Add fail2ban role and clean up yaml lint noise

roles/ensure_sudo/.travis.yml

@@ -1,16 +1,13 @@
 ---
 language: python
-python: "2.7"
+python: '2.7'
 
 # Use the new container infrastructure
 sudo: false
-
 # Install ansible
 addons:
   apt:
-    packages:
-    - python-pip
-
+    packages: [python-pip]
 install:
   # Install ansible
   - pip install ansible
@@ -20,10 +17,8 @@ install:
 
   # Create ansible.cfg with correct roles_path
   - printf '[defaults]\nroles_path=../' >ansible.cfg
-
 script:
   # Basic role syntax check
   - ansible-playbook tests/test.yml -i tests/inventory --syntax-check
-
 notifications:
-  webhooks: https://galaxy.ansible.com/api/v1/notifications/
+  webhooks: https://galaxy.ansible.com/api/v1/notifications/

roles/ensure_sudo/defaults/main.yml

@@ -1,4 +1,3 @@
 ---
 # defaults file for ensure_sudo
-sudo_log_retention: '90d'
-
+sudo_log_retention: 90d

roles/ensure_sudo/handlers/main.yml

@@ -1,17 +1,17 @@
 ---
 # handlers file for ensure_sudo
-- name: 'ensure_sudo.package_facts'
+- name: ensure_sudo.package_facts
   ansible.builtin.package_facts:
-- name: 'ensure_sudo.service_facts'
+- name: ensure_sudo.service_facts
   ansible.builtin.service_facts:
-- name: 'ensure_sudo.service_reload'
+- name: ensure_sudo.service_reload
   when:
     - ansible_facts["system"] == 'Linux'
     - ansible_facts["service_mgr"] == 'systemd'
     - ensure_sudo is defined
   ansible.builtin.systemd:
     daemon_reload: 'yes'
-- name: 'ensure_sudo.service_restart'
+- name: ensure_sudo.service_restart
   when:
     - ansible_facts["system"] == 'Linux'
     - ensure_sudo is defined
@@ -21,9 +21,7 @@
   ansible.builtin.service:
     enabled: '{{ item.enabled }}'
     name: '{{ item.name }}'
-    state: 'restarted'
+    state: restarted
   loop: '{{ ensure_sudo.service_list }}'
   loop_control:
     label: '{{ item.name }} will be restarted'
-...
-

roles/ensure_sudo/meta/main.yml

@@ -1,3 +1,4 @@
+---
 galaxy_info:
   author: Jason Rothstein
   description: Ensure sudo configuration
@@ -15,7 +16,6 @@ galaxy_info:
   # - Apache-2.0
   # - CC-BY-4.0
   license: LGPL-3.0-or-later
-
   min_ansible_version: 2.9
 
   # If this a Container Enabled role, provide the minimum Ansible Container version.
@@ -38,7 +38,6 @@ galaxy_info:
   #   - 1.0
   #   - 7
   #   - 99.99
-
   galaxy_tags: []
     # List tags for your role here, one per line. A tag is a keyword that describes
     # and categorizes the role. Users find roles by searching for tags. Be sure to
@@ -46,8 +45,6 @@ galaxy_info:
     #
     # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
     #       Maximum 20 tags per role.
-
 dependencies: []
   # List your role dependencies here, one per line. Be sure to remove the '[]' above,
   # if you add dependencies to this list.
-  

roles/ensure_sudo/tasks/main.yml

@@ -1,35 +1,37 @@
 ---
 # tasks file for ensure_sudo
-- name: 'include vendor / version specific variables'
-  when:
-    - ansible_facts["system"] == 'Linux'
+- name: include vendor / version specific variables
+  when: ["ansible_facts[\"system\"] == 'Linux'"]
   ansible.builtin.include_vars:
     file: '{{ lookup("first_found", findme) }}'
-    name: 'ensure_sudo'
+    name: ensure_sudo
   vars:
     findme:
       files:
-        - '{{ ansible_facts["distribution"] }}-{{ ansible_facts["distribution_major_version"] }}-{{ ansible_facts["architecture"] }}.yml'
-        - '{{ ansible_facts["distribution"] }}-{{ ansible_facts["distribution_major_version"] }}-default.yml'
+        - '{{ ansible_facts["distribution"] }}-{{ ansible_facts["distribution_major_version"]
+          }}-{{ ansible_facts["architecture"] }}.yml'
+        - '{{ ansible_facts["distribution"] }}-{{ ansible_facts["distribution_major_version"]
+          }}-default.yml'
         - '{{ ansible_facts["distribution"] }}-default.yml'
-        - '{{ ansible_facts["os_family"] }}-{{ ansible_facts["distribution_major_version"] }}-{{ ansible_facts["architecture"] }}.yml'
-        - '{{ ansible_facts["os_family"] }}-{{ ansible_facts["distribution_major_version"] }}-default.yml'
+        - '{{ ansible_facts["os_family"] }}-{{ ansible_facts["distribution_major_version"]
+          }}-{{ ansible_facts["architecture"] }}.yml'
+        - '{{ ansible_facts["os_family"] }}-{{ ansible_facts["distribution_major_version"]
+          }}-default.yml'
         - '{{ ansible_facts["os_family"] }}-default.yml'
-        - 'default.yml'
-      paths:
-        - '../vars/'
-      errors: 'ignore'
-- name: 'package discovery'
+        - default.yml
+      paths: [../vars/]
+      errors: ignore
+- name: package discovery
   when:
     - ansible_facts["system"] == 'Linux'
     - ansible_facts["packages"] is not defined
   ansible.builtin.package_facts:
-- name: 'service discovery'
+- name: service discovery
   when:
     - ansible_facts["system"] == 'Linux'
     - ansible_facts["services"] is not defined
   ansible.builtin.service_facts:
-- name: 'ensure packages'
+- name: ensure packages
   when:
     - ansible_facts["system"] == 'Linux'
     - ensure_sudo is defined
@@ -41,10 +43,8 @@
   loop: '{{ ensure_sudo.package_list }}'
   loop_control:
     label: '{{ item.name }} will be {{ item.state }}'
-  notify:
-    - 'ensure_sudo.package_facts'
-    - 'ensure_sudo.service_facts'
-- name: 'ensure configurations'
+  notify: [ensure_sudo.package_facts, ensure_sudo.service_facts]
+- name: ensure configurations
   when:
     - ansible_facts["system"] == 'Linux'
     - ensure_sudo is defined
@@ -65,11 +65,11 @@
   loop_control:
     label: '{{ item.dest }} will be ensured'
   notify:
-    - 'ensure_sudo.package_facts'
-    - 'ensure_sudo.service_facts'
-    - 'ensure_sudo.service_reload'
-    - 'ensure_sudo.service_restart'
-- name: 'ensure services'
+    - ensure_sudo.package_facts
+    - ensure_sudo.service_facts
+    - ensure_sudo.service_reload
+    - ensure_sudo.service_restart
+- name: ensure services
   when:
     - ansible_facts["system"] == 'Linux'
     - ensure_sudo is defined
@@ -82,10 +82,8 @@
   loop: '{{ ensure_sudo.service_list }}'
   loop_control:
     label: '{{ item.name }} will be {{ item.state }}'
-  notify:
-    - 'ensure_sudo.package_facts'
-    - 'ensure_sudo.service_facts'
-- name: 'find directories over log retention window under /var/log/sudo-io'
+  notify: [ensure_sudo.package_facts, ensure_sudo.service_facts]
+- name: find directories over log retention window under /var/log/sudo-io
   when:
     - ansible_facts["system"] == 'Linux'
     - ensure_sudo is defined
@@ -93,13 +91,12 @@
     - sudo_log_retention is regex('^[0-9]*[smhdw]$')
   ansible.builtin.find:
     age: '{{ sudo_log_retention }}'
-    file_type: 'directory'
+    file_type: directory
     follow: 'no'
-    paths:
-      - '/var/log/sudo-io/'
+    paths: [/var/log/sudo-io/]
     recurse: 'yes'
-  register: 'ensure_sudo_results'
-- name: 'And drop them'
+  register: ensure_sudo_results
+- name: And drop them
   when:
     - ansible_facts["system"] == 'Linux'
     - ensure_sudo is defined
@@ -108,10 +105,9 @@
     - item.path is regex('^/var/log/sudo-io/([0-9]|[A-Z])([0-9]|[A-Z])/([0-9]|[A-Z])([0-9]|[A-Z])/([0-9]|[A-Z])([0-9]|[A-Z])$')
   ansible.builtin.file:
     path: '{{ item.path }}'
-    state: 'absent'
+    state: absent
   loop: '{{ ensure_sudo_results.files }}'
   loop_control:
     label: '{{ item.path }} to be removed'
-- name: 'flush handlers'
-  ansible.builtin.meta: 'flush_handlers'
-...
+- name: flush handlers
+  ansible.builtin.meta: flush_handlers

roles/ensure_sudo/tests/test.yml

@@ -1,5 +1,4 @@
 ---
 - hosts: localhost
   remote_user: root
-  roles:
-    - ensure_sudo
+  roles: [ensure_sudo]

roles/ensure_sudo/vars/AlmaLinux-10-default.yml

@@ -1,40 +1,44 @@
 ---
 # vars file for ensure_sudo
 package_list:
-  - name: 'libsss_sudo'
-    state: 'present'
-  - name: 'sudo'
-    state: 'present'
+  - name: libsss_sudo
+    state: present
+  - name: sudo
+    state: present
 template_list:
-  - dest: '/etc/dnf/protected.d/sudo.conf'
-    group: 'root'
+  - dest: /etc/dnf/protected.d/sudo.conf
+    group: root
     mode: '0644'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/dnf/protected.d/sudo.conf'
-  - dest: '/etc/pam.d/sudo'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/dnf/protected.d/sudo.conf'
+  - dest: /etc/pam.d/sudo
+    group: root
     mode: '0644'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/pam.d/sudo'
-  - dest: '/etc/pam.d/sudo-i'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/pam.d/sudo'
+  - dest: /etc/pam.d/sudo-i
+    group: root
     mode: '0644'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/pam.d/sudo-i'
-  - dest: '/etc/sudo.conf'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/pam.d/sudo-i'
+  - dest: /etc/sudo.conf
+    group: root
     mode: '0640'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/sudo.conf'
-  - dest: '/etc/sudoers'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/sudo.conf'
+  - dest: /etc/sudoers
+    group: root
     mode: '0440'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/sudoers'
-  - dest: '/etc/sudoers.d/session_log'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/sudoers'
+  - dest: /etc/sudoers.d/session_log
+    group: root
     mode: '0440'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/sudoers.d/session_log.j2'
-...
-
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/sudoers.d/session_log.j2'

roles/ensure_sudo/vars/AlmaLinux-9-default.yml

@@ -1,40 +1,44 @@
 ---
 # vars file for ensure_sudo
 package_list:
-  - name: 'libsss_sudo'
-    state: 'present'
-  - name: 'sudo'
-    state: 'present'
+  - name: libsss_sudo
+    state: present
+  - name: sudo
+    state: present
 template_list:
-  - dest: '/etc/dnf/protected.d/sudo.conf'
-    group: 'root'
+  - dest: /etc/dnf/protected.d/sudo.conf
+    group: root
     mode: '0644'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/dnf/protected.d/sudo.conf'
-  - dest: '/etc/pam.d/sudo'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/dnf/protected.d/sudo.conf'
+  - dest: /etc/pam.d/sudo
+    group: root
     mode: '0644'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/pam.d/sudo'
-  - dest: '/etc/pam.d/sudo-i'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/pam.d/sudo'
+  - dest: /etc/pam.d/sudo-i
+    group: root
     mode: '0644'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/pam.d/sudo-i'
-  - dest: '/etc/sudo.conf'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/pam.d/sudo-i'
+  - dest: /etc/sudo.conf
+    group: root
     mode: '0640'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/sudo.conf'
-  - dest: '/etc/sudoers'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/sudo.conf'
+  - dest: /etc/sudoers
+    group: root
     mode: '0440'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/sudoers'
-  - dest: '/etc/sudoers.d/session_log'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/sudoers'
+  - dest: /etc/sudoers.d/session_log
+    group: root
     mode: '0440'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/sudoers.d/session_log.j2'
-...
-
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/sudoers.d/session_log.j2'

roles/ensure_sudo/vars/CentOS-10-default.yml

@@ -1,40 +1,44 @@
 ---
 # vars file for ensure_sudo
 package_list:
-  - name: 'libsss_sudo'
-    state: 'present'
-  - name: 'sudo'
-    state: 'present'
+  - name: libsss_sudo
+    state: present
+  - name: sudo
+    state: present
 template_list:
-  - dest: '/etc/dnf/protected.d/sudo.conf'
-    group: 'root'
+  - dest: /etc/dnf/protected.d/sudo.conf
+    group: root
     mode: '0644'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/dnf/protected.d/sudo.conf'
-  - dest: '/etc/pam.d/sudo'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/dnf/protected.d/sudo.conf'
+  - dest: /etc/pam.d/sudo
+    group: root
     mode: '0644'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/pam.d/sudo'
-  - dest: '/etc/pam.d/sudo-i'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/pam.d/sudo'
+  - dest: /etc/pam.d/sudo-i
+    group: root
     mode: '0644'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/pam.d/sudo-i'
-  - dest: '/etc/sudo.conf'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/pam.d/sudo-i'
+  - dest: /etc/sudo.conf
+    group: root
     mode: '0640'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/sudo.conf'
-  - dest: '/etc/sudoers'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/sudo.conf'
+  - dest: /etc/sudoers
+    group: root
     mode: '0440'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/sudoers'
-  - dest: '/etc/sudoers.d/session_log'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/sudoers'
+  - dest: /etc/sudoers.d/session_log
+    group: root
     mode: '0440'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/sudoers.d/session_log.j2'
-...
-
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/sudoers.d/session_log.j2'

roles/ensure_sudo/vars/CentOS-9-default.yml

@@ -1,40 +1,44 @@
 ---
 # vars file for ensure_sudo
 package_list:
-  - name: 'libsss_sudo'
-    state: 'present'
-  - name: 'sudo'
-    state: 'present'
+  - name: libsss_sudo
+    state: present
+  - name: sudo
+    state: present
 template_list:
-  - dest: '/etc/dnf/protected.d/sudo.conf'
-    group: 'root'
+  - dest: /etc/dnf/protected.d/sudo.conf
+    group: root
     mode: '0644'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/dnf/protected.d/sudo.conf'
-  - dest: '/etc/pam.d/sudo'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/dnf/protected.d/sudo.conf'
+  - dest: /etc/pam.d/sudo
+    group: root
     mode: '0644'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/pam.d/sudo'
-  - dest: '/etc/pam.d/sudo-i'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/pam.d/sudo'
+  - dest: /etc/pam.d/sudo-i
+    group: root
     mode: '0644'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/pam.d/sudo-i'
-  - dest: '/etc/sudo.conf'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/pam.d/sudo-i'
+  - dest: /etc/sudo.conf
+    group: root
     mode: '0640'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/sudo.conf'
-  - dest: '/etc/sudoers'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/sudo.conf'
+  - dest: /etc/sudoers
+    group: root
     mode: '0440'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/sudoers'
-  - dest: '/etc/sudoers.d/session_log'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/sudoers'
+  - dest: /etc/sudoers.d/session_log
+    group: root
     mode: '0440'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/sudoers.d/session_log.j2'
-...
-
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/sudoers.d/session_log.j2'

roles/ensure_sudo/vars/Fedora-42-default.yml

@@ -1,40 +1,44 @@
 ---
 # vars file for ensure_sudo
 package_list:
-  - name: 'libsss_sudo'
-    state: 'present'
-  - name: 'sudo'
-    state: 'present'
+  - name: libsss_sudo
+    state: present
+  - name: sudo
+    state: present
 template_list:
-  - dest: '/etc/dnf/protected.d/sudo.conf'
-    group: 'root'
+  - dest: /etc/dnf/protected.d/sudo.conf
+    group: root
     mode: '0644'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/dnf/protected.d/sudo.conf'
-  - dest: '/etc/pam.d/sudo'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/dnf/protected.d/sudo.conf'
+  - dest: /etc/pam.d/sudo
+    group: root
     mode: '0644'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/pam.d/sudo'
-  - dest: '/etc/pam.d/sudo-i'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/pam.d/sudo'
+  - dest: /etc/pam.d/sudo-i
+    group: root
     mode: '0644'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/pam.d/sudo-i'
-  - dest: '/etc/sudo.conf'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/pam.d/sudo-i'
+  - dest: /etc/sudo.conf
+    group: root
     mode: '0640'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/sudo.conf'
-  - dest: '/etc/sudoers'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/sudo.conf'
+  - dest: /etc/sudoers
+    group: root
     mode: '0440'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/sudoers'
-  - dest: '/etc/sudoers.d/session_log'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/sudoers'
+  - dest: /etc/sudoers.d/session_log
+    group: root
     mode: '0440'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/sudoers.d/session_log.j2'
-...
-
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/sudoers.d/session_log.j2'

roles/ensure_sudo/vars/Fedora-43-default.yml

@@ -1,40 +1,44 @@
 ---
 # vars file for ensure_sudo
 package_list:
-  - name: 'libsss_sudo'
-    state: 'present'
-  - name: 'sudo'
-    state: 'present'
+  - name: libsss_sudo
+    state: present
+  - name: sudo
+    state: present
 template_list:
-  - dest: '/etc/dnf/protected.d/sudo.conf'
-    group: 'root'
+  - dest: /etc/dnf/protected.d/sudo.conf
+    group: root
     mode: '0644'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/dnf/protected.d/sudo.conf'
-  - dest: '/etc/pam.d/sudo'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/dnf/protected.d/sudo.conf'
+  - dest: /etc/pam.d/sudo
+    group: root
     mode: '0644'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/pam.d/sudo'
-  - dest: '/etc/pam.d/sudo-i'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/pam.d/sudo'
+  - dest: /etc/pam.d/sudo-i
+    group: root
     mode: '0644'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/pam.d/sudo-i'
-  - dest: '/etc/sudo.conf'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/pam.d/sudo-i'
+  - dest: /etc/sudo.conf
+    group: root
     mode: '0640'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/sudo.conf'
-  - dest: '/etc/sudoers'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/sudo.conf'
+  - dest: /etc/sudoers
+    group: root
     mode: '0440'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/sudoers'
-  - dest: '/etc/sudoers.d/session_log'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/sudoers'
+  - dest: /etc/sudoers.d/session_log
+    group: root
     mode: '0440'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/sudoers.d/session_log.j2'
-...
-
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/sudoers.d/session_log.j2'

roles/ensure_sudo/vars/Fedora-44-default.yml

@@ -1,40 +1,44 @@
 ---
 # vars file for ensure_sudo
 package_list:
-  - name: 'libsss_sudo'
-    state: 'present'
-  - name: 'sudo'
-    state: 'present'
+  - name: libsss_sudo
+    state: present
+  - name: sudo
+    state: present
 template_list:
-  - dest: '/etc/dnf/protected.d/sudo.conf'
-    group: 'root'
+  - dest: /etc/dnf/protected.d/sudo.conf
+    group: root
     mode: '0644'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/dnf/protected.d/sudo.conf'
-  - dest: '/etc/pam.d/sudo'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/dnf/protected.d/sudo.conf'
+  - dest: /etc/pam.d/sudo
+    group: root
     mode: '0644'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/pam.d/sudo'
-  - dest: '/etc/pam.d/sudo-i'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/pam.d/sudo'
+  - dest: /etc/pam.d/sudo-i
+    group: root
     mode: '0644'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/pam.d/sudo-i'
-  - dest: '/etc/sudo.conf'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/pam.d/sudo-i'
+  - dest: /etc/sudo.conf
+    group: root
     mode: '0640'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/sudo.conf'
-  - dest: '/etc/sudoers'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/sudo.conf'
+  - dest: /etc/sudoers
+    group: root
     mode: '0440'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/sudoers'
-  - dest: '/etc/sudoers.d/session_log'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/sudoers'
+  - dest: /etc/sudoers.d/session_log
+    group: root
     mode: '0440'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/sudoers.d/session_log.j2'
-...
-
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/sudoers.d/session_log.j2'

roles/ensure_sudo/vars/OracleLinux-10-default.yml

@@ -1,40 +1,44 @@
 ---
 # vars file for ensure_sudo
 package_list:
-  - name: 'libsss_sudo'
-    state: 'present'
-  - name: 'sudo'
-    state: 'present'
+  - name: libsss_sudo
+    state: present
+  - name: sudo
+    state: present
 template_list:
-  - dest: '/etc/dnf/protected.d/sudo.conf'
-    group: 'root'
+  - dest: /etc/dnf/protected.d/sudo.conf
+    group: root
     mode: '0644'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/dnf/protected.d/sudo.conf'
-  - dest: '/etc/pam.d/sudo'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/dnf/protected.d/sudo.conf'
+  - dest: /etc/pam.d/sudo
+    group: root
     mode: '0644'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/pam.d/sudo'
-  - dest: '/etc/pam.d/sudo-i'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/pam.d/sudo'
+  - dest: /etc/pam.d/sudo-i
+    group: root
     mode: '0644'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/pam.d/sudo-i'
-  - dest: '/etc/sudo.conf'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/pam.d/sudo-i'
+  - dest: /etc/sudo.conf
+    group: root
     mode: '0640'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/sudo.conf'
-  - dest: '/etc/sudoers'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/sudo.conf'
+  - dest: /etc/sudoers
+    group: root
     mode: '0440'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/sudoers'
-  - dest: '/etc/sudoers.d/session_log'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/sudoers'
+  - dest: /etc/sudoers.d/session_log
+    group: root
     mode: '0440'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/sudoers.d/session_log.j2'
-...
-
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/sudoers.d/session_log.j2'

roles/ensure_sudo/vars/OracleLinux-9-default.yml

@@ -1,40 +1,44 @@
 ---
 # vars file for ensure_sudo
 package_list:
-  - name: 'libsss_sudo'
-    state: 'present'
-  - name: 'sudo'
-    state: 'present'
+  - name: libsss_sudo
+    state: present
+  - name: sudo
+    state: present
 template_list:
-  - dest: '/etc/dnf/protected.d/sudo.conf'
-    group: 'root'
+  - dest: /etc/dnf/protected.d/sudo.conf
+    group: root
     mode: '0644'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/dnf/protected.d/sudo.conf'
-  - dest: '/etc/pam.d/sudo'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/dnf/protected.d/sudo.conf'
+  - dest: /etc/pam.d/sudo
+    group: root
     mode: '0644'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/pam.d/sudo'
-  - dest: '/etc/pam.d/sudo-i'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/pam.d/sudo'
+  - dest: /etc/pam.d/sudo-i
+    group: root
     mode: '0644'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/pam.d/sudo-i'
-  - dest: '/etc/sudo.conf'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/pam.d/sudo-i'
+  - dest: /etc/sudo.conf
+    group: root
     mode: '0640'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/sudo.conf'
-  - dest: '/etc/sudoers'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/sudo.conf'
+  - dest: /etc/sudoers
+    group: root
     mode: '0440'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/sudoers'
-  - dest: '/etc/sudoers.d/session_log'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/sudoers'
+  - dest: /etc/sudoers.d/session_log
+    group: root
     mode: '0440'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/sudoers.d/session_log.j2'
-...
-
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/sudoers.d/session_log.j2'

roles/ensure_sudo/vars/Rocky-10-default.yml

@@ -1,40 +1,44 @@
 ---
 # vars file for ensure_sudo
 package_list:
-  - name: 'libsss_sudo'
-    state: 'present'
-  - name: 'sudo'
-    state: 'present'
+  - name: libsss_sudo
+    state: present
+  - name: sudo
+    state: present
 template_list:
-  - dest: '/etc/dnf/protected.d/sudo.conf'
-    group: 'root'
+  - dest: /etc/dnf/protected.d/sudo.conf
+    group: root
     mode: '0644'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/dnf/protected.d/sudo.conf'
-  - dest: '/etc/pam.d/sudo'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/dnf/protected.d/sudo.conf'
+  - dest: /etc/pam.d/sudo
+    group: root
     mode: '0644'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/pam.d/sudo'
-  - dest: '/etc/pam.d/sudo-i'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/pam.d/sudo'
+  - dest: /etc/pam.d/sudo-i
+    group: root
     mode: '0644'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/pam.d/sudo-i'
-  - dest: '/etc/sudo.conf'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/pam.d/sudo-i'
+  - dest: /etc/sudo.conf
+    group: root
     mode: '0640'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/sudo.conf'
-  - dest: '/etc/sudoers'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/sudo.conf'
+  - dest: /etc/sudoers
+    group: root
     mode: '0440'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/sudoers'
-  - dest: '/etc/sudoers.d/session_log'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/sudoers'
+  - dest: /etc/sudoers.d/session_log
+    group: root
     mode: '0440'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/sudoers.d/session_log.j2'
-...
-
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/sudoers.d/session_log.j2'

roles/ensure_sudo/vars/Rocky-9-default.yml

@@ -1,40 +1,44 @@
 ---
 # vars file for ensure_sudo
 package_list:
-  - name: 'libsss_sudo'
-    state: 'present'
-  - name: 'sudo'
-    state: 'present'
+  - name: libsss_sudo
+    state: present
+  - name: sudo
+    state: present
 template_list:
-  - dest: '/etc/dnf/protected.d/sudo.conf'
-    group: 'root'
+  - dest: /etc/dnf/protected.d/sudo.conf
+    group: root
     mode: '0644'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/dnf/protected.d/sudo.conf'
-  - dest: '/etc/pam.d/sudo'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/dnf/protected.d/sudo.conf'
+  - dest: /etc/pam.d/sudo
+    group: root
     mode: '0644'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/pam.d/sudo'
-  - dest: '/etc/pam.d/sudo-i'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/pam.d/sudo'
+  - dest: /etc/pam.d/sudo-i
+    group: root
     mode: '0644'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/pam.d/sudo-i'
-  - dest: '/etc/sudo.conf'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/pam.d/sudo-i'
+  - dest: /etc/sudo.conf
+    group: root
     mode: '0640'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/sudo.conf'
-  - dest: '/etc/sudoers'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/sudo.conf'
+  - dest: /etc/sudoers
+    group: root
     mode: '0440'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/sudoers'
-  - dest: '/etc/sudoers.d/session_log'
-    group: 'root'
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/sudoers'
+  - dest: /etc/sudoers.d/session_log
+    group: root
     mode: '0440'
-    owner: 'root'
-    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/sudoers.d/session_log.j2'
-...
-
+    owner: root
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/sudoers.d/session_log.j2'

roles/ensure_sudo/vars/default.yml

@@ -1,2 +1,2 @@
 ---
-# vars file for ensure_sudo
+...

roles/ensure_sudo/vars/main.yml

@@ -1,2 +1,2 @@
 ---
-# vars file for ensure_sudo
+...