diff --git a/AGENTS.md b/AGENTS.md index 25d2ea8..f41f08c 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -129,7 +129,6 @@ 3. **Installation**: Install or remove packages, binaries, and repositories with cryptographic verification. 4. **Configuration**: Apply configuration files, drop-in directories, and permissions (least privilege). 5. **Service Management**: Enable, start, or manage daemon state and register notifications/handlers. - 6. **Post-Validation / Health Verification**: Execute end-state verification to prove correct operational state. 3. **Platform Data Resolution Hierarchy**: - Platform-specific variables MUST reside in `vars/` and follow a deterministic naming schema based on OS Vendor, OS Major Version, and Architecture (e.g., `vars/{{ ansible_distribution }}_{{ ansible_distribution_major_version }}_{{ ansible_architecture }}.yml`). - Tasks MUST NOT embed OS-specific branching logic (`when: ansible_os_family == '...'`) for package names, service names, or configuration paths. @@ -161,22 +160,14 @@ 2. **Actionable Diagnostic Requirement**: - All validation failures (static or runtime) MUST produce clear, structured diagnostics stating: the failed constraint, observed vs. expected value, and the explicit remediation step. -## 10. Deployment Lifecycle, Health Gateways & Rollback Resilience +## 10. Deployment Lifecycle, Declarative State & Resilience -1. **Pre-Change Health & Baseline Validation**: - - Prior to applying any configuration, infrastructure, or code change, the execution sequence MUST validate that the target environment and dependent services are in a healthy, operational baseline state. - - Pre-change checks MUST be adapted to the specific component being deployed (e.g., verifying database connectivity, checking existing daemon health, validating DNS/network routing, verifying available disk/memory thresholds). - - If the pre-change health state fails, deployment MUST halt immediately before mutating any state. -2. **Post-Change Operational & Functional Verification**: - - Deployment sequences MUST NOT consider a change successful merely because an installer or configuration module exited with status code zero. - - Every deployment MUST execute active functional verification against the resulting state: - - The process/service is active and enabled. - - Sockets and network endpoints are listening and accepting connections. - - Application-level synthetic transaction succeeds (e.g., for a web service: HTTP 200 OK with expected payload content, zero 5xx/4xx error pages; for a database: successful query execution). - - If post-change verification fails, execution MUST fail fast with detailed operational telemetry. -3. **Reversibility & Non-Destructive Failure**: +1. **Declarative State Enforcement vs. Redundant Assertions**: + - Configuration management modules in Ansible (`ansible.builtin.package`, `ansible.builtin.service`, `ansible.builtin.template`, etc.) are natively declarative and self-enforcing: they enforce the desired target state and halt execution immediately upon encountering an error. + - Roles MUST NOT append redundant post-task discovery and assertion loops (e.g., calling `service_facts` or `package_facts` to assert that services are running or packages are installed). Such assertions add execution overhead, do not prevent pre-existing failures ("broken before"), and produce false-positive failures on systemd sockets (`.socket`), timers (`.timer`), and service aliases. +2. **Reversibility & Non-Destructive Failure**: - Deployments MUST be engineered to be non-destructive to prior working states. - - If a new deployment fails during application or post-verification, the system MUST not leave services in a degraded or corrupted state; atomic rollback strategies, staged deployments, or transaction-safe backups MUST be implemented to preserve or restore the last-known-good operational state. + - If a new deployment fails during application, the system MUST not leave services in a degraded or corrupted state; atomic rollback strategies, staged deployments, or transaction-safe backups MUST be implemented to preserve or restore the last-known-good operational state. ## 11. Infrastructure as Code (Terraform / OpenTofu) Technical Architecture @@ -241,7 +232,7 @@ - **Dual-Credential Rollover Pattern (Two-Phase Commit)**: When persistent credentials (e.g. static database users, API tokens, SSH keys) are rotated, automation MUST NOT perform single-step destructive overwrites. Rotation MUST follow a Two-Phase commit: 1. Stage and create the new credential alongside the existing active credential. 2. Update consumer service configuration and reload. - 3. Execute post-change synthetic verification (Section 10.2). + 3. Execute synthetic health verification against the service. 4. If verification passes, revoke/drop the legacy credential; if verification fails, roll back configuration to the legacy credential and fail fast. - **Idempotent Reconciliation**: Automated periodic runs (e.g. hourly fleet drift runs) MUST NOT generate new credentials unless a rotation trigger or TTL expiration has occurred, ensuring repeated runs remain idempotent with zero unnecessary service reloads. @@ -371,7 +362,6 @@ Before finalizing or committing any playbook, role, script, or infrastructure co - [ ] **Security Hardening Enforced**: Non-root daemon users configured, systemd sandboxing parameters enabled, least-privilege permissions applied, and SELinux contexts declared. - [ ] **Zero Credential Leaks**: All tasks and variables handling secrets or certificates enforce `no_log: true` (Ansible) or `sensitive = true` (Terraform/OpenTofu). - [ ] **Idempotency & Least Change**: Tasks modify only the minimal delta from factory defaults; repeated runs against compliant nodes report `changed=0`. -- [ ] **Post-Change Verification Active (Section 10.2)**: End-state functional assertions (listening sockets, synthetic HTTP 200 checks, database queries) are implemented. - [ ] **Supply Chain & Licensing Verified**: All third-party packages comply with Tier 1 Libre Open Source licensing (zero BSL/SSPL) with cryptographic SHA-256 validation. - [ ] **Formatting & Accessibility Compliant (`STYLE.md`)**: Narrow-line formatting applied, Yoda/defensive syntax used, attributes lexicographically sorted, and no decorative ASCII art. diff --git a/roles/ensure_ansible_prereq/tasks/main.yml b/roles/ensure_ansible_prereq/tasks/main.yml index 91f1e2b..e2c56cc 100644 --- a/roles/ensure_ansible_prereq/tasks/main.yml +++ b/roles/ensure_ansible_prereq/tasks/main.yml @@ -112,22 +112,3 @@ - Ensure_Ansible_Prereq.Service_Facts - name: Flush Handlers ansible.builtin.meta: flush_handlers -- name: Post Verification Package Discovery - when: - - ensure_ansible_prereq is defined - - ensure_ansible_prereq.package_list is defined - - ensure_ansible_prereq.package_list is iterable - ansible.builtin.package_facts: -- name: Assert Managed Packages Are Installed - when: - - ensure_ansible_prereq is defined - - ensure_ansible_prereq.package_list is defined - - ensure_ansible_prereq.package_list is iterable - ansible.builtin.assert: - fail_msg: "Package {{ item.name }} is not installed" - quiet: true - that: - - item.state != 'present' or ansible_facts['packages'][item.name] is defined - loop: "{{ ensure_ansible_prereq.package_list }}" - loop_control: - label: "{{ item.name }} will be verified" diff --git a/roles/ensure_apache/tasks/main.yml b/roles/ensure_apache/tasks/main.yml index 42fd807..158d69a 100644 --- a/roles/ensure_apache/tasks/main.yml +++ b/roles/ensure_apache/tasks/main.yml @@ -225,27 +225,3 @@ - Ensure_Apache.Service_Reload_Config - name: Flush Handlers ansible.builtin.meta: flush_handlers -- name: Post Verification Service Discovery - when: - - ensure_apache is defined - - ensure_apache.service_list is defined - - ensure_apache.service_list is iterable - ansible.builtin.service_facts: -- name: Assert Managed Services Are Active - when: - - ensure_apache is defined - - ensure_apache.service_list is defined - - ensure_apache.service_list is iterable - ansible.builtin.assert: - fail_msg: "Service {{ item.name }} is not active" - quiet: true - that: - - >- - item.state != 'started' or - (ansible_facts['services'][item.name ~ '.service'] is defined and - ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or - (ansible_facts['services'][item.name] is defined and - ansible_facts['services'][item.name]['state'] == 'running') - loop: "{{ ensure_apache.service_list }}" - loop_control: - label: "{{ item.name }} will be verified" diff --git a/roles/ensure_cockpit/tasks/main.yml b/roles/ensure_cockpit/tasks/main.yml index 37ad472..1d7bbd7 100644 --- a/roles/ensure_cockpit/tasks/main.yml +++ b/roles/ensure_cockpit/tasks/main.yml @@ -104,27 +104,3 @@ label: '{{ item.service }} will be {{ item.state }}' - name: Flush Handlers ansible.builtin.meta: flush_handlers -- name: Post Verification Service Discovery - when: - - ensure_cockpit is defined - - ensure_cockpit.service_list is defined - - ensure_cockpit.service_list is iterable - ansible.builtin.service_facts: -- name: Assert Managed Services Are Active - when: - - ensure_cockpit is defined - - ensure_cockpit.service_list is defined - - ensure_cockpit.service_list is iterable - ansible.builtin.assert: - fail_msg: "Service {{ item.name }} is not active" - quiet: true - that: - - >- - item.state != 'started' or - (ansible_facts['services'][item.name ~ '.service'] is defined and - ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or - (ansible_facts['services'][item.name] is defined and - ansible_facts['services'][item.name]['state'] == 'running') - loop: "{{ ensure_cockpit.service_list }}" - loop_control: - label: "{{ item.name }} will be verified" diff --git a/roles/ensure_dbus/tasks/main.yml b/roles/ensure_dbus/tasks/main.yml index 41f83c0..0ec57b5 100644 --- a/roles/ensure_dbus/tasks/main.yml +++ b/roles/ensure_dbus/tasks/main.yml @@ -67,27 +67,3 @@ - name: Flush Handlers ansible.builtin.meta: flush_handlers -- name: Post Verification Service Discovery - when: - - ensure_dbus is defined - - ensure_dbus.service_list is defined - - ensure_dbus.service_list is iterable - ansible.builtin.service_facts: -- name: Assert Managed Services Are Active - when: - - ensure_dbus is defined - - ensure_dbus.service_list is defined - - ensure_dbus.service_list is iterable - ansible.builtin.assert: - fail_msg: "Service {{ item.name }} is not active" - quiet: true - that: - - >- - item.state != 'started' or - (ansible_facts['services'][item.name ~ '.service'] is defined and - ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or - (ansible_facts['services'][item.name] is defined and - ansible_facts['services'][item.name]['state'] == 'running') - loop: "{{ ensure_dbus.service_list }}" - loop_control: - label: "{{ item.name }} will be verified" diff --git a/roles/ensure_dovecot/tasks/main.yml b/roles/ensure_dovecot/tasks/main.yml index a293717..b217992 100644 --- a/roles/ensure_dovecot/tasks/main.yml +++ b/roles/ensure_dovecot/tasks/main.yml @@ -150,27 +150,3 @@ notify: [Ensure_Dovecot.Package_Facts, Ensure_Dovecot.Service_Facts] - name: Flush Handlers ansible.builtin.meta: flush_handlers -- name: Post Verification Service Discovery - when: - - ensure_dovecot is defined - - ensure_dovecot.service_list is defined - - ensure_dovecot.service_list is iterable - ansible.builtin.service_facts: -- name: Assert Managed Services Are Active - when: - - ensure_dovecot is defined - - ensure_dovecot.service_list is defined - - ensure_dovecot.service_list is iterable - ansible.builtin.assert: - fail_msg: "Service {{ item.name }} is not active" - quiet: true - that: - - >- - item.state != 'started' or - (ansible_facts['services'][item.name ~ '.service'] is defined and - ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or - (ansible_facts['services'][item.name] is defined and - ansible_facts['services'][item.name]['state'] == 'running') - loop: "{{ ensure_dovecot.service_list }}" - loop_control: - label: "{{ item.name }} will be verified" diff --git a/roles/ensure_fail2ban/tasks/main.yml b/roles/ensure_fail2ban/tasks/main.yml index 00288eb..4b8ed69 100644 --- a/roles/ensure_fail2ban/tasks/main.yml +++ b/roles/ensure_fail2ban/tasks/main.yml @@ -130,27 +130,3 @@ - Ensure_Fail2ban.Service_Reload - name: Flush Handlers ansible.builtin.meta: flush_handlers -- name: Post Verification Service Discovery - when: - - ensure_fail2ban is defined - - ensure_fail2ban.service_list is defined - - ensure_fail2ban.service_list is iterable - ansible.builtin.service_facts: -- name: Assert Managed Services Are Active - when: - - ensure_fail2ban is defined - - ensure_fail2ban.service_list is defined - - ensure_fail2ban.service_list is iterable - ansible.builtin.assert: - fail_msg: "Service {{ item.name }} is not active" - quiet: true - that: - - >- - item.state != 'started' or - (ansible_facts['services'][item.name ~ '.service'] is defined and - ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or - (ansible_facts['services'][item.name] is defined and - ansible_facts['services'][item.name]['state'] == 'running') - loop: "{{ ensure_fail2ban.service_list }}" - loop_control: - label: "{{ item.name }} will be verified" diff --git a/roles/ensure_firewalld/tasks/main.yml b/roles/ensure_firewalld/tasks/main.yml index c70ddfe..d305d96 100644 --- a/roles/ensure_firewalld/tasks/main.yml +++ b/roles/ensure_firewalld/tasks/main.yml @@ -85,27 +85,3 @@ - name: Flush Handlers ansible.builtin.meta: flush_handlers -- name: Post Verification Service Discovery - when: - - ensure_firewalld is defined - - ensure_firewalld.service_list is defined - - ensure_firewalld.service_list is iterable - ansible.builtin.service_facts: -- name: Assert Managed Services Are Active - when: - - ensure_firewalld is defined - - ensure_firewalld.service_list is defined - - ensure_firewalld.service_list is iterable - ansible.builtin.assert: - fail_msg: "Service {{ item.name }} is not active" - quiet: true - that: - - >- - item.state != 'started' or - (ansible_facts['services'][item.name ~ '.service'] is defined and - ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or - (ansible_facts['services'][item.name] is defined and - ansible_facts['services'][item.name]['state'] == 'running') - loop: "{{ ensure_firewalld.service_list }}" - loop_control: - label: "{{ item.name }} will be verified" diff --git a/roles/ensure_git/tasks/main.yml b/roles/ensure_git/tasks/main.yml index da1bc12..3333c9e 100644 --- a/roles/ensure_git/tasks/main.yml +++ b/roles/ensure_git/tasks/main.yml @@ -130,22 +130,3 @@ - Ensure_Git.Service_Restart - name: Flush Handlers ansible.builtin.meta: flush_handlers -- name: Post Verification Package Discovery - when: - - ensure_git is defined - - ensure_git.package_list is defined - - ensure_git.package_list is iterable - ansible.builtin.package_facts: -- name: Assert Managed Packages Are Installed - when: - - ensure_git is defined - - ensure_git.package_list is defined - - ensure_git.package_list is iterable - ansible.builtin.assert: - fail_msg: "Package {{ item.name }} is not installed" - quiet: true - that: - - item.state != 'present' or ansible_facts['packages'][item.name] is defined - loop: "{{ ensure_git.package_list }}" - loop_control: - label: "{{ item.name }} will be verified" diff --git a/roles/ensure_gitea/tasks/main.yml b/roles/ensure_gitea/tasks/main.yml index 8328cf9..fd9d31e 100644 --- a/roles/ensure_gitea/tasks/main.yml +++ b/roles/ensure_gitea/tasks/main.yml @@ -216,27 +216,3 @@ - Ensure_Gitea.Service_Restart - name: Flush Handlers ansible.builtin.meta: flush_handlers -- name: Post Verification Service Discovery - when: - - ensure_gitea is defined - - ensure_gitea.service_list is defined - - ensure_gitea.service_list is iterable - ansible.builtin.service_facts: -- name: Assert Managed Services Are Active - when: - - ensure_gitea is defined - - ensure_gitea.service_list is defined - - ensure_gitea.service_list is iterable - ansible.builtin.assert: - fail_msg: "Service {{ item.name }} is not active" - quiet: true - that: - - >- - item.state != 'started' or - (ansible_facts['services'][item.name ~ '.service'] is defined and - ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or - (ansible_facts['services'][item.name] is defined and - ansible_facts['services'][item.name]['state'] == 'running') - loop: "{{ ensure_gitea.service_list }}" - loop_control: - label: "{{ item.name }} will be verified" diff --git a/roles/ensure_mariadb/tasks/main.yml b/roles/ensure_mariadb/tasks/main.yml index fce7ba8..9e33e3d 100644 --- a/roles/ensure_mariadb/tasks/main.yml +++ b/roles/ensure_mariadb/tasks/main.yml @@ -232,27 +232,3 @@ loop: '{{ mariadb_user_list }}' loop_control: label: '{{ item.name }} will be {{ item.state }}' -- name: Post Verification Service Discovery - when: - - ensure_mariadb is defined - - ensure_mariadb.service_list is defined - - ensure_mariadb.service_list is iterable - ansible.builtin.service_facts: -- name: Assert Managed Services Are Active - when: - - ensure_mariadb is defined - - ensure_mariadb.service_list is defined - - ensure_mariadb.service_list is iterable - ansible.builtin.assert: - fail_msg: "Service {{ item.name }} is not active" - quiet: true - that: - - >- - item.state != 'started' or - (ansible_facts['services'][item.name ~ '.service'] is defined and - ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or - (ansible_facts['services'][item.name] is defined and - ansible_facts['services'][item.name]['state'] == 'running') - loop: "{{ ensure_mariadb.service_list }}" - loop_control: - label: "{{ item.name }} will be verified" diff --git a/roles/ensure_os_patch/tasks/main.yml b/roles/ensure_os_patch/tasks/main.yml index 28019d6..ac0fc0c 100644 --- a/roles/ensure_os_patch/tasks/main.yml +++ b/roles/ensure_os_patch/tasks/main.yml @@ -91,22 +91,3 @@ notify: [Ensure_Os_Patch.Package_Facts, Ensure_Os_Patch.Service_Facts] - name: Flush Handlers ansible.builtin.meta: flush_handlers -- name: Post Verification Package Discovery - when: - - ensure_os_patch is defined - - ensure_os_patch.package_list is defined - - ensure_os_patch.package_list is iterable - ansible.builtin.package_facts: -- name: Assert Managed Packages Are Installed - when: - - ensure_os_patch is defined - - ensure_os_patch.package_list is defined - - ensure_os_patch.package_list is iterable - ansible.builtin.assert: - fail_msg: "Package {{ item.name }} is not installed" - quiet: true - that: - - item.state != 'present' or ansible_facts['packages'][item.name] is defined - loop: "{{ ensure_os_patch.package_list }}" - loop_control: - label: "{{ item.name }} will be verified" diff --git a/roles/ensure_os_upgrade/tasks/main.yml b/roles/ensure_os_upgrade/tasks/main.yml index 4f8fb85..2a08eb1 100644 --- a/roles/ensure_os_upgrade/tasks/main.yml +++ b/roles/ensure_os_upgrade/tasks/main.yml @@ -93,22 +93,3 @@ - Ensure_Os_Upgrade.Service_Facts - name: Flush Handlers ansible.builtin.meta: flush_handlers -- name: Post Verification Package Discovery - when: - - ensure_os_upgrade is defined - - ensure_os_upgrade.package_list is defined - - ensure_os_upgrade.package_list is iterable - ansible.builtin.package_facts: -- name: Assert Managed Packages Are Installed - when: - - ensure_os_upgrade is defined - - ensure_os_upgrade.package_list is defined - - ensure_os_upgrade.package_list is iterable - ansible.builtin.assert: - fail_msg: "Package {{ item.name }} is not installed" - quiet: true - that: - - item.state != 'present' or ansible_facts['packages'][item.name] is defined - loop: "{{ ensure_os_upgrade.package_list }}" - loop_control: - label: "{{ item.name }} will be verified" diff --git a/roles/ensure_podman/tasks/main.yml b/roles/ensure_podman/tasks/main.yml index f6537da..a90b59b 100644 --- a/roles/ensure_podman/tasks/main.yml +++ b/roles/ensure_podman/tasks/main.yml @@ -84,27 +84,3 @@ ansible.builtin.reboot: - name: Flush Handlers ansible.builtin.meta: flush_handlers -- name: Post Verification Service Discovery - when: - - ensure_podman is defined - - ensure_podman.service_list is defined - - ensure_podman.service_list is iterable - ansible.builtin.service_facts: -- name: Assert Managed Services Are Active - when: - - ensure_podman is defined - - ensure_podman.service_list is defined - - ensure_podman.service_list is iterable - ansible.builtin.assert: - fail_msg: "Service {{ item.name }} is not active" - quiet: true - that: - - >- - item.state != 'started' or - (ansible_facts['services'][item.name ~ '.service'] is defined and - ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or - (ansible_facts['services'][item.name] is defined and - ansible_facts['services'][item.name]['state'] == 'running') - loop: "{{ ensure_podman.service_list }}" - loop_control: - label: "{{ item.name }} will be verified" diff --git a/roles/ensure_postfix/tasks/main.yml b/roles/ensure_postfix/tasks/main.yml index a8cc796..fa6eb3e 100644 --- a/roles/ensure_postfix/tasks/main.yml +++ b/roles/ensure_postfix/tasks/main.yml @@ -150,27 +150,3 @@ notify: [Ensure_Postfix.Package_Facts, Ensure_Postfix.Service_Facts] - name: Flush Handlers ansible.builtin.meta: flush_handlers -- name: Post Verification Service Discovery - when: - - ensure_postfix is defined - - ensure_postfix.service_list is defined - - ensure_postfix.service_list is iterable - ansible.builtin.service_facts: -- name: Assert Managed Services Are Active - when: - - ensure_postfix is defined - - ensure_postfix.service_list is defined - - ensure_postfix.service_list is iterable - ansible.builtin.assert: - fail_msg: "Service {{ item.name }} is not active" - quiet: true - that: - - >- - item.state != 'started' or - (ansible_facts['services'][item.name ~ '.service'] is defined and - ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or - (ansible_facts['services'][item.name] is defined and - ansible_facts['services'][item.name]['state'] == 'running') - loop: "{{ ensure_postfix.service_list }}" - loop_control: - label: "{{ item.name }} will be verified" diff --git a/roles/ensure_repo_epel/tasks/main.yml b/roles/ensure_repo_epel/tasks/main.yml index 1745f8c..5ce08fe 100644 --- a/roles/ensure_repo_epel/tasks/main.yml +++ b/roles/ensure_repo_epel/tasks/main.yml @@ -100,22 +100,3 @@ create: false - name: Flush Handlers ansible.builtin.meta: flush_handlers -- name: Post Verification Package Discovery - when: - - ensure_repo_epel is defined - - ensure_repo_epel.package_list is defined - - ensure_repo_epel.package_list is iterable - ansible.builtin.package_facts: -- name: Assert Managed Packages Are Installed - when: - - ensure_repo_epel is defined - - ensure_repo_epel.package_list is defined - - ensure_repo_epel.package_list is iterable - ansible.builtin.assert: - fail_msg: "Package {{ item.name }} is not installed" - quiet: true - that: - - item.state != 'present' or ansible_facts['packages'][item.name] is defined - loop: "{{ ensure_repo_epel.package_list }}" - loop_control: - label: "{{ item.name }} will be verified" diff --git a/roles/ensure_repo_rpmfusion/tasks/main.yml b/roles/ensure_repo_rpmfusion/tasks/main.yml index ce381cc..509902c 100644 --- a/roles/ensure_repo_rpmfusion/tasks/main.yml +++ b/roles/ensure_repo_rpmfusion/tasks/main.yml @@ -72,22 +72,3 @@ - Ensure_Repo_Rpmfusion.Service_Facts - name: Flush Handlers ansible.builtin.meta: flush_handlers -- name: Post Verification Package Discovery - when: - - ensure_repo_rpmfusion is defined - - ensure_repo_rpmfusion.package_list is defined - - ensure_repo_rpmfusion.package_list is iterable - ansible.builtin.package_facts: -- name: Assert Managed Packages Are Installed - when: - - ensure_repo_rpmfusion is defined - - ensure_repo_rpmfusion.package_list is defined - - ensure_repo_rpmfusion.package_list is iterable - ansible.builtin.assert: - fail_msg: "Package {{ item.name }} is not installed" - quiet: true - that: - - item.state != 'present' or ansible_facts['packages'][item.name] is defined - loop: "{{ ensure_repo_rpmfusion.package_list }}" - loop_control: - label: "{{ item.name }} will be verified" diff --git a/roles/ensure_rsync/tasks/main.yml b/roles/ensure_rsync/tasks/main.yml index f98b891..66694d2 100644 --- a/roles/ensure_rsync/tasks/main.yml +++ b/roles/ensure_rsync/tasks/main.yml @@ -130,22 +130,3 @@ - Ensure_Rsync.Service_Restart - name: Flush Handlers ansible.builtin.meta: flush_handlers -- name: Post Verification Package Discovery - when: - - ensure_rsync is defined - - ensure_rsync.package_list is defined - - ensure_rsync.package_list is iterable - ansible.builtin.package_facts: -- name: Assert Managed Packages Are Installed - when: - - ensure_rsync is defined - - ensure_rsync.package_list is defined - - ensure_rsync.package_list is iterable - ansible.builtin.assert: - fail_msg: "Package {{ item.name }} is not installed" - quiet: true - that: - - item.state != 'present' or ansible_facts['packages'][item.name] is defined - loop: "{{ ensure_rsync.package_list }}" - loop_control: - label: "{{ item.name }} will be verified" diff --git a/roles/ensure_timezone/tasks/main.yml b/roles/ensure_timezone/tasks/main.yml index 2d2be59..5ea3720 100644 --- a/roles/ensure_timezone/tasks/main.yml +++ b/roles/ensure_timezone/tasks/main.yml @@ -128,27 +128,3 @@ label: '{{ item.name }} will be {{ item.state }}' - name: Flush Handlers ansible.builtin.meta: flush_handlers -- name: Post Verification Service Discovery - when: - - ensure_timezone is defined - - ensure_timezone.service_list is defined - - ensure_timezone.service_list is iterable - ansible.builtin.service_facts: -- name: Assert Managed Services Are Active - when: - - ensure_timezone is defined - - ensure_timezone.service_list is defined - - ensure_timezone.service_list is iterable - ansible.builtin.assert: - fail_msg: "Service {{ item.name }} is not active" - quiet: true - that: - - >- - item.state != 'started' or - (ansible_facts['services'][item.name ~ '.service'] is defined and - ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or - (ansible_facts['services'][item.name] is defined and - ansible_facts['services'][item.name]['state'] == 'running') - loop: "{{ ensure_timezone.service_list }}" - loop_control: - label: "{{ item.name }} will be verified" diff --git a/roles/ensure_vim/tasks/main.yml b/roles/ensure_vim/tasks/main.yml index 11095a9..f273f3f 100644 --- a/roles/ensure_vim/tasks/main.yml +++ b/roles/ensure_vim/tasks/main.yml @@ -130,22 +130,3 @@ - Ensure_Vim.Service_Restart - name: Flush Handlers ansible.builtin.meta: flush_handlers -- name: Post Verification Package Discovery - when: - - ensure_vim is defined - - ensure_vim.package_list is defined - - ensure_vim.package_list is iterable - ansible.builtin.package_facts: -- name: Assert Managed Packages Are Installed - when: - - ensure_vim is defined - - ensure_vim.package_list is defined - - ensure_vim.package_list is iterable - ansible.builtin.assert: - fail_msg: "Package {{ item.name }} is not installed" - quiet: true - that: - - item.state != 'present' or ansible_facts['packages'][item.name] is defined - loop: "{{ ensure_vim.package_list }}" - loop_control: - label: "{{ item.name }} will be verified"