22 +72,24 @@
   ansible.builtin.copy:
     src: vimrc
     dest: /root/.vimrc
+    mode: "0644"
 - name: Copy git config
   ansible.builtin.copy:
     src: gitconfig
     dest: /root/.gitconfig
+    mode: "0644"
 # Wifi
 - name: Get WiFi country
   ansible.builtin.command: "raspi-config nonint get_wifi_country"
-  register: wifi_country
+  register: pi_standard_setup_current_wifi_country
   changed_when: false
   ignore_errors: true # to avoid error when WiFi is not present
 - name: Change WiFi country
-  ansible.builtin.command: "raspi-config nonint do_wifi_country {{ wifi_country }}"
+  ansible.builtin.command: "raspi-config nonint do_wifi_country {{ pi_standard_setup_wifi_country }}"
   when: configure_wifi
   changed_when: true
 - name: Set WiFi credentials
-  ansible.builtin.command: "raspi-config nonint do_wifi_ssid_passphrase {{ wifi_ssid }} {{ lookup('keepass', 'bauer_wifi') }}"
+  ansible.builtin.command: "raspi-config nonint do_wifi_ssid_passphrase {{ pi_standard_setup_wifi_ssid }} {{ lookup('keepass', 'bauer_wifi') }}"
   when: configure_wifi
   changed_when: true
 - name: Install watchdog
@@ -95,7 +97,7 @@
     name: watchdog
     cache_valid_time: "7200"
     state: present
-  when: not wifi_ssid is defined
+  when: not pi_standard_setup_wifi_ssid is defined
 - name: Configure watchdog
   ansible.builtin.blockinfile:
     path: /etc/watchdog.conf
@@ -115,8 +117,9 @@
 # Message of the day
 - name: Set Message of the day
   ansible.builtin.copy:
-    src: motd/{{ pi_hostname.stdout }}
+    src: motd/{{ pi_standard_setup_pi_hostname.stdout }}
     dest: /etc/motd
+    mode: "0644"
 # LED off script
 - name: Copy led off script
   ansible.builtin.copy:
@@ -127,6 +130,7 @@
   ansible.builtin.copy:
     src: raspi-leds-off.service
     dest: /lib/systemd/system/
+    mode: "0644"
 - name: Activate led off servic
   ansible.builtin.systemd:
     name: raspi-leds-off

roles/pi_sysdweb/README.md

@@ -3,4 +3,4 @@
 Installs `sysdweb` (a small web UI for managing systemd units) and creates
 its service user. Other roles register their services with it.
 
-**Key vars:** `sysdweb_name`
+**Key vars:** `pi_sysdweb_name`

roles/pi_sysdweb/tasks/main.yml

@@ -19,6 +19,7 @@
   ansible.builtin.blockinfile:
     path: /etc/sysdweb.conf
     create: true
+    mode: "0644"
     marker: "# {mark} ansible user"
     block: |
       [DEFAULT]
@@ -27,15 +28,17 @@
   ansible.builtin.blockinfile:
     path: /etc/sysdweb.conf
     create: true
-    marker: "# {mark} ansible managed for {{ sysdweb_name }}"
+    mode: "0644"
+    marker: "# {mark} ansible managed for {{ pi_sysdweb_name }}"
     block: |
-      [{{ sysdweb_name }}]
+      [{{ pi_sysdweb_name }}]
-      title = {{ sysdweb_name }}
+      title = {{ pi_sysdweb_name }}
-      unit = {{ sysdweb_name }}.service
+      unit = {{ pi_sysdweb_name }}.service
 - name: Install systemd service file
   ansible.builtin.copy:
     src: sysdweb-system.service
     dest: /etc/systemd/system/
+    mode: "0644"
 - name: Enable sysdweb autostart
   ansible.builtin.systemd:
     name: sysdweb-system

roles/server_debian_docker/tasks/main.yml

@@ -9,7 +9,7 @@
       - python3-pip
       - virtualenv
       - python3-setuptools
-    state: latest
+    state: present
     update_cache: true
 
 - name: Add Docker GPG apt Key
@@ -27,7 +27,7 @@
     name:
       - docker-ce
       - docker-compose-plugin
-    state: latest
+    state: present
     update_cache: true
 
 - name: Add core to docker group

roles/server_exthdd_mount/tasks/main.yml

@@ -3,14 +3,17 @@
   ansible.builtin.copy:
     src: media-passport4.mount
     dest: /etc/systemd/system
+    mode: "0644"
 - name: Automount passport5 systemd file
   ansible.builtin.copy:
     src: media-passport5.mount
     dest: /etc/systemd/system
+    mode: "0644"
 - name: Create udev rules
   ansible.builtin.copy:
     src: 99-automounts.rules
     dest: /etc/udev/rules.d
+    mode: "0644"
 - name: Systemd reread configs
   ansible.builtin.systemd:
     daemon_reload: true

roles/server_link_aggregation/tasks/main.yml

@@ -7,3 +7,4 @@
   ansible.builtin.copy:
     src: interfaces
     dest: /etc/network/interfaces
+    mode: "0644"