Roles only run on intended supported OS, and minor cleanup of when statements to match

.editorconfig

@@ -0,0 +1,109 @@
+# EditorConfig Specification: https://EditorConfig.org
+root = true
+
+# Universal Defaults
+[*]
+charset = utf-8
+end_of_line = lf
+indent_size = 2
+indent_style = space
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+# Markdown & Documentation
+[*.md]
+trim_trailing_whitespace = false
+
+# Ansible & YAML Configuration
+[*.{yml,yaml}]
+indent_size = 2
+indent_style = space
+
+# Infrastructure as Code (OpenTofu / Terraform)
+[*.{tf,tfvars,tofu}]
+indent_size = 2
+indent_style = space
+
+# JSON Data Files
+[*.json]
+indent_size = 2
+indent_style = space
+
+# Rust (Rust standard mandates 4 spaces)
+[*.rs]
+indent_size = 4
+indent_style = space
+
+# Python
+[*.py]
+indent_size = 4
+indent_style = space
+
+# Perl
+[*.{pl,pm,t,pod}]
+indent_size = 4
+indent_style = space
+
+# Systems Programming (C, C++, Headers, eBPF)
+[*.{c,cc,cpp,cxx,h,hh,hpp,hxx,bpf.c,bpf.h}]
+indent_size = 4
+indent_style = space
+
+# Low-Level Assembly (x86_64, aarch64, riscv, Linker Scripts)
+[*.{s,S,asm,ld,lds}]
+indent_style = tab
+indent_size = 8
+
+# Device Tree (Linux Kernel Hardware Trees)
+[*.{dts,dtsi}]
+indent_style = tab
+indent_size = 8
+
+# Parser & Lexer Grammars (Bison / Flex / Yacc)
+[*.{y,l,yy,ll}]
+indent_style = tab
+indent_size = 8
+
+# Linux Kernel Kconfig / Kbuild
+[{Kconfig*,Kbuild*,*.kconfig}]
+indent_style = tab
+indent_size = 8
+
+# Makefiles & Build Systems (Hard tabs mandated by spec)
+[{Makefile*,*.mk}]
+indent_style = tab
+
+# AWK & Sed Scripts
+[*.{awk,sed}]
+indent_size = 4
+indent_style = space
+
+# Java
+[*.java]
+indent_size = 4
+indent_style = space
+
+# Go (Golang standard enforces hardware tabs)
+[*.go]
+indent_style = tab
+indent_size = 4
+
+# PHP
+[*.php]
+indent_size = 4
+indent_style = space
+
+# UNIX / POSIX Shells (Bash, Sh, Ksh, Csh, Tcsh, Zsh)
+[*.{sh,bash,ksh,csh,tcsh,zsh}]
+indent_size = 2
+indent_style = space
+
+# Windows PowerShell & Batch Scripts
+[*.{ps1,psm1,psd1}]
+indent_size = 4
+indent_style = space
+
+[*.{bat,cmd}]
+end_of_line = crlf
+indent_size = 2
+indent_style = space

AGENTS.md

@@ -0,0 +1,556 @@
+# AGENTS.md
+
+> ### Normative Requirement Levels (RFC 2119 / RFC 8174)
+> The key words **MUST**, **MUST NOT**, **REQUIRED**, **SHALL**, **SHALL NOT**, **SHOULD**, **SHOULD NOT**, **RECOMMENDED**, **NOT RECOMMENDED**, **MAY**, and **OPTIONAL** in this document are to be interpreted as described in [BCP 14](https://www.rfc-editor.org/info/bcp14) ([RFC 2119](https://www.rfc-editor.org/rfc/rfc2119.txt) and [RFC 8174](https://www.rfc-editor.org/rfc/rfc8174.txt)) when, and only when, they appear in all capitals, as shown here.
+
+### Governance Hierarchy & Precedence
+1. **Federal Mandates & Core Security Controls** (`AGENTS.md` Sections 1–4, 13, 16–20) take ultimate precedence over all other guidelines.
+2. **Technical & Architectural Standards** (`AGENTS.md`) take precedence over stylistic preferences (`STYLE.md`).
+3. **Correctness > Performance > Cost > Style**: Formatting or performance optimizations MUST NOT compromise compliance, idempotency, or operational resilience.
+
+## 1. Security & Compliance Baselines
+
+1. **Compliance by Default & Framework Hierarchy**: All architectural designs, system configurations, and automated implementations MUST strictly adhere to established security and compliance frameworks in the following priority order:
+   - **Federal & Legal Mandates**:
+     - NDAA Section 889 and TAA (Trade Agreements Act) compliance for all underlying hardware, appliances, cloud regions, and firmware.
+     - Executive Order 14028 (Improving the Nation's Cybersecurity) and OMB M-22-18 / M-23-16 software supply chain mandates.
+   - **Core Security Frameworks & NIST Special Publications**:
+     - Master Catalog: **NIST SP 800-53 (Rev. 5)** (Security and Privacy Controls).
+     - Domain-Specific NIST Companion Standards (Triggered and enforced whenever the respective technology domain is utilized):
+       - *Containers & Virtualization*: **NIST SP 800-190** (Application Container Security) & **SP 800-125A/B**.
+       - *Microservices & Service Mesh*: **NIST SP 800-204 (A/B/C)** (Microservices Architecture, Service Mesh & API Gateways).
+       - *Zero Trust Architecture*: **NIST SP 800-207** (Zero Trust Architecture).
+       - *Software Development Lifecycle*: **NIST SP 800-218** (Secure Software Development Framework - SSDF).
+       - *Supply Chain Security*: **NIST SP 800-161 (Rev. 1)** (Cybersecurity Supply Chain Risk Management).
+       - *Digital Identity & Cloud Access*: **NIST SP 800-63-3/4** (Digital Identity) & **SP 800-210** (Cloud Access Control).
+       - *Configuration & Patching*: **NIST SP 800-128** (Configuration Management) & **SP 800-40 (Rev. 4)** (Patch Management).
+       - *Log Management & Telemetry*: **NIST SP 800-92** (Log Management) & **SP 800-137** (Continuous Monitoring).
+       - *Controlled Unclassified Information*: **NIST SP 800-171 / SP 800-172** (Protecting CUI).
+       - *Media Sanitization*: **NIST SP 800-88 (Rev. 1)** (Media Sanitization).
+   - **Technical Hardening Baselines & Agency Guides**:
+     - DISA STIGs and CIS Benchmarks (Level 2 where applicable, Level 1 minimum).
+     - NSA/CISA Technical Hardening Guides (Kubernetes, Network Infrastructure, IAM).
+     - FedRAMP High / DoD Cloud Computing Security Requirements Guide (DoD CC SRG IL4/IL5/IL6).
+   - **Industry Regulatory Standards**:
+     - PCI-DSS, HIPAA Security Rule, and ISO/IEC 27001/27002 where domain requirements apply.
+2. **Evaluation Hierarchy**: Correctness and compliance MUST supersede performance optimizations; performance MUST supersede cost considerations (`Correctness > Performance > Cost`). Factory defaults must not be assumed secure; explicitly configure baseline security controls.
+
+## 2. Supply Chain Integrity & Licensing Policy
+
+1. **Supply Chain Security & Provenance**:
+   - All third-party packages, libraries, collections, and containers MUST adhere to SLSA (Supply-chain Levels for Software Artifacts) Level 3+ and OpenSSF Best Practices.
+   - Cryptographic verification (checksums, GPG signatures, or Sigstore/Cosign provenance) MUST be explicitly defined and verified before installing or executing any artifact.
+   - Dependencies MUST use pinned versions or immutable digests (e.g., SHA-256 commit hashes or container image digests) rather than mutable tags (e.g., `latest`, `main`).
+2. **Explicit Licensing Governance Matrix**:
+   - **Tier 1 (Pre-Approved Permissive & Copyleft)**:
+     - Permissive: MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, CC0-1.0.
+     - Weak/File-Level Copyleft: MPL-2.0, LGPLv3 (when linked dynamically).
+     - Strong Copyleft (Standalone Applications / System Utilities): GPLv3, AGPLv3 (prohibited as statically linked library dependencies in proprietary applications; approved for standalone infrastructure tools/services).
+   - **Tier 2 (Conditional / Requires Human Architectural Review)**:
+     - EPL-2.0, EUPL-1.2, or proprietary commercial vendor licenses with explicit contractual coverage.
+   - **Tier 3 (Strictly Prohibited / Banned)**:
+     - **ZFS / OpenZFS / CDDL-1.0 Kernel Modules**: ZFS is PERMANENTLY PROHIBITED under any circumstance due to:
+       1. *Licensing Incompatibility*: Rooted in unmaintained CDDL-1.0 from OpenSolaris, creating fundamental legal incompatibility with the GPLv2 Linux kernel.
+       2. *Hardware & Memory Overhead*: Mandates an excessive baseline of 4GB+ ECC RAM merely to import and mount pools (ARC/slab memory starvation).
+       3. *DKMS Fragility*: Out-of-tree DKMS module compilation breaks repeatedly during kernel updates on enterprise distributions (RHEL/Fedora).
+       4. *On-Disk Divergence & Data Recovery Impossibility*: OpenZFS shares only the name with Oracle Solaris 11 ZFS, possessing completely diverged on-disk structures. In catastrophic corruption events, third-party forensic recovery services cannot salvage corrupted encrypted pools, resulting in permanent unrecoverable data loss.
+       - Storage architectures MUST strictly utilize native in-tree Linux filesystems and volume managers (XFS, Ext4, LVM2, dm-crypt/LUKS, dm-snapshot, Btrfs, or Ceph).
+     - Source-available non-OSI licenses that restrict commercial, hosted, or competitive use: BSL (Business Source License), SSPL (Server Side Public License), Elastic License, Commons Clause, Confluent Community License, Redis Source Available License (RSAL), HashiCorp BSL.
+     - Unlicensed, "All Rights Reserved" code with no grant, or "free for non-commercial use only" restrictions.
+   - Any dependency falling into Tier 3 MUST NOT be introduced, referenced, or recommended under any circumstance.
+3. **Language-Specific Package (Pip, NPM, Cargo) Supply Chain Controls**:
+   - Direct installation of language packages from public registries (e.g., `pip install` from PyPI, `npm install` from npmjs) directly onto target servers is STRICTLY PROHIBITED.
+   - All language-specific modules and dependencies MUST be:
+     1. Built into native cryptographically signed OS packages (RPM/DEB) via internal build pipelines; OR
+     2. Sourced from an authenticated, internal artifact repository (e.g., private mirror/wheelhouse) containing locked dependency manifests (`requirements.txt` with SHA-256 hashes, `Pipfile.lock`, `poetry.lock`) that have passed static analysis, SBOM generation, and CVE scanning.
+4. **OS Package vs. Standalone Binary Installation Governance**:
+   - **OS Packages (RPM/DEB via Cryptographically Signed Repositories)**: Component installation MUST use `state: present` (or parameterized release tags). Automated security patch application is governed centrally by dedicated patch management roles (`ensure_os_patch` / `ensure_os_upgrade`) tracking official vendor errata.
+   - **Standalone Binaries, Tarballs & Containers**: MUST enforce exact version pinning and cryptographic SHA-256 digest validation.
+
+## 3. Prerequisite Verification & System Preconditions
+
+1. **Explicit Precondition Validation**:
+   - Systems, playbooks, scripts, and modules MUST NEVER assume prerequisites exist (e.g., specific OS release, kernel capabilities, architecture, network routes, package managers, user permissions, or installed binaries).
+   - Every execution sequence MUST explicitly test and validate required preconditions before initiating state changes.
+2. **Fail-Fast with Actionable Diagnostics**:
+   - If an environmental or technical prerequisite is missing or unsupported, execution MUST fail immediately with an explicit, structured error message identifying the missing requirement, expected vs. observed state, and remediation steps.
+   - Do NOT attempt destructive fallback workarounds (e.g., blindly forcing installation on unsupported OS releases or bypassing failed signature checks).
+
+## 4. State Management: Least Change & Complete Enforcement
+
+1. **Principle of Least Change**:
+   - Modifications MUST represent the minimal necessary delta from factory/upstream defaults required to satisfy security baselines, compliance rules, and operational requirements.
+   - Do NOT rewrite or override stock configurations entirely when targeted configuration directives (e.g., `.d` drop-in directories, specific key-value updates) achieve the desired outcome.
+2. **Complete Desired State Enforcement & Idempotency**:
+   - Every automation task and configuration management unit MUST achieve a complete, deterministic, and idempotent desired state.
+   - Partial or unmanaged states (e.g., leaving orphaned temporary files, unmanaged legacy configuration entries, or unverified service restarts) are prohibited.
+   - Repeated executions against an already compliant system MUST result in zero changes (no state drift, no unnecessary restarts or side effects).
+
+## 5. Architectural Decoupling: Code and Data Separation
+
+1. **Strict Decoupling of Logic and Configuration**:
+   - Execution logic (code, playbooks, task lists, scripts) MUST be completely decoupled from platform-specific and environment-specific data (variables, package names, service handles, filesystem paths, OS parameters).
+   - Execution flows MUST remain generic, deterministic, and consistent across target environments, with variance driven exclusively by loaded structured data.
+2. **Platform & Architecture Resolution Matrix**:
+   - Platform differences (OS distribution, major/minor version, CPU architecture) MUST be resolved via explicit data lookup tables or structured variable files rather than nested procedural conditionals (`if/else` or sprawling `when:` chains) inside task definitions.
+   - **Dynamic OS Task & Pre-Task Dispatching Hierarchy**:
+     - Where platforms share 90% common tasks but require vendor-specific adjustments (e.g., Debian cdrom cleanup in `sources.list`, Red Hat subscription registration), roles MUST use dynamic `first_found` pre-task inclusion:
+       `include_tasks: '{{ lookup("first_found", findme) }}'` searching `{{ distribution }}-{{ major_version }}-{{ arch }}.yml` -> `{{ os_family }}-default.yml` -> `default.yml`.
+     - Where platforms require completely distinct execution modules (e.g., Linux vs. Windows 11 Pro PowerShell/WinRM), roles MUST dispatch to dedicated OS family task entrypoints (`tasks/Linux.yml`, `tasks/Windows.yml`).
+   - All hardcoded magic strings, static system paths, and embedded constants within execution blocks are strictly prohibited.
+
+## 6. Multi-Domain Technical Review & Clarification Protocol
+
+1. **Panel of Experts Evaluation**:
+   - Complex architectural and implementation decisions MUST be evaluated across key technical disciplines: Security & Compliance SME, Systems/OS Architecture SME, Network/Infrastructure SME, and Site Reliability/Operations SME.
+   - Trade-offs MUST be explicitly analyzed through this multi-perspective lens, ensuring no single dimension (e.g., raw execution speed or developer convenience) compromises security, maintainability, or operational resilience.
+2. **Mandatory Ambiguity Clarification**:
+   - When encountering underspecified requirements, conflicting constraints, or unknown target environment baselines, agents MUST pause and request specific clarification and background context from human engineers.
+   - Speculative implementation based on unverified assumptions is strictly prohibited.
+
+## 7. Incremental Foundations & Evolutionary Architecture
+
+1. **Foundational Pragmatism**:
+   - Technical solutions MUST prioritize robust, verifiable, and working foundations for current operational requirements before attempting large-scale speculative abstractions.
+   - Brittle workarounds or temporary "quick hacks" that accumulate technical debt are prohibited; initial implementations must establish clean, extensible patterns.
+2. **Designed for Incremental Evolution**:
+   - All modules, roles, and architectural layers MUST be designed with modularity to support continuous, incremental refinement and scaling over time.
+   - Future architectural scaling must build upon and extend verified foundations rather than requiring destructive, rip-and-replace refactors.
+
+## 8. Ansible Technical Standards & Role Architecture
+
+1. **Standardized Role Naming & Scoping**:
+   - Roles MUST follow the naming convention `ensure_XXX`, where `XXX` represents the specific package, service, or system capability being managed (e.g., `ensure_sshd`, `ensure_chrony`, `ensure_firewalld`).
+   - Each role MUST be single-purpose, cohesive, and completely manage the lifecycle of its target component.
+2. **Deterministic Task Execution Order**:
+   - Role task execution MUST follow a standardized lifecycle order across all roles:
+     1. **Prerequisite & Fact Validation**: Assert supported OS, architecture, kernel, and dependencies.
+     2. **Data Loading**: Load platform-specific variables dynamically based on OS vendor, version, and architecture.
+     3. **Installation**: Install or remove packages, binaries, and repositories with cryptographic verification.
+     4. **Configuration**: Apply configuration files, drop-in directories, and permissions (least privilege).
+     5. **Service Management**: Enable, start, or manage daemon state and register notifications/handlers.
+     6. **Post-Validation / Health Verification**: Execute end-state verification to prove correct operational state.
+3. **Platform Data Resolution Hierarchy**:
+   - Platform-specific variables MUST reside in `vars/` and follow a deterministic naming schema based on OS Vendor, OS Major Version, and Architecture (e.g., `vars/{{ ansible_distribution }}_{{ ansible_distribution_major_version }}_{{ ansible_architecture }}.yml`).
+   - Tasks MUST NOT embed OS-specific branching logic (`when: ansible_os_family == '...'`) for package names, service names, or configuration paths.
+4. **Templates and Static Files Directory Hierarchy**:
+   - Templates MUST be organized reflecting target OS distribution, major version, and target filesystem path:
+     `templates/{{ ansible_distribution }}/{{ ansible_distribution_major_version }}/${PATH_ON_DISK}/${FILENAME}` (e.g., `templates/RedHat/9/etc/ssh/sshd_config.j2`).
+   - Static files and binaries (copied with overwrite enforcement) MUST follow the exact same structural hierarchy:
+     `files/{{ ansible_distribution }}/{{ ansible_distribution_major_version }}/${PATH_ON_DISK}/${FILENAME}` (e.g., `files/Ubuntu/22/usr/local/bin/custom_daemon`).
+5. **Role Dependency & Feature Composition**:
+   - When a service or role requires a prerequisite system feature, subsystem, or daemon (e.g., a firewall port, a system user, a logging pipeline, or TLS certificates), it MUST declare and depend on the existing `ensure_YYY` role responsible for that feature.
+   - Roles MUST NEVER duplicate configuration logic, package installations, or state mutations managed by another role.
+6. **Fleet Scale-Up Maturity & Multi-Node Topology Governance**:
+   - **Scale-Dependent Architectural Progression**: Systems MUST adopt the architectural pattern appropriate to their deployment scale:
+     - **Tier 1 (< 100 nodes)**: Direct sequential play ordering within standard playbooks.
+     - **Tier 2 (100 – 1,000 nodes)**: Decoupled service contracts using non-blocking readiness probes (`wait_for`, endpoint socket polling) before binding cross-node services.
+     - **Tier 3 (1,000 – 10,000 nodes)**: Workflow DAG orchestration (AWX/AAP/CI) operating on isolated tenant inventory slices (`--limit`) with dynamic service discovery (DNS, Consul, Vault).
+     - **Tier 4 (> 10,000 nodes)**: Bifurcated architecture:
+       a. Fleet-wide drift management via staggered pull-based reconciliation (`ansible-pull` or local daemon).
+       b. New tenant/host provisioning orchestrated via central workflow pipelines.
+   - **Cross-Node Readiness Contracts**: When a service depends on an external service residing on a distinct host (e.g., Web -> DB), the consumer role MUST execute an active readiness assertion against the target endpoint with an explicit timeout. Consumers MUST NOT assume external dependencies exist merely because a prior play completed.
+
+## 9. Shift-Left Validation & Universal Fail-Fast Hierarchy
+
+1. **Shift-Left Failure Hierarchy (All Languages & Frameworks)**:
+   - Validation MUST occur at the earliest possible stage in the development and execution lifecycle:
+     1. **Static Analysis & Schema Validation (Shift-Left Tier 1)**: Any syntax, type constraint, linting rule, security policy (e.g., Open Policy Agent, Checkov, yamllint, ansible-lint), or structural requirement MUST fail during static analysis before code execution or pipeline progression.
+     2. **Preflight Runtime Assertion (Shift-Left Tier 2)**: Environmental requirements, dynamic facts, and input variables MUST be asserted at the very first step of execution before any mutation or side-effect occurs.
+     3. **Atomic Execution Failure (Shift-Left Tier 3)**: Operations MUST fail immediately upon encountering an unexpected state, refusing to proceed with partial, corrupt, or unverified changes.
+2. **Actionable Diagnostic Requirement**:
+   - All validation failures (static or runtime) MUST produce clear, structured diagnostics stating: the failed constraint, observed vs. expected value, and the explicit remediation step.
+
+## 10. Deployment Lifecycle, Health Gateways & Rollback Resilience
+
+1. **Pre-Change Health & Baseline Validation**:
+   - Prior to applying any configuration, infrastructure, or code change, the execution sequence MUST validate that the target environment and dependent services are in a healthy, operational baseline state.
+   - Pre-change checks MUST be adapted to the specific component being deployed (e.g., verifying database connectivity, checking existing daemon health, validating DNS/network routing, verifying available disk/memory thresholds).
+   - If the pre-change health state fails, deployment MUST halt immediately before mutating any state.
+2. **Post-Change Operational & Functional Verification**:
+   - Deployment sequences MUST NOT consider a change successful merely because an installer or configuration module exited with status code zero.
+   - Every deployment MUST execute active functional verification against the resulting state:
+     - The process/service is active and enabled.
+     - Sockets and network endpoints are listening and accepting connections.
+     - Application-level synthetic transaction succeeds (e.g., for a web service: HTTP 200 OK with expected payload content, zero 5xx/4xx error pages; for a database: successful query execution).
+   - If post-change verification fails, execution MUST fail fast with detailed operational telemetry.
+3. **Reversibility & Non-Destructive Failure**:
+   - Deployments MUST be engineered to be non-destructive to prior working states.
+   - If a new deployment fails during application or post-verification, the system MUST not leave services in a degraded or corrupted state; atomic rollback strategies, staged deployments, or transaction-safe backups MUST be implemented to preserve or restore the last-known-good operational state.
+
+## 11. Infrastructure as Code (Terraform / OpenTofu) Technical Architecture
+
+1. **Deterministic Single-Directive File Hierarchy**:
+   - Every file MUST contain a single directive and MUST follow the naming convention:
+     `<DIRECTIVE_TYPE>.<SUBTYPE_OR_DATATYPE>.<HUMAN_NAME>.tf`
+     - Resources: `resource.<RESOURCE_TYPE>.<RESOURCE_NAME>.tf` (e.g., `resource.aws_s3_bucket.audit_logs.tf`)
+     - Data Sources: `data.<DATA_TYPE>.<DATA_NAME>.tf` (e.g., `data.aws_ami.hardened_linux.tf`)
+     - Variables: `variable.<DATATYPE>.<VAR_NAME>.tf` (e.g., `variable.string.environment_name.tf`)
+     - Locals: `local.<DATATYPE>.<LOCAL_NAME>.tf` (e.g., `local.map.network_routing.tf`)
+     - Outputs: `output.<DATATYPE>.<OUTPUT_NAME>.tf` (e.g., `output.string.database_endpoint.tf`)
+     - Checks: `check.<CHECK_TYPE>.<CHECK_NAME>.tf` (e.g., `check.http.ingress_health.tf`)
+2. **Modern Declarative Validation over Legacy Anti-Patterns**:
+   - Modern native constructs MUST be used in place of deprecated legacy patterns:
+     - Use native `precondition` and `postcondition` lifecycle blocks within resources and data sources for state validation.
+     - Use native `check` blocks with `assert` conditions for non-blocking continuous infrastructure health monitoring.
+     - Legacy workarounds (e.g., `null_resource` triggers and local-exec scripts used for validation or state orchestration) are strictly prohibited; use `terraform_data` only when custom state triggers are strictly required.
+3. **Refactoring & Historical Lineage (`moved` blocks)**:
+   - Any resource renaming, refactoring, or state migration MUST define an explicit `moved` block to prevent destructive destroy-and-recreate actions.
+   - Files containing `moved` blocks (`moved.tf` or `moved.<RESOURCE_NAME>.tf`) MUST chronologically group and sort the complete evolution of each resource from oldest to newest transition before moving to subsequent resources.
+
+## 12. Dependency Lifecycle, Enterprise OS Backporting & Support Matrix Governance
+
+1. **Exact Pinning & Staged Upgrade Lifecycle**:
+   - All third-party providers, modules, packages, and images MUST be pinned to exact versions or immutable hashes.
+   - Upstream releases MUST follow a staged rollout: automated test suite verification -> staging soak period -> production deployment.
+2. **Enterprise OS Versioning & Certified Configuration Discrepancy Protocol (RHEL / Clones / EUS)**:
+   - **Backport & Patch-Level Awareness**: For enterprise distributions (e.g., RHEL, AlmaLinux, Rocky Linux) that maintain minor release streams with backported security fixes (e.g., Extended Update Support / EUS), version validation MUST evaluate effective vendor patch level and security compliance rather than naive raw upstream semantic version string comparison.
+   - **Certified Baseline Reconciliation**: When third-party vendor certification mandates a specific minor release baseline (e.g., certified on RHEL 9.4), systems MUST lock to that supported stream while actively tracking and verifying vendor-backported security errata through official repository channels.
+3. **Support Matrix Compliance & Upstream Sunset Protocol**:
+   - All components MUST remain within actively supported vendor maintenance windows.
+   - If an upstream provider, library, or package has not had an active release or security patch within a 12-month period, it MUST be flagged as abandoned, initiating a mandatory 90-day evaluation and migration to an actively supported alternative.
+
+## 13. Cryptographic Standards, Post-Quantum Security & Data Protection
+
+1. **Zero Plaintext Credentials**:
+   - Hardcoded secrets, API tokens, cleartext passwords, private keys, and unencrypted credentials in repositories, task files, templates, or commit histories are strictly prohibited.
+   - All sensitive data MUST be injected dynamically via approved secrets managers (e.g., HashiCorp Vault, cloud KMS, OS secret stores, or encrypted Ansible Vault with separate key management).
+2. **Log Redaction & Leakage Prevention**:
+   - Any automation task or module processing credentials, private keys, or sensitive payload data MUST explicitly suppress logging output (e.g., `no_log: true` in Ansible, `sensitive = true` in Terraform/OpenTofu).
+   - CI/CD execution logs, terminal output, and failure diagnostic messages MUST NOT emit sensitive tokens or environment variables.
+3. **Approved Cryptographic Suites & Post-Quantum Cryptography (PQC) Standards**:
+   - **Post-Quantum Cryptography (PQC) Mandate**: Systems MUST prefer and implement NIST-standardized Post-Quantum Cryptographic algorithms and hybrid schemes where supported:
+     - Key Encapsulation Mechanisms (KEM): FIPS 203 (ML-KEM / Kyber) or Hybrid KEM (e.g., `X25519MLKEM768` / `X25519Kyber768` in TLS 1.3 and SSH).
+     - Digital Signatures: FIPS 204 (ML-DSA / Dilithium) and FIPS 205 (SLH-DSA / SPHINCS+).
+   - **PQC Network MTU & Fragmentation Mitigation**: Because post-quantum key exchanges produce significantly larger public keys and ciphertexts (800–1568 bytes), network devices and tunnel endpoints (WireGuard/IPsec) MUST enable TCP MSS clamping (`--clamp-mss-to-pmtu`) and jumbo frames on internal mesh networks to eliminate packet fragmentation and handshake drops.
+   - **Approved Symmetric Encryption**: AES-256-GCM, AES-256-XTS (for block/disk storage), ChaCha20-Poly1305.
+   - **Approved Cryptographic Hashing**: SHA-256, SHA-384, SHA-512, SHA3-256, SHA3-512, BLAKE2b/s.
+   - **Approved Classical Asymmetric Key Exchange & Signatures**: Ed25519 / Ed448, ECDSA (NIST P-384 minimum), RSA (>= 3072-bit minimum).
+   - **Approved Password Hashing / KDF**: Argon2id (preferred), PBKDF2 (HMAC-SHA512, >= 600,000 iterations), scrypt.
+4. **Data Protection at Rest**:
+   - All persistent data, volume block storage, database storage, object buckets, and backups MUST be encrypted at rest using AES-256-GCM or XTS-AES-256 with automated KMS/HSM key rotation (minimum 365-day rotation cycle).
+   - Direct key storage alongside encrypted data is strictly prohibited (envelope encryption mandatory).
+5. **Data Protection in Transit**:
+   - All network communication MUST be encrypted in transit using TLS 1.3 (preferred with hybrid PQC key exchange) or TLS 1.2 (minimum, strictly requiring Perfect Forward Secrecy / PFS cipher suites).
+   - Mutual TLS (mTLS) with cryptographically validated certificates MUST be enforced for all inter-service, microservice, and cluster RPC communication.
+6. **Strictly Prohibited Protocols & Algorithms**:
+   - Deprecated ciphers/hashing: MD5, SHA-1, DES, 3DES, RC4, Blowfish, single AES-CBC without HMAC.
+   - Insecure/Cleartext protocols: SSLv2, SSLv3, TLS 1.0, TLS 1.1, SSH-1, unencrypted HTTP, Telnet, FTP, unencrypted SNMPv1/v2c.
+7. **Dynamic Credential Lifecycles & Zero-Downtime Secret Rotation**:
+   - **Preference for Dynamic Ephemeral Secrets**: Workloads interacting with databases, cloud APIs, and microservices SHOULD consume short-lived, dynamically generated credentials (e.g., HashiCorp Vault Database Secrets Engine with automatic TTL leases and automatic revocation).
+   - **Dual-Credential Rollover Pattern (Two-Phase Commit)**: When persistent credentials (e.g. static database users, API tokens, SSH keys) are rotated, automation MUST NOT perform single-step destructive overwrites. Rotation MUST follow a Two-Phase commit:
+     1. Stage and create the new credential alongside the existing active credential.
+     2. Update consumer service configuration and reload.
+     3. Execute post-change synthetic verification (Section 10.2).
+     4. If verification passes, revoke/drop the legacy credential; if verification fails, roll back configuration to the legacy credential and fail fast.
+   - **Idempotent Reconciliation**: Automated periodic runs (e.g. hourly fleet drift runs) MUST NOT generate new credentials unless a rotation trigger or TTL expiration has occurred, ensuring repeated runs remain idempotent with zero unnecessary service reloads.
+
+## 14. Cross-Platform Portability, Shebang Architecture & Tool Resolution
+
+1. **Explicit Portability Scope Declaration**:
+   - Every script, utility, and automation hook MUST explicitly declare whether it is **Portable (Multi-OS/Multi-Vendor)** or **Target-Specific (Single OS/Platform)**.
+2. **Interpreter Resolution via `env`**:
+   - Portable scripts MUST use `#!/usr/bin/env <interpreter>` (e.g., `#!/usr/bin/env bash`, `#!/usr/bin/env python3`) to account for varying binary installation prefixes across operating systems (`/usr/bin`, `/usr/local/bin`, `/opt/homebrew/bin`).
+3. **Downstream Utility Discovery & Syntax Harmonization**:
+   - If a script relies on `env` for portability, it MUST NOT assume GNU-specific extensions, BSD-specific flags, or non-standard utility paths (e.g., `/usr/ucb/bin/grep` vs `/usr/bin/grep` vs `/usr/gnu/bin/grep`).
+   - Portable scripts MUST either:
+     a. Restrict all utility invocations (`grep`, `sed`, `awk`, `find`, `tar`, `date`) strictly to POSIX IEEE Std 1003.1 baseline options; OR
+     b. Implement explicit preflight discovery functions (e.g., resolving `command -v ggrep || command -v grep`) and validate required capability flags before execution.
+4. **Target-Specific Scripts**:
+   - Scripts designed strictly for a specific OS vendor/release MUST assert the host platform during preflight and use explicit, verified binary paths or managed environment wrappers.
+
+## 15. Section 508 Accessibility & Universal Design Baseline
+
+1. **Section 508 & WCAG 2.1 AA Compliance Mandate**:
+   - All automation outputs, diagnostic messages, CLI tooling, technical documentation, and repository structures MUST comply with Section 508 of the Rehabilitation Act (29 U.S.C. § 794d) and WCAG 2.1 Level AA standards.
+2. **Screen Reader & Assistive Tech Operability**:
+   - Diagnostic outputs, terminal logs, and system error messages MUST provide plain, structured textual explanations. Visual-only ASCII decorations, pseudo-tables without headers, and unannounced status color codes (without accompanying textual status strings) are strictly prohibited.
+   - Code comments and technical documentation MUST use semantic markdown with explicit alternative text (`alt` text) for all architectural diagrams and workflows.
+   - **Audio Cognitive Ergonomics & Flat Data Structures**: Automation variables, task definitions, and configuration schemas SHOULD avoid deeply nested structures (> 4 levels) and repetitive identical keys that cause audio cognitive fatigue on screen readers and speech synthesizers. Task names MUST be phrased as concise, natural spoken sentences.
+3. **Speech-to-Text & Voice-Coding Compatibility**:
+   - Identifier naming, API tokens, and command-line flags MUST be phonetically distinguishable and avoid ambiguous single-character or easily mispronounced/misrecognized homophones to support engineers using voice input systems (e.g., Talon Voice, Dragon).
+4. **Editor Configuration Decoupling (`.editorconfig`)**:
+   - Repositories MUST provide and maintain a root `.editorconfig` file.
+   - This decouples repository-level canonical formatting (e.g., 2-space indentation required for deterministic git diffs) from individual local developer accessibility settings (e.g., custom tab widths, large print, high contrast, or screen-reader indentation announcements).
+
+## 16. Host Hardening, Least Privilege & Mandatory Access Control (SELinux / AppArmor)
+
+1. **Identity & Authentication Hardening**:
+   - Direct `root` SSH login (`PermitRootLogin no`) and password-based SSH authentication (`PasswordAuthentication no`) MUST be strictly disabled across all managed hosts.
+   - Authentication MUST strictly require cryptographic public keys (Ed25519 preferred, FIDO2/hardware security keys where supported).
+2. **Granular Sudo & Least Privilege**:
+   - Administrative escalation MUST use modular drop-in files in `/etc/sudoers.d/` restricted to explicit, granular command paths and user groups.
+   - Blanket unmonitored escalation directives (e.g., `ALL=(ALL) NOPASSWD: ALL`) are strictly prohibited.
+3. **Daemon & Workload User Isolation**:
+   - Daemons, systemd services, and containerized workloads MUST execute under dedicated, unprivileged system users and groups with restricted shells (`/sbin/nologin` or `/usr/sbin/nologin`).
+   - Running userland services or application daemons as `root` is strictly prohibited.
+   - Systemd units MUST enable sandboxing directives (`ProtectSystem=strict`, `ProtectHome=true`, `NoNewPrivileges=true`, `PrivateTmp=true`).
+4. **Mandatory Access Control (MAC / LSM)**:
+   - Linux Security Modules (SELinux or AppArmor) MUST remain active and in `Enforcing` mode at all times.
+   - Setting SELinux to `Permissive` or `Disabled` to work around permission issues is strictly prohibited; custom policies or file context labels (`semanage fcontext`) MUST be applied.
+
+## 17. Centralized Audit Logging, System Integrity & Session Governance
+
+1. **Kernel Audit Subsystem (`auditd`) & Immutable Kernel Locking**:
+   - The Linux Audit daemon (`auditd`) MUST be installed, enabled, and configured with immutable rules (`-e 2`) to track critical security events:
+     - Authentication, session establishment, and sudo/privilege escalations.
+     - Interactive administrative session keystrokes via PAM TTY auditing (`pam_tty_audit.so`).
+     - Modifications to sensitive system files (`/etc/passwd`, `/etc/shadow`, `/etc/sudoers*`, `/etc/ssh/sshd_config`, PAM modules).
+     - Execution of administrative binaries and system calls modifying kernel state, system time, or network routing.
+   - **Immutable Kernel Locking (`auditctl -e 2`)**: The audit configuration MUST be locked in the kernel, preventing even a compromised `root` account from disabling audit logging without a full system reboot.
+   - **Volatile Memory Forensic Triage (DFIR)**: Systems SHOULD maintain kernel crashdump (`kdump`) and non-destructive memory acquisition hooks to preserve volatile RAM evidence prior to automated reboot or host teardown.
+2. **Session Termination & Inactivity Locking (NIST AC-11 / AC-12)**:
+   - **Shell Inactivity Auto-Logout**: All interactive shells MUST enforce a 15-minute (900-second) maximum idle timeout via a global, read-only configuration (`/etc/profile.d/timeout.sh` setting `readonly TMOUT=900; export TMOUT`).
+   - **SSH Daemon Idle Disconnect**: SSH configuration MUST enforce idle disconnects via `ClientAliveInterval 300` and `ClientAliveCountMax 2` (or `ClientAliveCountMax 0`).
+   - **Session Screen Locking**: Graphical and console sessions MUST automatically lock after 15 minutes of inactivity, requiring re-authentication.
+3. **Encrypted Remote SIEM / Log Forwarding**:
+   - Systems MUST NOT rely solely on local log storage. All system, security, and application logs MUST be forwarded in near-real-time to a centralized SIEM or secure log collector via TLS 1.3/1.2 (Syslog-over-TLS with mutual authentication).
+4. **Structured Telemetry & Log Hygiene**:
+   - Logs MUST use standardized structured formats (JSON or structured key-value) with UTC ISO 8601 timestamps and unique correlation/trace IDs.
+   - Local log files MUST enforce strict permissions (`0600` or `0640` owned by `root:adm`) with automated log rotation and retention policies defined.
+
+## 18. Network Architecture, Segmentation & Ingress/Egress Inspection
+
+1. **Default-Deny Ingress and Egress Policy**:
+   - Host-level firewalls (`nftables`, `firewalld`, `iptables`) and cloud security groups MUST enforce a strict **Default-Deny** posture for both incoming (ingress) and outgoing (egress) traffic.
+   - Any allowed network flow MUST be explicitly declared with minimal necessary destination CIDRs, ports, and protocols.
+2. **Mandatory Egress Traffic Inspection & Exfiltration Defense**:
+   - Workloads and servers MUST NOT have direct, uninspected outbound Internet access.
+   - Outbound connections to external networks MUST be routed through authenticated, inspecting forward proxies or Next-Generation Gateways enforcing:
+     - Domain/FQDN allowlisting and strict Server Name Indication (SNI) validation.
+     - Content and stream inspection via Data Loss Prevention (DLP) engines (e.g., ICAP proxy integration with ClamAV in Structured Data/DLP mode) to block sensitive data leakage (SSNs, credit cards, private keys).
+     - Deep packet inspection to detect Command-and-Control (C2) beaconing and unapproved data exfiltration.
+   - Cloud workloads MUST prefer private VPC endpoints / PrivateLink over public internet egress for cloud service communication.
+3. **Administrative Interface Isolation**:
+   - Administrative interfaces (SSH, management consoles, database ports, internal metrics endpoints) MUST NEVER be exposed to the public Internet.
+   - Access MUST strictly require private network segmentation, VPN with MFA, bastion jump hosts, or Zero-Trust Identity-Aware Proxies (IAP).
+4. **Local Loopback Binding & Network Surface Minimization**:
+   - Services and microservices communicating locally on the same host MUST bind strictly to loopback interfaces (`127.0.0.1` / `::1`) or UNIX domain sockets rather than wildcard addresses (`0.0.0.0`).
+
+## 19. Vulnerability Management, Security Scanning & Patch SLAs
+
+1. **Automated Continuous Security Scanning**:
+   - Automated vulnerability scanning MUST execute at every stage of the pipeline:
+     - Static Application Security Testing (SAST) and secret scanning during pre-commit and CI.
+     - Software Bill of Materials (SBOM) generation and dependency vulnerability scanning (Trivy, Grype, OpenSSF Scorecard).
+     - Container image and OS package vulnerability scanning prior to deployment.
+2. **Strict Vulnerability Remediation SLAs**:
+   - Discovered vulnerabilities MUST be patched or mitigated within strict operational timeframes based on severity:
+     - **CISA Known Exploited Vulnerabilities (KEV) & Critical (CVSS >= 9.0)**: Remediation within **7 calendar days**.
+     - **High Severity (CVSS 7.0 - 8.9)**: Remediation within **30 calendar days**.
+     - **Medium Severity (CVSS 4.0 - 6.9)**: Remediation within **60 calendar days**.
+3. **Formal Exception & Compensating Control Governance**:
+   - Deploying code or packages with known unpatched High/Critical vulnerabilities is prohibited unless a formal exception is documented with:
+     - Explicit technical rationale and compensating controls (e.g., firewall isolation, WAF rules, disabled vulnerable sub-features).
+     - A mandatory expiration date not exceeding **90 calendar days**.
+
+## 20. Disaster Recovery, Encrypted Backups & Automated Restore Verification
+
+1. **Immutable & Encrypted Backup Architecture (3-2-1-1-0 Rule)**:
+   - All stateful datasets, configurations, and database volumes MUST maintain an automated backup regimen adhering to the modern 3-2-1-1-0 standard:
+     - 3 total copies of data across at least 2 distinct storage media types.
+     - 1 copy stored offsite / in an isolated geographic region.
+     - 1 copy stored in an **immutable, air-gapped, or WORM (Write-Once-Read-Many)** object-locked state to prevent ransomware deletion or modification.
+     - 0 errors verified through automated restore testing.
+   - All backup archives MUST be encrypted at rest using approved KMS keys distinct from the production workload encryption keys.
+2. **Automated Synthetic Restore Verification**:
+   - A backup is NOT considered valid or compliant merely because the backup archive process exited without error.
+   - Automated synthetic restore jobs MUST execute on a scheduled basis within an isolated staging environment to prove data restorability and assert compliance with defined Recovery Point Objectives (RPO) and Recovery Time Objectives (RTO).
+3. **Disaster Recovery as Code (DRaC) & Rebuildability**:
+   - Infrastructure, operating system configurations, and application stacks MUST be completely restorable from cold storage using IaC (Terraform/OpenTofu) and automated configuration management (Ansible).
+   - Rebuilding any node, cluster, or environment from bare-metal or base images MUST require zero manual interactive intervention.
+4. **Facility Power Loss & Automated UPS Graceful Shutdown**:
+   - On-premises infrastructure and OpenStack clusters MUST integrate automated power monitoring (Network UPS Tools / NUT or `apcupsd`).
+   - Upon reaching a **20% UPS battery capacity threshold**, automation MUST execute an emergency graceful flush of in-flight database transactions and initiate clean, ordered node shutdowns before catastrophic utility power cutoff.
+
+## 21. Autonomous Agent Verification & Quality Gate Checklist
+
+Before finalizing or committing any playbook, role, script, or infrastructure code change, an agent MUST systematically verify:
+- [ ] **Prerequisites Asserted (Shift-Left Tier 2)**: OS distribution, version, architecture, and tool prerequisites are explicitly tested with structured fail-fast diagnostics.
+- [ ] **Code & Data Decoupled**: Zero hardcoded package names, service handles, or static disk paths inside execution tasks (all externalized to structured `vars/`).
+- [ ] **Security Hardening Enforced**: Non-root daemon users configured, systemd sandboxing parameters enabled, least-privilege permissions applied, and SELinux contexts declared.
+- [ ] **Zero Credential Leaks**: All tasks and variables handling secrets or certificates enforce `no_log: true` (Ansible) or `sensitive = true` (Terraform/OpenTofu).
+- [ ] **Idempotency & Least Change**: Tasks modify only the minimal delta from factory defaults; repeated runs against compliant nodes report `changed=0`.
+- [ ] **Post-Change Verification Active (Section 10.2)**: End-state functional assertions (listening sockets, synthetic HTTP 200 checks, database queries) are implemented.
+- [ ] **Supply Chain & Licensing Verified**: All third-party packages comply with Tier 1 Libre Open Source licensing (zero BSL/SSPL) with cryptographic SHA-256 validation.
+- [ ] **Formatting & Accessibility Compliant (`STYLE.md`)**: Narrow-line formatting applied, Yoda/defensive syntax used, attributes lexicographically sorted, and no decorative ASCII art.
+
+## 22. Data Classification, Privacy Sovereignty & Data Lifecycle
+
+1. **4-Tier Data Classification Matrix**:
+   - All systems, databases, object stores, and data pipelines MUST enforce classification tags:
+     - **Tier 1 (Public)**: Non-sensitive public marketing/documentation assets.
+     - **Tier 2 (Internal)**: Operational telemetry, non-sensitive system logs, internal policies.
+     - **Tier 3 (Confidential)**: Business financial records, proprietary source code, internal roadmap data.
+     - **Tier 4 (Restricted / PII / PHI / CUI)**: Personally Identifiable Information, Protected Health Information, Payment Card Data, and Controlled Unclassified Information.
+2. **Geographic Data Residency & Sovereignty**:
+   - Customer and regulated data MUST remain within designated sovereign jurisdictional boundaries (e.g., EU GDPR data must remain in EU regions; US defense/CUI data must remain in US datacenters).
+   - Cross-border data replication or backup transfer without explicit contractual approval is strictly prohibited.
+3. **Cryptographic Erasure & Right-to-be-Forgotten (NIST SP 800-88)**:
+   - Systems storing personal data MUST implement automated workflows for account deletion and data purging.
+   - Storage media decommissioning and tenant data sanitization MUST execute cryptographic key destruction or NIST SP 800-88 Rev 1 compliant overwriting.
+
+## 23. Incident Management, Break-Glass Access & Blameless Retrospectives
+
+1. **Incident Severity Classification & Response SLAs (NIST SP 800-61)**:
+   - **SEV-1 (Critical / Outage / Data Breach)**: Immediate response within **15 minutes**; continuous incident commander coordination until resolution.
+   - **SEV-2 (Major Impairment / Redundancy Loss)**: Response within **1 hour**.
+   - **SEV-3 (Moderate Degradation / Non-Critical Bug)**: Response within **4 business hours**.
+   - **SEV-4 (Minor Issue / Cosmetic Inquiry)**: Response within **24 business hours**.
+2. **Emergency Break-Glass Access & Just-In-Time (JIT) Elevation**:
+   - Standing root or administrator access in production environments is STRICTLY PROHIBITED.
+   - Emergency operational access MUST require Just-In-Time (JIT) checkout with a maximum **2-hour lease**, generating high-priority SIEM alerts and automated audit trails.
+3. **Mandatory Blameless Root Cause Analysis (RCA)**:
+   - Every SEV-1 and SEV-2 incident requires a formal, blameless post-mortem published within **72 hours** of resolution, identifying systemic root causes (5 Whys) and actionable preventive engineering tasks.
+4. **Alert Storm Deduplication & On-Call Cognitive Ergonomics**:
+   - Monitoring systems and SIEM collectors MUST enforce alert grouping, root-cause suppression, and deduplication to prevent cognitive overload and alert fatigue during major distributed fleet incidents.
+
+## 24. FinOps, Resource Allocation Tagging & Automated Waste Governance
+
+1. **Mandatory Resource Attribution Tagging**:
+   - Every cloud resource, VM, block volume, bucket, and service account MUST declare standardized metadata tags:
+     - `Owner`: Individual or team responsible for maintenance.
+     - `Environment`: `production`, `staging`, `development`, or `sandbox`.
+     - `CostCenter`: Financial billing unit or business allocation code.
+     - `Project`: Specific service or application identifier.
+     - `ComplianceScope`: `fedramp`, `pci-dss`, `hipaa`, `soc2`, or `general`.
+   - Untagged resources in automated environments MUST trigger automated compliance notifications and scheduled reaping.
+2. **Automated Idle Resource Reaping**:
+   - Unattached storage volumes, dangling elastic IP addresses, orphan snapshots past retention policy, and idle test instances MUST be automatically flagged and deleted after defined grace periods.
+
+## 25. Change Management, Deployment Windows & Production Freezes
+
+1. **ITIL v4 Change Classification**:
+   - **Standard Changes**: Pre-approved, automated, low-risk changes with verified idempotency (e.g., automated routine patch management via `ensure_os_patch`).
+   - **Normal Changes**: Standard feature deployments and architectural updates requiring peer code review, CI/CD automated test verification, and Change Advisory Board (CAB) approval.
+   - **Emergency Changes**: Hotfixes applied during active SEV-1/SEV-2 incidents with expedited approval and mandatory retrospective review.
+2. **Production Deployment Freezes & Blackout Windows**:
+   - Automated CI/CD deployment pipelines MUST enforce deployment freezes during designated business-critical blackout periods (e.g., peak retail events, end-of-fiscal-year reporting).
+   - Emergency security hotfixes during freezes require dual-executive authorization.
+
+## 26. Service Level Governance: SLAs, SLOs, SLIs & Error Budget Enforcement
+
+1. **Contractual SLAs vs. Internal Engineering SLOs**:
+   - Systems MUST define explicit Service Level Indicators (SLIs) measuring availability, error rate, and 95th/99th percentile latency.
+   - Internal Service Level Objectives (SLOs) MUST be engineered to be stricter than contractual customer Service Level Agreements (SLAs) (e.g., 99.99% internal SLO vs. 99.9% external SLA).
+2. **Error Budget Policy & Automated Deployment Gates**:
+   - Each service maintains a monthly Error Budget derived from its SLO (e.g., 99.9% availability allows 43.8 minutes of downtime per month).
+   - **Error Budget Exhaustion Gate**: If a service exhausts its monthly error budget due to instability or outages, all non-critical feature deployments MUST be automatically blocked in CI/CD, redirecting 100% of engineering capacity to reliability, resilience, and defect resolution until stability is restored.
+
+## 27. Financial Systems Architecture, Jurisdictional Tax Sourcing & Unit Economic Metering
+
+1. **Physical Execution Sourcing & Jurisdictional Tax Metadata**:
+   - All provisioned compute instances, container workloads, and storage volumes MUST expose runtime metadata declaring their physical execution location and legal jurisdiction (e.g., `execution_jurisdiction`, `datacenter_state`, `country_iso`).
+   - Telemetry and orchestration layers MUST feed this execution jurisdiction data directly into the automated rating and sales tax computation pipeline to guarantee multi-state (e.g., Texas Rule 3.330) and international VAT compliance.
+2. **CapEx vs. OpEx Lifecycle Governance**:
+   - Architectural decisions MUST evaluate total cost of ownership (TCO), modeling hardware capitalization, multi-year depreciation schedules, and power/colo expenses against variable cloud OpEx bills.
+   - Core predictable baselines (> 12-month steady-state) SHOULD be targeted for high-margin capitalized infrastructure (OpenStack on-premise), with cloud bursting (DigitalOcean edge) restricted to transient ingress or disaster recovery.
+3. **High-Cardinality Multi-Tenant Metering & Profitability Bucketing**:
+   - In MSP and multi-tenant environments, every ephemeral and persistent resource (vCPU-hours, RAM gigabyte-hours, block IOPS, network egress bytes, and dynamic credential leases) MUST be tagged with `TenantId` / `CustomerId`.
+   - Metered telemetry MUST stream continuously to an automated rating engine (e.g., Kill Bill / Lago) to generate usage-based billing line items and calculate real-time gross margin per customer.
+4. **Interstate Physical Nexus & Asset Entity Segregation (*South Dakota v. Wayfair*)**:
+   - On-premises hardware, backup repositories, and regional compute nodes MUST maintain clean legal entity ownership boundaries to prevent unintended interstate corporate tax nexus and asset exposure.
+
+## 28. Human-in-the-Loop (HITL) Fiduciary Governance & Deadlock Halting Protocol
+
+1. **Deterministic Execution vs. Fiduciary Accountability**:
+   - Automation systems execute deterministic business logic; human operators retain ultimate legal, regulatory, and fiduciary accountability for all state mutations.
+2. **Mandatory Automated Halting on Ambiguity & Deadlock**:
+   - When automation routines (Ansible playbooks, CI/CD pipelines, or agentic workers) encounter conflicting priorities, unresolvable drift, ambiguous tax jurisdictions, or unmapped database schemas, the system MUST NOT guess, extrapolate, or apply destructive overrides (`force: yes`).
+   - The execution sequence MUST immediately halt the affected host/service, preserve full state diagnostics, emit an alert to the centralized SIEM, and route the decision to an explicit Human-in-the-Loop (HITL) review queue.
+3. **Interactive Promotion & Migration Gates**:
+   - Irreversible production state changes (e.g., live financial ledger schema updates, production database failovers, data purges) MUST include mandatory human authorization pause gates before mutating production state.
+4. **Two-Person Integrity (TPI) for Destructive Operations**:
+   - Catastrophic infrastructure operations (e.g., bare-metal node wiping, production database drops, immutable backup purge authorization) MUST enforce a cryptographic Two-Person Integrity (TPI) approval rule, requiring distinct dual-operator credentials.
+
+## 29. Third-Party Vendor Risk Management & Subprocessor Governance (TPCRM)
+
+1. **Mandatory Subprocessor Due Diligence & Certification**:
+   - No third-party SaaS, cloud provider, external API, or payment processor can be configured to process production or customer data without an active **SOC 2 Type II** or **ISO/IEC 27001** audit certification on file (renewed annually).
+2. **Binding Data Processing Agreements (DPA / BAA)**:
+   - All external infrastructure and service dependencies MUST maintain executed, legally binding Data Processing Agreements (DPAs) or Business Associate Agreements (BAAs) establishing sovereign jurisdiction, breach notification SLAs, and data ownership boundaries.
+3. **Cryptographic Provenance & Network Egress Boundaries**:
+   - All external package repositories MUST enforce GPG signature validation (`gpgcheck: 1`, `repo_gpgcheck: 1`) using cryptographically verified vendor keys.
+   - Host firewalls and egress proxies MUST strictly restrict outbound network traffic exclusively to allowlisted, vetted subprocessor CIDRs and domain endpoints.
+
+## 30. Legacy Systems, Batch Interoperability & Physical Document Ingestion Bridges
+
+1. **Isolated & Chrooted Ingress Boundaries**:
+   - Ingress endpoints accepting data from legacy desktop software (e.g., Sage 100/MAS90, QuickBooks Desktop, Lightspeed POS), flat-file EDI feeds, or scanner OCR dropboxes MUST be strictly isolated.
+   - Ingestion services MUST enforce dedicated chrooted system users (`internal-sftp` with no shell access), SSH public key authentication, and segregated filesystem boundaries.
+2. **Cryptographic Manifest & Integrity Verification**:
+   - Batch data feeds, CSV exports, and document drop files MUST be accompanied by cryptographic SHA-256 manifest files.
+   - Ingestion automation MUST verify cryptographic checksums (`sha256sum -c`) and schema integrity prior to parsing or committing records to production transactional databases.
+3. **Transport Security & At-Rest Encryption**:
+   - All legacy data transmissions MUST be encrypted in transit using TLS 1.3 or SFTP.
+   - Staged batch files and unprocessed document scans MUST be stored on encrypted volumes with automated expiration and secure deletion (NIST SP 800-88) following successful database ingestion.
+
+## 31. Personnel Access Lifecycle & 24-Hour Offboarding SLAs
+
+1. **Least-Privilege Onboarding & Role-Based Access Control (RBAC)**:
+   - Access to production systems, source repositories, and cloud control planes MUST adhere strictly to the principle of least privilege, requiring mandatory background screening and manager authorization.
+2. **Automated 24-Hour Offboarding Access Deprovisioning (NIST SP 800-53 PS-4/PS-5)**:
+   - Upon the separation, transfer, or contract termination of any employee, contractor, or third-party maintainer, all associated access MUST be completely revoked within **24 calendar hours**.
+   - Deprovisioning automation MUST revoke:
+     - SSH authorized keys, VPN certificates, and bastion account access.
+     - Central IdP accounts (Keycloak / SSO / Google Workspace) and active sessions.
+     - Git repository write permissions and personal access tokens (PATs).
+     - Cloud IAM roles, AWS/GCP/OCI service accounts, and API secret keys.
+3. **Periodic Access Recertification**:
+   - Production privilege assignments and administrative entitlements MUST undergo automated quarterly access recertification by system owners.
+
+## 32. Autonomous Agent & AI Model Governance
+
+1. **Sandboxing & Least-Privilege Agent Execution**:
+   - Autonomous AI coding agents, automation bots, and LLM plugins MUST execute inside restricted sandbox environments with zero direct network egress unless explicitly authorized.
+   - Agents MUST NOT be granted unrestricted root access or production deployment execution privileges without an explicit human approval gate (Section 28).
+2. **Prompt Injection Defense & Input Sanitization (OWASP LLM Top 10)**:
+   - AI ingestion pipelines processing untrusted external text (e.g., support tickets, customer issue descriptions, web scraped content) MUST enforce strict prompt sanitization and delimiter isolation to prevent prompt injection and automated tool hijacking.
+3. **Data Privacy & Training Exclusion (NIST AI RMF 1.0 / ISO 42001)**:
+   - Customer data, proprietary business logic, financial ledgers, and credentials MUST NEVER be transmitted to external AI models that retain or train on input data without explicit enterprise contractual zero-retention guarantees.
+4. **Supply Chain & Licensing Provenance on AI Code Generation**:
+   - AI-generated source code and configuration snippets MUST undergo automated licensing and security static analysis (SAST) to ensure zero introduction of prohibited Tier 3 licenses (BSL/SSPL) or unvetted dependencies.
+
+## 33. Legal Hold, Electronic Discovery & Evidence Preservation
+
+1. **Automated Retention Freeze on Legal Hold Declaration (FRCP Rules 26/37 / ISO 27050)**:
+   - Upon receipt of a formal Legal Hold notice, automation systems MUST immediately suspend all automated log rotation, data purging, snapshot deletion, and cryptographic media sanitization (Section 22.3) on affected tenant data scopes.
+2. **Immutability & Chain-of-Custody Preservation**:
+   - All electronically stored information (ESI) subject to a legal hold MUST be placed in an immutable, write-once-read-many (WORM) storage state with cryptographic SHA-256 integrity sealing.
+3. **Audit Trail of Hold Activation & Release**:
+   - The activation, scope definition, and subsequent release of any legal hold MUST generate an immutable, non-repudiable audit event in the centralized SIEM.
+
+## 34. Corporate Finance, ASC 606 Revenue Recognition & Multi-Currency Treasury Architecture
+
+1. **GAAP / IFRS Automated Revenue Recognition (ASC 606 / IFRS 15)**:
+   - Automated rating, billing, and subscription engines MUST generate daily deferred revenue amortization schedules.
+   - Upfront multi-month and annual subscription payments MUST be booked as unearned deferred revenue liabilities and recognized incrementally over the performance obligation period.
+2. **Multi-Currency Invoicing & FX Currency Risk Mitigation**:
+   - Systems executing multi-currency transactions (USD, EUR, GBP, CAD) MUST lock the foreign exchange (FX) spot rate at invoice creation to eliminate unhedged currency fluctuation risk between billing generation and payment clearing.
+3. **Double-Entry Financial Ledger Integrity**:
+   - Usage telemetry and automated invoice generation MUST interface with accounting general ledgers via immutable, double-entry batch journals with balanced debits and credits.
+
+## 35. Cyber Insurance Warranty Defensibility & Underwriting Compliance Automation
+
+1. **Automated Insurance Policy Warranty Auditing**:
+   - To ensure defensibility and prevent claim denial by commercial Cyber Liability and Errors & Omissions (E&O) insurance carriers (e.g., Lloyd's, Chubb, Travelers), systems MUST automatically generate cryptographically verifiable quarterly compliance bundles.
+2. **Continuous Underwriting Warranties**:
+   - Automation MUST continuously verify and produce audit artifacts demonstrating:
+     - 100% Hardware Multi-Factor Authentication (MFA) enforcement on all remote access and administrative jump boxes (Section 16.1).
+     - 3-2-1-1-0 immutable, air-gapped, and object-locked backups with verified restore drills (Section 20).
+     - Continuous vulnerability scanning and remediation within policy SLAs (Section 19.2).
+     - Centralized, tamper-evident audit logging retained for a minimum of 365 days (Section 17).
+
+## 36. Intellectual Property Assignment (CIIAA) & Workforce Identity Verification
+
+1. **Cryptographic IP Ownership & Chain-of-Title Provenance**:
+   - To guarantee unencumbered corporate intellectual property ownership for M&A, investment due diligence, and copyright enforcement, all repository contributions MUST have unbroken chain of title.
+2. **Committer Verification & Contractual Binding**:
+   - Repository pre-receive hooks and CI/CD push gates MUST enforce cryptographic GPG commit signature verification, validating that every commit author maps to an active employee or contractor with an executed Confidential Information and Inventions Assignment Agreement (CIIAA) or contractor IP assignment schedule on file in the corporate HRIS.
+
+## 37. Physical Supply Chain Redundancy, Dual-OEM Sourcing & Hardware Capacity
+
+1. **Multi-Vendor Hardware & Component Fungibility**:
+   - On-premises infrastructure, private cloud datacenters, and OpenStack bare-metal clusters MUST maintain dual-OEM hardware specifications (e.g., Dell PowerEdge + Supermicro / AMD EPYC + Intel Xeon) to eliminate single-supplier physical supply chain vulnerabilities and component lead-time bottlenecks.
+2. **Hardware Capacity Planning & Spare Parts Buffering**:
+   - Critical infrastructure nodes MUST maintain an on-site cold-spare hardware buffer (minimum 10% replacement ratio for power supplies, NVMe drives, and NICs) backed by enterprise 4-hour on-site vendor hardware replacement SLAs.

STYLE.md

@@ -0,0 +1,225 @@
+# STYLE.md
+
+> ### Normative Requirement Levels (RFC 2119 / RFC 8174)
+> The key words **MUST**, **MUST NOT**, **REQUIRED**, **SHALL**, **SHALL NOT**, **SHOULD**, **SHOULD NOT**, **RECOMMENDED**, **NOT RECOMMENDED**, **MAY**, and **OPTIONAL** in this document are to be interpreted as described in [BCP 14](https://www.rfc-editor.org/info/bcp14) ([RFC 2119](https://www.rfc-editor.org/rfc/rfc2119.txt) and [RFC 8174](https://www.rfc-editor.org/rfc/rfc8174.txt)) when, and only when, they appear in all capitals, as shown here.
+
+---
+
+## 1. Universal Formatting & Merge Request Optimization
+
+1. **Merge Request Context & Narrow-Line Formatting**:
+   - Code, configuration, and data MUST be structured to maximize human readability and minimize line noise during diff and merge request reviews.
+   - Long lines and complex expressions MUST be broken across multiple lines rather than collapsed into dense single-line statements (e.g., compound `if` conditions testing multiple criteria, nested data structures, long parameter lists).
+   - Splitting expressions across dedicated lines ensures that future diffs highlight the exact changed variable or condition rather than obscuring edits in the middle of a wide line.
+2. **File Granularity & Concise Sizing**:
+   - Files SHOULD remain compact, focused, and single-purpose in languages and configuration formats that support modular decomposition.
+   - Monolithic files MUST be decomposed into cohesive, logically grouped sub-components.
+3. **Deterministic Lexicographical Sorting**:
+   - Where the order of code blocks, dictionary keys, variable definitions, exports, or lists does not affect semantic execution or program logic, items MUST be sorted alphabetically/lexicographically.
+   - Consistent sorting guarantees deterministic diffs and prevents spurious ordering conflicts during parallel merges.
+
+---
+
+## 2. Defensive Syntax & Error-Exposing Idioms
+
+1. **Compile-Time & Static Error-Exposing Constructs**:
+   - Code MUST be written using defensive syntax idioms that turn common typos or logical accidents into immediate compile-time or static analysis errors.
+2. **Constant-First Comparisons (Yoda Conditions)**:
+   - In languages where assignment within conditional expressions is syntactically valid (e.g., C, C++, PHP, Java, Perl), equality comparisons MUST place the constant or literal on the left-hand side:
+     - Preferred: `if (1 == variable)` or `if (NULL == ptr)`
+     - Prohibited: `if (variable = 1)` accidental assignment bugs.
+   - Placing the literal first causes accidental single-equal assignments (`1 = variable`) to immediately fail compilation or linting rather than executing undetected.
+
+---
+
+## 3. Ansible & YAML Formatting Standards
+
+1. **Native YAML Syntax & Multiline Arguments**:
+   - Module parameters MUST use native YAML key-value mapping over legacy `key=value` inline shorthand strings.
+   - Every parameter MUST reside on its own line to ensure concise git diffs and visual clarity during reviews.
+2. **Mandatory Explicit Task & Play Naming**:
+   - Every play, task, and block MUST include a descriptive, human-readable `name:` string stating its explicit intent.
+3. **Deterministic Variable & Key Ordering**:
+   - Dictionary keys, task arguments, and variable lists MUST be sorted alphabetically unless a specific execution order is functionally required.
+4. **Jinja2 Spacing & Quoting Integrity**:
+   - Jinja2 delimiters MUST have consistent inner single-space padding: `{{ variable_name }}` (not `{{variable_name}}`).
+   - YAML values starting with template delimiters MUST always be explicitly quoted (`"{{ var }}"`) to prevent parser syntax errors.
+
+---
+
+## 4. OpenTofu & Terraform Standards
+
+1. **Standardized Formatting & Indentation**:
+   - All HCL code MUST be formatted using standard 2-space indentation (enforced via `tofu fmt` / `terraform fmt`).
+2. **Deterministic Attribute & Block Sorting**:
+   - Attributes inside resources, data sources, locals, and variable blocks MUST be sorted alphabetically where evaluation order is order-independent.
+   - Meta-arguments (`count`, `for_each`, `lifecycle`, `depends_on`, `provider`) SHOULD appear in a standardized order (meta-arguments at the top, followed by sorted resource arguments, with `lifecycle` and `depends_on` at the bottom).
+3. **Mandatory Documentation Attributes**:
+   - Every `variable` and `output` declaration MUST include an explicit `description` string explaining its purpose, expected format, and constraints.
+4. **Multiline Collection Declarations**:
+   - Maps, lists, and complex objects MUST be formatted across multiple lines with trailing commas on list/map elements to ensure clean, one-line diffs when elements are appended.
+
+---
+
+## 5. JSON Formatting Standards
+
+1. **Strict 2-Space Indentation**:
+   - All JSON files MUST be formatted with 2-space indentation and a terminating newline.
+2. **Deterministic Key Sorting**:
+   - Keys in JSON objects MUST be sorted alphabetically unless document schemas require specific positional ordering.
+3. **Multiline Formatting for Objects & Arrays**:
+   - JSON objects and arrays containing multiple items MUST be expanded across multiple lines. Single-line minification is restricted to binary release artifacts only.
+
+---
+
+## 6. Rust Standards (Systems & Kernel Rust)
+
+1. **Standardized Formatting (`rustfmt`)**:
+   - Code MUST be formatted with 4-space indentation adhering to the standard `rustfmt` rules.
+2. **Explicit Error Propagation & Prohibition of Panics**:
+   - Production code and kernel/system modules MUST NOT use `.unwrap()` or `.expect()` on fallible operations.
+   - Errors MUST be propagated explicitly using `Result<T, E>`, `Option<T>`, or custom error types with the `?` operator.
+3. **Safe Rust Default & Explicit Unsafe Auditing**:
+   - All code MUST be `#![deny(unsafe_code)]` by default.
+   - When `unsafe` blocks are strictly required (e.g., FFI, kernel drivers, memory-mapped I/O), every `unsafe` block MUST include an explicit `// SAFETY:` explanatory comment proving memory safety invariants.
+4. **Deterministic Import & Module Sorting**:
+   - `use` declarations MUST be sorted alphabetically and grouped: `std` / `core` / `alloc` -> external crates -> internal modules.
+
+---
+
+## 7. Systems Programming, Kernel & eBPF Standards (C, C++, Assembly, eBPF)
+
+1. **Indentation & Block Formatting**:
+   - Userland C/C++ MUST use 4-space indentation.
+   - Linux Kernel modules, drivers, and low-level subsystem source files MUST follow the Linux Kernel Coding Style (8-character tabs, K&R brace placement).
+2. **Defensive Yoda Comparisons**:
+   - Equality comparisons against literals or constants MUST place the constant on the left: `if (0 == result)` and `if (NULL == ptr)`.
+3. **Extended BPF / eBPF Standards**:
+   - eBPF C programs (`*.bpf.c`) MUST adhere to BPF CO-RE (Compile Once – Run Everywhere) conventions using `vmlinux.h`.
+   - BPF maps and license declarations (`SEC("license")`) MUST be explicitly named and placed at file boundaries.
+4. **Assembly (ASM) & Linker Scripts (`.s`, `.S`, `.ld`, `.lds`)**:
+   - Assembly files MUST use standard tab alignment for labels, instructions, operands, and comments.
+   - Hardware register names and instruction mnemonics MUST be lowercase.
+5. **Zero Compiler Warnings**:
+   - Userland code MUST compile cleanly under `-Wall -Wextra -Werror -Wpedantic` (or MSVC `/W4 /WX`). Kernel code MUST compile cleanly with zero sparse / static analysis warnings.
+
+---
+
+## 8. Build Systems, Grammars & Device Trees (Make, Kconfig, Bison/Flex, DTS)
+
+1. **Makefiles & Kbuild (`Makefile`, `*.mk`, `Kconfig`, `Kbuild`)**:
+   - Recipe lines in Makefiles MUST be indented with literal tab characters (`\t`).
+   - Kconfig option declarations MUST be sorted logically with complete `help` documentation strings.
+2. **Device Tree Source (`.dts`, `.dtsi`)**:
+   - DTS node names and properties MUST use standard 8-character tab indentation.
+   - Node labels MUST follow standard naming conventions (`node_name@unit_address`).
+3. **Parser & Lexer Grammars (Bison `.y`, Flex `.l`)**:
+   - Grammars MUST use tab-indented production rules with explicit semantic error handlers (`yyerror`).
+
+---
+
+## 9. Shell & Scripting Standards (BASH, SH, KSH, CSH/TCSH, AWK, Sed)
+
+1. **Strict Execution Header & Shebang**:
+   - **Bash**: `#!/usr/bin/env bash` with `set -euo pipefail`.
+   - **POSIX / Bourne Shell (`sh`)**: `#!/usr/bin/env sh` with `set -eu`.
+   - **Korn Shell (`ksh`)**: `#!/usr/bin/env ksh` with `set -e -u`.
+   - **C Shell / TC Shell (`csh` / `tcsh`)**: Scripts in CSH/TCSH are NOT RECOMMENDED for automation logic; if required for legacy shell environments, they MUST begin with `#!/bin/csh -f` or `#!/bin/tcsh -f` and check `$status` after every command.
+2. **Defensive Variable Quoting & Modern Expansion**:
+   - Every variable expansion MUST be enclosed in double quotes (e.g., `"$target_dir"`, `"${items[@]}"`) to prevent field splitting and globbing.
+   - Command substitution in POSIX/Bash/Ksh MUST use standard `$()` syntax instead of legacy backticks (`` `...` ``).
+3. **AWK & Sed Scripting Standards**:
+   - AWK scripts (`.awk`) MUST use 4-space indentation with explicit `BEGIN` and `END` blocks.
+   - Complex regular expressions in Sed/AWK MUST be documented with inline comments explaining matching groups.
+4. **Deterministic Exit & Cleanup Traps**:
+   - Temporary files or resources created by a script MUST be cleaned up via an explicit `trap cleanup EXIT INT TERM` handler.
+
+---
+
+## 10. Perl Standards
+
+1. **Strict Pragmas Mandate**:
+   - Every Perl script (`.pl`) and module (`.pm`) MUST explicitly enable strict mode and warnings at the top of the file:
+     ```perl
+     #!/usr/bin/env perl
+     use strict;
+     use warnings;
+     use utf8;
+     ```
+2. **Formatting & Scoping**:
+   - Indentation MUST be 4 spaces.
+   - All variables MUST be lexically scoped using `my` (package variables `our` used only when strictly necessary).
+   - Global package variables (`$var`, `$@`) and direct typeglobs are prohibited.
+3. **Subroutine Signatures**:
+   - Modern Perl subroutine signatures (`use feature 'signatures';`) SHOULD be used for explicit argument validation.
+
+---
+
+## 11. Python Standards
+
+1. **PEP 8 Adherence & 4-Space Indentation**:
+   - All Python code MUST conform to PEP 8 standards with strict 4-space indentation.
+2. **Mandatory Type Annotations (`typing`)**:
+   - All function signatures and module interfaces MUST declare complete static type hints (`typing` / Python 3.10+ union types `str | None`).
+3. **Deterministic Import Sorting**:
+   - Imports MUST be sorted and grouped in standard order (Standard Library -> Third-Party -> Local) using tools like `isort` or `ruff`.
+4. **Multiline Call & Data Formatting**:
+   - Dictionaries, lists, and multi-argument function calls MUST be formatted across multiple lines with trailing commas on multiline structures.
+
+---
+
+## 12. Enterprise & Compiled Languages (Java & Go)
+
+1. **Java Standards**:
+   - Indentation MUST be 4 spaces.
+   - Class members and methods MUST be ordered: static constants -> member fields -> constructors -> public methods -> private methods.
+   - Constant-first equality checks: `"constant".equals(variable)` to eliminate `NullPointerException` risks.
+2. **Go (Golang) Standards**:
+   - Code MUST be formatted strictly using standard `gofmt` (tab-based indentation).
+   - Error handling MUST be explicit and fail-fast: `if err != nil { return fmt.Errorf(...) }`.
+   - Struct field declarations and imports MUST be formatted and sorted via `goimports`.
+
+---
+
+## 13. Web & Backend Scripting (PHP)
+
+1. **PSR-12 Extended Coding Style**:
+   - All PHP code MUST adhere strictly to PSR-12 formatting with 4-space indentation.
+2. **Strict Typing Mandate**:
+   - Every PHP file MUST begin with `declare(strict_types=1);` immediately after `<?php`.
+   - All function parameters and return types MUST declare explicit types.
+3. **Defensive Yoda Comparisons**:
+   - Use constant-first comparisons (`if (true === $flag)` or `if (null === $data)`).
+
+---
+
+## 14. Windows Scripting Standards (PowerShell & CMD)
+
+1. **PowerShell (`.ps1`, `.psm1`) Standards**:
+   - Scripts MUST include `$ErrorActionPreference = 'Stop'` at the top to enforce fail-fast execution.
+   - Indentation MUST be 4 spaces.
+   - Use approved PowerShell verb-noun naming conventions for functions (e.g., `Get-Resource`, `Set-Configuration`).
+   - All parameters MUST be explicitly typed (`[string]$Path`, `[int]$Count`).
+2. **Windows Command Script (`.bat`, `.cmd`) Standards**:
+   - CMD scripts MUST begin with `@echo off` and `setlocal enableextensions enabledelayedexpansion`.
+   - Explicitly check `%ERRORLEVEL%` after critical invocations: `if %ERRORLEVEL% neq 0 exit /b %ERRORLEVEL%`.
+   - Files MUST use Windows CRLF line endings as required by the Windows Command interpreter.
+
+---
+
+## 15. Accessible Code Formatting & Documentation Style
+
+1. **Phonetic & Voice-Coding Naming Clarity**:
+   - Variable, function, task, and file names MUST be descriptive, pronounceable, and phonetically distinct.
+   - Avoid ambiguous single-character variables (except standard loop indices `i`, `j` where unavoidable), cryptic phonetic abbreviations, or homophones that impede speech-to-text dictation (e.g., Talon Voice) or screen-reader comprehension.
+2. **Audio Cognitive Ergonomics & Spoken Phrasing**:
+   - Playbook task names and block descriptions MUST be written as concise, natural spoken sentences (e.g., `name: Ensure Apache Web Daemon Is Active and Enabled`).
+   - Configuration maps and data schemas SHOULD avoid nesting deeper than 4 levels to prevent auditory disorientation on speech synthesizers.
+3. **Prohibition of Decorative Visual ASCII Art**:
+   - Purely visual ASCII art, boxed comment headers (`/*******************/`), decorative divider lines, and ASCII pseudo-diagrams are strictly prohibited.
+   - Code comments MUST use clean, natural phrasing without decorative punctuation noise that confuses screen readers and Braille displays.
+4. **Semantic Documentation & Mandatory Alt Text**:
+   - Technical documentation and markdown files MUST use strict hierarchical heading levels (`#`, `##`, `###` in sequential order without skipping levels).
+   - All embedded diagrams, architecture flowcharts, and screenshots MUST include meaningful, descriptive `alt` text and plain textual summary descriptions.
+5. **Editor Configuration (.editorconfig) Baseline**:
+   - All repository contributors and automation agents MUST respect `.editorconfig` rules across all supported languages.

roles/ensure_ansible_prereq/README.md

@@ -1,38 +0,0 @@
-Role Name
-=========
-
-A brief description of the role goes here.
-
-Requirements
-------------
-
-Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
-
-Role Variables
---------------
-
-A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
-
-Dependencies
-------------
-
-A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
-
-Example Playbook
-----------------
-
-Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
-
-    - hosts: servers
-      roles:
-         - { role: username.rolename, x: 42 }
-
-License
--------
-
-LGPL-3.0-or-later
-
-Author Information
-------------------
-
-An optional section for the role authors to include contact information, or a website (HTML is not allowed).

roles/ensure_ansible_prereq/tasks/main.yml

@@ -1,7 +1,17 @@
 ---
 # tasks file for ensure_ansible_prereq
+- name: Assert Target OS Is Supported
+  when:
+    - ansible_facts["system"] is defined
+  ansible.builtin.assert:
+    fail_msg: "Unsupported OS: {{ ansible_facts['distribution'] | default('unknown') }}"
+    quiet: true
+    that:
+      - ansible_facts["system"] == 'Linux'
+      - >-
+        ansible_facts["distribution"] in ['AlmaLinux', 'CentOS', 'Debian',
+        'Fedora', 'OracleLinux', 'Rocky', 'Ubuntu']
 - name: Include Vendor / Version Specific Tasks
-  when: ["ansible_facts[\"system\"] == 'Linux'"]
   ansible.builtin.include_tasks:
     file: '{{ lookup("first_found", findme) }}'
   vars:
@@ -20,7 +30,6 @@
         - default.yml
       errors: ignore
 - name: Include Vendor / Version Specific Variables
-  when: ["ansible_facts[\"system\"] == 'Linux'"]
   ansible.builtin.include_vars:
     file: '{{ lookup("first_found", findme) }}'
     name: ensure_ansible_prereq
@@ -42,17 +51,14 @@
       errors: ignore
 - name: Package Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["packages"] is not defined
   ansible.builtin.package_facts:
 - name: Service Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["services"] is not defined
   ansible.builtin.service_facts:
 - name: Ensure Packages
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_ansible_prereq is defined
     - ensure_ansible_prereq.package_list is defined
     - ensure_ansible_prereq.package_list is iterable
@@ -67,7 +73,6 @@
     - Ensure_Ansible_Prereq.Service_Facts
 - name: Ensure Configurations
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_ansible_prereq is defined
     - ensure_ansible_prereq.template_list is defined
     - ensure_ansible_prereq.template_list is iterable
@@ -77,7 +82,7 @@
     group: '{{ item.group | default(omit) }}'
     mode: '{{ item.mode | default(omit) }}'
     owner: '{{ item.owner | default(omit) }}'
-    selevel: '{{ iteml.selevel | default(omit) }}'
+    selevel: '{{ item.selevel | default(omit) }}'
     serole: '{{ item.serole | default(omit) }}'
     setype: '{{ item.setype | default(omit) }}'
     seuser: '{{ item.seuser | default(omit) }}'
@@ -92,7 +97,6 @@
     - Ensure_Ansible_Prereq.Service_Restart
 - name: Ensure Services
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_ansible_prereq is defined
     - ensure_ansible_prereq.service_list is defined
     - ensure_ansible_prereq.service_list is iterable
@@ -108,3 +112,22 @@
     - Ensure_Ansible_Prereq.Service_Facts
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
+- name: Post Verification Package Discovery
+  when:
+    - ensure_ansible_prereq is defined
+    - ensure_ansible_prereq.package_list is defined
+    - ensure_ansible_prereq.package_list is iterable
+  ansible.builtin.package_facts:
+- name: Assert Managed Packages Are Installed
+  when:
+    - ensure_ansible_prereq is defined
+    - ensure_ansible_prereq.package_list is defined
+    - ensure_ansible_prereq.package_list is iterable
+  ansible.builtin.assert:
+    fail_msg: "Package {{ item.name }} is not installed"
+    quiet: true
+    that:
+      - item.state != 'present' or ansible_facts['packages'][item.name] is defined
+  loop: "{{ ensure_ansible_prereq.package_list }}"
+  loop_control:
+    label: "{{ item.name }} will be verified"

roles/ensure_apache/LICENSE

@@ -1,163 +0,0 @@
-GNU LESSER GENERAL PUBLIC LICENSE
-
-Version 3, 29 June 2007
-
-Copyright (C) 2007 Free Software Foundation, Inc. <http s ://fsf.org/>
-
-Everyone is permitted to copy and distribute verbatim copies of this license
-document, but changing it is not allowed.
-
-This version of the GNU Lesser General Public License incorporates the terms
-and conditions of version 3 of the GNU General Public License, supplemented
-by the additional permissions listed below.
-
-   0. Additional Definitions.
-
-      
-
-As used herein, "this License" refers to version 3 of the GNU Lesser General
-Public License, and the "GNU GPL" refers to version 3 of the GNU General Public
-License.
-
-      
-
-"The Library" refers to a covered work governed by this License, other than
-an Application or a Combined Work as defined below.
-
-      
-
-An "Application" is any work that makes use of an interface provided by the
-Library, but which is not otherwise based on the Library. Defining a subclass
-of a class defined by the Library is deemed a mode of using an interface provided
-by the Library.
-
-      
-
-A "Combined Work" is a work produced by combining or linking an Application
-with the Library. The particular version of the Library with which the Combined
-Work was made is also called the "Linked Version".
-
-      
-
-The "Minimal Corresponding Source" for a Combined Work means the Corresponding
-Source for the Combined Work, excluding any source code for portions of the
-Combined Work that, considered in isolation, are based on the Application,
-and not on the Linked Version.
-
-      
-
-The "Corresponding Application Code" for a Combined Work means the object
-code and/or source code for the Application, including any data and utility
-programs needed for reproducing the Combined Work from the Application, but
-excluding the System Libraries of the Combined Work.
-
-   1. Exception to Section 3 of the GNU GPL.
-
-You may convey a covered work under sections 3 and 4 of this License without
-being bound by section 3 of the GNU GPL.
-
-   2. Conveying Modified Versions.
-
-If you modify a copy of the Library, and, in your modifications, a facility
-refers to a function or data to be supplied by an Application that uses the
-facility (other than as an argument passed when the facility is invoked),
-then you may convey a copy of the modified version:
-
-a) under this License, provided that you make a good faith effort to ensure
-that, in the event an Application does not supply the function or data, the
-facility still operates, and performs whatever part of its purpose remains
-meaningful, or
-
-b) under the GNU GPL, with none of the additional permissions of this License
-applicable to that copy.
-
-   3. Object Code Incorporating Material from Library Header Files.
-
-The object code form of an Application may incorporate material from a header
-file that is part of the Library. You may convey such object code under terms
-of your choice, provided that, if the incorporated material is not limited
-to numerical parameters, data structure layouts and accessors, or small macros,
-inline functions and templates (ten or fewer lines in length), you do both
-of the following:
-
-a) Give prominent notice with each copy of the object code that the Library
-is used in it and that the Library and its use are covered by this License.
-
-b) Accompany the object code with a copy of the GNU GPL and this license document.
-
-   4. Combined Works.
-
-You may convey a Combined Work under terms of your choice that, taken together,
-effectively do not restrict modification of the portions of the Library contained
-in the Combined Work and reverse engineering for debugging such modifications,
-if you also do each of the following:
-
-a) Give prominent notice with each copy of the Combined Work that the Library
-is used in it and that the Library and its use are covered by this License.
-
-b) Accompany the Combined Work with a copy of the GNU GPL and this license
-document.
-
-c) For a Combined Work that displays copyright notices during execution, include
-the copyright notice for the Library among these notices, as well as a reference
-directing the user to the copies of the GNU GPL and this license document.
-
-      d) Do one of the following:
-
-0) Convey the Minimal Corresponding Source under the terms of this License,
-and the Corresponding Application Code in a form suitable for, and under terms
-that permit, the user to recombine or relink the Application with a modified
-version of the Linked Version to produce a modified Combined Work, in the
-manner specified by section 6 of the GNU GPL for conveying Corresponding Source.
-
-1) Use a suitable shared library mechanism for linking with the Library. A
-suitable mechanism is one that (a) uses at run time a copy of the Library
-already present on the user's computer system, and (b) will operate properly
-with a modified version of the Library that is interface-compatible with the
-Linked Version.
-
-e) Provide Installation Information, but only if you would otherwise be required
-to provide such information under section 6 of the GNU GPL, and only to the
-extent that such information is necessary to install and execute a modified
-version of the Combined Work produced by recombining or relinking the Application
-with a modified version of the Linked Version. (If you use option 4d0, the
-Installation Information must accompany the Minimal Corresponding Source and
-Corresponding Application Code. If you use option 4d1, you must provide the
-Installation Information in the manner specified by section 6 of the GNU GPL
-for conveying Corresponding Source.)
-
-   5. Combined Libraries.
-
-You may place library facilities that are a work based on the Library side
-by side in a single library together with other library facilities that are
-not Applications and are not covered by this License, and convey such a combined
-library under terms of your choice, if you do both of the following:
-
-a) Accompany the combined library with a copy of the same work based on the
-Library, uncombined with any other library facilities, conveyed under the
-terms of this License.
-
-b) Give prominent notice with the combined library that part of it is a work
-based on the Library, and explaining where to find the accompanying uncombined
-form of the same work.
-
-   6. Revised Versions of the GNU Lesser General Public License.
-
-The Free Software Foundation may publish revised and/or new versions of the
-GNU Lesser General Public License from time to time. Such new versions will
-be similar in spirit to the present version, but may differ in detail to address
-new problems or concerns.
-
-Each version is given a distinguishing version number. If the Library as you
-received it specifies that a certain numbered version of the GNU Lesser General
-Public License "or any later version" applies to it, you have the option of
-following the terms and conditions either of that published version or of
-any later version published by the Free Software Foundation. If the Library
-as you received it does not specify a version number of the GNU Lesser General
-Public License, you may choose any version of the GNU Lesser General Public
-License ever published by the Free Software Foundation.
-
-If the Library as you received it specifies that a proxy can decide whether
-future versions of the GNU Lesser General Public License shall apply, that
-proxy's public statement of acceptance of any version is permanent authorization
-for you to choose that version for the Library.

roles/ensure_apache/tasks/main.yml

@@ -1,7 +1,17 @@
 ---
 # tasks file for ensure_apache
+- name: Assert Target OS Is Supported
+  when:
+    - ansible_facts["system"] is defined
+  ansible.builtin.assert:
+    fail_msg: "Unsupported OS: {{ ansible_facts['distribution'] | default('unknown') }}"
+    quiet: true
+    that:
+      - ansible_facts["system"] == 'Linux'
+      - >-
+        ansible_facts["distribution"] in ['AlmaLinux', 'CentOS', 'Debian',
+        'Fedora', 'OracleLinux', 'Rocky', 'Ubuntu']
 - name: Include Variables
-  when: ["ansible_facts[\"system\"] == 'Linux'"]
   ansible.builtin.include_vars:
     file: '{{ lookup("first_found", findme) }}'
     name: ensure_apache
@@ -23,17 +33,14 @@
       errors: ignore
 - name: Package Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["packages"] is not defined
   ansible.builtin.package_facts:
 - name: Service Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["services"] is not defined
   ansible.builtin.service_facts:
 - name: Ensure Sysctl
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_apache is defined
     - ensure_apache.sysctl_list is defined
     - ensure_apache.sysctl_list is iterable
@@ -54,7 +61,6 @@
     - Ensure_Apache.Service_Reload_Config
 - name: Ensure Packages
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_apache is defined
     - ensure_apache.package_list is defined
     - ensure_apache.package_list is iterable
@@ -71,7 +77,6 @@
     - Ensure_Apache.Service_Reload_Config
 - name: Ensure Seboolean
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_apache is defined
     - ensure_apache.seboolean_list is defined
     - ensure_apache.seboolean_list is iterable
@@ -89,7 +94,6 @@
     - Ensure_Apache.Service_Reload_Config
 - name: Ensure Configurations
   when:
-    - ansible_facts["system"] == 'Linux'
     - http_vhost is defined
     - ensure_apache is defined
     - ensure_apache.template_list is defined
@@ -100,7 +104,7 @@
     group: '{{ item.group | default(omit) }}'
     mode: '{{ item.mode | default(omit) }}'
     owner: '{{ item.owner | default(omit) }}'
-    selevel: '{{ iteml.selevel | default(omit) }}'
+    selevel: '{{ item.selevel | default(omit) }}'
     serole: '{{ item.serole | default(omit) }}'
     setype: '{{ item.setype | default(omit) }}'
     seuser: '{{ item.seuser | default(omit) }}'
@@ -115,7 +119,6 @@
     - Ensure_Apache.Service_Reload_Config
 - name: Ensure Firewall
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts.packages["firewalld"] is defined
     - ansible_facts.packages["python3-firewall"] is defined
     - ensure_apache is defined
@@ -135,7 +138,6 @@
     - Ensure_Apache.Service_Reload_Config
 - name: Ensure Permissions
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_apache is defined
     - http_vhost is defined
     - http_vhost is iterable
@@ -166,7 +168,6 @@
     - Ensure_Apache.Service_Reload_Config
 - name: Ensure Vhost Document Roots
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_apache is defined
     - http_vhost is defined
     - http_vhost is iterable
@@ -188,7 +189,6 @@
     - Ensure_Apache.Service_Reload_Config
 - name: Ensure Website Content From Git Repos
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_apache is defined
     - http_vhost is defined
     - http_vhost is iterable
@@ -208,7 +208,6 @@
     - Ensure_Apache.Service_Reload_Config
 - name: Ensure Services
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_apache is defined
     - ensure_apache.service_list is defined
     - ensure_apache.service_list is iterable
@@ -226,3 +225,27 @@
     - Ensure_Apache.Service_Reload_Config
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
+- name: Post Verification Service Discovery
+  when:
+    - ensure_apache is defined
+    - ensure_apache.service_list is defined
+    - ensure_apache.service_list is iterable
+  ansible.builtin.service_facts:
+- name: Assert Managed Services Are Active
+  when:
+    - ensure_apache is defined
+    - ensure_apache.service_list is defined
+    - ensure_apache.service_list is iterable
+  ansible.builtin.assert:
+    fail_msg: "Service {{ item.name }} is not active"
+    quiet: true
+    that:
+      - >-
+        item.state != 'started' or
+        (ansible_facts['services'][item.name ~ '.service'] is defined and
+        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
+        (ansible_facts['services'][item.name] is defined and
+        ansible_facts['services'][item.name]['state'] == 'running')
+  loop: "{{ ensure_apache.service_list }}"
+  loop_control:
+    label: "{{ item.name }} will be verified"

roles/ensure_cockpit/LICENSE

@@ -1,163 +0,0 @@
-GNU LESSER GENERAL PUBLIC LICENSE
-
-Version 3, 29 June 2007
-
-Copyright (C) 2007 Free Software Foundation, Inc. <http s ://fsf.org/>
-
-Everyone is permitted to copy and distribute verbatim copies of this license
-document, but changing it is not allowed.
-
-This version of the GNU Lesser General Public License incorporates the terms
-and conditions of version 3 of the GNU General Public License, supplemented
-by the additional permissions listed below.
-
-   0. Additional Definitions.
-
-      
-
-As used herein, "this License" refers to version 3 of the GNU Lesser General
-Public License, and the "GNU GPL" refers to version 3 of the GNU General Public
-License.
-
-      
-
-"The Library" refers to a covered work governed by this License, other than
-an Application or a Combined Work as defined below.
-
-      
-
-An "Application" is any work that makes use of an interface provided by the
-Library, but which is not otherwise based on the Library. Defining a subclass
-of a class defined by the Library is deemed a mode of using an interface provided
-by the Library.
-
-      
-
-A "Combined Work" is a work produced by combining or linking an Application
-with the Library. The particular version of the Library with which the Combined
-Work was made is also called the "Linked Version".
-
-      
-
-The "Minimal Corresponding Source" for a Combined Work means the Corresponding
-Source for the Combined Work, excluding any source code for portions of the
-Combined Work that, considered in isolation, are based on the Application,
-and not on the Linked Version.
-
-      
-
-The "Corresponding Application Code" for a Combined Work means the object
-code and/or source code for the Application, including any data and utility
-programs needed for reproducing the Combined Work from the Application, but
-excluding the System Libraries of the Combined Work.
-
-   1. Exception to Section 3 of the GNU GPL.
-
-You may convey a covered work under sections 3 and 4 of this License without
-being bound by section 3 of the GNU GPL.
-
-   2. Conveying Modified Versions.
-
-If you modify a copy of the Library, and, in your modifications, a facility
-refers to a function or data to be supplied by an Application that uses the
-facility (other than as an argument passed when the facility is invoked),
-then you may convey a copy of the modified version:
-
-a) under this License, provided that you make a good faith effort to ensure
-that, in the event an Application does not supply the function or data, the
-facility still operates, and performs whatever part of its purpose remains
-meaningful, or
-
-b) under the GNU GPL, with none of the additional permissions of this License
-applicable to that copy.
-
-   3. Object Code Incorporating Material from Library Header Files.
-
-The object code form of an Application may incorporate material from a header
-file that is part of the Library. You may convey such object code under terms
-of your choice, provided that, if the incorporated material is not limited
-to numerical parameters, data structure layouts and accessors, or small macros,
-inline functions and templates (ten or fewer lines in length), you do both
-of the following:
-
-a) Give prominent notice with each copy of the object code that the Library
-is used in it and that the Library and its use are covered by this License.
-
-b) Accompany the object code with a copy of the GNU GPL and this license document.
-
-   4. Combined Works.
-
-You may convey a Combined Work under terms of your choice that, taken together,
-effectively do not restrict modification of the portions of the Library contained
-in the Combined Work and reverse engineering for debugging such modifications,
-if you also do each of the following:
-
-a) Give prominent notice with each copy of the Combined Work that the Library
-is used in it and that the Library and its use are covered by this License.
-
-b) Accompany the Combined Work with a copy of the GNU GPL and this license
-document.
-
-c) For a Combined Work that displays copyright notices during execution, include
-the copyright notice for the Library among these notices, as well as a reference
-directing the user to the copies of the GNU GPL and this license document.
-
-      d) Do one of the following:
-
-0) Convey the Minimal Corresponding Source under the terms of this License,
-and the Corresponding Application Code in a form suitable for, and under terms
-that permit, the user to recombine or relink the Application with a modified
-version of the Linked Version to produce a modified Combined Work, in the
-manner specified by section 6 of the GNU GPL for conveying Corresponding Source.
-
-1) Use a suitable shared library mechanism for linking with the Library. A
-suitable mechanism is one that (a) uses at run time a copy of the Library
-already present on the user's computer system, and (b) will operate properly
-with a modified version of the Library that is interface-compatible with the
-Linked Version.
-
-e) Provide Installation Information, but only if you would otherwise be required
-to provide such information under section 6 of the GNU GPL, and only to the
-extent that such information is necessary to install and execute a modified
-version of the Combined Work produced by recombining or relinking the Application
-with a modified version of the Linked Version. (If you use option 4d0, the
-Installation Information must accompany the Minimal Corresponding Source and
-Corresponding Application Code. If you use option 4d1, you must provide the
-Installation Information in the manner specified by section 6 of the GNU GPL
-for conveying Corresponding Source.)
-
-   5. Combined Libraries.
-
-You may place library facilities that are a work based on the Library side
-by side in a single library together with other library facilities that are
-not Applications and are not covered by this License, and convey such a combined
-library under terms of your choice, if you do both of the following:
-
-a) Accompany the combined library with a copy of the same work based on the
-Library, uncombined with any other library facilities, conveyed under the
-terms of this License.
-
-b) Give prominent notice with the combined library that part of it is a work
-based on the Library, and explaining where to find the accompanying uncombined
-form of the same work.
-
-   6. Revised Versions of the GNU Lesser General Public License.
-
-The Free Software Foundation may publish revised and/or new versions of the
-GNU Lesser General Public License from time to time. Such new versions will
-be similar in spirit to the present version, but may differ in detail to address
-new problems or concerns.
-
-Each version is given a distinguishing version number. If the Library as you
-received it specifies that a certain numbered version of the GNU Lesser General
-Public License "or any later version" applies to it, you have the option of
-following the terms and conditions either of that published version or of
-any later version published by the Free Software Foundation. If the Library
-as you received it does not specify a version number of the GNU Lesser General
-Public License, you may choose any version of the GNU Lesser General Public
-License ever published by the Free Software Foundation.
-
-If the Library as you received it specifies that a proxy can decide whether
-future versions of the GNU Lesser General Public License shall apply, that
-proxy's public statement of acceptance of any version is permanent authorization
-for you to choose that version for the Library.

roles/ensure_cockpit/README.md

@@ -1,38 +0,0 @@
-Role Name
-=========
-
-Ensures cockpit is running
-
-Requirements
-------------
-
-Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
-
-Role Variables
---------------
-
-A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
-
-Dependencies
-------------
-
-A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
-
-Example Playbook
-----------------
-
-Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
-
-    - hosts: servers
-      roles:
-         - { role: username.rolename, x: 42 }
-
-License
--------
-
-LGPL-3.0-or-later
-
-Author Information
-------------------
-
-An optional section for the role authors to include contact information, or a website (HTML is not allowed).

roles/ensure_cockpit/tasks/main.yml

@@ -1,7 +1,17 @@
 ---
 # tasks file for ensure_cockpit
+- name: Assert Target OS Is Supported
+  when:
+    - ansible_facts["system"] is defined
+  ansible.builtin.assert:
+    fail_msg: "Unsupported OS: {{ ansible_facts['distribution'] | default('unknown') }}"
+    quiet: true
+    that:
+      - ansible_facts["system"] == 'Linux'
+      - >-
+        ansible_facts["distribution"] in ['AlmaLinux', 'CentOS', 'Debian',
+        'Fedora', 'OracleLinux', 'Rocky', 'Ubuntu']
 - name: Include Variables
-  when: ["ansible_facts[\"system\"] == 'Linux'"]
   ansible.builtin.include_vars:
     file: '{{ lookup("first_found", findme) }}'
     name: ensure_cockpit
@@ -23,17 +33,14 @@
       errors: ignore
 - name: Package Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["packages"] is not defined
   ansible.builtin.package_facts:
 - name: Service Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["services"] is not defined
   ansible.builtin.service_facts:
 - name: Ensure Packages
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_cockpit is defined
     - ensure_cockpit.package_list is defined
     - ensure_cockpit.package_list is iterable
@@ -46,7 +53,6 @@
   notify: [Ensure_Cockpit.Package_Facts, Ensure_Cockpit.Service_Facts]
 - name: Ensure Configurations
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_cockpit is defined
     - ensure_cockpit.template_list is defined
     - ensure_cockpit.template_list is iterable
@@ -56,7 +62,7 @@
     group: '{{ item.group | default(omit) }}'
     mode: '{{ item.mode | default(omit) }}'
     owner: '{{ item.owner | default(omit) }}'
-    selevel: '{{ iteml.selevel | default(omit) }}'
+    selevel: '{{ item.selevel | default(omit) }}'
     serole: '{{ item.serole | default(omit) }}'
     setype: '{{ item.setype | default(omit) }}'
     seuser: '{{ item.seuser | default(omit) }}'
@@ -71,7 +77,6 @@
     - Ensure_Cockpit.Service_Restart
 - name: Ensure Services
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_cockpit is defined
     - ensure_cockpit.service_list is defined
     - ensure_cockpit.service_list is iterable
@@ -85,7 +90,6 @@
   notify: [Ensure_Cockpit.Package_Facts, Ensure_Cockpit.Service_Facts]
 - name: Ensure Firewall
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts.packages["firewalld"] is defined
     - ansible_facts.packages["python3-firewall"] is defined
     - ensure_cockpit is defined
@@ -100,3 +104,27 @@
     label: '{{ item.service }} will be {{ item.state }}'
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
+- name: Post Verification Service Discovery
+  when:
+    - ensure_cockpit is defined
+    - ensure_cockpit.service_list is defined
+    - ensure_cockpit.service_list is iterable
+  ansible.builtin.service_facts:
+- name: Assert Managed Services Are Active
+  when:
+    - ensure_cockpit is defined
+    - ensure_cockpit.service_list is defined
+    - ensure_cockpit.service_list is iterable
+  ansible.builtin.assert:
+    fail_msg: "Service {{ item.name }} is not active"
+    quiet: true
+    that:
+      - >-
+        item.state != 'started' or
+        (ansible_facts['services'][item.name ~ '.service'] is defined and
+        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
+        (ansible_facts['services'][item.name] is defined and
+        ansible_facts['services'][item.name]['state'] == 'running')
+  loop: "{{ ensure_cockpit.service_list }}"
+  loop_control:
+    label: "{{ item.name }} will be verified"

roles/ensure_dbus/README.md

@@ -1,38 +0,0 @@
-Role Name
-=========
-
-A brief description of the role goes here.
-
-Requirements
-------------
-
-Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
-
-Role Variables
---------------
-
-A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
-
-Dependencies
-------------
-
-A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
-
-Example Playbook
-----------------
-
-Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
-
-    - hosts: servers
-      roles:
-         - { role: username.rolename, x: 42 }
-
-License
--------
-
-BSD
-
-Author Information
-------------------
-
-An optional section for the role authors to include contact information, or a website (HTML is not allowed).

roles/ensure_dbus/tasks/main.yml

@@ -1,7 +1,17 @@
 ---
 # tasks file for ensure_dbus
+- name: Assert Target OS Is Supported
+  when:
+    - ansible_facts["system"] is defined
+  ansible.builtin.assert:
+    fail_msg: "Unsupported OS: {{ ansible_facts['distribution'] | default('unknown') }}"
+    quiet: true
+    that:
+      - ansible_facts["system"] == 'Linux'
+      - >-
+        ansible_facts["distribution"] in ['AlmaLinux', 'CentOS', 'Debian',
+        'Fedora', 'OracleLinux', 'Rocky', 'Ubuntu']
 - name: Include Variables
-  when: ["ansible_facts[\"system\"] == 'Linux'"]
   ansible.builtin.include_vars:
     file: '{{ lookup("first_found", findme) }}'
     name: ensure_dbus
@@ -20,19 +30,16 @@
 
 - name: Package Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["packages"] is not defined
   ansible.builtin.package_facts:
 
 - name: Service Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["services"] is not defined
   ansible.builtin.service_facts:
 
 - name: Ensure Packages
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_dbus is defined
     - ensure_dbus.package_list is defined
     - ensure_dbus.package_list is iterable
@@ -46,7 +53,6 @@
 
 - name: Ensure Services
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_dbus is defined
     - ensure_dbus.service_list is defined
     - ensure_dbus.service_list is iterable
@@ -61,3 +67,27 @@
 
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
+- name: Post Verification Service Discovery
+  when:
+    - ensure_dbus is defined
+    - ensure_dbus.service_list is defined
+    - ensure_dbus.service_list is iterable
+  ansible.builtin.service_facts:
+- name: Assert Managed Services Are Active
+  when:
+    - ensure_dbus is defined
+    - ensure_dbus.service_list is defined
+    - ensure_dbus.service_list is iterable
+  ansible.builtin.assert:
+    fail_msg: "Service {{ item.name }} is not active"
+    quiet: true
+    that:
+      - >-
+        item.state != 'started' or
+        (ansible_facts['services'][item.name ~ '.service'] is defined and
+        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
+        (ansible_facts['services'][item.name] is defined and
+        ansible_facts['services'][item.name]['state'] == 'running')
+  loop: "{{ ensure_dbus.service_list }}"
+  loop_control:
+    label: "{{ item.name }} will be verified"

roles/ensure_dovecot/LICENSE

@@ -1,163 +0,0 @@
-GNU LESSER GENERAL PUBLIC LICENSE
-
-Version 3, 29 June 2007
-
-Copyright (C) 2007 Free Software Foundation, Inc. <http s ://fsf.org/>
-
-Everyone is permitted to copy and distribute verbatim copies of this license
-document, but changing it is not allowed.
-
-This version of the GNU Lesser General Public License incorporates the terms
-and conditions of version 3 of the GNU General Public License, supplemented
-by the additional permissions listed below.
-
-   0. Additional Definitions.
-
-      
-
-As used herein, "this License" refers to version 3 of the GNU Lesser General
-Public License, and the "GNU GPL" refers to version 3 of the GNU General Public
-License.
-
-      
-
-"The Library" refers to a covered work governed by this License, other than
-an Application or a Combined Work as defined below.
-
-      
-
-An "Application" is any work that makes use of an interface provided by the
-Library, but which is not otherwise based on the Library. Defining a subclass
-of a class defined by the Library is deemed a mode of using an interface provided
-by the Library.
-
-      
-
-A "Combined Work" is a work produced by combining or linking an Application
-with the Library. The particular version of the Library with which the Combined
-Work was made is also called the "Linked Version".
-
-      
-
-The "Minimal Corresponding Source" for a Combined Work means the Corresponding
-Source for the Combined Work, excluding any source code for portions of the
-Combined Work that, considered in isolation, are based on the Application,
-and not on the Linked Version.
-
-      
-
-The "Corresponding Application Code" for a Combined Work means the object
-code and/or source code for the Application, including any data and utility
-programs needed for reproducing the Combined Work from the Application, but
-excluding the System Libraries of the Combined Work.
-
-   1. Exception to Section 3 of the GNU GPL.
-
-You may convey a covered work under sections 3 and 4 of this License without
-being bound by section 3 of the GNU GPL.
-
-   2. Conveying Modified Versions.
-
-If you modify a copy of the Library, and, in your modifications, a facility
-refers to a function or data to be supplied by an Application that uses the
-facility (other than as an argument passed when the facility is invoked),
-then you may convey a copy of the modified version:
-
-a) under this License, provided that you make a good faith effort to ensure
-that, in the event an Application does not supply the function or data, the
-facility still operates, and performs whatever part of its purpose remains
-meaningful, or
-
-b) under the GNU GPL, with none of the additional permissions of this License
-applicable to that copy.
-
-   3. Object Code Incorporating Material from Library Header Files.
-
-The object code form of an Application may incorporate material from a header
-file that is part of the Library. You may convey such object code under terms
-of your choice, provided that, if the incorporated material is not limited
-to numerical parameters, data structure layouts and accessors, or small macros,
-inline functions and templates (ten or fewer lines in length), you do both
-of the following:
-
-a) Give prominent notice with each copy of the object code that the Library
-is used in it and that the Library and its use are covered by this License.
-
-b) Accompany the object code with a copy of the GNU GPL and this license document.
-
-   4. Combined Works.
-
-You may convey a Combined Work under terms of your choice that, taken together,
-effectively do not restrict modification of the portions of the Library contained
-in the Combined Work and reverse engineering for debugging such modifications,
-if you also do each of the following:
-
-a) Give prominent notice with each copy of the Combined Work that the Library
-is used in it and that the Library and its use are covered by this License.
-
-b) Accompany the Combined Work with a copy of the GNU GPL and this license
-document.
-
-c) For a Combined Work that displays copyright notices during execution, include
-the copyright notice for the Library among these notices, as well as a reference
-directing the user to the copies of the GNU GPL and this license document.
-
-      d) Do one of the following:
-
-0) Convey the Minimal Corresponding Source under the terms of this License,
-and the Corresponding Application Code in a form suitable for, and under terms
-that permit, the user to recombine or relink the Application with a modified
-version of the Linked Version to produce a modified Combined Work, in the
-manner specified by section 6 of the GNU GPL for conveying Corresponding Source.
-
-1) Use a suitable shared library mechanism for linking with the Library. A
-suitable mechanism is one that (a) uses at run time a copy of the Library
-already present on the user's computer system, and (b) will operate properly
-with a modified version of the Library that is interface-compatible with the
-Linked Version.
-
-e) Provide Installation Information, but only if you would otherwise be required
-to provide such information under section 6 of the GNU GPL, and only to the
-extent that such information is necessary to install and execute a modified
-version of the Combined Work produced by recombining or relinking the Application
-with a modified version of the Linked Version. (If you use option 4d0, the
-Installation Information must accompany the Minimal Corresponding Source and
-Corresponding Application Code. If you use option 4d1, you must provide the
-Installation Information in the manner specified by section 6 of the GNU GPL
-for conveying Corresponding Source.)
-
-   5. Combined Libraries.
-
-You may place library facilities that are a work based on the Library side
-by side in a single library together with other library facilities that are
-not Applications and are not covered by this License, and convey such a combined
-library under terms of your choice, if you do both of the following:
-
-a) Accompany the combined library with a copy of the same work based on the
-Library, uncombined with any other library facilities, conveyed under the
-terms of this License.
-
-b) Give prominent notice with the combined library that part of it is a work
-based on the Library, and explaining where to find the accompanying uncombined
-form of the same work.
-
-   6. Revised Versions of the GNU Lesser General Public License.
-
-The Free Software Foundation may publish revised and/or new versions of the
-GNU Lesser General Public License from time to time. Such new versions will
-be similar in spirit to the present version, but may differ in detail to address
-new problems or concerns.
-
-Each version is given a distinguishing version number. If the Library as you
-received it specifies that a certain numbered version of the GNU Lesser General
-Public License "or any later version" applies to it, you have the option of
-following the terms and conditions either of that published version or of
-any later version published by the Free Software Foundation. If the Library
-as you received it does not specify a version number of the GNU Lesser General
-Public License, you may choose any version of the GNU Lesser General Public
-License ever published by the Free Software Foundation.
-
-If the Library as you received it specifies that a proxy can decide whether
-future versions of the GNU Lesser General Public License shall apply, that
-proxy's public statement of acceptance of any version is permanent authorization
-for you to choose that version for the Library.

roles/ensure_dovecot/tasks/main.yml

@@ -1,7 +1,17 @@
 ---
 # tasks file for ensure_dovecot
+- name: Assert Target OS Is Supported
+  when:
+    - ansible_facts["system"] is defined
+  ansible.builtin.assert:
+    fail_msg: "Unsupported OS: {{ ansible_facts['distribution'] | default('unknown') }}"
+    quiet: true
+    that:
+      - ansible_facts["system"] == 'Linux'
+      - >-
+        ansible_facts["distribution"] in ['AlmaLinux', 'CentOS', 'Debian',
+        'Fedora', 'OracleLinux', 'Rocky', 'Ubuntu']
 - name: Include Variables
-  when: ["ansible_facts[\"system\"] == 'Linux'"]
   ansible.builtin.include_vars:
     file: '{{ lookup("first_found", findme) }}'
     name: ensure_dovecot
@@ -23,17 +33,14 @@
       errors: ignore
 - name: Package Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["packages"] is not defined
   ansible.builtin.package_facts:
 - name: Service Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["services"] is not defined
   ansible.builtin.service_facts:
 - name: Ensure Sysctl
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_dovecot is defined
     - ensure_dovecot.sysctl_list is defined
     - ensure_dovecot.sysctl_list is iterable
@@ -54,7 +61,6 @@
     - Ensure_Dovecot.Service_Reload_Config
 - name: Ensure Packages
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_dovecot is defined
     - ensure_dovecot.package_list is defined
     - ensure_dovecot.package_list is iterable
@@ -71,7 +77,6 @@
     - Ensure_Dovecot.Service_Reload_Config
 - name: Ensure Seboolean
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_dovecot is defined
     - ensure_dovecot.seboolean_list is defined
     - ensure_dovecot.seboolean_list is iterable
@@ -89,7 +94,6 @@
     - Ensure_Dovecot.Service_Reload_Config
 - name: Ensure Configurations
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_dovecot is defined
     - ensure_dovecot.template_list is defined
     - ensure_dovecot.template_list is iterable
@@ -99,7 +103,7 @@
     group: '{{ item.group | default(omit) }}'
     mode: '{{ item.mode | default(omit) }}'
     owner: '{{ item.owner | default(omit) }}'
-    selevel: '{{ iteml.selevel | default(omit) }}'
+    selevel: '{{ item.selevel | default(omit) }}'
     serole: '{{ item.serole | default(omit) }}'
     setype: '{{ item.setype | default(omit) }}'
     seuser: '{{ item.seuser | default(omit) }}'
@@ -114,7 +118,6 @@
     - Ensure_Dovecot.Service_Reload_Config
 - name: Ensure Firewall
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts.packages["firewalld"] is defined
     - ansible_facts.packages["python3-firewall"] is defined
     - ensure_dovecot is defined
@@ -134,7 +137,6 @@
     - Ensure_Dovecot.Service_Reload_Config
 - name: Ensure Services
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_dovecot is defined
     - ensure_dovecot.service_list is defined
     - ensure_dovecot.service_list is iterable
@@ -148,3 +150,27 @@
   notify: [Ensure_Dovecot.Package_Facts, Ensure_Dovecot.Service_Facts]
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
+- name: Post Verification Service Discovery
+  when:
+    - ensure_dovecot is defined
+    - ensure_dovecot.service_list is defined
+    - ensure_dovecot.service_list is iterable
+  ansible.builtin.service_facts:
+- name: Assert Managed Services Are Active
+  when:
+    - ensure_dovecot is defined
+    - ensure_dovecot.service_list is defined
+    - ensure_dovecot.service_list is iterable
+  ansible.builtin.assert:
+    fail_msg: "Service {{ item.name }} is not active"
+    quiet: true
+    that:
+      - >-
+        item.state != 'started' or
+        (ansible_facts['services'][item.name ~ '.service'] is defined and
+        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
+        (ansible_facts['services'][item.name] is defined and
+        ansible_facts['services'][item.name]['state'] == 'running')
+  loop: "{{ ensure_dovecot.service_list }}"
+  loop_control:
+    label: "{{ item.name }} will be verified"

roles/ensure_fail2ban/tasks/main.yml

@@ -1,7 +1,17 @@
 ---
 # tasks file for ensure_fail2ban
+- name: Assert Target OS Is Supported
+  when:
+    - ansible_facts["system"] is defined
+  ansible.builtin.assert:
+    fail_msg: "Unsupported OS: {{ ansible_facts['distribution'] | default('unknown') }}"
+    quiet: true
+    that:
+      - ansible_facts["system"] == 'Linux'
+      - >-
+        ansible_facts["distribution"] in ['AlmaLinux', 'CentOS', 'Debian',
+        'Fedora', 'OracleLinux', 'Rocky', 'Ubuntu']
 - name: Include Variables
-  when: ["ansible_facts[\"system\"] == 'Linux'"]
   ansible.builtin.include_vars:
     file: '{{ lookup("first_found", findme) }}'
     name: ensure_fail2ban
@@ -23,17 +33,14 @@
       errors: ignore
 - name: Package Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["packages"] is not defined
   ansible.builtin.package_facts:
 - name: Service Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["services"] is not defined
   ansible.builtin.service_facts:
 - name: Ensure Packages
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_fail2ban is defined
     - ensure_fail2ban.package_list is defined
     - ensure_fail2ban.package_list is iterable
@@ -46,7 +53,6 @@
   notify: [Ensure_Fail2ban.Package_Facts, Ensure_Fail2ban.Service_Facts]
 - name: Ensure Configurations
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_fail2ban is defined
     - ensure_fail2ban.template_list is defined
     - ensure_fail2ban.template_list is iterable
@@ -71,7 +77,6 @@
     - Ensure_Fail2ban.Service_Reload
 - name: Ensure Services
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_fail2ban is defined
     - ensure_fail2ban.service_list is defined
     - ensure_fail2ban.service_list is iterable
@@ -85,7 +90,6 @@
   notify: [Ensure_Fail2ban.Package_Facts, Ensure_Fail2ban.Service_Facts]
 - name: Ensure Selinux Is Configured
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_fail2ban is defined
     - ensure_fail2ban.selinux_policy is defined
     - ensure_fail2ban.selinux_state is defined
@@ -100,7 +104,6 @@
     - Ensure_Fail2ban.Service_Reload
 - name: Reboot If Required
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_fail2ban is defined
     - ensure_fail2ban.selinux_policy is defined
     - ensure_fail2ban.selinux_state is defined
@@ -110,7 +113,6 @@
   ansible.builtin.reboot:
 - name: Ensure Seboolean
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_fail2ban is defined
     - ensure_fail2ban.seboolean_list is defined
     - ensure_fail2ban.seboolean_list is iterable
@@ -128,3 +130,27 @@
     - Ensure_Fail2ban.Service_Reload
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
+- name: Post Verification Service Discovery
+  when:
+    - ensure_fail2ban is defined
+    - ensure_fail2ban.service_list is defined
+    - ensure_fail2ban.service_list is iterable
+  ansible.builtin.service_facts:
+- name: Assert Managed Services Are Active
+  when:
+    - ensure_fail2ban is defined
+    - ensure_fail2ban.service_list is defined
+    - ensure_fail2ban.service_list is iterable
+  ansible.builtin.assert:
+    fail_msg: "Service {{ item.name }} is not active"
+    quiet: true
+    that:
+      - >-
+        item.state != 'started' or
+        (ansible_facts['services'][item.name ~ '.service'] is defined and
+        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
+        (ansible_facts['services'][item.name] is defined and
+        ansible_facts['services'][item.name]['state'] == 'running')
+  loop: "{{ ensure_fail2ban.service_list }}"
+  loop_control:
+    label: "{{ item.name }} will be verified"

roles/ensure_firewalld/README.md

@@ -1,38 +0,0 @@
-Role Name
-=========
-
-A brief description of the role goes here.
-
-Requirements
-------------
-
-Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
-
-Role Variables
---------------
-
-A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
-
-Dependencies
-------------
-
-A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
-
-Example Playbook
-----------------
-
-Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
-
-    - hosts: servers
-      roles:
-         - { role: username.rolename, x: 42 }
-
-License
--------
-
-BSD
-
-Author Information
-------------------
-
-An optional section for the role authors to include contact information, or a website (HTML is not allowed).

roles/ensure_firewalld/tasks/main.yml

@@ -1,7 +1,17 @@
 ---
 # tasks file for ensure_firewalld
+- name: Assert Target OS Is Supported
+  when:
+    - ansible_facts["system"] is defined
+  ansible.builtin.assert:
+    fail_msg: "Unsupported OS: {{ ansible_facts['distribution'] | default('unknown') }}"
+    quiet: true
+    that:
+      - ansible_facts["system"] == 'Linux'
+      - >-
+        ansible_facts["distribution"] in ['AlmaLinux', 'CentOS', 'Debian',
+        'Fedora', 'OracleLinux', 'Rocky', 'Ubuntu']
 - name: Include Variables
-  when: ["ansible_facts[\"system\"] == 'Linux'"]
   ansible.builtin.include_vars:
     file: '{{ lookup("first_found", findme) }}'
     name: ensure_firewalld
@@ -20,19 +30,16 @@
 
 - name: Package Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["packages"] is not defined
   ansible.builtin.package_facts:
 
 - name: Service Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["services"] is not defined
   ansible.builtin.service_facts:
 
 - name: Ensure Packages
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_firewalld is defined
     - ensure_firewalld.package_list is defined
     - ensure_firewalld.package_list is iterable
@@ -46,7 +53,6 @@
 
 - name: Ensure Services
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_firewalld is defined
     - ensure_firewalld.service_list is defined
     - ensure_firewalld.service_list is iterable
@@ -64,7 +70,6 @@
 
 - name: Ensure Default Firewall Rules
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts.packages["firewalld"] is defined
     - ansible_facts.packages["python3-firewall"] is defined
     - ensure_firewalld is defined
@@ -80,3 +85,27 @@
 
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
+- name: Post Verification Service Discovery
+  when:
+    - ensure_firewalld is defined
+    - ensure_firewalld.service_list is defined
+    - ensure_firewalld.service_list is iterable
+  ansible.builtin.service_facts:
+- name: Assert Managed Services Are Active
+  when:
+    - ensure_firewalld is defined
+    - ensure_firewalld.service_list is defined
+    - ensure_firewalld.service_list is iterable
+  ansible.builtin.assert:
+    fail_msg: "Service {{ item.name }} is not active"
+    quiet: true
+    that:
+      - >-
+        item.state != 'started' or
+        (ansible_facts['services'][item.name ~ '.service'] is defined and
+        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
+        (ansible_facts['services'][item.name] is defined and
+        ansible_facts['services'][item.name]['state'] == 'running')
+  loop: "{{ ensure_firewalld.service_list }}"
+  loop_control:
+    label: "{{ item.name }} will be verified"

roles/ensure_git/LICENSE

@@ -1,163 +0,0 @@
-GNU LESSER GENERAL PUBLIC LICENSE
-
-Version 3, 29 June 2007
-
-Copyright (C) 2007 Free Software Foundation, Inc. <http s ://fsf.org/>
-
-Everyone is permitted to copy and distribute verbatim copies of this license
-document, but changing it is not allowed.
-
-This version of the GNU Lesser General Public License incorporates the terms
-and conditions of version 3 of the GNU General Public License, supplemented
-by the additional permissions listed below.
-
-   0. Additional Definitions.
-
-      
-
-As used herein, "this License" refers to version 3 of the GNU Lesser General
-Public License, and the "GNU GPL" refers to version 3 of the GNU General Public
-License.
-
-      
-
-"The Library" refers to a covered work governed by this License, other than
-an Application or a Combined Work as defined below.
-
-      
-
-An "Application" is any work that makes use of an interface provided by the
-Library, but which is not otherwise based on the Library. Defining a subclass
-of a class defined by the Library is deemed a mode of using an interface provided
-by the Library.
-
-      
-
-A "Combined Work" is a work produced by combining or linking an Application
-with the Library. The particular version of the Library with which the Combined
-Work was made is also called the "Linked Version".
-
-      
-
-The "Minimal Corresponding Source" for a Combined Work means the Corresponding
-Source for the Combined Work, excluding any source code for portions of the
-Combined Work that, considered in isolation, are based on the Application,
-and not on the Linked Version.
-
-      
-
-The "Corresponding Application Code" for a Combined Work means the object
-code and/or source code for the Application, including any data and utility
-programs needed for reproducing the Combined Work from the Application, but
-excluding the System Libraries of the Combined Work.
-
-   1. Exception to Section 3 of the GNU GPL.
-
-You may convey a covered work under sections 3 and 4 of this License without
-being bound by section 3 of the GNU GPL.
-
-   2. Conveying Modified Versions.
-
-If you modify a copy of the Library, and, in your modifications, a facility
-refers to a function or data to be supplied by an Application that uses the
-facility (other than as an argument passed when the facility is invoked),
-then you may convey a copy of the modified version:
-
-a) under this License, provided that you make a good faith effort to ensure
-that, in the event an Application does not supply the function or data, the
-facility still operates, and performs whatever part of its purpose remains
-meaningful, or
-
-b) under the GNU GPL, with none of the additional permissions of this License
-applicable to that copy.
-
-   3. Object Code Incorporating Material from Library Header Files.
-
-The object code form of an Application may incorporate material from a header
-file that is part of the Library. You may convey such object code under terms
-of your choice, provided that, if the incorporated material is not limited
-to numerical parameters, data structure layouts and accessors, or small macros,
-inline functions and templates (ten or fewer lines in length), you do both
-of the following:
-
-a) Give prominent notice with each copy of the object code that the Library
-is used in it and that the Library and its use are covered by this License.
-
-b) Accompany the object code with a copy of the GNU GPL and this license document.
-
-   4. Combined Works.
-
-You may convey a Combined Work under terms of your choice that, taken together,
-effectively do not restrict modification of the portions of the Library contained
-in the Combined Work and reverse engineering for debugging such modifications,
-if you also do each of the following:
-
-a) Give prominent notice with each copy of the Combined Work that the Library
-is used in it and that the Library and its use are covered by this License.
-
-b) Accompany the Combined Work with a copy of the GNU GPL and this license
-document.
-
-c) For a Combined Work that displays copyright notices during execution, include
-the copyright notice for the Library among these notices, as well as a reference
-directing the user to the copies of the GNU GPL and this license document.
-
-      d) Do one of the following:
-
-0) Convey the Minimal Corresponding Source under the terms of this License,
-and the Corresponding Application Code in a form suitable for, and under terms
-that permit, the user to recombine or relink the Application with a modified
-version of the Linked Version to produce a modified Combined Work, in the
-manner specified by section 6 of the GNU GPL for conveying Corresponding Source.
-
-1) Use a suitable shared library mechanism for linking with the Library. A
-suitable mechanism is one that (a) uses at run time a copy of the Library
-already present on the user's computer system, and (b) will operate properly
-with a modified version of the Library that is interface-compatible with the
-Linked Version.
-
-e) Provide Installation Information, but only if you would otherwise be required
-to provide such information under section 6 of the GNU GPL, and only to the
-extent that such information is necessary to install and execute a modified
-version of the Combined Work produced by recombining or relinking the Application
-with a modified version of the Linked Version. (If you use option 4d0, the
-Installation Information must accompany the Minimal Corresponding Source and
-Corresponding Application Code. If you use option 4d1, you must provide the
-Installation Information in the manner specified by section 6 of the GNU GPL
-for conveying Corresponding Source.)
-
-   5. Combined Libraries.
-
-You may place library facilities that are a work based on the Library side
-by side in a single library together with other library facilities that are
-not Applications and are not covered by this License, and convey such a combined
-library under terms of your choice, if you do both of the following:
-
-a) Accompany the combined library with a copy of the same work based on the
-Library, uncombined with any other library facilities, conveyed under the
-terms of this License.
-
-b) Give prominent notice with the combined library that part of it is a work
-based on the Library, and explaining where to find the accompanying uncombined
-form of the same work.
-
-   6. Revised Versions of the GNU Lesser General Public License.
-
-The Free Software Foundation may publish revised and/or new versions of the
-GNU Lesser General Public License from time to time. Such new versions will
-be similar in spirit to the present version, but may differ in detail to address
-new problems or concerns.
-
-Each version is given a distinguishing version number. If the Library as you
-received it specifies that a certain numbered version of the GNU Lesser General
-Public License "or any later version" applies to it, you have the option of
-following the terms and conditions either of that published version or of
-any later version published by the Free Software Foundation. If the Library
-as you received it does not specify a version number of the GNU Lesser General
-Public License, you may choose any version of the GNU Lesser General Public
-License ever published by the Free Software Foundation.
-
-If the Library as you received it specifies that a proxy can decide whether
-future versions of the GNU Lesser General Public License shall apply, that
-proxy's public statement of acceptance of any version is permanent authorization
-for you to choose that version for the Library.

roles/ensure_git/README.md

@@ -1,38 +0,0 @@
-Role Name
-=========
-
-A brief description of the role goes here.
-
-Requirements
-------------
-
-Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
-
-Role Variables
---------------
-
-A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
-
-Dependencies
-------------
-
-A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
-
-Example Playbook
-----------------
-
-Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
-
-    - hosts: servers
-      roles:
-         - { role: username.rolename, x: 42 }
-
-License
--------
-
-BSD
-
-Author Information
-------------------
-
-An optional section for the role authors to include contact information, or a website (HTML is not allowed).

roles/ensure_git/tasks/main.yml

@@ -1,7 +1,17 @@
 ---
 # tasks file for ensure_git
+- name: Assert Target OS Is Supported
+  when:
+    - ansible_facts["system"] is defined
+  ansible.builtin.assert:
+    fail_msg: "Unsupported OS: {{ ansible_facts['distribution'] | default('unknown') }}"
+    quiet: true
+    that:
+      - ansible_facts["system"] == 'Linux'
+      - >-
+        ansible_facts["distribution"] in ['AlmaLinux', 'CentOS', 'Debian',
+        'Fedora', 'OracleLinux', 'Rocky', 'Ubuntu']
 - name: Include Variables
-  when: ["ansible_facts[\"system\"] == 'Linux'"]
   ansible.builtin.include_vars:
     file: '{{ lookup("first_found", findme) }}'
     name: ensure_git
@@ -23,17 +33,14 @@
       errors: ignore
 - name: Package Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["packages"] is not defined
   ansible.builtin.package_facts:
 - name: Service Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["services"] is not defined
   ansible.builtin.service_facts:
 - name: Ensure Packages
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_git is defined
     - ensure_git.package_list is defined
     - ensure_git.package_list is iterable
@@ -46,7 +53,6 @@
   notify: [Ensure_Git.Package_Facts, Ensure_Git.Service_Facts]
 - name: Ensure Configurations
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_git is defined
     - ensure_git.template_list is defined
     - ensure_git.template_list is iterable
@@ -71,7 +77,6 @@
     - Ensure_Git.Service_Restart
 - name: Ensure Services
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_git is defined
     - ensure_git.service_list is defined
     - ensure_git.service_list is iterable
@@ -85,7 +90,6 @@
   notify: [Ensure_Git.Package_Facts, Ensure_Git.Service_Facts]
 - name: Ensure Selinux Is Configured
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_git is defined
     - ensure_git.selinux_policy is defined
     - ensure_git.selinux_state is defined
@@ -100,7 +104,6 @@
     - Ensure_Git.Service_Restart
 - name: Reboot If Required
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_git is defined
     - ensure_git.selinux_policy is defined
     - ensure_git.selinux_state is defined
@@ -110,7 +113,6 @@
   ansible.builtin.reboot:
 - name: Ensure Seboolean
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_git is defined
     - ensure_git.seboolean_list is defined
     - ensure_git.seboolean_list is iterable
@@ -128,3 +130,22 @@
     - Ensure_Git.Service_Restart
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
+- name: Post Verification Package Discovery
+  when:
+    - ensure_git is defined
+    - ensure_git.package_list is defined
+    - ensure_git.package_list is iterable
+  ansible.builtin.package_facts:
+- name: Assert Managed Packages Are Installed
+  when:
+    - ensure_git is defined
+    - ensure_git.package_list is defined
+    - ensure_git.package_list is iterable
+  ansible.builtin.assert:
+    fail_msg: "Package {{ item.name }} is not installed"
+    quiet: true
+    that:
+      - item.state != 'present' or ansible_facts['packages'][item.name] is defined
+  loop: "{{ ensure_git.package_list }}"
+  loop_control:
+    label: "{{ item.name }} will be verified"

roles/ensure_gitea/LICENSE

@@ -1,163 +0,0 @@
-GNU LESSER GENERAL PUBLIC LICENSE
-
-Version 3, 29 June 2007
-
-Copyright (C) 2007 Free Software Foundation, Inc. <http s ://fsf.org/>
-
-Everyone is permitted to copy and distribute verbatim copies of this license
-document, but changing it is not allowed.
-
-This version of the GNU Lesser General Public License incorporates the terms
-and conditions of version 3 of the GNU General Public License, supplemented
-by the additional permissions listed below.
-
-   0. Additional Definitions.
-
-      
-
-As used herein, "this License" refers to version 3 of the GNU Lesser General
-Public License, and the "GNU GPL" refers to version 3 of the GNU General Public
-License.
-
-      
-
-"The Library" refers to a covered work governed by this License, other than
-an Application or a Combined Work as defined below.
-
-      
-
-An "Application" is any work that makes use of an interface provided by the
-Library, but which is not otherwise based on the Library. Defining a subclass
-of a class defined by the Library is deemed a mode of using an interface provided
-by the Library.
-
-      
-
-A "Combined Work" is a work produced by combining or linking an Application
-with the Library. The particular version of the Library with which the Combined
-Work was made is also called the "Linked Version".
-
-      
-
-The "Minimal Corresponding Source" for a Combined Work means the Corresponding
-Source for the Combined Work, excluding any source code for portions of the
-Combined Work that, considered in isolation, are based on the Application,
-and not on the Linked Version.
-
-      
-
-The "Corresponding Application Code" for a Combined Work means the object
-code and/or source code for the Application, including any data and utility
-programs needed for reproducing the Combined Work from the Application, but
-excluding the System Libraries of the Combined Work.
-
-   1. Exception to Section 3 of the GNU GPL.
-
-You may convey a covered work under sections 3 and 4 of this License without
-being bound by section 3 of the GNU GPL.
-
-   2. Conveying Modified Versions.
-
-If you modify a copy of the Library, and, in your modifications, a facility
-refers to a function or data to be supplied by an Application that uses the
-facility (other than as an argument passed when the facility is invoked),
-then you may convey a copy of the modified version:
-
-a) under this License, provided that you make a good faith effort to ensure
-that, in the event an Application does not supply the function or data, the
-facility still operates, and performs whatever part of its purpose remains
-meaningful, or
-
-b) under the GNU GPL, with none of the additional permissions of this License
-applicable to that copy.
-
-   3. Object Code Incorporating Material from Library Header Files.
-
-The object code form of an Application may incorporate material from a header
-file that is part of the Library. You may convey such object code under terms
-of your choice, provided that, if the incorporated material is not limited
-to numerical parameters, data structure layouts and accessors, or small macros,
-inline functions and templates (ten or fewer lines in length), you do both
-of the following:
-
-a) Give prominent notice with each copy of the object code that the Library
-is used in it and that the Library and its use are covered by this License.
-
-b) Accompany the object code with a copy of the GNU GPL and this license document.
-
-   4. Combined Works.
-
-You may convey a Combined Work under terms of your choice that, taken together,
-effectively do not restrict modification of the portions of the Library contained
-in the Combined Work and reverse engineering for debugging such modifications,
-if you also do each of the following:
-
-a) Give prominent notice with each copy of the Combined Work that the Library
-is used in it and that the Library and its use are covered by this License.
-
-b) Accompany the Combined Work with a copy of the GNU GPL and this license
-document.
-
-c) For a Combined Work that displays copyright notices during execution, include
-the copyright notice for the Library among these notices, as well as a reference
-directing the user to the copies of the GNU GPL and this license document.
-
-      d) Do one of the following:
-
-0) Convey the Minimal Corresponding Source under the terms of this License,
-and the Corresponding Application Code in a form suitable for, and under terms
-that permit, the user to recombine or relink the Application with a modified
-version of the Linked Version to produce a modified Combined Work, in the
-manner specified by section 6 of the GNU GPL for conveying Corresponding Source.
-
-1) Use a suitable shared library mechanism for linking with the Library. A
-suitable mechanism is one that (a) uses at run time a copy of the Library
-already present on the user's computer system, and (b) will operate properly
-with a modified version of the Library that is interface-compatible with the
-Linked Version.
-
-e) Provide Installation Information, but only if you would otherwise be required
-to provide such information under section 6 of the GNU GPL, and only to the
-extent that such information is necessary to install and execute a modified
-version of the Combined Work produced by recombining or relinking the Application
-with a modified version of the Linked Version. (If you use option 4d0, the
-Installation Information must accompany the Minimal Corresponding Source and
-Corresponding Application Code. If you use option 4d1, you must provide the
-Installation Information in the manner specified by section 6 of the GNU GPL
-for conveying Corresponding Source.)
-
-   5. Combined Libraries.
-
-You may place library facilities that are a work based on the Library side
-by side in a single library together with other library facilities that are
-not Applications and are not covered by this License, and convey such a combined
-library under terms of your choice, if you do both of the following:
-
-a) Accompany the combined library with a copy of the same work based on the
-Library, uncombined with any other library facilities, conveyed under the
-terms of this License.
-
-b) Give prominent notice with the combined library that part of it is a work
-based on the Library, and explaining where to find the accompanying uncombined
-form of the same work.
-
-   6. Revised Versions of the GNU Lesser General Public License.
-
-The Free Software Foundation may publish revised and/or new versions of the
-GNU Lesser General Public License from time to time. Such new versions will
-be similar in spirit to the present version, but may differ in detail to address
-new problems or concerns.
-
-Each version is given a distinguishing version number. If the Library as you
-received it specifies that a certain numbered version of the GNU Lesser General
-Public License "or any later version" applies to it, you have the option of
-following the terms and conditions either of that published version or of
-any later version published by the Free Software Foundation. If the Library
-as you received it does not specify a version number of the GNU Lesser General
-Public License, you may choose any version of the GNU Lesser General Public
-License ever published by the Free Software Foundation.
-
-If the Library as you received it specifies that a proxy can decide whether
-future versions of the GNU Lesser General Public License shall apply, that
-proxy's public statement of acceptance of any version is permanent authorization
-for you to choose that version for the Library.

roles/ensure_gitea/tasks/main.yml

@@ -1,7 +1,17 @@
 ---
 # tasks file for ensure_gitea
+- name: Assert Target OS Is Supported
+  when:
+    - ansible_facts["system"] is defined
+  ansible.builtin.assert:
+    fail_msg: "Unsupported OS: {{ ansible_facts['distribution'] | default('unknown') }}"
+    quiet: true
+    that:
+      - ansible_facts["system"] == 'Linux'
+      - >-
+        ansible_facts["distribution"] in ['AlmaLinux', 'CentOS', 'Debian',
+        'Fedora', 'OracleLinux', 'Rocky', 'Ubuntu']
 - name: Include Variables
-  when: ["ansible_facts[\"system\"] == 'Linux'"]
   ansible.builtin.include_vars:
     file: '{{ lookup("first_found", findme) }}'
     name: ensure_gitea
@@ -23,17 +33,14 @@
       errors: ignore
 - name: Package Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["packages"] is not defined
   ansible.builtin.package_facts:
 - name: Service Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["services"] is not defined
   ansible.builtin.service_facts:
 - name: Ensure Yum Repository
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["pkg_mgr"] == 'dnf' or ansible_facts["pkg_mgr"] == 'dnf5'
     - ensure_gitea is defined
     - ensure_gitea.yum_repository_list is defined
@@ -96,7 +103,6 @@
     - Ensure_Gitea.Service_Restart
 - name: Ensure Sysctl
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_gitea is defined
     - ensure_gitea.sysctl_list is defined
     - ensure_gitea.sysctl_list is iterable
@@ -117,7 +123,6 @@
     - Ensure_Gitea.Service_Restart
 - name: Ensure Packages
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_gitea is defined
     - ensure_gitea.package_list is defined
     - ensure_gitea.package_list is iterable
@@ -134,7 +139,6 @@
     - Ensure_Gitea.Service_Restart
 - name: Ensure Seboolean
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_gitea is defined
     - ensure_gitea.seboolean_list is defined
     - ensure_gitea.seboolean_list is iterable
@@ -152,7 +156,6 @@
     - Ensure_Gitea.Service_Restart
 - name: Ensure Configurations
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_gitea is defined
     - ensure_gitea.template_list is defined
     - ensure_gitea.template_list is iterable
@@ -162,7 +165,7 @@
     group: '{{ item.group | default(omit) }}'
     mode: '{{ item.mode | default(omit) }}'
     owner: '{{ item.owner | default(omit) }}'
-    selevel: '{{ iteml.selevel | default(omit) }}'
+    selevel: '{{ item.selevel | default(omit) }}'
     serole: '{{ item.serole | default(omit) }}'
     setype: '{{ item.setype | default(omit) }}'
     seuser: '{{ item.seuser | default(omit) }}'
@@ -177,7 +180,6 @@
     - Ensure_Gitea.Service_Restart
 - name: Ensure Firewall
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts.packages["firewalld"] is defined
     - ansible_facts.packages["python3-firewall"] is defined
     - ensure_gitea is defined
@@ -197,7 +199,6 @@
     - Ensure_Gitea.Service_Restart
 - name: Ensure Services
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_gitea is defined
     - ensure_gitea.service_list is defined
     - ensure_gitea.service_list is iterable
@@ -215,3 +216,27 @@
     - Ensure_Gitea.Service_Restart
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
+- name: Post Verification Service Discovery
+  when:
+    - ensure_gitea is defined
+    - ensure_gitea.service_list is defined
+    - ensure_gitea.service_list is iterable
+  ansible.builtin.service_facts:
+- name: Assert Managed Services Are Active
+  when:
+    - ensure_gitea is defined
+    - ensure_gitea.service_list is defined
+    - ensure_gitea.service_list is iterable
+  ansible.builtin.assert:
+    fail_msg: "Service {{ item.name }} is not active"
+    quiet: true
+    that:
+      - >-
+        item.state != 'started' or
+        (ansible_facts['services'][item.name ~ '.service'] is defined and
+        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
+        (ansible_facts['services'][item.name] is defined and
+        ansible_facts['services'][item.name]['state'] == 'running')
+  loop: "{{ ensure_gitea.service_list }}"
+  loop_control:
+    label: "{{ item.name }} will be verified"

roles/ensure_hostname/LICENSE

@@ -1,163 +0,0 @@
-GNU LESSER GENERAL PUBLIC LICENSE
-
-Version 3, 29 June 2007
-
-Copyright (C) 2007 Free Software Foundation, Inc. <http s ://fsf.org/>
-
-Everyone is permitted to copy and distribute verbatim copies of this license
-document, but changing it is not allowed.
-
-This version of the GNU Lesser General Public License incorporates the terms
-and conditions of version 3 of the GNU General Public License, supplemented
-by the additional permissions listed below.
-
-   0. Additional Definitions.
-
-      
-
-As used herein, "this License" refers to version 3 of the GNU Lesser General
-Public License, and the "GNU GPL" refers to version 3 of the GNU General Public
-License.
-
-      
-
-"The Library" refers to a covered work governed by this License, other than
-an Application or a Combined Work as defined below.
-
-      
-
-An "Application" is any work that makes use of an interface provided by the
-Library, but which is not otherwise based on the Library. Defining a subclass
-of a class defined by the Library is deemed a mode of using an interface provided
-by the Library.
-
-      
-
-A "Combined Work" is a work produced by combining or linking an Application
-with the Library. The particular version of the Library with which the Combined
-Work was made is also called the "Linked Version".
-
-      
-
-The "Minimal Corresponding Source" for a Combined Work means the Corresponding
-Source for the Combined Work, excluding any source code for portions of the
-Combined Work that, considered in isolation, are based on the Application,
-and not on the Linked Version.
-
-      
-
-The "Corresponding Application Code" for a Combined Work means the object
-code and/or source code for the Application, including any data and utility
-programs needed for reproducing the Combined Work from the Application, but
-excluding the System Libraries of the Combined Work.
-
-   1. Exception to Section 3 of the GNU GPL.
-
-You may convey a covered work under sections 3 and 4 of this License without
-being bound by section 3 of the GNU GPL.
-
-   2. Conveying Modified Versions.
-
-If you modify a copy of the Library, and, in your modifications, a facility
-refers to a function or data to be supplied by an Application that uses the
-facility (other than as an argument passed when the facility is invoked),
-then you may convey a copy of the modified version:
-
-a) under this License, provided that you make a good faith effort to ensure
-that, in the event an Application does not supply the function or data, the
-facility still operates, and performs whatever part of its purpose remains
-meaningful, or
-
-b) under the GNU GPL, with none of the additional permissions of this License
-applicable to that copy.
-
-   3. Object Code Incorporating Material from Library Header Files.
-
-The object code form of an Application may incorporate material from a header
-file that is part of the Library. You may convey such object code under terms
-of your choice, provided that, if the incorporated material is not limited
-to numerical parameters, data structure layouts and accessors, or small macros,
-inline functions and templates (ten or fewer lines in length), you do both
-of the following:
-
-a) Give prominent notice with each copy of the object code that the Library
-is used in it and that the Library and its use are covered by this License.
-
-b) Accompany the object code with a copy of the GNU GPL and this license document.
-
-   4. Combined Works.
-
-You may convey a Combined Work under terms of your choice that, taken together,
-effectively do not restrict modification of the portions of the Library contained
-in the Combined Work and reverse engineering for debugging such modifications,
-if you also do each of the following:
-
-a) Give prominent notice with each copy of the Combined Work that the Library
-is used in it and that the Library and its use are covered by this License.
-
-b) Accompany the Combined Work with a copy of the GNU GPL and this license
-document.
-
-c) For a Combined Work that displays copyright notices during execution, include
-the copyright notice for the Library among these notices, as well as a reference
-directing the user to the copies of the GNU GPL and this license document.
-
-      d) Do one of the following:
-
-0) Convey the Minimal Corresponding Source under the terms of this License,
-and the Corresponding Application Code in a form suitable for, and under terms
-that permit, the user to recombine or relink the Application with a modified
-version of the Linked Version to produce a modified Combined Work, in the
-manner specified by section 6 of the GNU GPL for conveying Corresponding Source.
-
-1) Use a suitable shared library mechanism for linking with the Library. A
-suitable mechanism is one that (a) uses at run time a copy of the Library
-already present on the user's computer system, and (b) will operate properly
-with a modified version of the Library that is interface-compatible with the
-Linked Version.
-
-e) Provide Installation Information, but only if you would otherwise be required
-to provide such information under section 6 of the GNU GPL, and only to the
-extent that such information is necessary to install and execute a modified
-version of the Combined Work produced by recombining or relinking the Application
-with a modified version of the Linked Version. (If you use option 4d0, the
-Installation Information must accompany the Minimal Corresponding Source and
-Corresponding Application Code. If you use option 4d1, you must provide the
-Installation Information in the manner specified by section 6 of the GNU GPL
-for conveying Corresponding Source.)
-
-   5. Combined Libraries.
-
-You may place library facilities that are a work based on the Library side
-by side in a single library together with other library facilities that are
-not Applications and are not covered by this License, and convey such a combined
-library under terms of your choice, if you do both of the following:
-
-a) Accompany the combined library with a copy of the same work based on the
-Library, uncombined with any other library facilities, conveyed under the
-terms of this License.
-
-b) Give prominent notice with the combined library that part of it is a work
-based on the Library, and explaining where to find the accompanying uncombined
-form of the same work.
-
-   6. Revised Versions of the GNU Lesser General Public License.
-
-The Free Software Foundation may publish revised and/or new versions of the
-GNU Lesser General Public License from time to time. Such new versions will
-be similar in spirit to the present version, but may differ in detail to address
-new problems or concerns.
-
-Each version is given a distinguishing version number. If the Library as you
-received it specifies that a certain numbered version of the GNU Lesser General
-Public License "or any later version" applies to it, you have the option of
-following the terms and conditions either of that published version or of
-any later version published by the Free Software Foundation. If the Library
-as you received it does not specify a version number of the GNU Lesser General
-Public License, you may choose any version of the GNU Lesser General Public
-License ever published by the Free Software Foundation.
-
-If the Library as you received it specifies that a proxy can decide whether
-future versions of the GNU Lesser General Public License shall apply, that
-proxy's public statement of acceptance of any version is permanent authorization
-for you to choose that version for the Library.

roles/ensure_hostname/README.md

@@ -1,38 +0,0 @@
-Role Name
-=========
-
-A brief description of the role goes here.
-
-Requirements
-------------
-
-Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
-
-Role Variables
---------------
-
-A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
-
-Dependencies
-------------
-
-A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
-
-Example Playbook
-----------------
-
-Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
-
-    - hosts: servers
-      roles:
-         - { role: username.rolename, x: 42 }
-
-License
--------
-
-BSD
-
-Author Information
-------------------
-
-An optional section for the role authors to include contact information, or a website (HTML is not allowed).

roles/ensure_hostname/tasks/main.yml

@@ -1,8 +1,22 @@
 ---
 # tasks file for ensure_hostname
+- name: Assert Target OS Is Supported
+  when:
+    - ansible_facts["system"] is defined
+  ansible.builtin.assert:
+    fail_msg: "Unsupported OS: {{ ansible_facts['system'] | default('unknown') }}"
+    quiet: true
+    that:
+      - ansible_facts["system"] == 'Linux'
 - name: Set Hostname If Localhost
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["fqdn"] == 'localhost.localdomain'
   ansible.builtin.hostname:
     name: '{{ inventory_hostname }}'
+- name: Assert Hostname Verification
+  ansible.builtin.assert:
+    fail_msg: "Hostname is not defined"
+    quiet: true
+    that:
+      - ansible_facts["nodename"] is defined
+      - ansible_facts["nodename"] != ''

roles/ensure_log_rotation/LICENSE

@@ -1,163 +0,0 @@
-GNU LESSER GENERAL PUBLIC LICENSE
-
-Version 3, 29 June 2007
-
-Copyright (C) 2007 Free Software Foundation, Inc. <http s ://fsf.org/>
-
-Everyone is permitted to copy and distribute verbatim copies of this license
-document, but changing it is not allowed.
-
-This version of the GNU Lesser General Public License incorporates the terms
-and conditions of version 3 of the GNU General Public License, supplemented
-by the additional permissions listed below.
-
-   0. Additional Definitions.
-
-      
-
-As used herein, "this License" refers to version 3 of the GNU Lesser General
-Public License, and the "GNU GPL" refers to version 3 of the GNU General Public
-License.
-
-      
-
-"The Library" refers to a covered work governed by this License, other than
-an Application or a Combined Work as defined below.
-
-      
-
-An "Application" is any work that makes use of an interface provided by the
-Library, but which is not otherwise based on the Library. Defining a subclass
-of a class defined by the Library is deemed a mode of using an interface provided
-by the Library.
-
-      
-
-A "Combined Work" is a work produced by combining or linking an Application
-with the Library. The particular version of the Library with which the Combined
-Work was made is also called the "Linked Version".
-
-      
-
-The "Minimal Corresponding Source" for a Combined Work means the Corresponding
-Source for the Combined Work, excluding any source code for portions of the
-Combined Work that, considered in isolation, are based on the Application,
-and not on the Linked Version.
-
-      
-
-The "Corresponding Application Code" for a Combined Work means the object
-code and/or source code for the Application, including any data and utility
-programs needed for reproducing the Combined Work from the Application, but
-excluding the System Libraries of the Combined Work.
-
-   1. Exception to Section 3 of the GNU GPL.
-
-You may convey a covered work under sections 3 and 4 of this License without
-being bound by section 3 of the GNU GPL.
-
-   2. Conveying Modified Versions.
-
-If you modify a copy of the Library, and, in your modifications, a facility
-refers to a function or data to be supplied by an Application that uses the
-facility (other than as an argument passed when the facility is invoked),
-then you may convey a copy of the modified version:
-
-a) under this License, provided that you make a good faith effort to ensure
-that, in the event an Application does not supply the function or data, the
-facility still operates, and performs whatever part of its purpose remains
-meaningful, or
-
-b) under the GNU GPL, with none of the additional permissions of this License
-applicable to that copy.
-
-   3. Object Code Incorporating Material from Library Header Files.
-
-The object code form of an Application may incorporate material from a header
-file that is part of the Library. You may convey such object code under terms
-of your choice, provided that, if the incorporated material is not limited
-to numerical parameters, data structure layouts and accessors, or small macros,
-inline functions and templates (ten or fewer lines in length), you do both
-of the following:
-
-a) Give prominent notice with each copy of the object code that the Library
-is used in it and that the Library and its use are covered by this License.
-
-b) Accompany the object code with a copy of the GNU GPL and this license document.
-
-   4. Combined Works.
-
-You may convey a Combined Work under terms of your choice that, taken together,
-effectively do not restrict modification of the portions of the Library contained
-in the Combined Work and reverse engineering for debugging such modifications,
-if you also do each of the following:
-
-a) Give prominent notice with each copy of the Combined Work that the Library
-is used in it and that the Library and its use are covered by this License.
-
-b) Accompany the Combined Work with a copy of the GNU GPL and this license
-document.
-
-c) For a Combined Work that displays copyright notices during execution, include
-the copyright notice for the Library among these notices, as well as a reference
-directing the user to the copies of the GNU GPL and this license document.
-
-      d) Do one of the following:
-
-0) Convey the Minimal Corresponding Source under the terms of this License,
-and the Corresponding Application Code in a form suitable for, and under terms
-that permit, the user to recombine or relink the Application with a modified
-version of the Linked Version to produce a modified Combined Work, in the
-manner specified by section 6 of the GNU GPL for conveying Corresponding Source.
-
-1) Use a suitable shared library mechanism for linking with the Library. A
-suitable mechanism is one that (a) uses at run time a copy of the Library
-already present on the user's computer system, and (b) will operate properly
-with a modified version of the Library that is interface-compatible with the
-Linked Version.
-
-e) Provide Installation Information, but only if you would otherwise be required
-to provide such information under section 6 of the GNU GPL, and only to the
-extent that such information is necessary to install and execute a modified
-version of the Combined Work produced by recombining or relinking the Application
-with a modified version of the Linked Version. (If you use option 4d0, the
-Installation Information must accompany the Minimal Corresponding Source and
-Corresponding Application Code. If you use option 4d1, you must provide the
-Installation Information in the manner specified by section 6 of the GNU GPL
-for conveying Corresponding Source.)
-
-   5. Combined Libraries.
-
-You may place library facilities that are a work based on the Library side
-by side in a single library together with other library facilities that are
-not Applications and are not covered by this License, and convey such a combined
-library under terms of your choice, if you do both of the following:
-
-a) Accompany the combined library with a copy of the same work based on the
-Library, uncombined with any other library facilities, conveyed under the
-terms of this License.
-
-b) Give prominent notice with the combined library that part of it is a work
-based on the Library, and explaining where to find the accompanying uncombined
-form of the same work.
-
-   6. Revised Versions of the GNU Lesser General Public License.
-
-The Free Software Foundation may publish revised and/or new versions of the
-GNU Lesser General Public License from time to time. Such new versions will
-be similar in spirit to the present version, but may differ in detail to address
-new problems or concerns.
-
-Each version is given a distinguishing version number. If the Library as you
-received it specifies that a certain numbered version of the GNU Lesser General
-Public License "or any later version" applies to it, you have the option of
-following the terms and conditions either of that published version or of
-any later version published by the Free Software Foundation. If the Library
-as you received it does not specify a version number of the GNU Lesser General
-Public License, you may choose any version of the GNU Lesser General Public
-License ever published by the Free Software Foundation.
-
-If the Library as you received it specifies that a proxy can decide whether
-future versions of the GNU Lesser General Public License shall apply, that
-proxy's public statement of acceptance of any version is permanent authorization
-for you to choose that version for the Library.

roles/ensure_log_rotation/tasks/main.yml

@@ -1,7 +1,17 @@
 ---
 # tasks file for ensure_log_rotation
+- name: Assert Target OS Is Supported
+  when:
+    - ansible_facts["system"] is defined
+  ansible.builtin.assert:
+    fail_msg: "Unsupported OS: {{ ansible_facts['distribution'] | default('unknown') }}"
+    quiet: true
+    that:
+      - ansible_facts["system"] == 'Linux'
+      - >-
+        ansible_facts["distribution"] in ['AlmaLinux', 'CentOS', 'Debian',
+        'Fedora', 'OracleLinux', 'Rocky', 'Ubuntu']
 - name: Include Variables
-  when: ["ansible_facts[\"system\"] == 'Linux'"]
   ansible.builtin.include_vars:
     file: '{{ lookup("first_found", findme) }}'
     name: ensure_log_rotation
@@ -23,17 +33,14 @@
       errors: ignore
 - name: Package Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["packages"] is not defined
   ansible.builtin.package_facts:
 - name: Service Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["services"] is not defined
   ansible.builtin.service_facts:
 - name: Ensure Packages
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_log_rotation is defined
     - ensure_log_rotation.package_list is defined
     - ensure_log_rotation.package_list is iterable
@@ -48,7 +55,6 @@
     - Ensure_Log_Rotation.Service_Facts
 - name: Ensure Configuration
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_log_rotation is defined
     - ensure_log_rotation.template_list is defined
     - ensure_log_rotation.template_list is iterable
@@ -77,7 +83,6 @@
     - Ensure_Log_Rotation.Service_Restart
 - name: Ensure Services
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_log_rotation is defined
     - ensure_log_rotation.service_list is defined
     - ensure_log_rotation.service_list is iterable
@@ -93,3 +98,15 @@
     - Ensure_Log_Rotation.Service_Facts
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
+- name: Assert Logrotate Configuration
+  ansible.builtin.stat:
+    path: /etc/logrotate.conf
+  register: _logrotate_stat
+- name: Assert Logrotate File Exists
+  when:
+    - _logrotate_stat.stat is defined
+  ansible.builtin.assert:
+    fail_msg: "/etc/logrotate.conf does not exist"
+    quiet: true
+    that:
+      - _logrotate_stat.stat.exists

roles/ensure_mariadb/LICENSE

@@ -1,163 +0,0 @@
-GNU LESSER GENERAL PUBLIC LICENSE
-
-Version 3, 29 June 2007
-
-Copyright (C) 2007 Free Software Foundation, Inc. <http s ://fsf.org/>
-
-Everyone is permitted to copy and distribute verbatim copies of this license
-document, but changing it is not allowed.
-
-This version of the GNU Lesser General Public License incorporates the terms
-and conditions of version 3 of the GNU General Public License, supplemented
-by the additional permissions listed below.
-
-   0. Additional Definitions.
-
-      
-
-As used herein, "this License" refers to version 3 of the GNU Lesser General
-Public License, and the "GNU GPL" refers to version 3 of the GNU General Public
-License.
-
-      
-
-"The Library" refers to a covered work governed by this License, other than
-an Application or a Combined Work as defined below.
-
-      
-
-An "Application" is any work that makes use of an interface provided by the
-Library, but which is not otherwise based on the Library. Defining a subclass
-of a class defined by the Library is deemed a mode of using an interface provided
-by the Library.
-
-      
-
-A "Combined Work" is a work produced by combining or linking an Application
-with the Library. The particular version of the Library with which the Combined
-Work was made is also called the "Linked Version".
-
-      
-
-The "Minimal Corresponding Source" for a Combined Work means the Corresponding
-Source for the Combined Work, excluding any source code for portions of the
-Combined Work that, considered in isolation, are based on the Application,
-and not on the Linked Version.
-
-      
-
-The "Corresponding Application Code" for a Combined Work means the object
-code and/or source code for the Application, including any data and utility
-programs needed for reproducing the Combined Work from the Application, but
-excluding the System Libraries of the Combined Work.
-
-   1. Exception to Section 3 of the GNU GPL.
-
-You may convey a covered work under sections 3 and 4 of this License without
-being bound by section 3 of the GNU GPL.
-
-   2. Conveying Modified Versions.
-
-If you modify a copy of the Library, and, in your modifications, a facility
-refers to a function or data to be supplied by an Application that uses the
-facility (other than as an argument passed when the facility is invoked),
-then you may convey a copy of the modified version:
-
-a) under this License, provided that you make a good faith effort to ensure
-that, in the event an Application does not supply the function or data, the
-facility still operates, and performs whatever part of its purpose remains
-meaningful, or
-
-b) under the GNU GPL, with none of the additional permissions of this License
-applicable to that copy.
-
-   3. Object Code Incorporating Material from Library Header Files.
-
-The object code form of an Application may incorporate material from a header
-file that is part of the Library. You may convey such object code under terms
-of your choice, provided that, if the incorporated material is not limited
-to numerical parameters, data structure layouts and accessors, or small macros,
-inline functions and templates (ten or fewer lines in length), you do both
-of the following:
-
-a) Give prominent notice with each copy of the object code that the Library
-is used in it and that the Library and its use are covered by this License.
-
-b) Accompany the object code with a copy of the GNU GPL and this license document.
-
-   4. Combined Works.
-
-You may convey a Combined Work under terms of your choice that, taken together,
-effectively do not restrict modification of the portions of the Library contained
-in the Combined Work and reverse engineering for debugging such modifications,
-if you also do each of the following:
-
-a) Give prominent notice with each copy of the Combined Work that the Library
-is used in it and that the Library and its use are covered by this License.
-
-b) Accompany the Combined Work with a copy of the GNU GPL and this license
-document.
-
-c) For a Combined Work that displays copyright notices during execution, include
-the copyright notice for the Library among these notices, as well as a reference
-directing the user to the copies of the GNU GPL and this license document.
-
-      d) Do one of the following:
-
-0) Convey the Minimal Corresponding Source under the terms of this License,
-and the Corresponding Application Code in a form suitable for, and under terms
-that permit, the user to recombine or relink the Application with a modified
-version of the Linked Version to produce a modified Combined Work, in the
-manner specified by section 6 of the GNU GPL for conveying Corresponding Source.
-
-1) Use a suitable shared library mechanism for linking with the Library. A
-suitable mechanism is one that (a) uses at run time a copy of the Library
-already present on the user's computer system, and (b) will operate properly
-with a modified version of the Library that is interface-compatible with the
-Linked Version.
-
-e) Provide Installation Information, but only if you would otherwise be required
-to provide such information under section 6 of the GNU GPL, and only to the
-extent that such information is necessary to install and execute a modified
-version of the Combined Work produced by recombining or relinking the Application
-with a modified version of the Linked Version. (If you use option 4d0, the
-Installation Information must accompany the Minimal Corresponding Source and
-Corresponding Application Code. If you use option 4d1, you must provide the
-Installation Information in the manner specified by section 6 of the GNU GPL
-for conveying Corresponding Source.)
-
-   5. Combined Libraries.
-
-You may place library facilities that are a work based on the Library side
-by side in a single library together with other library facilities that are
-not Applications and are not covered by this License, and convey such a combined
-library under terms of your choice, if you do both of the following:
-
-a) Accompany the combined library with a copy of the same work based on the
-Library, uncombined with any other library facilities, conveyed under the
-terms of this License.
-
-b) Give prominent notice with the combined library that part of it is a work
-based on the Library, and explaining where to find the accompanying uncombined
-form of the same work.
-
-   6. Revised Versions of the GNU Lesser General Public License.
-
-The Free Software Foundation may publish revised and/or new versions of the
-GNU Lesser General Public License from time to time. Such new versions will
-be similar in spirit to the present version, but may differ in detail to address
-new problems or concerns.
-
-Each version is given a distinguishing version number. If the Library as you
-received it specifies that a certain numbered version of the GNU Lesser General
-Public License "or any later version" applies to it, you have the option of
-following the terms and conditions either of that published version or of
-any later version published by the Free Software Foundation. If the Library
-as you received it does not specify a version number of the GNU Lesser General
-Public License, you may choose any version of the GNU Lesser General Public
-License ever published by the Free Software Foundation.
-
-If the Library as you received it specifies that a proxy can decide whether
-future versions of the GNU Lesser General Public License shall apply, that
-proxy's public statement of acceptance of any version is permanent authorization
-for you to choose that version for the Library.

roles/ensure_mariadb/tasks/main.yml

@@ -1,7 +1,17 @@
 ---
 # tasks file for ensure_mariadb
+- name: Assert Target OS Is Supported
+  when:
+    - ansible_facts["system"] is defined
+  ansible.builtin.assert:
+    fail_msg: "Unsupported OS: {{ ansible_facts['distribution'] | default('unknown') }}"
+    quiet: true
+    that:
+      - ansible_facts["system"] == 'Linux'
+      - >-
+        ansible_facts["distribution"] in ['AlmaLinux', 'CentOS', 'Debian',
+        'Fedora', 'OracleLinux', 'Rocky', 'Ubuntu']
 - name: Include Variables
-  when: ["ansible_facts[\"system\"] == 'Linux'"]
   ansible.builtin.include_vars:
     file: '{{ lookup("first_found", findme) }}'
     name: ensure_mariadb
@@ -23,17 +33,14 @@
       errors: ignore
 - name: Package Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["packages"] is not defined
   ansible.builtin.package_facts:
 - name: Service Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["services"] is not defined
   ansible.builtin.service_facts:
 - name: Ensure Sysctl
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_mariadb is defined
     - ensure_mariadb.sysctl_list is defined
     - ensure_mariadb.sysctl_list is iterable
@@ -54,7 +61,6 @@
     - Ensure_Mariadb.Service_Restart
 - name: Ensure Packages
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_mariadb is defined
     - ensure_mariadb.package_list is defined
     - ensure_mariadb.package_list is iterable
@@ -71,7 +77,6 @@
     - Ensure_Mariadb.Service_Restart
 - name: Ensure Seboolean
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_mariadb is defined
     - ensure_mariadb.seboolean_list is defined
     - ensure_mariadb.seboolean_list is iterable
@@ -89,7 +94,6 @@
     - Ensure_Mariadb.Service_Restart
 - name: Ensure Configurations
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_mariadb is defined
     - ensure_mariadb.template_list is defined
     - ensure_mariadb.template_list is iterable
@@ -99,7 +103,7 @@
     group: '{{ item.group | default(omit) }}'
     mode: '{{ item.mode | default(omit) }}'
     owner: '{{ item.owner | default(omit) }}'
-    selevel: '{{ iteml.selevel | default(omit) }}'
+    selevel: '{{ item.selevel | default(omit) }}'
     serole: '{{ item.serole | default(omit) }}'
     setype: '{{ item.setype | default(omit) }}'
     seuser: '{{ item.seuser | default(omit) }}'
@@ -114,7 +118,6 @@
     - Ensure_Mariadb.Service_Restart
 - name: Ensure Firewall
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts.packages["firewalld"] is defined
     - ansible_facts.packages["python3-firewall"] is defined
     - ensure_mariadb is defined
@@ -134,7 +137,6 @@
     - Ensure_Mariadb.Service_Restart
 - name: Ensure Services
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_mariadb is defined
     - ensure_mariadb.service_list is defined
     - ensure_mariadb.service_list is iterable
@@ -230,3 +232,27 @@
   loop: '{{ mariadb_user_list }}'
   loop_control:
     label: '{{ item.name }} will be {{ item.state }}'
+- name: Post Verification Service Discovery
+  when:
+    - ensure_mariadb is defined
+    - ensure_mariadb.service_list is defined
+    - ensure_mariadb.service_list is iterable
+  ansible.builtin.service_facts:
+- name: Assert Managed Services Are Active
+  when:
+    - ensure_mariadb is defined
+    - ensure_mariadb.service_list is defined
+    - ensure_mariadb.service_list is iterable
+  ansible.builtin.assert:
+    fail_msg: "Service {{ item.name }} is not active"
+    quiet: true
+    that:
+      - >-
+        item.state != 'started' or
+        (ansible_facts['services'][item.name ~ '.service'] is defined and
+        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
+        (ansible_facts['services'][item.name] is defined and
+        ansible_facts['services'][item.name]['state'] == 'running')
+  loop: "{{ ensure_mariadb.service_list }}"
+  loop_control:
+    label: "{{ item.name }} will be verified"

roles/ensure_os_patch/LICENSE

@@ -1,163 +0,0 @@
-GNU LESSER GENERAL PUBLIC LICENSE
-
-Version 3, 29 June 2007
-
-Copyright (C) 2007 Free Software Foundation, Inc. <http s ://fsf.org/>
-
-Everyone is permitted to copy and distribute verbatim copies of this license
-document, but changing it is not allowed.
-
-This version of the GNU Lesser General Public License incorporates the terms
-and conditions of version 3 of the GNU General Public License, supplemented
-by the additional permissions listed below.
-
-   0. Additional Definitions.
-
-      
-
-As used herein, "this License" refers to version 3 of the GNU Lesser General
-Public License, and the "GNU GPL" refers to version 3 of the GNU General Public
-License.
-
-      
-
-"The Library" refers to a covered work governed by this License, other than
-an Application or a Combined Work as defined below.
-
-      
-
-An "Application" is any work that makes use of an interface provided by the
-Library, but which is not otherwise based on the Library. Defining a subclass
-of a class defined by the Library is deemed a mode of using an interface provided
-by the Library.
-
-      
-
-A "Combined Work" is a work produced by combining or linking an Application
-with the Library. The particular version of the Library with which the Combined
-Work was made is also called the "Linked Version".
-
-      
-
-The "Minimal Corresponding Source" for a Combined Work means the Corresponding
-Source for the Combined Work, excluding any source code for portions of the
-Combined Work that, considered in isolation, are based on the Application,
-and not on the Linked Version.
-
-      
-
-The "Corresponding Application Code" for a Combined Work means the object
-code and/or source code for the Application, including any data and utility
-programs needed for reproducing the Combined Work from the Application, but
-excluding the System Libraries of the Combined Work.
-
-   1. Exception to Section 3 of the GNU GPL.
-
-You may convey a covered work under sections 3 and 4 of this License without
-being bound by section 3 of the GNU GPL.
-
-   2. Conveying Modified Versions.
-
-If you modify a copy of the Library, and, in your modifications, a facility
-refers to a function or data to be supplied by an Application that uses the
-facility (other than as an argument passed when the facility is invoked),
-then you may convey a copy of the modified version:
-
-a) under this License, provided that you make a good faith effort to ensure
-that, in the event an Application does not supply the function or data, the
-facility still operates, and performs whatever part of its purpose remains
-meaningful, or
-
-b) under the GNU GPL, with none of the additional permissions of this License
-applicable to that copy.
-
-   3. Object Code Incorporating Material from Library Header Files.
-
-The object code form of an Application may incorporate material from a header
-file that is part of the Library. You may convey such object code under terms
-of your choice, provided that, if the incorporated material is not limited
-to numerical parameters, data structure layouts and accessors, or small macros,
-inline functions and templates (ten or fewer lines in length), you do both
-of the following:
-
-a) Give prominent notice with each copy of the object code that the Library
-is used in it and that the Library and its use are covered by this License.
-
-b) Accompany the object code with a copy of the GNU GPL and this license document.
-
-   4. Combined Works.
-
-You may convey a Combined Work under terms of your choice that, taken together,
-effectively do not restrict modification of the portions of the Library contained
-in the Combined Work and reverse engineering for debugging such modifications,
-if you also do each of the following:
-
-a) Give prominent notice with each copy of the Combined Work that the Library
-is used in it and that the Library and its use are covered by this License.
-
-b) Accompany the Combined Work with a copy of the GNU GPL and this license
-document.
-
-c) For a Combined Work that displays copyright notices during execution, include
-the copyright notice for the Library among these notices, as well as a reference
-directing the user to the copies of the GNU GPL and this license document.
-
-      d) Do one of the following:
-
-0) Convey the Minimal Corresponding Source under the terms of this License,
-and the Corresponding Application Code in a form suitable for, and under terms
-that permit, the user to recombine or relink the Application with a modified
-version of the Linked Version to produce a modified Combined Work, in the
-manner specified by section 6 of the GNU GPL for conveying Corresponding Source.
-
-1) Use a suitable shared library mechanism for linking with the Library. A
-suitable mechanism is one that (a) uses at run time a copy of the Library
-already present on the user's computer system, and (b) will operate properly
-with a modified version of the Library that is interface-compatible with the
-Linked Version.
-
-e) Provide Installation Information, but only if you would otherwise be required
-to provide such information under section 6 of the GNU GPL, and only to the
-extent that such information is necessary to install and execute a modified
-version of the Combined Work produced by recombining or relinking the Application
-with a modified version of the Linked Version. (If you use option 4d0, the
-Installation Information must accompany the Minimal Corresponding Source and
-Corresponding Application Code. If you use option 4d1, you must provide the
-Installation Information in the manner specified by section 6 of the GNU GPL
-for conveying Corresponding Source.)
-
-   5. Combined Libraries.
-
-You may place library facilities that are a work based on the Library side
-by side in a single library together with other library facilities that are
-not Applications and are not covered by this License, and convey such a combined
-library under terms of your choice, if you do both of the following:
-
-a) Accompany the combined library with a copy of the same work based on the
-Library, uncombined with any other library facilities, conveyed under the
-terms of this License.
-
-b) Give prominent notice with the combined library that part of it is a work
-based on the Library, and explaining where to find the accompanying uncombined
-form of the same work.
-
-   6. Revised Versions of the GNU Lesser General Public License.
-
-The Free Software Foundation may publish revised and/or new versions of the
-GNU Lesser General Public License from time to time. Such new versions will
-be similar in spirit to the present version, but may differ in detail to address
-new problems or concerns.
-
-Each version is given a distinguishing version number. If the Library as you
-received it specifies that a certain numbered version of the GNU Lesser General
-Public License "or any later version" applies to it, you have the option of
-following the terms and conditions either of that published version or of
-any later version published by the Free Software Foundation. If the Library
-as you received it does not specify a version number of the GNU Lesser General
-Public License, you may choose any version of the GNU Lesser General Public
-License ever published by the Free Software Foundation.
-
-If the Library as you received it specifies that a proxy can decide whether
-future versions of the GNU Lesser General Public License shall apply, that
-proxy's public statement of acceptance of any version is permanent authorization
-for you to choose that version for the Library.

roles/ensure_os_patch/README.md

@@ -1,38 +0,0 @@
-Role Name
-=========
-
-Ensure OS is patched
-
-Requirements
-------------
-
-Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
-
-Role Variables
---------------
-
-A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
-
-Dependencies
-------------
-
-A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
-
-Example Playbook
-----------------
-
-Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
-
-    - hosts: servers
-      roles:
-         - { role: username.rolename, x: 42 }
-
-License
--------
-
-LGPL-3.0-or-later
-
-Author Information
-------------------
-
-An optional section for the role authors to include contact information, or a website (HTML is not allowed).

roles/ensure_os_patch/tasks/main.yml

@@ -1,7 +1,17 @@
 ---
 # tasks file for ensure_os_patch
+- name: Assert Target OS Is Supported
+  when:
+    - ansible_facts["system"] is defined
+  ansible.builtin.assert:
+    fail_msg: "Unsupported OS: {{ ansible_facts['distribution'] | default('unknown') }}"
+    quiet: true
+    that:
+      - ansible_facts["system"] == 'Linux'
+      - >-
+        ansible_facts["distribution"] in ['AlmaLinux', 'CentOS', 'Debian',
+        'Fedora', 'OracleLinux', 'Rocky', 'Ubuntu']
 - name: Include Variables
-  when: ["ansible_facts[\"system\"] == 'Linux'"]
   ansible.builtin.include_vars:
     file: '{{ lookup("first_found", findme) }}'
     name: ensure_os_patch
@@ -23,17 +33,14 @@
       errors: ignore
 - name: Package Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["packages"] is not defined
   ansible.builtin.package_facts:
 - name: Service Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["services"] is not defined
   ansible.builtin.service_facts:
 - name: Ensure Packages
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_os_patch is defined
     - ensure_os_patch.package_list is defined
     - ensure_os_patch.package_list is iterable
@@ -46,7 +53,6 @@
   notify: [Ensure_Os_Patch.Package_Facts, Ensure_Os_Patch.Service_Facts]
 - name: Ensure Apt Patch
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["pkg_mgr"] == 'apt'
   ansible.builtin.apt:
     autoclean: 'yes'
@@ -56,7 +62,6 @@
   notify: [Ensure_Os_Patch.Package_Facts, Ensure_Os_Patch.Service_Facts]
 - name: Ensure Dnf
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["pkg_mgr"] == 'dnf'
   ansible.builtin.dnf:
     name: '*'
@@ -65,7 +70,6 @@
   notify: [Ensure_Os_Patch.Package_Facts, Ensure_Os_Patch.Service_Facts]
 - name: Ensure Dnf5
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["pkg_mgr"] == 'dnf5'
   ansible.builtin.dnf5:
     name: '*'
@@ -74,7 +78,6 @@
   notify: [Ensure_Os_Patch.Package_Facts, Ensure_Os_Patch.Service_Facts]
 - name: Ensure Services
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_os_patch is defined
     - ensure_os_patch.service_list is defined
     - ensure_os_patch.service_list is iterable
@@ -88,3 +91,22 @@
   notify: [Ensure_Os_Patch.Package_Facts, Ensure_Os_Patch.Service_Facts]
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
+- name: Post Verification Package Discovery
+  when:
+    - ensure_os_patch is defined
+    - ensure_os_patch.package_list is defined
+    - ensure_os_patch.package_list is iterable
+  ansible.builtin.package_facts:
+- name: Assert Managed Packages Are Installed
+  when:
+    - ensure_os_patch is defined
+    - ensure_os_patch.package_list is defined
+    - ensure_os_patch.package_list is iterable
+  ansible.builtin.assert:
+    fail_msg: "Package {{ item.name }} is not installed"
+    quiet: true
+    that:
+      - item.state != 'present' or ansible_facts['packages'][item.name] is defined
+  loop: "{{ ensure_os_patch.package_list }}"
+  loop_control:
+    label: "{{ item.name }} will be verified"

roles/ensure_os_upgrade/LICENSE

@@ -1,163 +0,0 @@
-GNU LESSER GENERAL PUBLIC LICENSE
-
-Version 3, 29 June 2007
-
-Copyright (C) 2007 Free Software Foundation, Inc. <http s ://fsf.org/>
-
-Everyone is permitted to copy and distribute verbatim copies of this license
-document, but changing it is not allowed.
-
-This version of the GNU Lesser General Public License incorporates the terms
-and conditions of version 3 of the GNU General Public License, supplemented
-by the additional permissions listed below.
-
-   0. Additional Definitions.
-
-      
-
-As used herein, "this License" refers to version 3 of the GNU Lesser General
-Public License, and the "GNU GPL" refers to version 3 of the GNU General Public
-License.
-
-      
-
-"The Library" refers to a covered work governed by this License, other than
-an Application or a Combined Work as defined below.
-
-      
-
-An "Application" is any work that makes use of an interface provided by the
-Library, but which is not otherwise based on the Library. Defining a subclass
-of a class defined by the Library is deemed a mode of using an interface provided
-by the Library.
-
-      
-
-A "Combined Work" is a work produced by combining or linking an Application
-with the Library. The particular version of the Library with which the Combined
-Work was made is also called the "Linked Version".
-
-      
-
-The "Minimal Corresponding Source" for a Combined Work means the Corresponding
-Source for the Combined Work, excluding any source code for portions of the
-Combined Work that, considered in isolation, are based on the Application,
-and not on the Linked Version.
-
-      
-
-The "Corresponding Application Code" for a Combined Work means the object
-code and/or source code for the Application, including any data and utility
-programs needed for reproducing the Combined Work from the Application, but
-excluding the System Libraries of the Combined Work.
-
-   1. Exception to Section 3 of the GNU GPL.
-
-You may convey a covered work under sections 3 and 4 of this License without
-being bound by section 3 of the GNU GPL.
-
-   2. Conveying Modified Versions.
-
-If you modify a copy of the Library, and, in your modifications, a facility
-refers to a function or data to be supplied by an Application that uses the
-facility (other than as an argument passed when the facility is invoked),
-then you may convey a copy of the modified version:
-
-a) under this License, provided that you make a good faith effort to ensure
-that, in the event an Application does not supply the function or data, the
-facility still operates, and performs whatever part of its purpose remains
-meaningful, or
-
-b) under the GNU GPL, with none of the additional permissions of this License
-applicable to that copy.
-
-   3. Object Code Incorporating Material from Library Header Files.
-
-The object code form of an Application may incorporate material from a header
-file that is part of the Library. You may convey such object code under terms
-of your choice, provided that, if the incorporated material is not limited
-to numerical parameters, data structure layouts and accessors, or small macros,
-inline functions and templates (ten or fewer lines in length), you do both
-of the following:
-
-a) Give prominent notice with each copy of the object code that the Library
-is used in it and that the Library and its use are covered by this License.
-
-b) Accompany the object code with a copy of the GNU GPL and this license document.
-
-   4. Combined Works.
-
-You may convey a Combined Work under terms of your choice that, taken together,
-effectively do not restrict modification of the portions of the Library contained
-in the Combined Work and reverse engineering for debugging such modifications,
-if you also do each of the following:
-
-a) Give prominent notice with each copy of the Combined Work that the Library
-is used in it and that the Library and its use are covered by this License.
-
-b) Accompany the Combined Work with a copy of the GNU GPL and this license
-document.
-
-c) For a Combined Work that displays copyright notices during execution, include
-the copyright notice for the Library among these notices, as well as a reference
-directing the user to the copies of the GNU GPL and this license document.
-
-      d) Do one of the following:
-
-0) Convey the Minimal Corresponding Source under the terms of this License,
-and the Corresponding Application Code in a form suitable for, and under terms
-that permit, the user to recombine or relink the Application with a modified
-version of the Linked Version to produce a modified Combined Work, in the
-manner specified by section 6 of the GNU GPL for conveying Corresponding Source.
-
-1) Use a suitable shared library mechanism for linking with the Library. A
-suitable mechanism is one that (a) uses at run time a copy of the Library
-already present on the user's computer system, and (b) will operate properly
-with a modified version of the Library that is interface-compatible with the
-Linked Version.
-
-e) Provide Installation Information, but only if you would otherwise be required
-to provide such information under section 6 of the GNU GPL, and only to the
-extent that such information is necessary to install and execute a modified
-version of the Combined Work produced by recombining or relinking the Application
-with a modified version of the Linked Version. (If you use option 4d0, the
-Installation Information must accompany the Minimal Corresponding Source and
-Corresponding Application Code. If you use option 4d1, you must provide the
-Installation Information in the manner specified by section 6 of the GNU GPL
-for conveying Corresponding Source.)
-
-   5. Combined Libraries.
-
-You may place library facilities that are a work based on the Library side
-by side in a single library together with other library facilities that are
-not Applications and are not covered by this License, and convey such a combined
-library under terms of your choice, if you do both of the following:
-
-a) Accompany the combined library with a copy of the same work based on the
-Library, uncombined with any other library facilities, conveyed under the
-terms of this License.
-
-b) Give prominent notice with the combined library that part of it is a work
-based on the Library, and explaining where to find the accompanying uncombined
-form of the same work.
-
-   6. Revised Versions of the GNU Lesser General Public License.
-
-The Free Software Foundation may publish revised and/or new versions of the
-GNU Lesser General Public License from time to time. Such new versions will
-be similar in spirit to the present version, but may differ in detail to address
-new problems or concerns.
-
-Each version is given a distinguishing version number. If the Library as you
-received it specifies that a certain numbered version of the GNU Lesser General
-Public License "or any later version" applies to it, you have the option of
-following the terms and conditions either of that published version or of
-any later version published by the Free Software Foundation. If the Library
-as you received it does not specify a version number of the GNU Lesser General
-Public License, you may choose any version of the GNU Lesser General Public
-License ever published by the Free Software Foundation.
-
-If the Library as you received it specifies that a proxy can decide whether
-future versions of the GNU Lesser General Public License shall apply, that
-proxy's public statement of acceptance of any version is permanent authorization
-for you to choose that version for the Library.

roles/ensure_os_upgrade/README.md

@@ -1,38 +0,0 @@
-Role Name
-=========
-
-A brief description of the role goes here.
-
-Requirements
-------------
-
-Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
-
-Role Variables
---------------
-
-A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
-
-Dependencies
-------------
-
-A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
-
-Example Playbook
-----------------
-
-Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
-
-    - hosts: servers
-      roles:
-         - { role: username.rolename, x: 42 }
-
-License
--------
-
-BSD
-
-Author Information
-------------------
-
-An optional section for the role authors to include contact information, or a website (HTML is not allowed).

roles/ensure_os_upgrade/tasks/Debian-default.yml

@@ -2,7 +2,6 @@
 # tasks file for ensure_os_upgrade - Debian
 - name: Update sources.list for Debian Upgrade
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["os_family"] == 'Debian'
     - ensure_os_upgrade is defined
     - ensure_os_upgrade.target_codename is defined
@@ -14,7 +13,6 @@
 
 - name: Safe Upgrade Debian Packages
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["os_family"] == 'Debian'
     - ensure_os_upgrade is defined
     - ensure_os_upgrade.target_codename is defined
@@ -27,7 +25,6 @@
 
 - name: Full Upgrade Debian Packages
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["os_family"] == 'Debian'
     - ensure_os_upgrade is defined
     - ensure_os_upgrade.target_codename is defined
@@ -41,7 +38,6 @@
 
 - name: Reboot Debian After Upgrade
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["os_family"] == 'Debian'
     - ensure_os_upgrade is defined
     - ensure_os_upgrade.target_codename is defined

roles/ensure_os_upgrade/tasks/Fedora-default.yml

@@ -2,7 +2,6 @@
 # tasks file for ensure_os_upgrade - Fedora
 - name: Ensure System-upgrade Download
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["distribution"] == 'Fedora'
     - ensure_os_upgrade is defined
     - ensure_os_upgrade.package_list is defined
@@ -13,7 +12,6 @@
     dnf -y system-upgrade download --refresh --releasever={{ ensure_os_upgrade.target_version | int }}
 - name: Ensure System-upgrade Reboot
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["distribution"] == 'Fedora'
     - ensure_os_upgrade is defined
     - ensure_os_upgrade.package_list is defined
@@ -26,7 +24,6 @@
     sleep 5 && dnf -y system-upgrade reboot
 - name: Wait For The Reboot
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["distribution"] == 'Fedora'
     - ensure_os_upgrade is defined
     - ensure_os_upgrade.package_list is defined

roles/ensure_os_upgrade/tasks/Ubuntu-default.yml

@@ -2,7 +2,6 @@
 # tasks file for ensure_os_upgrade - Ubuntu
 - name: Ensure update-manager-core is installed
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["distribution"] == 'Ubuntu'
     - ensure_os_upgrade is defined
   ansible.builtin.apt:
@@ -11,7 +10,6 @@
 
 - name: Configure Ubuntu Release Upgrade Prompt
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["distribution"] == 'Ubuntu'
     - ensure_os_upgrade is defined
     - ensure_os_upgrade.target_version is defined
@@ -22,7 +20,6 @@
 
 - name: Execute Ubuntu Release Upgrade
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["distribution"] == 'Ubuntu'
     - ensure_os_upgrade is defined
     - ensure_os_upgrade.target_version is defined
@@ -34,7 +31,6 @@
 
 - name: Reboot Ubuntu After Upgrade
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["distribution"] == 'Ubuntu'
     - ensure_os_upgrade is defined
     - ensure_os_upgrade.target_version is defined

roles/ensure_os_upgrade/tasks/main.yml

@@ -1,7 +1,17 @@
 ---
 # tasks file for ensure_os_upgrade
+- name: Assert Target OS Is Supported
+  when:
+    - ansible_facts["system"] is defined
+  ansible.builtin.assert:
+    fail_msg: "Unsupported OS: {{ ansible_facts['distribution'] | default('unknown') }}"
+    quiet: true
+    that:
+      - ansible_facts["system"] == 'Linux'
+      - >-
+        ansible_facts["distribution"] in ['AlmaLinux', 'CentOS', 'Debian',
+        'Fedora', 'OracleLinux', 'Rocky', 'Ubuntu']
 - name: Include Variables
-  when: ["ansible_facts[\"system\"] == 'Linux'"]
   ansible.builtin.include_vars:
     file: '{{ lookup("first_found", findme) }}'
     name: ensure_os_upgrade
@@ -23,17 +33,14 @@
       errors: ignore
 - name: Package Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["packages"] is not defined
   ansible.builtin.package_facts:
 - name: Service Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["services"] is not defined
   ansible.builtin.service_facts:
 - name: Ensure Packages
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_os_upgrade is defined
     - ensure_os_upgrade.package_list is defined
     - ensure_os_upgrade.package_list is iterable
@@ -48,7 +55,6 @@
     - Ensure_Os_Upgrade.Service_Facts
 - name: Ensure Services
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_os_upgrade is defined
     - ensure_os_upgrade.service_list is defined
     - ensure_os_upgrade.service_list is iterable
@@ -63,7 +69,6 @@
     - Ensure_Os_Upgrade.Package_Facts
     - Ensure_Os_Upgrade.Service_Facts
 - name: Include Vendor / Version Specific Tasks
-  when: ["ansible_facts[\"system\"] == 'Linux'"]
   ansible.builtin.include_tasks:
     file: '{{ lookup("first_found", findme) }}'
   vars:
@@ -88,3 +93,22 @@
     - Ensure_Os_Upgrade.Service_Facts
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
+- name: Post Verification Package Discovery
+  when:
+    - ensure_os_upgrade is defined
+    - ensure_os_upgrade.package_list is defined
+    - ensure_os_upgrade.package_list is iterable
+  ansible.builtin.package_facts:
+- name: Assert Managed Packages Are Installed
+  when:
+    - ensure_os_upgrade is defined
+    - ensure_os_upgrade.package_list is defined
+    - ensure_os_upgrade.package_list is iterable
+  ansible.builtin.assert:
+    fail_msg: "Package {{ item.name }} is not installed"
+    quiet: true
+    that:
+      - item.state != 'present' or ansible_facts['packages'][item.name] is defined
+  loop: "{{ ensure_os_upgrade.package_list }}"
+  loop_control:
+    label: "{{ item.name }} will be verified"

roles/ensure_podman/LICENSE

@@ -1,163 +0,0 @@
-GNU LESSER GENERAL PUBLIC LICENSE
-
-Version 3, 29 June 2007
-
-Copyright (C) 2007 Free Software Foundation, Inc. <http s ://fsf.org/>
-
-Everyone is permitted to copy and distribute verbatim copies of this license
-document, but changing it is not allowed.
-
-This version of the GNU Lesser General Public License incorporates the terms
-and conditions of version 3 of the GNU General Public License, supplemented
-by the additional permissions listed below.
-
-   0. Additional Definitions.
-
-      
-
-As used herein, "this License" refers to version 3 of the GNU Lesser General
-Public License, and the "GNU GPL" refers to version 3 of the GNU General Public
-License.
-
-      
-
-"The Library" refers to a covered work governed by this License, other than
-an Application or a Combined Work as defined below.
-
-      
-
-An "Application" is any work that makes use of an interface provided by the
-Library, but which is not otherwise based on the Library. Defining a subclass
-of a class defined by the Library is deemed a mode of using an interface provided
-by the Library.
-
-      
-
-A "Combined Work" is a work produced by combining or linking an Application
-with the Library. The particular version of the Library with which the Combined
-Work was made is also called the "Linked Version".
-
-      
-
-The "Minimal Corresponding Source" for a Combined Work means the Corresponding
-Source for the Combined Work, excluding any source code for portions of the
-Combined Work that, considered in isolation, are based on the Application,
-and not on the Linked Version.
-
-      
-
-The "Corresponding Application Code" for a Combined Work means the object
-code and/or source code for the Application, including any data and utility
-programs needed for reproducing the Combined Work from the Application, but
-excluding the System Libraries of the Combined Work.
-
-   1. Exception to Section 3 of the GNU GPL.
-
-You may convey a covered work under sections 3 and 4 of this License without
-being bound by section 3 of the GNU GPL.
-
-   2. Conveying Modified Versions.
-
-If you modify a copy of the Library, and, in your modifications, a facility
-refers to a function or data to be supplied by an Application that uses the
-facility (other than as an argument passed when the facility is invoked),
-then you may convey a copy of the modified version:
-
-a) under this License, provided that you make a good faith effort to ensure
-that, in the event an Application does not supply the function or data, the
-facility still operates, and performs whatever part of its purpose remains
-meaningful, or
-
-b) under the GNU GPL, with none of the additional permissions of this License
-applicable to that copy.
-
-   3. Object Code Incorporating Material from Library Header Files.
-
-The object code form of an Application may incorporate material from a header
-file that is part of the Library. You may convey such object code under terms
-of your choice, provided that, if the incorporated material is not limited
-to numerical parameters, data structure layouts and accessors, or small macros,
-inline functions and templates (ten or fewer lines in length), you do both
-of the following:
-
-a) Give prominent notice with each copy of the object code that the Library
-is used in it and that the Library and its use are covered by this License.
-
-b) Accompany the object code with a copy of the GNU GPL and this license document.
-
-   4. Combined Works.
-
-You may convey a Combined Work under terms of your choice that, taken together,
-effectively do not restrict modification of the portions of the Library contained
-in the Combined Work and reverse engineering for debugging such modifications,
-if you also do each of the following:
-
-a) Give prominent notice with each copy of the Combined Work that the Library
-is used in it and that the Library and its use are covered by this License.
-
-b) Accompany the Combined Work with a copy of the GNU GPL and this license
-document.
-
-c) For a Combined Work that displays copyright notices during execution, include
-the copyright notice for the Library among these notices, as well as a reference
-directing the user to the copies of the GNU GPL and this license document.
-
-      d) Do one of the following:
-
-0) Convey the Minimal Corresponding Source under the terms of this License,
-and the Corresponding Application Code in a form suitable for, and under terms
-that permit, the user to recombine or relink the Application with a modified
-version of the Linked Version to produce a modified Combined Work, in the
-manner specified by section 6 of the GNU GPL for conveying Corresponding Source.
-
-1) Use a suitable shared library mechanism for linking with the Library. A
-suitable mechanism is one that (a) uses at run time a copy of the Library
-already present on the user's computer system, and (b) will operate properly
-with a modified version of the Library that is interface-compatible with the
-Linked Version.
-
-e) Provide Installation Information, but only if you would otherwise be required
-to provide such information under section 6 of the GNU GPL, and only to the
-extent that such information is necessary to install and execute a modified
-version of the Combined Work produced by recombining or relinking the Application
-with a modified version of the Linked Version. (If you use option 4d0, the
-Installation Information must accompany the Minimal Corresponding Source and
-Corresponding Application Code. If you use option 4d1, you must provide the
-Installation Information in the manner specified by section 6 of the GNU GPL
-for conveying Corresponding Source.)
-
-   5. Combined Libraries.
-
-You may place library facilities that are a work based on the Library side
-by side in a single library together with other library facilities that are
-not Applications and are not covered by this License, and convey such a combined
-library under terms of your choice, if you do both of the following:
-
-a) Accompany the combined library with a copy of the same work based on the
-Library, uncombined with any other library facilities, conveyed under the
-terms of this License.
-
-b) Give prominent notice with the combined library that part of it is a work
-based on the Library, and explaining where to find the accompanying uncombined
-form of the same work.
-
-   6. Revised Versions of the GNU Lesser General Public License.
-
-The Free Software Foundation may publish revised and/or new versions of the
-GNU Lesser General Public License from time to time. Such new versions will
-be similar in spirit to the present version, but may differ in detail to address
-new problems or concerns.
-
-Each version is given a distinguishing version number. If the Library as you
-received it specifies that a certain numbered version of the GNU Lesser General
-Public License "or any later version" applies to it, you have the option of
-following the terms and conditions either of that published version or of
-any later version published by the Free Software Foundation. If the Library
-as you received it does not specify a version number of the GNU Lesser General
-Public License, you may choose any version of the GNU Lesser General Public
-License ever published by the Free Software Foundation.
-
-If the Library as you received it specifies that a proxy can decide whether
-future versions of the GNU Lesser General Public License shall apply, that
-proxy's public statement of acceptance of any version is permanent authorization
-for you to choose that version for the Library.

roles/ensure_podman/README.md

@@ -1,38 +0,0 @@
-Role Name
-=========
-
-A brief description of the role goes here.
-
-Requirements
-------------
-
-Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
-
-Role Variables
---------------
-
-A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
-
-Dependencies
-------------
-
-A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
-
-Example Playbook
-----------------
-
-Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
-
-    - hosts: servers
-      roles:
-         - { role: username.rolename, x: 42 }
-
-License
--------
-
-BSD
-
-Author Information
-------------------
-
-An optional section for the role authors to include contact information, or a website (HTML is not allowed).

roles/ensure_podman/tasks/main.yml

@@ -1,7 +1,17 @@
 ---
 # tasks file for ensure_podman
+- name: Assert Target OS Is Supported
+  when:
+    - ansible_facts["system"] is defined
+  ansible.builtin.assert:
+    fail_msg: "Unsupported OS: {{ ansible_facts['distribution'] | default('unknown') }}"
+    quiet: true
+    that:
+      - ansible_facts["system"] == 'Linux'
+      - >-
+        ansible_facts["distribution"] in ['AlmaLinux', 'CentOS', 'Debian',
+        'Fedora', 'OracleLinux', 'Rocky', 'Ubuntu']
 - name: Include Variables
-  when: ["ansible_facts[\"system\"] == 'Linux'"]
   ansible.builtin.include_vars:
     file: '{{ lookup("first_found", findme) }}'
     name: ensure_podman
@@ -23,17 +33,14 @@
       errors: ignore
 - name: Package Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["packages"] is not defined
   ansible.builtin.package_facts:
 - name: Service Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["services"] is not defined
   ansible.builtin.service_facts:
 - name: Ensure Packages
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_podman is defined
     - ensure_podman.package_list is defined
     - ensure_podman.package_list is iterable
@@ -46,7 +53,6 @@
   notify: [Ensure_Podman.Package_Facts, Ensure_Podman.Service_Facts]
 - name: Ensure Services
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_podman is defined
     - ensure_podman.service_list is defined
     - ensure_podman.service_list is iterable
@@ -60,7 +66,6 @@
   notify: [Ensure_Podman.Package_Facts, Ensure_Podman.Service_Facts]
 - name: Ensure Cgroup V2 Have Not Been Disabled
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_podman is defined
     - ansible_facts["distribution"] == 'Fedora'
     - ansible_facts["distribution_major_version"] is version('32', '>=')
@@ -71,7 +76,6 @@
       grubby --update-kernel=ALL --remove-args=systemd.unified_cgroup_hierarchy=0
 - name: Reboot To Disable Cgroups V1
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_podman is defined
     - ansible_facts["distribution"] == 'Fedora'
     - ansible_facts["distribution_major_version"] is version('32', '>=')
@@ -80,3 +84,27 @@
   ansible.builtin.reboot:
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
+- name: Post Verification Service Discovery
+  when:
+    - ensure_podman is defined
+    - ensure_podman.service_list is defined
+    - ensure_podman.service_list is iterable
+  ansible.builtin.service_facts:
+- name: Assert Managed Services Are Active
+  when:
+    - ensure_podman is defined
+    - ensure_podman.service_list is defined
+    - ensure_podman.service_list is iterable
+  ansible.builtin.assert:
+    fail_msg: "Service {{ item.name }} is not active"
+    quiet: true
+    that:
+      - >-
+        item.state != 'started' or
+        (ansible_facts['services'][item.name ~ '.service'] is defined and
+        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
+        (ansible_facts['services'][item.name] is defined and
+        ansible_facts['services'][item.name]['state'] == 'running')
+  loop: "{{ ensure_podman.service_list }}"
+  loop_control:
+    label: "{{ item.name }} will be verified"

roles/ensure_postfix/LICENSE

@@ -1,163 +0,0 @@
-GNU LESSER GENERAL PUBLIC LICENSE
-
-Version 3, 29 June 2007
-
-Copyright (C) 2007 Free Software Foundation, Inc. <http s ://fsf.org/>
-
-Everyone is permitted to copy and distribute verbatim copies of this license
-document, but changing it is not allowed.
-
-This version of the GNU Lesser General Public License incorporates the terms
-and conditions of version 3 of the GNU General Public License, supplemented
-by the additional permissions listed below.
-
-   0. Additional Definitions.
-
-      
-
-As used herein, "this License" refers to version 3 of the GNU Lesser General
-Public License, and the "GNU GPL" refers to version 3 of the GNU General Public
-License.
-
-      
-
-"The Library" refers to a covered work governed by this License, other than
-an Application or a Combined Work as defined below.
-
-      
-
-An "Application" is any work that makes use of an interface provided by the
-Library, but which is not otherwise based on the Library. Defining a subclass
-of a class defined by the Library is deemed a mode of using an interface provided
-by the Library.
-
-      
-
-A "Combined Work" is a work produced by combining or linking an Application
-with the Library. The particular version of the Library with which the Combined
-Work was made is also called the "Linked Version".
-
-      
-
-The "Minimal Corresponding Source" for a Combined Work means the Corresponding
-Source for the Combined Work, excluding any source code for portions of the
-Combined Work that, considered in isolation, are based on the Application,
-and not on the Linked Version.
-
-      
-
-The "Corresponding Application Code" for a Combined Work means the object
-code and/or source code for the Application, including any data and utility
-programs needed for reproducing the Combined Work from the Application, but
-excluding the System Libraries of the Combined Work.
-
-   1. Exception to Section 3 of the GNU GPL.
-
-You may convey a covered work under sections 3 and 4 of this License without
-being bound by section 3 of the GNU GPL.
-
-   2. Conveying Modified Versions.
-
-If you modify a copy of the Library, and, in your modifications, a facility
-refers to a function or data to be supplied by an Application that uses the
-facility (other than as an argument passed when the facility is invoked),
-then you may convey a copy of the modified version:
-
-a) under this License, provided that you make a good faith effort to ensure
-that, in the event an Application does not supply the function or data, the
-facility still operates, and performs whatever part of its purpose remains
-meaningful, or
-
-b) under the GNU GPL, with none of the additional permissions of this License
-applicable to that copy.
-
-   3. Object Code Incorporating Material from Library Header Files.
-
-The object code form of an Application may incorporate material from a header
-file that is part of the Library. You may convey such object code under terms
-of your choice, provided that, if the incorporated material is not limited
-to numerical parameters, data structure layouts and accessors, or small macros,
-inline functions and templates (ten or fewer lines in length), you do both
-of the following:
-
-a) Give prominent notice with each copy of the object code that the Library
-is used in it and that the Library and its use are covered by this License.
-
-b) Accompany the object code with a copy of the GNU GPL and this license document.
-
-   4. Combined Works.
-
-You may convey a Combined Work under terms of your choice that, taken together,
-effectively do not restrict modification of the portions of the Library contained
-in the Combined Work and reverse engineering for debugging such modifications,
-if you also do each of the following:
-
-a) Give prominent notice with each copy of the Combined Work that the Library
-is used in it and that the Library and its use are covered by this License.
-
-b) Accompany the Combined Work with a copy of the GNU GPL and this license
-document.
-
-c) For a Combined Work that displays copyright notices during execution, include
-the copyright notice for the Library among these notices, as well as a reference
-directing the user to the copies of the GNU GPL and this license document.
-
-      d) Do one of the following:
-
-0) Convey the Minimal Corresponding Source under the terms of this License,
-and the Corresponding Application Code in a form suitable for, and under terms
-that permit, the user to recombine or relink the Application with a modified
-version of the Linked Version to produce a modified Combined Work, in the
-manner specified by section 6 of the GNU GPL for conveying Corresponding Source.
-
-1) Use a suitable shared library mechanism for linking with the Library. A
-suitable mechanism is one that (a) uses at run time a copy of the Library
-already present on the user's computer system, and (b) will operate properly
-with a modified version of the Library that is interface-compatible with the
-Linked Version.
-
-e) Provide Installation Information, but only if you would otherwise be required
-to provide such information under section 6 of the GNU GPL, and only to the
-extent that such information is necessary to install and execute a modified
-version of the Combined Work produced by recombining or relinking the Application
-with a modified version of the Linked Version. (If you use option 4d0, the
-Installation Information must accompany the Minimal Corresponding Source and
-Corresponding Application Code. If you use option 4d1, you must provide the
-Installation Information in the manner specified by section 6 of the GNU GPL
-for conveying Corresponding Source.)
-
-   5. Combined Libraries.
-
-You may place library facilities that are a work based on the Library side
-by side in a single library together with other library facilities that are
-not Applications and are not covered by this License, and convey such a combined
-library under terms of your choice, if you do both of the following:
-
-a) Accompany the combined library with a copy of the same work based on the
-Library, uncombined with any other library facilities, conveyed under the
-terms of this License.
-
-b) Give prominent notice with the combined library that part of it is a work
-based on the Library, and explaining where to find the accompanying uncombined
-form of the same work.
-
-   6. Revised Versions of the GNU Lesser General Public License.
-
-The Free Software Foundation may publish revised and/or new versions of the
-GNU Lesser General Public License from time to time. Such new versions will
-be similar in spirit to the present version, but may differ in detail to address
-new problems or concerns.
-
-Each version is given a distinguishing version number. If the Library as you
-received it specifies that a certain numbered version of the GNU Lesser General
-Public License "or any later version" applies to it, you have the option of
-following the terms and conditions either of that published version or of
-any later version published by the Free Software Foundation. If the Library
-as you received it does not specify a version number of the GNU Lesser General
-Public License, you may choose any version of the GNU Lesser General Public
-License ever published by the Free Software Foundation.
-
-If the Library as you received it specifies that a proxy can decide whether
-future versions of the GNU Lesser General Public License shall apply, that
-proxy's public statement of acceptance of any version is permanent authorization
-for you to choose that version for the Library.

roles/ensure_postfix/tasks/main.yml

@@ -1,7 +1,17 @@
 ---
 # tasks file for ensure_postfix
+- name: Assert Target OS Is Supported
+  when:
+    - ansible_facts["system"] is defined
+  ansible.builtin.assert:
+    fail_msg: "Unsupported OS: {{ ansible_facts['distribution'] | default('unknown') }}"
+    quiet: true
+    that:
+      - ansible_facts["system"] == 'Linux'
+      - >-
+        ansible_facts["distribution"] in ['AlmaLinux', 'CentOS', 'Debian',
+        'Fedora', 'OracleLinux', 'Rocky', 'Ubuntu']
 - name: Include Variables
-  when: ["ansible_facts[\"system\"] == 'Linux'"]
   ansible.builtin.include_vars:
     file: '{{ lookup("first_found", findme) }}'
     name: ensure_postfix
@@ -23,17 +33,14 @@
       errors: ignore
 - name: Package Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["packages"] is not defined
   ansible.builtin.package_facts:
 - name: Service Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["services"] is not defined
   ansible.builtin.service_facts:
 - name: Ensure Sysctl
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_postfix is defined
     - ensure_postfix.sysctl_list is defined
     - ensure_postfix.sysctl_list is iterable
@@ -54,7 +61,6 @@
     - Ensure_Postfix.Service_Reload_Config
 - name: Ensure Packages
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_postfix is defined
     - ensure_postfix.package_list is defined
     - ensure_postfix.package_list is iterable
@@ -71,7 +77,6 @@
     - Ensure_Postfix.Service_Reload_Config
 - name: Ensure Seboolean
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_postfix is defined
     - ensure_postfix.seboolean_list is defined
     - ensure_postfix.seboolean_list is iterable
@@ -89,7 +94,6 @@
     - Ensure_Postfix.Service_Reload_Config
 - name: Ensure Configurations
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_postfix is defined
     - ensure_postfix.template_list is defined
     - ensure_postfix.template_list is iterable
@@ -99,7 +103,7 @@
     group: '{{ item.group | default(omit) }}'
     mode: '{{ item.mode | default(omit) }}'
     owner: '{{ item.owner | default(omit) }}'
-    selevel: '{{ iteml.selevel | default(omit) }}'
+    selevel: '{{ item.selevel | default(omit) }}'
     serole: '{{ item.serole | default(omit) }}'
     setype: '{{ item.setype | default(omit) }}'
     seuser: '{{ item.seuser | default(omit) }}'
@@ -114,7 +118,6 @@
     - Ensure_Postfix.Service_Reload_Config
 - name: Ensure Firewall
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts.packages["firewalld"] is defined
     - ansible_facts.packages["python3-firewall"] is defined
     - ensure_postfix is defined
@@ -134,7 +137,6 @@
     - Ensure_Postfix.Service_Reload_Config
 - name: Ensure Services
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_postfix is defined
     - ensure_postfix.service_list is defined
     - ensure_postfix.service_list is iterable
@@ -148,3 +150,27 @@
   notify: [Ensure_Postfix.Package_Facts, Ensure_Postfix.Service_Facts]
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
+- name: Post Verification Service Discovery
+  when:
+    - ensure_postfix is defined
+    - ensure_postfix.service_list is defined
+    - ensure_postfix.service_list is iterable
+  ansible.builtin.service_facts:
+- name: Assert Managed Services Are Active
+  when:
+    - ensure_postfix is defined
+    - ensure_postfix.service_list is defined
+    - ensure_postfix.service_list is iterable
+  ansible.builtin.assert:
+    fail_msg: "Service {{ item.name }} is not active"
+    quiet: true
+    that:
+      - >-
+        item.state != 'started' or
+        (ansible_facts['services'][item.name ~ '.service'] is defined and
+        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
+        (ansible_facts['services'][item.name] is defined and
+        ansible_facts['services'][item.name]['state'] == 'running')
+  loop: "{{ ensure_postfix.service_list }}"
+  loop_control:
+    label: "{{ item.name }} will be verified"

roles/ensure_repo_epel/LICENSE

@@ -1,163 +0,0 @@
-GNU LESSER GENERAL PUBLIC LICENSE
-
-Version 3, 29 June 2007
-
-Copyright (C) 2007 Free Software Foundation, Inc. <http s ://fsf.org/>
-
-Everyone is permitted to copy and distribute verbatim copies of this license
-document, but changing it is not allowed.
-
-This version of the GNU Lesser General Public License incorporates the terms
-and conditions of version 3 of the GNU General Public License, supplemented
-by the additional permissions listed below.
-
-   0. Additional Definitions.
-
-      
-
-As used herein, "this License" refers to version 3 of the GNU Lesser General
-Public License, and the "GNU GPL" refers to version 3 of the GNU General Public
-License.
-
-      
-
-"The Library" refers to a covered work governed by this License, other than
-an Application or a Combined Work as defined below.
-
-      
-
-An "Application" is any work that makes use of an interface provided by the
-Library, but which is not otherwise based on the Library. Defining a subclass
-of a class defined by the Library is deemed a mode of using an interface provided
-by the Library.
-
-      
-
-A "Combined Work" is a work produced by combining or linking an Application
-with the Library. The particular version of the Library with which the Combined
-Work was made is also called the "Linked Version".
-
-      
-
-The "Minimal Corresponding Source" for a Combined Work means the Corresponding
-Source for the Combined Work, excluding any source code for portions of the
-Combined Work that, considered in isolation, are based on the Application,
-and not on the Linked Version.
-
-      
-
-The "Corresponding Application Code" for a Combined Work means the object
-code and/or source code for the Application, including any data and utility
-programs needed for reproducing the Combined Work from the Application, but
-excluding the System Libraries of the Combined Work.
-
-   1. Exception to Section 3 of the GNU GPL.
-
-You may convey a covered work under sections 3 and 4 of this License without
-being bound by section 3 of the GNU GPL.
-
-   2. Conveying Modified Versions.
-
-If you modify a copy of the Library, and, in your modifications, a facility
-refers to a function or data to be supplied by an Application that uses the
-facility (other than as an argument passed when the facility is invoked),
-then you may convey a copy of the modified version:
-
-a) under this License, provided that you make a good faith effort to ensure
-that, in the event an Application does not supply the function or data, the
-facility still operates, and performs whatever part of its purpose remains
-meaningful, or
-
-b) under the GNU GPL, with none of the additional permissions of this License
-applicable to that copy.
-
-   3. Object Code Incorporating Material from Library Header Files.
-
-The object code form of an Application may incorporate material from a header
-file that is part of the Library. You may convey such object code under terms
-of your choice, provided that, if the incorporated material is not limited
-to numerical parameters, data structure layouts and accessors, or small macros,
-inline functions and templates (ten or fewer lines in length), you do both
-of the following:
-
-a) Give prominent notice with each copy of the object code that the Library
-is used in it and that the Library and its use are covered by this License.
-
-b) Accompany the object code with a copy of the GNU GPL and this license document.
-
-   4. Combined Works.
-
-You may convey a Combined Work under terms of your choice that, taken together,
-effectively do not restrict modification of the portions of the Library contained
-in the Combined Work and reverse engineering for debugging such modifications,
-if you also do each of the following:
-
-a) Give prominent notice with each copy of the Combined Work that the Library
-is used in it and that the Library and its use are covered by this License.
-
-b) Accompany the Combined Work with a copy of the GNU GPL and this license
-document.
-
-c) For a Combined Work that displays copyright notices during execution, include
-the copyright notice for the Library among these notices, as well as a reference
-directing the user to the copies of the GNU GPL and this license document.
-
-      d) Do one of the following:
-
-0) Convey the Minimal Corresponding Source under the terms of this License,
-and the Corresponding Application Code in a form suitable for, and under terms
-that permit, the user to recombine or relink the Application with a modified
-version of the Linked Version to produce a modified Combined Work, in the
-manner specified by section 6 of the GNU GPL for conveying Corresponding Source.
-
-1) Use a suitable shared library mechanism for linking with the Library. A
-suitable mechanism is one that (a) uses at run time a copy of the Library
-already present on the user's computer system, and (b) will operate properly
-with a modified version of the Library that is interface-compatible with the
-Linked Version.
-
-e) Provide Installation Information, but only if you would otherwise be required
-to provide such information under section 6 of the GNU GPL, and only to the
-extent that such information is necessary to install and execute a modified
-version of the Combined Work produced by recombining or relinking the Application
-with a modified version of the Linked Version. (If you use option 4d0, the
-Installation Information must accompany the Minimal Corresponding Source and
-Corresponding Application Code. If you use option 4d1, you must provide the
-Installation Information in the manner specified by section 6 of the GNU GPL
-for conveying Corresponding Source.)
-
-   5. Combined Libraries.
-
-You may place library facilities that are a work based on the Library side
-by side in a single library together with other library facilities that are
-not Applications and are not covered by this License, and convey such a combined
-library under terms of your choice, if you do both of the following:
-
-a) Accompany the combined library with a copy of the same work based on the
-Library, uncombined with any other library facilities, conveyed under the
-terms of this License.
-
-b) Give prominent notice with the combined library that part of it is a work
-based on the Library, and explaining where to find the accompanying uncombined
-form of the same work.
-
-   6. Revised Versions of the GNU Lesser General Public License.
-
-The Free Software Foundation may publish revised and/or new versions of the
-GNU Lesser General Public License from time to time. Such new versions will
-be similar in spirit to the present version, but may differ in detail to address
-new problems or concerns.
-
-Each version is given a distinguishing version number. If the Library as you
-received it specifies that a certain numbered version of the GNU Lesser General
-Public License "or any later version" applies to it, you have the option of
-following the terms and conditions either of that published version or of
-any later version published by the Free Software Foundation. If the Library
-as you received it does not specify a version number of the GNU Lesser General
-Public License, you may choose any version of the GNU Lesser General Public
-License ever published by the Free Software Foundation.
-
-If the Library as you received it specifies that a proxy can decide whether
-future versions of the GNU Lesser General Public License shall apply, that
-proxy's public statement of acceptance of any version is permanent authorization
-for you to choose that version for the Library.

roles/ensure_repo_epel/README.md

@@ -1,38 +0,0 @@
-Role Name
-=========
-
-Ensure Repository EPEL
-
-Requirements
-------------
-
-Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
-
-Role Variables
---------------
-
-A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
-
-Dependencies
-------------
-
-A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
-
-Example Playbook
-----------------
-
-Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
-
-    - hosts: servers
-      roles:
-         - { role: username.rolename, x: 42 }
-
-License
--------
-
-LGPL-3.0-or-later
-
-Author Information
-------------------
-
-An optional section for the role authors to include contact information, or a website (HTML is not allowed).

roles/ensure_repo_epel/tasks/main.yml

@@ -1,7 +1,17 @@
 ---
 # tasks file for ensure_repo_epel
+- name: Assert Target OS Is Supported
+  when:
+    - ansible_facts["system"] is defined
+  ansible.builtin.assert:
+    fail_msg: "Unsupported OS: {{ ansible_facts['distribution'] | default('unknown') }}"
+    quiet: true
+    that:
+      - ansible_facts["system"] == 'Linux'
+      - >-
+        ansible_facts["distribution"] in ['AlmaLinux', 'CentOS', 'Debian',
+        'Fedora', 'OracleLinux', 'Rocky', 'Ubuntu']
 - name: Include Variables
-  when: ["ansible_facts[\"system\"] == 'Linux'"]
   ansible.builtin.include_vars:
     file: '{{ lookup("first_found", findme) }}'
     name: ensure_repo_epel
@@ -23,17 +33,14 @@
       errors: ignore
 - name: Package Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["packages"] is not defined
   ansible.builtin.package_facts:
 - name: Service Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["services"] is not defined
   ansible.builtin.service_facts:
 - name: Ensure Packages
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_repo_epel is defined
     - ensure_repo_epel.package_list is defined
     - ensure_repo_epel.package_list is iterable
@@ -48,7 +55,6 @@
   notify: [Ensure_Repo_Epel.Package_Facts, Ensure_Repo_Epel.Service_Facts]
 - name: Ensure Services
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_repo_epel is defined
     - ensure_repo_epel.service_list is defined
     - ensure_repo_epel.service_list is iterable
@@ -62,7 +68,6 @@
   notify: [Ensure_Repo_Epel.Package_Facts, Ensure_Repo_Epel.Service_Facts]
 - name: Read Oracle EPEL Repo File
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["distribution"] == 'OracleLinux'
   ansible.builtin.slurp:
     src: "/etc/yum.repos.d/oracle-epel-ol{{ ansible_facts['distribution_major_version'] }}.repo"
@@ -71,7 +76,6 @@
 
 - name: Prioritize Oracle Epel Repo
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["distribution"] == 'OracleLinux'
     - oracle_epel_repo_file.content is defined
     - (oracle_epel_repo_file.content | b64decode | community.general.from_ini).keys() | select('search', '_EPEL') | length > 0
@@ -85,7 +89,6 @@
     create: false
 - name: Deprioritize Upstream Epel Repo
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["distribution"] == 'OracleLinux'
   community.general.ini_file:
     path: "/etc/yum.repos.d/epel.repo"
@@ -97,3 +100,22 @@
     create: false
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
+- name: Post Verification Package Discovery
+  when:
+    - ensure_repo_epel is defined
+    - ensure_repo_epel.package_list is defined
+    - ensure_repo_epel.package_list is iterable
+  ansible.builtin.package_facts:
+- name: Assert Managed Packages Are Installed
+  when:
+    - ensure_repo_epel is defined
+    - ensure_repo_epel.package_list is defined
+    - ensure_repo_epel.package_list is iterable
+  ansible.builtin.assert:
+    fail_msg: "Package {{ item.name }} is not installed"
+    quiet: true
+    that:
+      - item.state != 'present' or ansible_facts['packages'][item.name] is defined
+  loop: "{{ ensure_repo_epel.package_list }}"
+  loop_control:
+    label: "{{ item.name }} will be verified"

roles/ensure_repo_rpmfusion/LICENSE

@@ -1,163 +0,0 @@
-GNU LESSER GENERAL PUBLIC LICENSE
-
-Version 3, 29 June 2007
-
-Copyright (C) 2007 Free Software Foundation, Inc. <http s ://fsf.org/>
-
-Everyone is permitted to copy and distribute verbatim copies of this license
-document, but changing it is not allowed.
-
-This version of the GNU Lesser General Public License incorporates the terms
-and conditions of version 3 of the GNU General Public License, supplemented
-by the additional permissions listed below.
-
-   0. Additional Definitions.
-
-      
-
-As used herein, "this License" refers to version 3 of the GNU Lesser General
-Public License, and the "GNU GPL" refers to version 3 of the GNU General Public
-License.
-
-      
-
-"The Library" refers to a covered work governed by this License, other than
-an Application or a Combined Work as defined below.
-
-      
-
-An "Application" is any work that makes use of an interface provided by the
-Library, but which is not otherwise based on the Library. Defining a subclass
-of a class defined by the Library is deemed a mode of using an interface provided
-by the Library.
-
-      
-
-A "Combined Work" is a work produced by combining or linking an Application
-with the Library. The particular version of the Library with which the Combined
-Work was made is also called the "Linked Version".
-
-      
-
-The "Minimal Corresponding Source" for a Combined Work means the Corresponding
-Source for the Combined Work, excluding any source code for portions of the
-Combined Work that, considered in isolation, are based on the Application,
-and not on the Linked Version.
-
-      
-
-The "Corresponding Application Code" for a Combined Work means the object
-code and/or source code for the Application, including any data and utility
-programs needed for reproducing the Combined Work from the Application, but
-excluding the System Libraries of the Combined Work.
-
-   1. Exception to Section 3 of the GNU GPL.
-
-You may convey a covered work under sections 3 and 4 of this License without
-being bound by section 3 of the GNU GPL.
-
-   2. Conveying Modified Versions.
-
-If you modify a copy of the Library, and, in your modifications, a facility
-refers to a function or data to be supplied by an Application that uses the
-facility (other than as an argument passed when the facility is invoked),
-then you may convey a copy of the modified version:
-
-a) under this License, provided that you make a good faith effort to ensure
-that, in the event an Application does not supply the function or data, the
-facility still operates, and performs whatever part of its purpose remains
-meaningful, or
-
-b) under the GNU GPL, with none of the additional permissions of this License
-applicable to that copy.
-
-   3. Object Code Incorporating Material from Library Header Files.
-
-The object code form of an Application may incorporate material from a header
-file that is part of the Library. You may convey such object code under terms
-of your choice, provided that, if the incorporated material is not limited
-to numerical parameters, data structure layouts and accessors, or small macros,
-inline functions and templates (ten or fewer lines in length), you do both
-of the following:
-
-a) Give prominent notice with each copy of the object code that the Library
-is used in it and that the Library and its use are covered by this License.
-
-b) Accompany the object code with a copy of the GNU GPL and this license document.
-
-   4. Combined Works.
-
-You may convey a Combined Work under terms of your choice that, taken together,
-effectively do not restrict modification of the portions of the Library contained
-in the Combined Work and reverse engineering for debugging such modifications,
-if you also do each of the following:
-
-a) Give prominent notice with each copy of the Combined Work that the Library
-is used in it and that the Library and its use are covered by this License.
-
-b) Accompany the Combined Work with a copy of the GNU GPL and this license
-document.
-
-c) For a Combined Work that displays copyright notices during execution, include
-the copyright notice for the Library among these notices, as well as a reference
-directing the user to the copies of the GNU GPL and this license document.
-
-      d) Do one of the following:
-
-0) Convey the Minimal Corresponding Source under the terms of this License,
-and the Corresponding Application Code in a form suitable for, and under terms
-that permit, the user to recombine or relink the Application with a modified
-version of the Linked Version to produce a modified Combined Work, in the
-manner specified by section 6 of the GNU GPL for conveying Corresponding Source.
-
-1) Use a suitable shared library mechanism for linking with the Library. A
-suitable mechanism is one that (a) uses at run time a copy of the Library
-already present on the user's computer system, and (b) will operate properly
-with a modified version of the Library that is interface-compatible with the
-Linked Version.
-
-e) Provide Installation Information, but only if you would otherwise be required
-to provide such information under section 6 of the GNU GPL, and only to the
-extent that such information is necessary to install and execute a modified
-version of the Combined Work produced by recombining or relinking the Application
-with a modified version of the Linked Version. (If you use option 4d0, the
-Installation Information must accompany the Minimal Corresponding Source and
-Corresponding Application Code. If you use option 4d1, you must provide the
-Installation Information in the manner specified by section 6 of the GNU GPL
-for conveying Corresponding Source.)
-
-   5. Combined Libraries.
-
-You may place library facilities that are a work based on the Library side
-by side in a single library together with other library facilities that are
-not Applications and are not covered by this License, and convey such a combined
-library under terms of your choice, if you do both of the following:
-
-a) Accompany the combined library with a copy of the same work based on the
-Library, uncombined with any other library facilities, conveyed under the
-terms of this License.
-
-b) Give prominent notice with the combined library that part of it is a work
-based on the Library, and explaining where to find the accompanying uncombined
-form of the same work.
-
-   6. Revised Versions of the GNU Lesser General Public License.
-
-The Free Software Foundation may publish revised and/or new versions of the
-GNU Lesser General Public License from time to time. Such new versions will
-be similar in spirit to the present version, but may differ in detail to address
-new problems or concerns.
-
-Each version is given a distinguishing version number. If the Library as you
-received it specifies that a certain numbered version of the GNU Lesser General
-Public License "or any later version" applies to it, you have the option of
-following the terms and conditions either of that published version or of
-any later version published by the Free Software Foundation. If the Library
-as you received it does not specify a version number of the GNU Lesser General
-Public License, you may choose any version of the GNU Lesser General Public
-License ever published by the Free Software Foundation.
-
-If the Library as you received it specifies that a proxy can decide whether
-future versions of the GNU Lesser General Public License shall apply, that
-proxy's public statement of acceptance of any version is permanent authorization
-for you to choose that version for the Library.

roles/ensure_repo_rpmfusion/README.md

@@ -1,38 +0,0 @@
-Role Name
-=========
-
-Deploy RPMFusion for EL/Fedora
-
-Requirements
-------------
-
-Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
-
-Role Variables
---------------
-
-A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
-
-Dependencies
-------------
-
-A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
-
-Example Playbook
-----------------
-
-Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
-
-    - hosts: servers
-      roles:
-         - { role: username.rolename, x: 42 }
-
-License
--------
-
-LGPL-3.0-or-later
-
-Author Information
-------------------
-
-An optional section for the role authors to include contact information, or a website (HTML is not allowed).

roles/ensure_repo_rpmfusion/tasks/main.yml

@@ -1,7 +1,17 @@
 ---
 # tasks file for ensure_repo_rpmfusion
+- name: Assert Target OS Is Supported
+  when:
+    - ansible_facts["system"] is defined
+  ansible.builtin.assert:
+    fail_msg: "Unsupported OS: {{ ansible_facts['distribution'] | default('unknown') }}"
+    quiet: true
+    that:
+      - ansible_facts["system"] == 'Linux'
+      - >-
+        ansible_facts["distribution"] in ['AlmaLinux', 'CentOS', 'Debian',
+        'Fedora', 'OracleLinux', 'Rocky', 'Ubuntu']
 - name: Include Variables
-  when: ["ansible_facts[\"system\"] == 'Linux'"]
   ansible.builtin.include_vars:
     file: '{{ lookup("first_found", findme) }}'
     name: ensure_repo_rpmfusion
@@ -23,17 +33,14 @@
       errors: ignore
 - name: Package Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["packages"] is not defined
   ansible.builtin.package_facts:
 - name: Service Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["services"] is not defined
   ansible.builtin.service_facts:
 - name: Ensure Packages
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_repo_rpmfusion is defined
     - ensure_repo_rpmfusion.package_list is defined
     - ensure_repo_rpmfusion.package_list is iterable
@@ -50,7 +57,6 @@
     - Ensure_Repo_Rpmfusion.Service_Facts
 - name: Ensure Services
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_repo_rpmfusion is defined
     - ensure_repo_rpmfusion.service_list is defined
     - ensure_repo_rpmfusion.service_list is iterable
@@ -66,3 +72,22 @@
     - Ensure_Repo_Rpmfusion.Service_Facts
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
+- name: Post Verification Package Discovery
+  when:
+    - ensure_repo_rpmfusion is defined
+    - ensure_repo_rpmfusion.package_list is defined
+    - ensure_repo_rpmfusion.package_list is iterable
+  ansible.builtin.package_facts:
+- name: Assert Managed Packages Are Installed
+  when:
+    - ensure_repo_rpmfusion is defined
+    - ensure_repo_rpmfusion.package_list is defined
+    - ensure_repo_rpmfusion.package_list is iterable
+  ansible.builtin.assert:
+    fail_msg: "Package {{ item.name }} is not installed"
+    quiet: true
+    that:
+      - item.state != 'present' or ansible_facts['packages'][item.name] is defined
+  loop: "{{ ensure_repo_rpmfusion.package_list }}"
+  loop_control:
+    label: "{{ item.name }} will be verified"

roles/ensure_rsync/LICENSE

@@ -1,163 +0,0 @@
-GNU LESSER GENERAL PUBLIC LICENSE
-
-Version 3, 29 June 2007
-
-Copyright (C) 2007 Free Software Foundation, Inc. <http s ://fsf.org/>
-
-Everyone is permitted to copy and distribute verbatim copies of this license
-document, but changing it is not allowed.
-
-This version of the GNU Lesser General Public License incorporates the terms
-and conditions of version 3 of the GNU General Public License, supplemented
-by the additional permissions listed below.
-
-   0. Additional Definitions.
-
-      
-
-As used herein, "this License" refers to version 3 of the GNU Lesser General
-Public License, and the "GNU GPL" refers to version 3 of the GNU General Public
-License.
-
-      
-
-"The Library" refers to a covered work governed by this License, other than
-an Application or a Combined Work as defined below.
-
-      
-
-An "Application" is any work that makes use of an interface provided by the
-Library, but which is not otherwise based on the Library. Defining a subclass
-of a class defined by the Library is deemed a mode of using an interface provided
-by the Library.
-
-      
-
-A "Combined Work" is a work produced by combining or linking an Application
-with the Library. The particular version of the Library with which the Combined
-Work was made is also called the "Linked Version".
-
-      
-
-The "Minimal Corresponding Source" for a Combined Work means the Corresponding
-Source for the Combined Work, excluding any source code for portions of the
-Combined Work that, considered in isolation, are based on the Application,
-and not on the Linked Version.
-
-      
-
-The "Corresponding Application Code" for a Combined Work means the object
-code and/or source code for the Application, including any data and utility
-programs needed for reproducing the Combined Work from the Application, but
-excluding the System Libraries of the Combined Work.
-
-   1. Exception to Section 3 of the GNU GPL.
-
-You may convey a covered work under sections 3 and 4 of this License without
-being bound by section 3 of the GNU GPL.
-
-   2. Conveying Modified Versions.
-
-If you modify a copy of the Library, and, in your modifications, a facility
-refers to a function or data to be supplied by an Application that uses the
-facility (other than as an argument passed when the facility is invoked),
-then you may convey a copy of the modified version:
-
-a) under this License, provided that you make a good faith effort to ensure
-that, in the event an Application does not supply the function or data, the
-facility still operates, and performs whatever part of its purpose remains
-meaningful, or
-
-b) under the GNU GPL, with none of the additional permissions of this License
-applicable to that copy.
-
-   3. Object Code Incorporating Material from Library Header Files.
-
-The object code form of an Application may incorporate material from a header
-file that is part of the Library. You may convey such object code under terms
-of your choice, provided that, if the incorporated material is not limited
-to numerical parameters, data structure layouts and accessors, or small macros,
-inline functions and templates (ten or fewer lines in length), you do both
-of the following:
-
-a) Give prominent notice with each copy of the object code that the Library
-is used in it and that the Library and its use are covered by this License.
-
-b) Accompany the object code with a copy of the GNU GPL and this license document.
-
-   4. Combined Works.
-
-You may convey a Combined Work under terms of your choice that, taken together,
-effectively do not restrict modification of the portions of the Library contained
-in the Combined Work and reverse engineering for debugging such modifications,
-if you also do each of the following:
-
-a) Give prominent notice with each copy of the Combined Work that the Library
-is used in it and that the Library and its use are covered by this License.
-
-b) Accompany the Combined Work with a copy of the GNU GPL and this license
-document.
-
-c) For a Combined Work that displays copyright notices during execution, include
-the copyright notice for the Library among these notices, as well as a reference
-directing the user to the copies of the GNU GPL and this license document.
-
-      d) Do one of the following:
-
-0) Convey the Minimal Corresponding Source under the terms of this License,
-and the Corresponding Application Code in a form suitable for, and under terms
-that permit, the user to recombine or relink the Application with a modified
-version of the Linked Version to produce a modified Combined Work, in the
-manner specified by section 6 of the GNU GPL for conveying Corresponding Source.
-
-1) Use a suitable shared library mechanism for linking with the Library. A
-suitable mechanism is one that (a) uses at run time a copy of the Library
-already present on the user's computer system, and (b) will operate properly
-with a modified version of the Library that is interface-compatible with the
-Linked Version.
-
-e) Provide Installation Information, but only if you would otherwise be required
-to provide such information under section 6 of the GNU GPL, and only to the
-extent that such information is necessary to install and execute a modified
-version of the Combined Work produced by recombining or relinking the Application
-with a modified version of the Linked Version. (If you use option 4d0, the
-Installation Information must accompany the Minimal Corresponding Source and
-Corresponding Application Code. If you use option 4d1, you must provide the
-Installation Information in the manner specified by section 6 of the GNU GPL
-for conveying Corresponding Source.)
-
-   5. Combined Libraries.
-
-You may place library facilities that are a work based on the Library side
-by side in a single library together with other library facilities that are
-not Applications and are not covered by this License, and convey such a combined
-library under terms of your choice, if you do both of the following:
-
-a) Accompany the combined library with a copy of the same work based on the
-Library, uncombined with any other library facilities, conveyed under the
-terms of this License.
-
-b) Give prominent notice with the combined library that part of it is a work
-based on the Library, and explaining where to find the accompanying uncombined
-form of the same work.
-
-   6. Revised Versions of the GNU Lesser General Public License.
-
-The Free Software Foundation may publish revised and/or new versions of the
-GNU Lesser General Public License from time to time. Such new versions will
-be similar in spirit to the present version, but may differ in detail to address
-new problems or concerns.
-
-Each version is given a distinguishing version number. If the Library as you
-received it specifies that a certain numbered version of the GNU Lesser General
-Public License "or any later version" applies to it, you have the option of
-following the terms and conditions either of that published version or of
-any later version published by the Free Software Foundation. If the Library
-as you received it does not specify a version number of the GNU Lesser General
-Public License, you may choose any version of the GNU Lesser General Public
-License ever published by the Free Software Foundation.
-
-If the Library as you received it specifies that a proxy can decide whether
-future versions of the GNU Lesser General Public License shall apply, that
-proxy's public statement of acceptance of any version is permanent authorization
-for you to choose that version for the Library.

roles/ensure_rsync/README.md

@@ -1,38 +0,0 @@
-Role Name
-=========
-
-A brief description of the role goes here.
-
-Requirements
-------------
-
-Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
-
-Role Variables
---------------
-
-A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
-
-Dependencies
-------------
-
-A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
-
-Example Playbook
-----------------
-
-Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
-
-    - hosts: servers
-      roles:
-         - { role: username.rolename, x: 42 }
-
-License
--------
-
-BSD
-
-Author Information
-------------------
-
-An optional section for the role authors to include contact information, or a website (HTML is not allowed).

roles/ensure_rsync/tasks/main.yml

@@ -1,7 +1,17 @@
 ---
 # tasks file for ensure_rsync
+- name: Assert Target OS Is Supported
+  when:
+    - ansible_facts["system"] is defined
+  ansible.builtin.assert:
+    fail_msg: "Unsupported OS: {{ ansible_facts['distribution'] | default('unknown') }}"
+    quiet: true
+    that:
+      - ansible_facts["system"] == 'Linux'
+      - >-
+        ansible_facts["distribution"] in ['AlmaLinux', 'CentOS', 'Debian',
+        'Fedora', 'OracleLinux', 'Rocky', 'Ubuntu']
 - name: Include Variables
-  when: ["ansible_facts[\"system\"] == 'Linux'"]
   ansible.builtin.include_vars:
     file: '{{ lookup("first_found", findme) }}'
     name: ensure_rsync
@@ -23,17 +33,14 @@
       errors: ignore
 - name: Package Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["packages"] is not defined
   ansible.builtin.package_facts:
 - name: Service Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["services"] is not defined
   ansible.builtin.service_facts:
 - name: Ensure Packages
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_rsync is defined
     - ensure_rsync.package_list is defined
     - ensure_rsync.package_list is iterable
@@ -46,7 +53,6 @@
   notify: [Ensure_Rsync.Package_Facts, Ensure_Rsync.Service_Facts]
 - name: Ensure Configurations
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_rsync is defined
     - ensure_rsync.template_list is defined
     - ensure_rsync.template_list is iterable
@@ -56,7 +62,7 @@
     group: '{{ item.group | default(omit) }}'
     mode: '{{ item.mode | default(omit) }}'
     owner: '{{ item.owner | default(omit) }}'
-    selevel: '{{ iteml.selevel | default(omit) }}'
+    selevel: '{{ item.selevel | default(omit) }}'
     serole: '{{ item.serole | default(omit) }}'
     setype: '{{ item.setype | default(omit) }}'
     seuser: '{{ item.seuser | default(omit) }}'
@@ -71,7 +77,6 @@
     - Ensure_Rsync.Service_Restart
 - name: Ensure Services
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_rsync is defined
     - ensure_rsync.service_list is defined
     - ensure_rsync.service_list is iterable
@@ -85,7 +90,6 @@
   notify: [Ensure_Rsync.Package_Facts, Ensure_Rsync.Service_Facts]
 - name: Ensure Selinux Is Configured
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_rsync is defined
     - ensure_rsync.selinux_policy is defined
     - ensure_rsync.selinux_state is defined
@@ -100,7 +104,6 @@
     - Ensure_Rsync.Service_Restart
 - name: Reboot If Required
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_rsync is defined
     - ensure_rsync.selinux_policy is defined
     - ensure_rsync.selinux_state is defined  # This line is correct, no change needed
@@ -110,7 +113,6 @@
   ansible.builtin.reboot:
 - name: Ensure Seboolean
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_rsync is defined
     - ensure_rsync.seboolean_list is defined
     - ensure_rsync.seboolean_list is iterable
@@ -128,3 +130,22 @@
     - Ensure_Rsync.Service_Restart
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
+- name: Post Verification Package Discovery
+  when:
+    - ensure_rsync is defined
+    - ensure_rsync.package_list is defined
+    - ensure_rsync.package_list is iterable
+  ansible.builtin.package_facts:
+- name: Assert Managed Packages Are Installed
+  when:
+    - ensure_rsync is defined
+    - ensure_rsync.package_list is defined
+    - ensure_rsync.package_list is iterable
+  ansible.builtin.assert:
+    fail_msg: "Package {{ item.name }} is not installed"
+    quiet: true
+    that:
+      - item.state != 'present' or ansible_facts['packages'][item.name] is defined
+  loop: "{{ ensure_rsync.package_list }}"
+  loop_control:
+    label: "{{ item.name }} will be verified"

roles/ensure_selinux/LICENSE

@@ -1,163 +0,0 @@
-GNU LESSER GENERAL PUBLIC LICENSE
-
-Version 3, 29 June 2007
-
-Copyright (C) 2007 Free Software Foundation, Inc. <http s ://fsf.org/>
-
-Everyone is permitted to copy and distribute verbatim copies of this license
-document, but changing it is not allowed.
-
-This version of the GNU Lesser General Public License incorporates the terms
-and conditions of version 3 of the GNU General Public License, supplemented
-by the additional permissions listed below.
-
-   0. Additional Definitions.
-
-      
-
-As used herein, "this License" refers to version 3 of the GNU Lesser General
-Public License, and the "GNU GPL" refers to version 3 of the GNU General Public
-License.
-
-      
-
-"The Library" refers to a covered work governed by this License, other than
-an Application or a Combined Work as defined below.
-
-      
-
-An "Application" is any work that makes use of an interface provided by the
-Library, but which is not otherwise based on the Library. Defining a subclass
-of a class defined by the Library is deemed a mode of using an interface provided
-by the Library.
-
-      
-
-A "Combined Work" is a work produced by combining or linking an Application
-with the Library. The particular version of the Library with which the Combined
-Work was made is also called the "Linked Version".
-
-      
-
-The "Minimal Corresponding Source" for a Combined Work means the Corresponding
-Source for the Combined Work, excluding any source code for portions of the
-Combined Work that, considered in isolation, are based on the Application,
-and not on the Linked Version.
-
-      
-
-The "Corresponding Application Code" for a Combined Work means the object
-code and/or source code for the Application, including any data and utility
-programs needed for reproducing the Combined Work from the Application, but
-excluding the System Libraries of the Combined Work.
-
-   1. Exception to Section 3 of the GNU GPL.
-
-You may convey a covered work under sections 3 and 4 of this License without
-being bound by section 3 of the GNU GPL.
-
-   2. Conveying Modified Versions.
-
-If you modify a copy of the Library, and, in your modifications, a facility
-refers to a function or data to be supplied by an Application that uses the
-facility (other than as an argument passed when the facility is invoked),
-then you may convey a copy of the modified version:
-
-a) under this License, provided that you make a good faith effort to ensure
-that, in the event an Application does not supply the function or data, the
-facility still operates, and performs whatever part of its purpose remains
-meaningful, or
-
-b) under the GNU GPL, with none of the additional permissions of this License
-applicable to that copy.
-
-   3. Object Code Incorporating Material from Library Header Files.
-
-The object code form of an Application may incorporate material from a header
-file that is part of the Library. You may convey such object code under terms
-of your choice, provided that, if the incorporated material is not limited
-to numerical parameters, data structure layouts and accessors, or small macros,
-inline functions and templates (ten or fewer lines in length), you do both
-of the following:
-
-a) Give prominent notice with each copy of the object code that the Library
-is used in it and that the Library and its use are covered by this License.
-
-b) Accompany the object code with a copy of the GNU GPL and this license document.
-
-   4. Combined Works.
-
-You may convey a Combined Work under terms of your choice that, taken together,
-effectively do not restrict modification of the portions of the Library contained
-in the Combined Work and reverse engineering for debugging such modifications,
-if you also do each of the following:
-
-a) Give prominent notice with each copy of the Combined Work that the Library
-is used in it and that the Library and its use are covered by this License.
-
-b) Accompany the Combined Work with a copy of the GNU GPL and this license
-document.
-
-c) For a Combined Work that displays copyright notices during execution, include
-the copyright notice for the Library among these notices, as well as a reference
-directing the user to the copies of the GNU GPL and this license document.
-
-      d) Do one of the following:
-
-0) Convey the Minimal Corresponding Source under the terms of this License,
-and the Corresponding Application Code in a form suitable for, and under terms
-that permit, the user to recombine or relink the Application with a modified
-version of the Linked Version to produce a modified Combined Work, in the
-manner specified by section 6 of the GNU GPL for conveying Corresponding Source.
-
-1) Use a suitable shared library mechanism for linking with the Library. A
-suitable mechanism is one that (a) uses at run time a copy of the Library
-already present on the user's computer system, and (b) will operate properly
-with a modified version of the Library that is interface-compatible with the
-Linked Version.
-
-e) Provide Installation Information, but only if you would otherwise be required
-to provide such information under section 6 of the GNU GPL, and only to the
-extent that such information is necessary to install and execute a modified
-version of the Combined Work produced by recombining or relinking the Application
-with a modified version of the Linked Version. (If you use option 4d0, the
-Installation Information must accompany the Minimal Corresponding Source and
-Corresponding Application Code. If you use option 4d1, you must provide the
-Installation Information in the manner specified by section 6 of the GNU GPL
-for conveying Corresponding Source.)
-
-   5. Combined Libraries.
-
-You may place library facilities that are a work based on the Library side
-by side in a single library together with other library facilities that are
-not Applications and are not covered by this License, and convey such a combined
-library under terms of your choice, if you do both of the following:
-
-a) Accompany the combined library with a copy of the same work based on the
-Library, uncombined with any other library facilities, conveyed under the
-terms of this License.
-
-b) Give prominent notice with the combined library that part of it is a work
-based on the Library, and explaining where to find the accompanying uncombined
-form of the same work.
-
-   6. Revised Versions of the GNU Lesser General Public License.
-
-The Free Software Foundation may publish revised and/or new versions of the
-GNU Lesser General Public License from time to time. Such new versions will
-be similar in spirit to the present version, but may differ in detail to address
-new problems or concerns.
-
-Each version is given a distinguishing version number. If the Library as you
-received it specifies that a certain numbered version of the GNU Lesser General
-Public License "or any later version" applies to it, you have the option of
-following the terms and conditions either of that published version or of
-any later version published by the Free Software Foundation. If the Library
-as you received it does not specify a version number of the GNU Lesser General
-Public License, you may choose any version of the GNU Lesser General Public
-License ever published by the Free Software Foundation.
-
-If the Library as you received it specifies that a proxy can decide whether
-future versions of the GNU Lesser General Public License shall apply, that
-proxy's public statement of acceptance of any version is permanent authorization
-for you to choose that version for the Library.

roles/ensure_selinux/README.md

@@ -1,38 +0,0 @@
-Role Name
-=========
-
-A brief description of the role goes here.
-
-Requirements
-------------
-
-Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
-
-Role Variables
---------------
-
-A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
-
-Dependencies
-------------
-
-A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
-
-Example Playbook
-----------------
-
-Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
-
-    - hosts: servers
-      roles:
-         - { role: username.rolename, x: 42 }
-
-License
--------
-
-BSD
-
-Author Information
-------------------
-
-An optional section for the role authors to include contact information, or a website (HTML is not allowed).

roles/ensure_selinux/tasks/main.yml

@@ -1,7 +1,17 @@
 ---
 # tasks file for ensure_selinux
+- name: Assert Target OS Is Supported
+  when:
+    - ansible_facts["system"] is defined
+  ansible.builtin.assert:
+    fail_msg: "Unsupported OS: {{ ansible_facts['distribution'] | default('unknown') }}"
+    quiet: true
+    that:
+      - ansible_facts["system"] == 'Linux'
+      - >-
+        ansible_facts["distribution"] in ['AlmaLinux', 'CentOS', 'Fedora',
+        'OracleLinux', 'Rocky']
 - name: Include Variables
-  when: ["ansible_facts[\"system\"] == 'Linux'"]
   ansible.builtin.include_vars:
     file: '{{ lookup("first_found", findme) }}'
     name: ensure_selinux
@@ -23,17 +33,14 @@
       errors: ignore
 - name: Package Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["packages"] is not defined
   ansible.builtin.package_facts:
 - name: Service Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["services"] is not defined
   ansible.builtin.service_facts:
 - name: Ensure Packages
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_selinux is defined
     - ensure_selinux.package_list is defined
     - ensure_selinux.package_list is iterable
@@ -46,7 +53,6 @@
   notify: [Ensure_Selinux.Package_Facts, Ensure_Selinux.Service_Facts]
 - name: Ensure Configurations
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_selinux is defined
     - ensure_selinux.template_list is defined
     - ensure_selinux.template_list is iterable
@@ -56,7 +62,7 @@
     group: '{{ item.group | default(omit) }}'
     mode: '{{ item.mode | default(omit) }}'
     owner: '{{ item.owner | default(omit) }}'
-    selevel: '{{ iteml.selevel | default(omit) }}'
+    selevel: '{{ item.selevel | default(omit) }}'
     serole: '{{ item.serole | default(omit) }}'
     setype: '{{ item.setype | default(omit) }}'
     seuser: '{{ item.seuser | default(omit) }}'
@@ -71,7 +77,6 @@
     - Ensure_Selinux.Service_Restart
 - name: Ensure Services
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_selinux is defined
     - ensure_selinux.service_list is defined
     - ensure_selinux.service_list is iterable
@@ -85,7 +90,6 @@
   notify: [Ensure_Selinux.Package_Facts, Ensure_Selinux.Service_Facts]
 - name: Ensure Selinux Is Configured
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_selinux is defined
     - ensure_selinux.selinux_policy is defined
     - ensure_selinux.selinux_state is defined
@@ -95,7 +99,6 @@
   register: ensure_selinux_results
 - name: Reboot If Required
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_selinux is defined
     - ensure_selinux.selinux_policy is defined
     - ensure_selinux.selinux_state is defined
@@ -105,7 +108,6 @@
   ansible.builtin.reboot:
 - name: Ensure Seboolean
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_selinux is defined
     - ensure_selinux.seboolean_list is defined
     - ensure_selinux.seboolean_list is iterable
@@ -118,3 +120,13 @@
     label: '{{ item.name }} will be {{ item.state }}'
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
+- name: Assert SELinux Policy And State
+  when:
+    - ensure_selinux is defined
+    - ensure_selinux.selinux_state is defined
+  ansible.builtin.assert:
+    fail_msg: "SELinux state mismatch"
+    quiet: true
+    that:
+      - ansible_facts["selinux"] is defined
+      - ansible_facts["selinux"]["status"] == 'enabled' or ensure_selinux.selinux_state == 'disabled'

roles/ensure_sudo/LICENSE

@@ -1,163 +0,0 @@
-GNU LESSER GENERAL PUBLIC LICENSE
-
-Version 3, 29 June 2007
-
-Copyright (C) 2007 Free Software Foundation, Inc. <http s ://fsf.org/>
-
-Everyone is permitted to copy and distribute verbatim copies of this license
-document, but changing it is not allowed.
-
-This version of the GNU Lesser General Public License incorporates the terms
-and conditions of version 3 of the GNU General Public License, supplemented
-by the additional permissions listed below.
-
-   0. Additional Definitions.
-
-      
-
-As used herein, "this License" refers to version 3 of the GNU Lesser General
-Public License, and the "GNU GPL" refers to version 3 of the GNU General Public
-License.
-
-      
-
-"The Library" refers to a covered work governed by this License, other than
-an Application or a Combined Work as defined below.
-
-      
-
-An "Application" is any work that makes use of an interface provided by the
-Library, but which is not otherwise based on the Library. Defining a subclass
-of a class defined by the Library is deemed a mode of using an interface provided
-by the Library.
-
-      
-
-A "Combined Work" is a work produced by combining or linking an Application
-with the Library. The particular version of the Library with which the Combined
-Work was made is also called the "Linked Version".
-
-      
-
-The "Minimal Corresponding Source" for a Combined Work means the Corresponding
-Source for the Combined Work, excluding any source code for portions of the
-Combined Work that, considered in isolation, are based on the Application,
-and not on the Linked Version.
-
-      
-
-The "Corresponding Application Code" for a Combined Work means the object
-code and/or source code for the Application, including any data and utility
-programs needed for reproducing the Combined Work from the Application, but
-excluding the System Libraries of the Combined Work.
-
-   1. Exception to Section 3 of the GNU GPL.
-
-You may convey a covered work under sections 3 and 4 of this License without
-being bound by section 3 of the GNU GPL.
-
-   2. Conveying Modified Versions.
-
-If you modify a copy of the Library, and, in your modifications, a facility
-refers to a function or data to be supplied by an Application that uses the
-facility (other than as an argument passed when the facility is invoked),
-then you may convey a copy of the modified version:
-
-a) under this License, provided that you make a good faith effort to ensure
-that, in the event an Application does not supply the function or data, the
-facility still operates, and performs whatever part of its purpose remains
-meaningful, or
-
-b) under the GNU GPL, with none of the additional permissions of this License
-applicable to that copy.
-
-   3. Object Code Incorporating Material from Library Header Files.
-
-The object code form of an Application may incorporate material from a header
-file that is part of the Library. You may convey such object code under terms
-of your choice, provided that, if the incorporated material is not limited
-to numerical parameters, data structure layouts and accessors, or small macros,
-inline functions and templates (ten or fewer lines in length), you do both
-of the following:
-
-a) Give prominent notice with each copy of the object code that the Library
-is used in it and that the Library and its use are covered by this License.
-
-b) Accompany the object code with a copy of the GNU GPL and this license document.
-
-   4. Combined Works.
-
-You may convey a Combined Work under terms of your choice that, taken together,
-effectively do not restrict modification of the portions of the Library contained
-in the Combined Work and reverse engineering for debugging such modifications,
-if you also do each of the following:
-
-a) Give prominent notice with each copy of the Combined Work that the Library
-is used in it and that the Library and its use are covered by this License.
-
-b) Accompany the Combined Work with a copy of the GNU GPL and this license
-document.
-
-c) For a Combined Work that displays copyright notices during execution, include
-the copyright notice for the Library among these notices, as well as a reference
-directing the user to the copies of the GNU GPL and this license document.
-
-      d) Do one of the following:
-
-0) Convey the Minimal Corresponding Source under the terms of this License,
-and the Corresponding Application Code in a form suitable for, and under terms
-that permit, the user to recombine or relink the Application with a modified
-version of the Linked Version to produce a modified Combined Work, in the
-manner specified by section 6 of the GNU GPL for conveying Corresponding Source.
-
-1) Use a suitable shared library mechanism for linking with the Library. A
-suitable mechanism is one that (a) uses at run time a copy of the Library
-already present on the user's computer system, and (b) will operate properly
-with a modified version of the Library that is interface-compatible with the
-Linked Version.
-
-e) Provide Installation Information, but only if you would otherwise be required
-to provide such information under section 6 of the GNU GPL, and only to the
-extent that such information is necessary to install and execute a modified
-version of the Combined Work produced by recombining or relinking the Application
-with a modified version of the Linked Version. (If you use option 4d0, the
-Installation Information must accompany the Minimal Corresponding Source and
-Corresponding Application Code. If you use option 4d1, you must provide the
-Installation Information in the manner specified by section 6 of the GNU GPL
-for conveying Corresponding Source.)
-
-   5. Combined Libraries.
-
-You may place library facilities that are a work based on the Library side
-by side in a single library together with other library facilities that are
-not Applications and are not covered by this License, and convey such a combined
-library under terms of your choice, if you do both of the following:
-
-a) Accompany the combined library with a copy of the same work based on the
-Library, uncombined with any other library facilities, conveyed under the
-terms of this License.
-
-b) Give prominent notice with the combined library that part of it is a work
-based on the Library, and explaining where to find the accompanying uncombined
-form of the same work.
-
-   6. Revised Versions of the GNU Lesser General Public License.
-
-The Free Software Foundation may publish revised and/or new versions of the
-GNU Lesser General Public License from time to time. Such new versions will
-be similar in spirit to the present version, but may differ in detail to address
-new problems or concerns.
-
-Each version is given a distinguishing version number. If the Library as you
-received it specifies that a certain numbered version of the GNU Lesser General
-Public License "or any later version" applies to it, you have the option of
-following the terms and conditions either of that published version or of
-any later version published by the Free Software Foundation. If the Library
-as you received it does not specify a version number of the GNU Lesser General
-Public License, you may choose any version of the GNU Lesser General Public
-License ever published by the Free Software Foundation.
-
-If the Library as you received it specifies that a proxy can decide whether
-future versions of the GNU Lesser General Public License shall apply, that
-proxy's public statement of acceptance of any version is permanent authorization
-for you to choose that version for the Library.

roles/ensure_sudo/README.md

@@ -1,38 +0,0 @@
-Role Name
-=========
-
-A brief description of the role goes here.
-
-Requirements
-------------
-
-Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
-
-Role Variables
---------------
-
-A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
-
-Dependencies
-------------
-
-A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
-
-Example Playbook
-----------------
-
-Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
-
-    - hosts: servers
-      roles:
-         - { role: username.rolename, x: 42 }
-
-License
--------
-
-BSD
-
-Author Information
-------------------
-
-An optional section for the role authors to include contact information, or a website (HTML is not allowed).

roles/ensure_sudo/tasks/main.yml

@@ -1,7 +1,17 @@
 ---
 # tasks file for ensure_sudo
+- name: Assert Target OS Is Supported
+  when:
+    - ansible_facts["system"] is defined
+  ansible.builtin.assert:
+    fail_msg: "Unsupported OS: {{ ansible_facts['distribution'] | default('unknown') }}"
+    quiet: true
+    that:
+      - ansible_facts["system"] == 'Linux'
+      - >-
+        ansible_facts["distribution"] in ['AlmaLinux', 'CentOS', 'Debian',
+        'Fedora', 'OracleLinux', 'Rocky', 'Ubuntu']
 - name: Include Vendor / Version Specific Variables
-  when: ["ansible_facts[\"system\"] == 'Linux'"]
   ansible.builtin.include_vars:
     file: '{{ lookup("first_found", findme) }}'
     name: ensure_sudo
@@ -23,17 +33,14 @@
       errors: ignore
 - name: Package Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["packages"] is not defined
   ansible.builtin.package_facts:
 - name: Service Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["services"] is not defined
   ansible.builtin.service_facts:
 - name: Ensure Packages
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_sudo is defined
     - ensure_sudo.package_list is defined
     - ensure_sudo.package_list is iterable
@@ -46,7 +53,6 @@
   notify: [Ensure_Sudo.Package_Facts, Ensure_Sudo.Service_Facts]
 - name: Ensure Configurations
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_sudo is defined
     - ensure_sudo.template_list is defined
     - ensure_sudo.template_list is iterable
@@ -56,7 +62,7 @@
     group: '{{ item.group | default(omit) }}'
     mode: '{{ item.mode | default(omit) }}'
     owner: '{{ item.owner | default(omit) }}'
-    selevel: '{{ iteml.selevel | default(omit) }}'
+    selevel: '{{ item.selevel | default(omit) }}'
     serole: '{{ item.serole | default(omit) }}'
     setype: '{{ item.setype | default(omit) }}'
     seuser: '{{ item.seuser | default(omit) }}'
@@ -71,7 +77,6 @@
     - Ensure_Sudo.Service_Restart
 - name: Ensure Services
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_sudo is defined
     - ensure_sudo.service_list is defined
     - ensure_sudo.service_list is iterable
@@ -85,7 +90,6 @@
   notify: [Ensure_Sudo.Package_Facts, Ensure_Sudo.Service_Facts]
 - name: Find Directories Over Log Retention Window Under /var/log/sudo-io
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_sudo is defined
     - sudo_log_retention is defined
     - sudo_log_retention is regex('^[0-9]*[smhdw]$')
@@ -98,7 +102,6 @@
   register: ensure_sudo_results
 - name: And Drop Them
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_sudo is defined
     - sudo_log_retention is defined
     - sudo_log_retention is regex('^[0-9]*[smhdw]$')
@@ -111,3 +114,16 @@
     label: '{{ item.path }} to be removed'
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
+- name: Assert Sudoers Configuration Syntax
+  ansible.builtin.stat:
+    path: /etc/sudoers
+  register: _sudoers_stat
+- name: Assert Sudoers File Exists And Has Secure Permissions
+  when:
+    - _sudoers_stat.stat is defined
+  ansible.builtin.assert:
+    fail_msg: "/etc/sudoers does not exist or has invalid mode"
+    quiet: true
+    that:
+      - _sudoers_stat.stat.exists
+      - _sudoers_stat.stat.mode in ['0440', '0400', '0600']

roles/ensure_timezone/LICENSE

@@ -1,163 +0,0 @@
-GNU LESSER GENERAL PUBLIC LICENSE
-
-Version 3, 29 June 2007
-
-Copyright (C) 2007 Free Software Foundation, Inc. <http s ://fsf.org/>
-
-Everyone is permitted to copy and distribute verbatim copies of this license
-document, but changing it is not allowed.
-
-This version of the GNU Lesser General Public License incorporates the terms
-and conditions of version 3 of the GNU General Public License, supplemented
-by the additional permissions listed below.
-
-   0. Additional Definitions.
-
-      
-
-As used herein, "this License" refers to version 3 of the GNU Lesser General
-Public License, and the "GNU GPL" refers to version 3 of the GNU General Public
-License.
-
-      
-
-"The Library" refers to a covered work governed by this License, other than
-an Application or a Combined Work as defined below.
-
-      
-
-An "Application" is any work that makes use of an interface provided by the
-Library, but which is not otherwise based on the Library. Defining a subclass
-of a class defined by the Library is deemed a mode of using an interface provided
-by the Library.
-
-      
-
-A "Combined Work" is a work produced by combining or linking an Application
-with the Library. The particular version of the Library with which the Combined
-Work was made is also called the "Linked Version".
-
-      
-
-The "Minimal Corresponding Source" for a Combined Work means the Corresponding
-Source for the Combined Work, excluding any source code for portions of the
-Combined Work that, considered in isolation, are based on the Application,
-and not on the Linked Version.
-
-      
-
-The "Corresponding Application Code" for a Combined Work means the object
-code and/or source code for the Application, including any data and utility
-programs needed for reproducing the Combined Work from the Application, but
-excluding the System Libraries of the Combined Work.
-
-   1. Exception to Section 3 of the GNU GPL.
-
-You may convey a covered work under sections 3 and 4 of this License without
-being bound by section 3 of the GNU GPL.
-
-   2. Conveying Modified Versions.
-
-If you modify a copy of the Library, and, in your modifications, a facility
-refers to a function or data to be supplied by an Application that uses the
-facility (other than as an argument passed when the facility is invoked),
-then you may convey a copy of the modified version:
-
-a) under this License, provided that you make a good faith effort to ensure
-that, in the event an Application does not supply the function or data, the
-facility still operates, and performs whatever part of its purpose remains
-meaningful, or
-
-b) under the GNU GPL, with none of the additional permissions of this License
-applicable to that copy.
-
-   3. Object Code Incorporating Material from Library Header Files.
-
-The object code form of an Application may incorporate material from a header
-file that is part of the Library. You may convey such object code under terms
-of your choice, provided that, if the incorporated material is not limited
-to numerical parameters, data structure layouts and accessors, or small macros,
-inline functions and templates (ten or fewer lines in length), you do both
-of the following:
-
-a) Give prominent notice with each copy of the object code that the Library
-is used in it and that the Library and its use are covered by this License.
-
-b) Accompany the object code with a copy of the GNU GPL and this license document.
-
-   4. Combined Works.
-
-You may convey a Combined Work under terms of your choice that, taken together,
-effectively do not restrict modification of the portions of the Library contained
-in the Combined Work and reverse engineering for debugging such modifications,
-if you also do each of the following:
-
-a) Give prominent notice with each copy of the Combined Work that the Library
-is used in it and that the Library and its use are covered by this License.
-
-b) Accompany the Combined Work with a copy of the GNU GPL and this license
-document.
-
-c) For a Combined Work that displays copyright notices during execution, include
-the copyright notice for the Library among these notices, as well as a reference
-directing the user to the copies of the GNU GPL and this license document.
-
-      d) Do one of the following:
-
-0) Convey the Minimal Corresponding Source under the terms of this License,
-and the Corresponding Application Code in a form suitable for, and under terms
-that permit, the user to recombine or relink the Application with a modified
-version of the Linked Version to produce a modified Combined Work, in the
-manner specified by section 6 of the GNU GPL for conveying Corresponding Source.
-
-1) Use a suitable shared library mechanism for linking with the Library. A
-suitable mechanism is one that (a) uses at run time a copy of the Library
-already present on the user's computer system, and (b) will operate properly
-with a modified version of the Library that is interface-compatible with the
-Linked Version.
-
-e) Provide Installation Information, but only if you would otherwise be required
-to provide such information under section 6 of the GNU GPL, and only to the
-extent that such information is necessary to install and execute a modified
-version of the Combined Work produced by recombining or relinking the Application
-with a modified version of the Linked Version. (If you use option 4d0, the
-Installation Information must accompany the Minimal Corresponding Source and
-Corresponding Application Code. If you use option 4d1, you must provide the
-Installation Information in the manner specified by section 6 of the GNU GPL
-for conveying Corresponding Source.)
-
-   5. Combined Libraries.
-
-You may place library facilities that are a work based on the Library side
-by side in a single library together with other library facilities that are
-not Applications and are not covered by this License, and convey such a combined
-library under terms of your choice, if you do both of the following:
-
-a) Accompany the combined library with a copy of the same work based on the
-Library, uncombined with any other library facilities, conveyed under the
-terms of this License.
-
-b) Give prominent notice with the combined library that part of it is a work
-based on the Library, and explaining where to find the accompanying uncombined
-form of the same work.
-
-   6. Revised Versions of the GNU Lesser General Public License.
-
-The Free Software Foundation may publish revised and/or new versions of the
-GNU Lesser General Public License from time to time. Such new versions will
-be similar in spirit to the present version, but may differ in detail to address
-new problems or concerns.
-
-Each version is given a distinguishing version number. If the Library as you
-received it specifies that a certain numbered version of the GNU Lesser General
-Public License "or any later version" applies to it, you have the option of
-following the terms and conditions either of that published version or of
-any later version published by the Free Software Foundation. If the Library
-as you received it does not specify a version number of the GNU Lesser General
-Public License, you may choose any version of the GNU Lesser General Public
-License ever published by the Free Software Foundation.
-
-If the Library as you received it specifies that a proxy can decide whether
-future versions of the GNU Lesser General Public License shall apply, that
-proxy's public statement of acceptance of any version is permanent authorization
-for you to choose that version for the Library.

roles/ensure_timezone/tasks/main.yml

@@ -1,7 +1,17 @@
 ---
 # tasks file for ensure_timezone
+- name: Assert Target OS Is Supported
+  when:
+    - ansible_facts["system"] is defined
+  ansible.builtin.assert:
+    fail_msg: "Unsupported OS: {{ ansible_facts['distribution'] | default('unknown') }}"
+    quiet: true
+    that:
+      - ansible_facts["system"] == 'Linux'
+      - >-
+        ansible_facts["distribution"] in ['AlmaLinux', 'CentOS', 'Debian',
+        'Fedora', 'OracleLinux', 'Rocky', 'Ubuntu']
 - name: Include Variables
-  when: ["ansible_facts[\"system\"] == 'Linux'"]
   ansible.builtin.include_vars:
     file: '{{ lookup("first_found", findme) }}'
     name: ensure_timezone
@@ -23,12 +33,10 @@
       errors: ignore
 - name: Package Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["packages"] is not defined
   ansible.builtin.package_facts:
 - name: Service Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["services"] is not defined
   ansible.builtin.service_facts:
 - name: Set Timezone
@@ -41,7 +49,6 @@
     - Ensure_Timezone.Service_Restart
 - name: Ensure Packages
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_timezone is defined
     - ensure_timezone.package_list is defined
     - ensure_timezone.package_list is iterable
@@ -54,7 +61,6 @@
   notify: [Ensure_Timezone.Package_Facts, Ensure_Timezone.Service_Facts]
 - name: Ensure Configurations
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_timezone is defined
     - ensure_timezone.template_list is defined
     - ensure_timezone.template_list is iterable
@@ -64,7 +70,7 @@
     group: '{{ item.group | default(omit) }}'
     mode: '{{ item.mode | default(omit) }}'
     owner: '{{ item.owner | default(omit) }}'
-    selevel: '{{ iteml.selevel | default(omit) }}'
+    selevel: '{{ item.selevel | default(omit) }}'
     serole: '{{ item.serole | default(omit) }}'
     setype: '{{ item.setype | default(omit) }}'
     seuser: '{{ item.seuser | default(omit) }}'
@@ -79,7 +85,6 @@
     - Ensure_Timezone.Service_Restart
 - name: Ensure Services
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_timezone is defined
     - ensure_timezone.service_list is defined
     - ensure_timezone.service_list is iterable
@@ -93,7 +98,6 @@
   notify: [Ensure_Timezone.Package_Facts, Ensure_Timezone.Service_Facts]
 - name: Ensure Selinux Is Configured
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_timezone is defined
     - ensure_timezone.selinux_policy is defined
     - ensure_timezone.selinux_state is defined
@@ -103,7 +107,6 @@
   register: ensure_timezone_results
 - name: Reboot If Required
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_timezone is defined
     - ensure_timezone.selinux_policy is defined
     - ensure_timezone.selinux_state is defined
@@ -113,7 +116,6 @@
   ansible.builtin.reboot:
 - name: Ensure Seboolean
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_timezone is defined
     - ensure_timezone.seboolean_list is defined
     - ensure_timezone.seboolean_list is iterable
@@ -126,3 +128,27 @@
     label: '{{ item.name }} will be {{ item.state }}'
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
+- name: Post Verification Service Discovery
+  when:
+    - ensure_timezone is defined
+    - ensure_timezone.service_list is defined
+    - ensure_timezone.service_list is iterable
+  ansible.builtin.service_facts:
+- name: Assert Managed Services Are Active
+  when:
+    - ensure_timezone is defined
+    - ensure_timezone.service_list is defined
+    - ensure_timezone.service_list is iterable
+  ansible.builtin.assert:
+    fail_msg: "Service {{ item.name }} is not active"
+    quiet: true
+    that:
+      - >-
+        item.state != 'started' or
+        (ansible_facts['services'][item.name ~ '.service'] is defined and
+        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
+        (ansible_facts['services'][item.name] is defined and
+        ansible_facts['services'][item.name]['state'] == 'running')
+  loop: "{{ ensure_timezone.service_list }}"
+  loop_control:
+    label: "{{ item.name }} will be verified"

roles/ensure_vim/LICENSE

@@ -1,163 +0,0 @@
-GNU LESSER GENERAL PUBLIC LICENSE
-
-Version 3, 29 June 2007
-
-Copyright (C) 2007 Free Software Foundation, Inc. <http s ://fsf.org/>
-
-Everyone is permitted to copy and distribute verbatim copies of this license
-document, but changing it is not allowed.
-
-This version of the GNU Lesser General Public License incorporates the terms
-and conditions of version 3 of the GNU General Public License, supplemented
-by the additional permissions listed below.
-
-   0. Additional Definitions.
-
-      
-
-As used herein, "this License" refers to version 3 of the GNU Lesser General
-Public License, and the "GNU GPL" refers to version 3 of the GNU General Public
-License.
-
-      
-
-"The Library" refers to a covered work governed by this License, other than
-an Application or a Combined Work as defined below.
-
-      
-
-An "Application" is any work that makes use of an interface provided by the
-Library, but which is not otherwise based on the Library. Defining a subclass
-of a class defined by the Library is deemed a mode of using an interface provided
-by the Library.
-
-      
-
-A "Combined Work" is a work produced by combining or linking an Application
-with the Library. The particular version of the Library with which the Combined
-Work was made is also called the "Linked Version".
-
-      
-
-The "Minimal Corresponding Source" for a Combined Work means the Corresponding
-Source for the Combined Work, excluding any source code for portions of the
-Combined Work that, considered in isolation, are based on the Application,
-and not on the Linked Version.
-
-      
-
-The "Corresponding Application Code" for a Combined Work means the object
-code and/or source code for the Application, including any data and utility
-programs needed for reproducing the Combined Work from the Application, but
-excluding the System Libraries of the Combined Work.
-
-   1. Exception to Section 3 of the GNU GPL.
-
-You may convey a covered work under sections 3 and 4 of this License without
-being bound by section 3 of the GNU GPL.
-
-   2. Conveying Modified Versions.
-
-If you modify a copy of the Library, and, in your modifications, a facility
-refers to a function or data to be supplied by an Application that uses the
-facility (other than as an argument passed when the facility is invoked),
-then you may convey a copy of the modified version:
-
-a) under this License, provided that you make a good faith effort to ensure
-that, in the event an Application does not supply the function or data, the
-facility still operates, and performs whatever part of its purpose remains
-meaningful, or
-
-b) under the GNU GPL, with none of the additional permissions of this License
-applicable to that copy.
-
-   3. Object Code Incorporating Material from Library Header Files.
-
-The object code form of an Application may incorporate material from a header
-file that is part of the Library. You may convey such object code under terms
-of your choice, provided that, if the incorporated material is not limited
-to numerical parameters, data structure layouts and accessors, or small macros,
-inline functions and templates (ten or fewer lines in length), you do both
-of the following:
-
-a) Give prominent notice with each copy of the object code that the Library
-is used in it and that the Library and its use are covered by this License.
-
-b) Accompany the object code with a copy of the GNU GPL and this license document.
-
-   4. Combined Works.
-
-You may convey a Combined Work under terms of your choice that, taken together,
-effectively do not restrict modification of the portions of the Library contained
-in the Combined Work and reverse engineering for debugging such modifications,
-if you also do each of the following:
-
-a) Give prominent notice with each copy of the Combined Work that the Library
-is used in it and that the Library and its use are covered by this License.
-
-b) Accompany the Combined Work with a copy of the GNU GPL and this license
-document.
-
-c) For a Combined Work that displays copyright notices during execution, include
-the copyright notice for the Library among these notices, as well as a reference
-directing the user to the copies of the GNU GPL and this license document.
-
-      d) Do one of the following:
-
-0) Convey the Minimal Corresponding Source under the terms of this License,
-and the Corresponding Application Code in a form suitable for, and under terms
-that permit, the user to recombine or relink the Application with a modified
-version of the Linked Version to produce a modified Combined Work, in the
-manner specified by section 6 of the GNU GPL for conveying Corresponding Source.
-
-1) Use a suitable shared library mechanism for linking with the Library. A
-suitable mechanism is one that (a) uses at run time a copy of the Library
-already present on the user's computer system, and (b) will operate properly
-with a modified version of the Library that is interface-compatible with the
-Linked Version.
-
-e) Provide Installation Information, but only if you would otherwise be required
-to provide such information under section 6 of the GNU GPL, and only to the
-extent that such information is necessary to install and execute a modified
-version of the Combined Work produced by recombining or relinking the Application
-with a modified version of the Linked Version. (If you use option 4d0, the
-Installation Information must accompany the Minimal Corresponding Source and
-Corresponding Application Code. If you use option 4d1, you must provide the
-Installation Information in the manner specified by section 6 of the GNU GPL
-for conveying Corresponding Source.)
-
-   5. Combined Libraries.
-
-You may place library facilities that are a work based on the Library side
-by side in a single library together with other library facilities that are
-not Applications and are not covered by this License, and convey such a combined
-library under terms of your choice, if you do both of the following:
-
-a) Accompany the combined library with a copy of the same work based on the
-Library, uncombined with any other library facilities, conveyed under the
-terms of this License.
-
-b) Give prominent notice with the combined library that part of it is a work
-based on the Library, and explaining where to find the accompanying uncombined
-form of the same work.
-
-   6. Revised Versions of the GNU Lesser General Public License.
-
-The Free Software Foundation may publish revised and/or new versions of the
-GNU Lesser General Public License from time to time. Such new versions will
-be similar in spirit to the present version, but may differ in detail to address
-new problems or concerns.
-
-Each version is given a distinguishing version number. If the Library as you
-received it specifies that a certain numbered version of the GNU Lesser General
-Public License "or any later version" applies to it, you have the option of
-following the terms and conditions either of that published version or of
-any later version published by the Free Software Foundation. If the Library
-as you received it does not specify a version number of the GNU Lesser General
-Public License, you may choose any version of the GNU Lesser General Public
-License ever published by the Free Software Foundation.
-
-If the Library as you received it specifies that a proxy can decide whether
-future versions of the GNU Lesser General Public License shall apply, that
-proxy's public statement of acceptance of any version is permanent authorization
-for you to choose that version for the Library.

roles/ensure_vim/README.md

@@ -1,38 +0,0 @@
-Role Name
-=========
-
-A brief description of the role goes here.
-
-Requirements
-------------
-
-Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
-
-Role Variables
---------------
-
-A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
-
-Dependencies
-------------
-
-A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
-
-Example Playbook
-----------------
-
-Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
-
-    - hosts: servers
-      roles:
-         - { role: username.rolename, x: 42 }
-
-License
--------
-
-BSD
-
-Author Information
-------------------
-
-An optional section for the role authors to include contact information, or a website (HTML is not allowed).

roles/ensure_vim/tasks/main.yml

@@ -1,7 +1,17 @@
 ---
 # tasks file for ensure_vim
+- name: Assert Target OS Is Supported
+  when:
+    - ansible_facts["system"] is defined
+  ansible.builtin.assert:
+    fail_msg: "Unsupported OS: {{ ansible_facts['distribution'] | default('unknown') }}"
+    quiet: true
+    that:
+      - ansible_facts["system"] == 'Linux'
+      - >-
+        ansible_facts["distribution"] in ['AlmaLinux', 'CentOS', 'Debian',
+        'Fedora', 'OracleLinux', 'Rocky', 'Ubuntu']
 - name: Include Variables
-  when: ["ansible_facts[\"system\"] == 'Linux'"]
   ansible.builtin.include_vars:
     file: '{{ lookup("first_found", findme) }}'
     name: ensure_vim
@@ -23,17 +33,14 @@
       errors: ignore
 - name: Package Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["packages"] is not defined
   ansible.builtin.package_facts:
 - name: Service Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["services"] is not defined
   ansible.builtin.service_facts:
 - name: Ensure Packages
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_vim is defined
     - ensure_vim.package_list is defined
     - ensure_vim.package_list is iterable
@@ -46,7 +53,6 @@
   notify: [Ensure_Vim.Package_Facts, Ensure_Vim.Service_Facts]
 - name: Ensure Configurations
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_vim is defined
     - ensure_vim.template_list is defined
     - ensure_vim.template_list is iterable
@@ -56,7 +62,7 @@
     group: '{{ item.group | default(omit) }}'
     mode: '{{ item.mode | default(omit) }}'
     owner: '{{ item.owner | default(omit) }}'
-    selevel: '{{ iteml.selevel | default(omit) }}'
+    selevel: '{{ item.selevel | default(omit) }}'
     serole: '{{ item.serole | default(omit) }}'
     setype: '{{ item.setype | default(omit) }}'
     seuser: '{{ item.seuser | default(omit) }}'
@@ -71,7 +77,6 @@
     - Ensure_Vim.Service_Restart
 - name: Ensure Services
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_vim is defined
     - ensure_vim.service_list is defined
     - ensure_vim.service_list is iterable
@@ -85,7 +90,6 @@
   notify: [Ensure_Vim.Package_Facts, Ensure_Vim.Service_Facts]
 - name: Ensure Selinux Is Configured
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_vim is defined
     - ensure_vim.selinux_policy is defined
     - ensure_vim.selinux_state is defined
@@ -100,7 +104,6 @@
     - Ensure_Vim.Service_Restart
 - name: Reboot If Required
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_vim is defined
     - ensure_vim.selinux_policy is defined
     - ensure_vim.selinux_state is defined
@@ -110,7 +113,6 @@
   ansible.builtin.reboot:
 - name: Ensure Seboolean
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_vim is defined
     - ensure_vim.seboolean_list is defined
     - ensure_vim.seboolean_list is iterable
@@ -128,3 +130,22 @@
     - Ensure_Vim.Service_Restart
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
+- name: Post Verification Package Discovery
+  when:
+    - ensure_vim is defined
+    - ensure_vim.package_list is defined
+    - ensure_vim.package_list is iterable
+  ansible.builtin.package_facts:
+- name: Assert Managed Packages Are Installed
+  when:
+    - ensure_vim is defined
+    - ensure_vim.package_list is defined
+    - ensure_vim.package_list is iterable
+  ansible.builtin.assert:
+    fail_msg: "Package {{ item.name }} is not installed"
+    quiet: true
+    that:
+      - item.state != 'present' or ansible_facts['packages'][item.name] is defined
+  loop: "{{ ensure_vim.package_list }}"
+  loop_control:
+    label: "{{ item.name }} will be verified"