refactor(roles/common): naming and formatting improvements

roles/common/defaults/main.yaml

@@ -1,3 +1,3 @@
 ---
-journal_retention_days: 21
+common_journal_retention_days: 21
-journal_max_disk_limit: "5%"
+common_journal_max_disk_limit: "5%"

roles/common/tasks/cron.yaml

@@ -1,9 +1,10 @@
 ---
 - name: Create cron job to prune journald logs with configurable limits
+  become: true
   ansible.builtin.cron:
-    name: "Prune systemd journal logs ({{ journal_retention_days }} days, {{ journal_max_disk_limit }} disk)"
+    name: "Prune systemd journal logs ({{ common_journal_retention_days }} days, {{ common_journal_max_disk_limit }} disk)"
     minute: "0"
     hour: "2"
-    job: "/usr/bin/journalctl --vacuum-time={{ journal_retention_days }}d --vacuum-size={{ journal_max_disk_limit }} > /dev/null 2>&1"
+    job: "/usr/bin/journalctl --vacuum-time={{ common_journal_retention_days }}d --vacuum-size={{ common_journal_max_disk_limit }} > /dev/null 2>&1"
     user: root
     state: present

roles/common/tasks/main.yaml

@@ -1,9 +1,10 @@
 ---
 - name: Include optimization tasks
-  include_tasks: optimization.yaml
+  ansible.builtin.include_tasks: optimization.yaml
   tags: optimization
 
 - name: Install essential packages
+  become: true
   ansible.builtin.apt:
     name: "{{ system_packages.essential }}"
     state: present
@@ -12,48 +13,54 @@
   tags: packages
 
 - name: Set hostname and FQDN
+  tags: system
   block:
     - name: Set hostname
+      become: true
       ansible.builtin.hostname:
         name: "{{ hostname | default(inventory_hostname) }}"
 
     - name: Configure FQDN in hosts file
+      become: true
       ansible.builtin.lineinfile:
         path: /etc/hosts
         regexp: '^127\.0\.1\.1.*'
         line: "127.0.1.1 {{ fqdn | default(hostname) }} {{ hostname | default(inventory_hostname) }}"
         state: present
-  tags: system
 
 - name: Deploy MOTD template
-  template:
+  become: true
+  ansible.builtin.template:
     src: motd.j2
     dest: /etc/motd
-    mode: '0644'
+    mode: "0644"
 
 - name: Configure timezone
+  become: true
   community.general.timezone:
     name: "{{ timezone }}"
   tags: system, ntp
 
 - name: Install and configure NTP
-  include_role:
+  ansible.builtin.include_role:
     name: geerlingguy.ntp
   tags: system, ntp
 
 - name: Deploy SSH configuration
+  become: true
   ansible.builtin.template:
     src: sshd_config.j2
     dest: /etc/ssh/sshd_config
     owner: root
     group: root
-    mode: '0600'
+    mode: "0600"
-    validate: '/usr/sbin/sshd -t -f %s'
+    validate: "/usr/sbin/sshd -t -f %s"
   notify: Restart ssh
 
 - name: Create admin users with proper SSH keys
   block:
     - name: Ensure user exists
+      become: true
       ansible.builtin.user:
         name: "{{ item.name }}"
         shell: "{{ item.shell | default('/bin/bash') }}"
@@ -66,6 +73,7 @@
       tags: users
 
     - name: Deploy SSH authorized keys
+      become: true
       ansible.posix.authorized_key:
         user: "{{ item.0.name }}"
         state: present
@@ -77,5 +85,5 @@
       tags: users, ssh
 
 - name: Include cron tasks
-  include_tasks: cron.yaml
+  ansible.builtin.include_tasks: cron.yaml
   tags: cron

roles/common/tasks/optimization.yaml

@@ -1,6 +1,7 @@
 ---
 - name: Configure sysctl parameters
-  ansible.builtin.sysctl:
+  become: true
+  ansible.posix.sysctl:
     name: "{{ item.key }}"
     value: "{{ item.value }}"
     state: present
@@ -9,11 +10,13 @@
   tags: optimization
 
 - name: Configure file handle limits
+  become: true
   ansible.builtin.lineinfile:
     path: /etc/security/limits.conf
     regexp: "^{{ item.user | regex_escape }}.*{{ item.type }}"
     line: "{{ item.user }} - nofile {{ item.limit }}"
     create: true
+    mode: "0644"
   loop:
     - { user: "root", type: "soft", limit: "65536" }
     - { user: "root", type: "hard", limit: "65536" }