Add 'roles/ensure_os_patch/' from commit 'd0314b6c526ef93f56212f08dc00c1bcf96c2682'

git-subtree-dir: roles/ensure_os_patch
git-subtree-mainline: 88133e84ee
git-subtree-split: d0314b6c52

roles/ensure_os_patch/tasks/main.yml

@@ -0,0 +1,87 @@
+---
+# tasks file for ensure_os_patch
+- name: 'include variables'
+  when:
+    - ansible_facts["system"] == 'Linux'
+  include_vars:
+    file: '{{ lookup("first_found", findme ) }}'
+    name: 'ensure_os_patch'
+  vars:
+    findme:
+      files:
+        - '{{ ansible_facts["distribution"] }}-{{ ansible_facts["distribution_major_version"] }}-{{ ansible_facts["architecture"] }}.yml'
+        - '{{ ansible_facts["distribution"] }}-{{ ansible_facts["distribution_major_version"] }}-default.yml'
+        - '{{ ansible_facts["distribution"] }}-default.yml'
+        - '{{ ansible_facts["os_family"] }}-{{ ansible_facts["distribution_major_version"] }}-{{ ansible_facts["architecture"] }}.yml'
+        - '{{ ansible_facts["os_family"] }}-{{ ansible_facts["distribution_major_version"] }}-default.yml'
+        - '{{ ansible_facts["os_family"] }}-default.yml'
+        - 'default.yml'
+      paths:
+        - '../vars/'
+      errors: 'ignore'
+- name: 'package discovery'
+  when:
+    - ansible_facts["system"] == 'Linux'
+    - ansible_facts["packages"] is not defined
+  ansible.builtin.package_facts:
+- name: 'service discovery'
+  when:
+    - ansible_facts["system"] == 'Linux'
+    - ansible_facts["services"] is not defined
+  ansible.builtin.service_facts:
+- name: 'ensure packages'
+  when:
+    - ansible_facts["system"] == 'Linux'
+    - ensure_os_patch is defined
+    - ensure_os_patch.package_list is defined
+    - ensure_os_patch.package_list is iterable
+  ansible.builtin.package:
+    name: '{{ item.name }}'
+    state: '{{ item.state }}'
+  loop: '{{ ensure_os_patch.package_list }}'
+  loop_control:
+    label: '{{ item.name }} will be {{ item.state }}'
+  notify:
+    - 'ensure_os_patch.package_facts'
+    - 'ensure_os_patch.service_facts'
+- name: 'ensure apt patch'
+  when:
+    - ansible_facts["system"] == 'Linux'
+    - ansible_facts["pkg_mgr"] == 'apt'
+  ansible.builtin.apt:
+    autoclean: 'yes'
+    autoremove: 'yes'
+    upgrade: 'dist'
+  notify:
+    - 'ensure_os_patch.package_facts'
+    - 'ensure_os_patch.service_facts'
+- name: 'ensure dnf or yum patch'
+  when:
+    - ansible_facts["system"] == 'Linux'
+    - ansible_facts["pkg_mgr"] == 'dnf' or ansible_facts["pkg_mgr"] == 'dnf5' or ansible_facts["pkg_mgr"] == 'yum'
+  ansible.builtin.package:
+    name: '*'
+    state: 'latest'
+  notify:
+    - 'ensure_os_patch.package_facts'
+    - 'ensure_os_patch.service_facts'
+- name: 'ensure services'
+  when:
+    - ansible_facts["system"] == 'Linux'
+    - ensure_os_patch is defined
+    - ensure_os_patch.service_list is defined
+    - ensure_os_patch.service_list is iterable
+  ansible.builtin.service:
+    enabled: '{{ item.enabled }}'
+    name: '{{ item.name }}'
+    state: '{{ item.state }}'
+  loop: '{{ ensure_os_patch.service_list }}'
+  loop_control:
+    label: '{{ item.name }} will be {{ item.state }}'
+  notify:
+    - 'ensure_os_patch.package_facts'
+    - 'ensure_os_patch.service_facts'
+- name: 'flush handlers'
+  meta: 'flush_handlers'
+...
+