refactor(roles): drop duplicated and dead code

motoko commented

2026-10-07 23:04:02 +02:00

Collaborator

Why

Fifteen roles opened with a debug task that printed their flag only under -v, twenty-three handlers/main.yml and vars/main.yml files held nothing but a header, and several roles repeated a block, a condition or an expression they already had.

What changed

The enabled-debug tasks and the header-only stubs are gone; gluster, kdeconnect, swarm and webserver now ship only their defaults and port file, with no tasks/. CONTRIBUTING asks for only the directories a role uses. Visible to operators: -v no longer prints those per-role lines, some of which also showed settings such as firewall-apply's file and forward-drop state.
scan-share probes the Samba password from one auth file; firewall-apply states each condition and port-file lookup once; unattended-upgrades, traefik-routes, zram, shell and docker-engine lose their repeats; hardening-basic's workstation module blacklist is a YAML alias of the server one; two redundant flush_handlers guards and a comment repeated above every win_powershell script go.
The docs follow: no banner promised under -v, tag examples on a role that still runs tasks, and the SupportsShouldProcess rule stated once for both Windows roles.

Net −247 lines.

Verification

Rebased onto main after #24 and #26; make check passes on the rebased branch.
firewall-apply: the firewall_render fixtures and every shipped port file render byte-identical to main, and evidence.yml against a stub nft (healthy, wrong policy, no table; live and --check) ends as it does on main.
hardening-basic's defaults parse identical to main's; a probe confirmed that meta: flush_handlers inherits its block's when on ansible-core 2.21; the loader includes the tasks-less webserver role without error.
Not run: make test (no podman in the agent sandbox).

Risks and follow-ups

Roles that reconfigure live hosts are touched: firewall-apply on every Linux host with it enabled (the table renders byte-identical, and a failing collect stops before the render, leaving the loaded table as it is), hardening-basic (no rendered file changes), unattended-upgrades, auditd, fail2ban-basic, windows-hardening-basic and windows-firewall-basic (a debug task, comments, a redundant when, an install task moved into its own block). None changes what a host receives; run make test, then --check --diff before the next live run.

## Why Fifteen roles opened with a debug task that printed their flag only under `-v`, twenty-three `handlers/main.yml` and `vars/main.yml` files held nothing but a header, and several roles repeated a block, a condition or an expression they already had. ## What changed - The enabled-debug tasks and the header-only stubs are gone; gluster, kdeconnect, swarm and webserver now ship only their defaults and port file, with no `tasks/`. CONTRIBUTING asks for only the directories a role uses. Visible to operators: `-v` no longer prints those per-role lines, some of which also showed settings such as firewall-apply's file and forward-drop state. - scan-share probes the Samba password from one auth file; firewall-apply states each condition and port-file lookup once; unattended-upgrades, traefik-routes, zram, shell and docker-engine lose their repeats; hardening-basic's workstation module blacklist is a YAML alias of the server one; two redundant `flush_handlers` guards and a comment repeated above every `win_powershell` script go. - The docs follow: no banner promised under `-v`, tag examples on a role that still runs tasks, and the `SupportsShouldProcess` rule stated once for both Windows roles. Net −247 lines. ## Verification - Rebased onto `main` after #24 and #26; `make check` passes on the rebased branch. - firewall-apply: the `firewall_render` fixtures and every shipped port file render byte-identical to `main`, and `evidence.yml` against a stub `nft` (healthy, wrong policy, no table; live and `--check`) ends as it does on `main`. - hardening-basic's defaults parse identical to `main`'s; a probe confirmed that `meta: flush_handlers` inherits its block's `when` on ansible-core 2.21; the loader includes the tasks-less webserver role without error. - Not run: `make test` (no podman in the agent sandbox). ## Risks and follow-ups - Roles that reconfigure live hosts are touched: firewall-apply on every Linux host with it enabled (the table renders byte-identical, and a failing collect stops before the render, leaving the loaded table as it is), hardening-basic (no rendered file changes), unattended-upgrades, auditd, fail2ban-basic, windows-hardening-basic and windows-firewall-basic (a debug task, comments, a redundant `when`, an install task moved into its own block). None changes what a host receives; run `make test`, then `--check --diff` before the next live run.

motoko added 8 commits

2026-10-07 23:04:04 +02:00

refactor(roles): drop the enabled-debug tasks and empty stubs 9d64d7ecc1

Fifteen roles opened with a debug task that printed their flag, and in
some a few settings, only at -v; a run already shows the loader's
"included" line and whether each task ran or skipped. gluster,
kdeconnect, swarm and webserver had no other task, so they now ship
defaults and a port file and no tasks/ at all, which ansible-core
accepts for a role that names no tasks_from.

Twenty-three handlers/main.yml and vars/main.yml files held nothing but
a header. CONTRIBUTING's "Adding a role" now asks for only the
directories a role uses.

refactor(scan-share): probe the Samba password from one auth file 5e1def92ae

The first sign-in and the repeat after a reset each created, wrote and
removed their own temporary auth file, in two identical blocks. One
block now creates the file once, signs in, resets the password when the
account exists and the sign-in failed, signs in again when needed, and
removes the file in its always: section.

Every host converges to the same state: the password, the account and
the refusal when the share still cannot be opened are unchanged. The
0600 auth file now also exists while smbpasswd runs. The scan-share
scenario drives both the matching and the rotated-password path.

refactor(firewall-apply): state each condition and lookup once 05bb451d92

The collect include sat in a block of its own with the same tags and
the same three conditions as the block that renders, so it now opens
that block. evidence.yml derived the live table's input chain and jumps
twice, for the check-mode report and for the assert; one block guarded
by a readable table now carries them for both. The service key and its
rules lookup, computed in two tasks of collect_service.yml and once
more in the include's condition, are variables on the include.

Checked on the branch only: the firewall_render fixtures and every
shipped port file render byte-identical to main, with the same dropped
rules reported, and evidence.yml against a stub nft (healthy, wrong
policy, no table; live and --check) ends the same way on both.

refactor(roles): say once what five roles said twice 9c9cdf3c62

unattended-upgrades installs its package inside the block that already
carried the same tags and condition. traefik-routes names the routes
that stay present once, as a block variable, for both the write and
the verify loops. zram sets ALGO and PERCENT with one looped replace.
shell's include hands user.yml the home and group it read twice from
the looked-up account; the variables stay lazy, so each resolves after
user.yml's own getent. docker-engine's assert include sits in a block
carrying its tags, so assert.yml's six tasks no longer repeat them.

Nothing a host receives changes. The include_tags gate covers the
docker-engine block, the docker_engine gate still includes assert.yml
directly, and the four roles' scenarios drive the rest.

refactor(hardening-basic): alias the workstation module blacklist aecde7e3f6

The workstation profile's modprobe_disable_list repeated the server
one line for line, as its comment says it must. It is now a YAML alias
of the server list, so a module added there reaches desk machines too,
which is the comment's intent; a merge key is avoided, since
ansible-core warns on the keys a profile overrides.

The parsed defaults are identical to main's, so no host's rendered
blacklist changes.

refactor(roles): drop repeated flush guards and comments 5594fec82e

warden's and windows-hardening-basic's flush_handlers repeated their
block's when. A meta task inherits the block's condition in ansible-
core 2.21, the version every role requires: a probe showed a flush in
a false block left the handler for the end of the play, and a true one
ran it in place. warden's comment claimed the opposite and is cut.

The two Windows roles said why each win_powershell script declares
SupportsShouldProcess above every script; each file now says it once,
pointing at windows-hardening-basic's README, its home.

docs: describe roles without banners, stubs or port-only tasks 40cf3b181b

ADVANCED_USAGE no longer promises a flag banner under -v, and its tag
examples use warden, which still runs tasks, where swarm and webserver
now run none; ARCHITECTURE says a role owns only the tasks, handlers
and port file it needs; the four port-only READMEs say the role runs
no tasks. CONTRIBUTING lists molecule/ among a role's optional
directories and says once, with the port file, that a port-only
service needs no tasks.

windows-hardening-basic's README, now the one place the task files
point to for SupportsShouldProcess, states the rule for both Windows
roles and every read-only script, instead of a list of tasks that had
fallen behind the role.

refactor: finish two collapses and the auth file's wording 0f5ab63dd1

firewall-apply's include still looked a service's port file up twice,
once with a default for its condition and once to index its rules; it
reads it once now, and the render of the fixtures and every shipped port
file stays byte-identical to main's. zram's block held one task after
its two replaces became a loop, so the task carries the condition.

scan-share's task comment and README said the probe's auth file goes
right after the sign-in; it now lives until the check ends, through the
reset and the second sign-in, and both say so.

motoko force-pushed refactor/dedup-roles from 0f5ab63dd1 to 146a2f62ae

2026-10-07 23:08:42 +02:00

Compare

motoko force-pushed refactor/dedup-roles from 146a2f62ae to 216d416959

2026-10-07 23:34:08 +02:00

Compare