Roles only run on intended supported OS, and minor cleanup of when statements to match

roles/ensure_ansible_prereq/tasks/main.yml

@@ -1,7 +1,17 @@
 ---
 # tasks file for ensure_ansible_prereq
+- name: Assert Target OS Is Supported
+  when:
+    - ansible_facts["system"] is defined
+  ansible.builtin.assert:
+    fail_msg: "Unsupported OS: {{ ansible_facts['distribution'] | default('unknown') }}"
+    quiet: true
+    that:
+      - ansible_facts["system"] == 'Linux'
+      - >-
+        ansible_facts["distribution"] in ['AlmaLinux', 'CentOS', 'Debian',
+        'Fedora', 'OracleLinux', 'Rocky', 'Ubuntu']
 - name: Include Vendor / Version Specific Tasks
-  when: ["ansible_facts[\"system\"] == 'Linux'"]
   ansible.builtin.include_tasks:
     file: '{{ lookup("first_found", findme) }}'
   vars:
@@ -20,7 +30,6 @@
         - default.yml
       errors: ignore
 - name: Include Vendor / Version Specific Variables
-  when: ["ansible_facts[\"system\"] == 'Linux'"]
   ansible.builtin.include_vars:
     file: '{{ lookup("first_found", findme) }}'
     name: ensure_ansible_prereq
@@ -42,17 +51,14 @@
       errors: ignore
 - name: Package Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["packages"] is not defined
   ansible.builtin.package_facts:
 - name: Service Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["services"] is not defined
   ansible.builtin.service_facts:
 - name: Ensure Packages
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_ansible_prereq is defined
     - ensure_ansible_prereq.package_list is defined
     - ensure_ansible_prereq.package_list is iterable
@@ -67,7 +73,6 @@
     - Ensure_Ansible_Prereq.Service_Facts
 - name: Ensure Configurations
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_ansible_prereq is defined
     - ensure_ansible_prereq.template_list is defined
     - ensure_ansible_prereq.template_list is iterable
@@ -77,7 +82,7 @@
     group: '{{ item.group | default(omit) }}'
     mode: '{{ item.mode | default(omit) }}'
     owner: '{{ item.owner | default(omit) }}'
-    selevel: '{{ iteml.selevel | default(omit) }}'
+    selevel: '{{ item.selevel | default(omit) }}'
     serole: '{{ item.serole | default(omit) }}'
     setype: '{{ item.setype | default(omit) }}'
     seuser: '{{ item.seuser | default(omit) }}'
@@ -92,7 +97,6 @@
     - Ensure_Ansible_Prereq.Service_Restart
 - name: Ensure Services
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_ansible_prereq is defined
     - ensure_ansible_prereq.service_list is defined
     - ensure_ansible_prereq.service_list is iterable
@@ -108,3 +112,22 @@
     - Ensure_Ansible_Prereq.Service_Facts
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
+- name: Post Verification Package Discovery
+  when:
+    - ensure_ansible_prereq is defined
+    - ensure_ansible_prereq.package_list is defined
+    - ensure_ansible_prereq.package_list is iterable
+  ansible.builtin.package_facts:
+- name: Assert Managed Packages Are Installed
+  when:
+    - ensure_ansible_prereq is defined
+    - ensure_ansible_prereq.package_list is defined
+    - ensure_ansible_prereq.package_list is iterable
+  ansible.builtin.assert:
+    fail_msg: "Package {{ item.name }} is not installed"
+    quiet: true
+    that:
+      - item.state != 'present' or ansible_facts['packages'][item.name] is defined
+  loop: "{{ ensure_ansible_prereq.package_list }}"
+  loop_control:
+    label: "{{ item.name }} will be verified"

roles/ensure_apache/tasks/main.yml

@@ -1,7 +1,17 @@
 ---
 # tasks file for ensure_apache
+- name: Assert Target OS Is Supported
+  when:
+    - ansible_facts["system"] is defined
+  ansible.builtin.assert:
+    fail_msg: "Unsupported OS: {{ ansible_facts['distribution'] | default('unknown') }}"
+    quiet: true
+    that:
+      - ansible_facts["system"] == 'Linux'
+      - >-
+        ansible_facts["distribution"] in ['AlmaLinux', 'CentOS', 'Debian',
+        'Fedora', 'OracleLinux', 'Rocky', 'Ubuntu']
 - name: Include Variables
-  when: ["ansible_facts[\"system\"] == 'Linux'"]
   ansible.builtin.include_vars:
     file: '{{ lookup("first_found", findme) }}'
     name: ensure_apache
@@ -23,17 +33,14 @@
       errors: ignore
 - name: Package Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["packages"] is not defined
   ansible.builtin.package_facts:
 - name: Service Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["services"] is not defined
   ansible.builtin.service_facts:
 - name: Ensure Sysctl
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_apache is defined
     - ensure_apache.sysctl_list is defined
     - ensure_apache.sysctl_list is iterable
@@ -54,7 +61,6 @@
     - Ensure_Apache.Service_Reload_Config
 - name: Ensure Packages
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_apache is defined
     - ensure_apache.package_list is defined
     - ensure_apache.package_list is iterable
@@ -71,7 +77,6 @@
     - Ensure_Apache.Service_Reload_Config
 - name: Ensure Seboolean
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_apache is defined
     - ensure_apache.seboolean_list is defined
     - ensure_apache.seboolean_list is iterable
@@ -89,7 +94,6 @@
     - Ensure_Apache.Service_Reload_Config
 - name: Ensure Configurations
   when:
-    - ansible_facts["system"] == 'Linux'
     - http_vhost is defined
     - ensure_apache is defined
     - ensure_apache.template_list is defined
@@ -100,7 +104,7 @@
     group: '{{ item.group | default(omit) }}'
     mode: '{{ item.mode | default(omit) }}'
     owner: '{{ item.owner | default(omit) }}'
-    selevel: '{{ iteml.selevel | default(omit) }}'
+    selevel: '{{ item.selevel | default(omit) }}'
     serole: '{{ item.serole | default(omit) }}'
     setype: '{{ item.setype | default(omit) }}'
     seuser: '{{ item.seuser | default(omit) }}'
@@ -115,7 +119,6 @@
     - Ensure_Apache.Service_Reload_Config
 - name: Ensure Firewall
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts.packages["firewalld"] is defined
     - ansible_facts.packages["python3-firewall"] is defined
     - ensure_apache is defined
@@ -135,7 +138,6 @@
     - Ensure_Apache.Service_Reload_Config
 - name: Ensure Permissions
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_apache is defined
     - http_vhost is defined
     - http_vhost is iterable
@@ -166,7 +168,6 @@
     - Ensure_Apache.Service_Reload_Config
 - name: Ensure Vhost Document Roots
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_apache is defined
     - http_vhost is defined
     - http_vhost is iterable
@@ -188,7 +189,6 @@
     - Ensure_Apache.Service_Reload_Config
 - name: Ensure Website Content From Git Repos
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_apache is defined
     - http_vhost is defined
     - http_vhost is iterable
@@ -208,7 +208,6 @@
     - Ensure_Apache.Service_Reload_Config
 - name: Ensure Services
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_apache is defined
     - ensure_apache.service_list is defined
     - ensure_apache.service_list is iterable
@@ -226,3 +225,27 @@
     - Ensure_Apache.Service_Reload_Config
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
+- name: Post Verification Service Discovery
+  when:
+    - ensure_apache is defined
+    - ensure_apache.service_list is defined
+    - ensure_apache.service_list is iterable
+  ansible.builtin.service_facts:
+- name: Assert Managed Services Are Active
+  when:
+    - ensure_apache is defined
+    - ensure_apache.service_list is defined
+    - ensure_apache.service_list is iterable
+  ansible.builtin.assert:
+    fail_msg: "Service {{ item.name }} is not active"
+    quiet: true
+    that:
+      - >-
+        item.state != 'started' or
+        (ansible_facts['services'][item.name ~ '.service'] is defined and
+        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
+        (ansible_facts['services'][item.name] is defined and
+        ansible_facts['services'][item.name]['state'] == 'running')
+  loop: "{{ ensure_apache.service_list }}"
+  loop_control:
+    label: "{{ item.name }} will be verified"

roles/ensure_cockpit/tasks/main.yml

@@ -1,7 +1,17 @@
 ---
 # tasks file for ensure_cockpit
+- name: Assert Target OS Is Supported
+  when:
+    - ansible_facts["system"] is defined
+  ansible.builtin.assert:
+    fail_msg: "Unsupported OS: {{ ansible_facts['distribution'] | default('unknown') }}"
+    quiet: true
+    that:
+      - ansible_facts["system"] == 'Linux'
+      - >-
+        ansible_facts["distribution"] in ['AlmaLinux', 'CentOS', 'Debian',
+        'Fedora', 'OracleLinux', 'Rocky', 'Ubuntu']
 - name: Include Variables
-  when: ["ansible_facts[\"system\"] == 'Linux'"]
   ansible.builtin.include_vars:
     file: '{{ lookup("first_found", findme) }}'
     name: ensure_cockpit
@@ -23,17 +33,14 @@
       errors: ignore
 - name: Package Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["packages"] is not defined
   ansible.builtin.package_facts:
 - name: Service Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["services"] is not defined
   ansible.builtin.service_facts:
 - name: Ensure Packages
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_cockpit is defined
     - ensure_cockpit.package_list is defined
     - ensure_cockpit.package_list is iterable
@@ -46,7 +53,6 @@
   notify: [Ensure_Cockpit.Package_Facts, Ensure_Cockpit.Service_Facts]
 - name: Ensure Configurations
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_cockpit is defined
     - ensure_cockpit.template_list is defined
     - ensure_cockpit.template_list is iterable
@@ -56,7 +62,7 @@
     group: '{{ item.group | default(omit) }}'
     mode: '{{ item.mode | default(omit) }}'
     owner: '{{ item.owner | default(omit) }}'
-    selevel: '{{ iteml.selevel | default(omit) }}'
+    selevel: '{{ item.selevel | default(omit) }}'
     serole: '{{ item.serole | default(omit) }}'
     setype: '{{ item.setype | default(omit) }}'
     seuser: '{{ item.seuser | default(omit) }}'
@@ -71,7 +77,6 @@
     - Ensure_Cockpit.Service_Restart
 - name: Ensure Services
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_cockpit is defined
     - ensure_cockpit.service_list is defined
     - ensure_cockpit.service_list is iterable
@@ -85,7 +90,6 @@
   notify: [Ensure_Cockpit.Package_Facts, Ensure_Cockpit.Service_Facts]
 - name: Ensure Firewall
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts.packages["firewalld"] is defined
     - ansible_facts.packages["python3-firewall"] is defined
     - ensure_cockpit is defined
@@ -100,3 +104,27 @@
     label: '{{ item.service }} will be {{ item.state }}'
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
+- name: Post Verification Service Discovery
+  when:
+    - ensure_cockpit is defined
+    - ensure_cockpit.service_list is defined
+    - ensure_cockpit.service_list is iterable
+  ansible.builtin.service_facts:
+- name: Assert Managed Services Are Active
+  when:
+    - ensure_cockpit is defined
+    - ensure_cockpit.service_list is defined
+    - ensure_cockpit.service_list is iterable
+  ansible.builtin.assert:
+    fail_msg: "Service {{ item.name }} is not active"
+    quiet: true
+    that:
+      - >-
+        item.state != 'started' or
+        (ansible_facts['services'][item.name ~ '.service'] is defined and
+        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
+        (ansible_facts['services'][item.name] is defined and
+        ansible_facts['services'][item.name]['state'] == 'running')
+  loop: "{{ ensure_cockpit.service_list }}"
+  loop_control:
+    label: "{{ item.name }} will be verified"

roles/ensure_dbus/tasks/main.yml

@@ -1,7 +1,17 @@
 ---
 # tasks file for ensure_dbus
+- name: Assert Target OS Is Supported
+  when:
+    - ansible_facts["system"] is defined
+  ansible.builtin.assert:
+    fail_msg: "Unsupported OS: {{ ansible_facts['distribution'] | default('unknown') }}"
+    quiet: true
+    that:
+      - ansible_facts["system"] == 'Linux'
+      - >-
+        ansible_facts["distribution"] in ['AlmaLinux', 'CentOS', 'Debian',
+        'Fedora', 'OracleLinux', 'Rocky', 'Ubuntu']
 - name: Include Variables
-  when: ["ansible_facts[\"system\"] == 'Linux'"]
   ansible.builtin.include_vars:
     file: '{{ lookup("first_found", findme) }}'
     name: ensure_dbus
@@ -20,19 +30,16 @@
 
 - name: Package Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["packages"] is not defined
   ansible.builtin.package_facts:
 
 - name: Service Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["services"] is not defined
   ansible.builtin.service_facts:
 
 - name: Ensure Packages
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_dbus is defined
     - ensure_dbus.package_list is defined
     - ensure_dbus.package_list is iterable
@@ -46,7 +53,6 @@
 
 - name: Ensure Services
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_dbus is defined
     - ensure_dbus.service_list is defined
     - ensure_dbus.service_list is iterable
@@ -61,3 +67,27 @@
 
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
+- name: Post Verification Service Discovery
+  when:
+    - ensure_dbus is defined
+    - ensure_dbus.service_list is defined
+    - ensure_dbus.service_list is iterable
+  ansible.builtin.service_facts:
+- name: Assert Managed Services Are Active
+  when:
+    - ensure_dbus is defined
+    - ensure_dbus.service_list is defined
+    - ensure_dbus.service_list is iterable
+  ansible.builtin.assert:
+    fail_msg: "Service {{ item.name }} is not active"
+    quiet: true
+    that:
+      - >-
+        item.state != 'started' or
+        (ansible_facts['services'][item.name ~ '.service'] is defined and
+        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
+        (ansible_facts['services'][item.name] is defined and
+        ansible_facts['services'][item.name]['state'] == 'running')
+  loop: "{{ ensure_dbus.service_list }}"
+  loop_control:
+    label: "{{ item.name }} will be verified"

roles/ensure_dovecot/tasks/main.yml

@@ -1,7 +1,17 @@
 ---
 # tasks file for ensure_dovecot
+- name: Assert Target OS Is Supported
+  when:
+    - ansible_facts["system"] is defined
+  ansible.builtin.assert:
+    fail_msg: "Unsupported OS: {{ ansible_facts['distribution'] | default('unknown') }}"
+    quiet: true
+    that:
+      - ansible_facts["system"] == 'Linux'
+      - >-
+        ansible_facts["distribution"] in ['AlmaLinux', 'CentOS', 'Debian',
+        'Fedora', 'OracleLinux', 'Rocky', 'Ubuntu']
 - name: Include Variables
-  when: ["ansible_facts[\"system\"] == 'Linux'"]
   ansible.builtin.include_vars:
     file: '{{ lookup("first_found", findme) }}'
     name: ensure_dovecot
@@ -23,17 +33,14 @@
       errors: ignore
 - name: Package Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["packages"] is not defined
   ansible.builtin.package_facts:
 - name: Service Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["services"] is not defined
   ansible.builtin.service_facts:
 - name: Ensure Sysctl
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_dovecot is defined
     - ensure_dovecot.sysctl_list is defined
     - ensure_dovecot.sysctl_list is iterable
@@ -54,7 +61,6 @@
     - Ensure_Dovecot.Service_Reload_Config
 - name: Ensure Packages
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_dovecot is defined
     - ensure_dovecot.package_list is defined
     - ensure_dovecot.package_list is iterable
@@ -71,7 +77,6 @@
     - Ensure_Dovecot.Service_Reload_Config
 - name: Ensure Seboolean
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_dovecot is defined
     - ensure_dovecot.seboolean_list is defined
     - ensure_dovecot.seboolean_list is iterable
@@ -89,7 +94,6 @@
     - Ensure_Dovecot.Service_Reload_Config
 - name: Ensure Configurations
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_dovecot is defined
     - ensure_dovecot.template_list is defined
     - ensure_dovecot.template_list is iterable
@@ -99,7 +103,7 @@
     group: '{{ item.group | default(omit) }}'
     mode: '{{ item.mode | default(omit) }}'
     owner: '{{ item.owner | default(omit) }}'
-    selevel: '{{ iteml.selevel | default(omit) }}'
+    selevel: '{{ item.selevel | default(omit) }}'
     serole: '{{ item.serole | default(omit) }}'
     setype: '{{ item.setype | default(omit) }}'
     seuser: '{{ item.seuser | default(omit) }}'
@@ -114,7 +118,6 @@
     - Ensure_Dovecot.Service_Reload_Config
 - name: Ensure Firewall
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts.packages["firewalld"] is defined
     - ansible_facts.packages["python3-firewall"] is defined
     - ensure_dovecot is defined
@@ -134,7 +137,6 @@
     - Ensure_Dovecot.Service_Reload_Config
 - name: Ensure Services
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_dovecot is defined
     - ensure_dovecot.service_list is defined
     - ensure_dovecot.service_list is iterable
@@ -148,3 +150,27 @@
   notify: [Ensure_Dovecot.Package_Facts, Ensure_Dovecot.Service_Facts]
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
+- name: Post Verification Service Discovery
+  when:
+    - ensure_dovecot is defined
+    - ensure_dovecot.service_list is defined
+    - ensure_dovecot.service_list is iterable
+  ansible.builtin.service_facts:
+- name: Assert Managed Services Are Active
+  when:
+    - ensure_dovecot is defined
+    - ensure_dovecot.service_list is defined
+    - ensure_dovecot.service_list is iterable
+  ansible.builtin.assert:
+    fail_msg: "Service {{ item.name }} is not active"
+    quiet: true
+    that:
+      - >-
+        item.state != 'started' or
+        (ansible_facts['services'][item.name ~ '.service'] is defined and
+        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
+        (ansible_facts['services'][item.name] is defined and
+        ansible_facts['services'][item.name]['state'] == 'running')
+  loop: "{{ ensure_dovecot.service_list }}"
+  loop_control:
+    label: "{{ item.name }} will be verified"

roles/ensure_fail2ban/tasks/main.yml

@@ -1,7 +1,17 @@
 ---
 # tasks file for ensure_fail2ban
+- name: Assert Target OS Is Supported
+  when:
+    - ansible_facts["system"] is defined
+  ansible.builtin.assert:
+    fail_msg: "Unsupported OS: {{ ansible_facts['distribution'] | default('unknown') }}"
+    quiet: true
+    that:
+      - ansible_facts["system"] == 'Linux'
+      - >-
+        ansible_facts["distribution"] in ['AlmaLinux', 'CentOS', 'Debian',
+        'Fedora', 'OracleLinux', 'Rocky', 'Ubuntu']
 - name: Include Variables
-  when: ["ansible_facts[\"system\"] == 'Linux'"]
   ansible.builtin.include_vars:
     file: '{{ lookup("first_found", findme) }}'
     name: ensure_fail2ban
@@ -23,17 +33,14 @@
       errors: ignore
 - name: Package Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["packages"] is not defined
   ansible.builtin.package_facts:
 - name: Service Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["services"] is not defined
   ansible.builtin.service_facts:
 - name: Ensure Packages
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_fail2ban is defined
     - ensure_fail2ban.package_list is defined
     - ensure_fail2ban.package_list is iterable
@@ -46,7 +53,6 @@
   notify: [Ensure_Fail2ban.Package_Facts, Ensure_Fail2ban.Service_Facts]
 - name: Ensure Configurations
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_fail2ban is defined
     - ensure_fail2ban.template_list is defined
     - ensure_fail2ban.template_list is iterable
@@ -71,7 +77,6 @@
     - Ensure_Fail2ban.Service_Reload
 - name: Ensure Services
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_fail2ban is defined
     - ensure_fail2ban.service_list is defined
     - ensure_fail2ban.service_list is iterable
@@ -85,7 +90,6 @@
   notify: [Ensure_Fail2ban.Package_Facts, Ensure_Fail2ban.Service_Facts]
 - name: Ensure Selinux Is Configured
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_fail2ban is defined
     - ensure_fail2ban.selinux_policy is defined
     - ensure_fail2ban.selinux_state is defined
@@ -100,7 +104,6 @@
     - Ensure_Fail2ban.Service_Reload
 - name: Reboot If Required
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_fail2ban is defined
     - ensure_fail2ban.selinux_policy is defined
     - ensure_fail2ban.selinux_state is defined
@@ -110,7 +113,6 @@
   ansible.builtin.reboot:
 - name: Ensure Seboolean
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_fail2ban is defined
     - ensure_fail2ban.seboolean_list is defined
     - ensure_fail2ban.seboolean_list is iterable
@@ -128,3 +130,27 @@
     - Ensure_Fail2ban.Service_Reload
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
+- name: Post Verification Service Discovery
+  when:
+    - ensure_fail2ban is defined
+    - ensure_fail2ban.service_list is defined
+    - ensure_fail2ban.service_list is iterable
+  ansible.builtin.service_facts:
+- name: Assert Managed Services Are Active
+  when:
+    - ensure_fail2ban is defined
+    - ensure_fail2ban.service_list is defined
+    - ensure_fail2ban.service_list is iterable
+  ansible.builtin.assert:
+    fail_msg: "Service {{ item.name }} is not active"
+    quiet: true
+    that:
+      - >-
+        item.state != 'started' or
+        (ansible_facts['services'][item.name ~ '.service'] is defined and
+        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
+        (ansible_facts['services'][item.name] is defined and
+        ansible_facts['services'][item.name]['state'] == 'running')
+  loop: "{{ ensure_fail2ban.service_list }}"
+  loop_control:
+    label: "{{ item.name }} will be verified"

roles/ensure_firewalld/tasks/main.yml

@@ -1,7 +1,17 @@
 ---
 # tasks file for ensure_firewalld
+- name: Assert Target OS Is Supported
+  when:
+    - ansible_facts["system"] is defined
+  ansible.builtin.assert:
+    fail_msg: "Unsupported OS: {{ ansible_facts['distribution'] | default('unknown') }}"
+    quiet: true
+    that:
+      - ansible_facts["system"] == 'Linux'
+      - >-
+        ansible_facts["distribution"] in ['AlmaLinux', 'CentOS', 'Debian',
+        'Fedora', 'OracleLinux', 'Rocky', 'Ubuntu']
 - name: Include Variables
-  when: ["ansible_facts[\"system\"] == 'Linux'"]
   ansible.builtin.include_vars:
     file: '{{ lookup("first_found", findme) }}'
     name: ensure_firewalld
@@ -20,19 +30,16 @@
 
 - name: Package Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["packages"] is not defined
   ansible.builtin.package_facts:
 
 - name: Service Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["services"] is not defined
   ansible.builtin.service_facts:
 
 - name: Ensure Packages
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_firewalld is defined
     - ensure_firewalld.package_list is defined
     - ensure_firewalld.package_list is iterable
@@ -46,7 +53,6 @@
 
 - name: Ensure Services
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_firewalld is defined
     - ensure_firewalld.service_list is defined
     - ensure_firewalld.service_list is iterable
@@ -64,7 +70,6 @@
 
 - name: Ensure Default Firewall Rules
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts.packages["firewalld"] is defined
     - ansible_facts.packages["python3-firewall"] is defined
     - ensure_firewalld is defined
@@ -80,3 +85,27 @@
 
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
+- name: Post Verification Service Discovery
+  when:
+    - ensure_firewalld is defined
+    - ensure_firewalld.service_list is defined
+    - ensure_firewalld.service_list is iterable
+  ansible.builtin.service_facts:
+- name: Assert Managed Services Are Active
+  when:
+    - ensure_firewalld is defined
+    - ensure_firewalld.service_list is defined
+    - ensure_firewalld.service_list is iterable
+  ansible.builtin.assert:
+    fail_msg: "Service {{ item.name }} is not active"
+    quiet: true
+    that:
+      - >-
+        item.state != 'started' or
+        (ansible_facts['services'][item.name ~ '.service'] is defined and
+        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
+        (ansible_facts['services'][item.name] is defined and
+        ansible_facts['services'][item.name]['state'] == 'running')
+  loop: "{{ ensure_firewalld.service_list }}"
+  loop_control:
+    label: "{{ item.name }} will be verified"

roles/ensure_git/tasks/main.yml

@@ -1,7 +1,17 @@
 ---
 # tasks file for ensure_git
+- name: Assert Target OS Is Supported
+  when:
+    - ansible_facts["system"] is defined
+  ansible.builtin.assert:
+    fail_msg: "Unsupported OS: {{ ansible_facts['distribution'] | default('unknown') }}"
+    quiet: true
+    that:
+      - ansible_facts["system"] == 'Linux'
+      - >-
+        ansible_facts["distribution"] in ['AlmaLinux', 'CentOS', 'Debian',
+        'Fedora', 'OracleLinux', 'Rocky', 'Ubuntu']
 - name: Include Variables
-  when: ["ansible_facts[\"system\"] == 'Linux'"]
   ansible.builtin.include_vars:
     file: '{{ lookup("first_found", findme) }}'
     name: ensure_git
@@ -23,17 +33,14 @@
       errors: ignore
 - name: Package Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["packages"] is not defined
   ansible.builtin.package_facts:
 - name: Service Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["services"] is not defined
   ansible.builtin.service_facts:
 - name: Ensure Packages
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_git is defined
     - ensure_git.package_list is defined
     - ensure_git.package_list is iterable
@@ -46,7 +53,6 @@
   notify: [Ensure_Git.Package_Facts, Ensure_Git.Service_Facts]
 - name: Ensure Configurations
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_git is defined
     - ensure_git.template_list is defined
     - ensure_git.template_list is iterable
@@ -71,7 +77,6 @@
     - Ensure_Git.Service_Restart
 - name: Ensure Services
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_git is defined
     - ensure_git.service_list is defined
     - ensure_git.service_list is iterable
@@ -85,7 +90,6 @@
   notify: [Ensure_Git.Package_Facts, Ensure_Git.Service_Facts]
 - name: Ensure Selinux Is Configured
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_git is defined
     - ensure_git.selinux_policy is defined
     - ensure_git.selinux_state is defined
@@ -100,7 +104,6 @@
     - Ensure_Git.Service_Restart
 - name: Reboot If Required
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_git is defined
     - ensure_git.selinux_policy is defined
     - ensure_git.selinux_state is defined
@@ -110,7 +113,6 @@
   ansible.builtin.reboot:
 - name: Ensure Seboolean
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_git is defined
     - ensure_git.seboolean_list is defined
     - ensure_git.seboolean_list is iterable
@@ -128,3 +130,22 @@
     - Ensure_Git.Service_Restart
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
+- name: Post Verification Package Discovery
+  when:
+    - ensure_git is defined
+    - ensure_git.package_list is defined
+    - ensure_git.package_list is iterable
+  ansible.builtin.package_facts:
+- name: Assert Managed Packages Are Installed
+  when:
+    - ensure_git is defined
+    - ensure_git.package_list is defined
+    - ensure_git.package_list is iterable
+  ansible.builtin.assert:
+    fail_msg: "Package {{ item.name }} is not installed"
+    quiet: true
+    that:
+      - item.state != 'present' or ansible_facts['packages'][item.name] is defined
+  loop: "{{ ensure_git.package_list }}"
+  loop_control:
+    label: "{{ item.name }} will be verified"

roles/ensure_gitea/tasks/main.yml

@@ -1,7 +1,17 @@
 ---
 # tasks file for ensure_gitea
+- name: Assert Target OS Is Supported
+  when:
+    - ansible_facts["system"] is defined
+  ansible.builtin.assert:
+    fail_msg: "Unsupported OS: {{ ansible_facts['distribution'] | default('unknown') }}"
+    quiet: true
+    that:
+      - ansible_facts["system"] == 'Linux'
+      - >-
+        ansible_facts["distribution"] in ['AlmaLinux', 'CentOS', 'Debian',
+        'Fedora', 'OracleLinux', 'Rocky', 'Ubuntu']
 - name: Include Variables
-  when: ["ansible_facts[\"system\"] == 'Linux'"]
   ansible.builtin.include_vars:
     file: '{{ lookup("first_found", findme) }}'
     name: ensure_gitea
@@ -23,17 +33,14 @@
       errors: ignore
 - name: Package Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["packages"] is not defined
   ansible.builtin.package_facts:
 - name: Service Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["services"] is not defined
   ansible.builtin.service_facts:
 - name: Ensure Yum Repository
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["pkg_mgr"] == 'dnf' or ansible_facts["pkg_mgr"] == 'dnf5'
     - ensure_gitea is defined
     - ensure_gitea.yum_repository_list is defined
@@ -96,7 +103,6 @@
     - Ensure_Gitea.Service_Restart
 - name: Ensure Sysctl
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_gitea is defined
     - ensure_gitea.sysctl_list is defined
     - ensure_gitea.sysctl_list is iterable
@@ -117,7 +123,6 @@
     - Ensure_Gitea.Service_Restart
 - name: Ensure Packages
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_gitea is defined
     - ensure_gitea.package_list is defined
     - ensure_gitea.package_list is iterable
@@ -134,7 +139,6 @@
     - Ensure_Gitea.Service_Restart
 - name: Ensure Seboolean
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_gitea is defined
     - ensure_gitea.seboolean_list is defined
     - ensure_gitea.seboolean_list is iterable
@@ -152,7 +156,6 @@
     - Ensure_Gitea.Service_Restart
 - name: Ensure Configurations
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_gitea is defined
     - ensure_gitea.template_list is defined
     - ensure_gitea.template_list is iterable
@@ -162,7 +165,7 @@
     group: '{{ item.group | default(omit) }}'
     mode: '{{ item.mode | default(omit) }}'
     owner: '{{ item.owner | default(omit) }}'
-    selevel: '{{ iteml.selevel | default(omit) }}'
+    selevel: '{{ item.selevel | default(omit) }}'
     serole: '{{ item.serole | default(omit) }}'
     setype: '{{ item.setype | default(omit) }}'
     seuser: '{{ item.seuser | default(omit) }}'
@@ -177,7 +180,6 @@
     - Ensure_Gitea.Service_Restart
 - name: Ensure Firewall
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts.packages["firewalld"] is defined
     - ansible_facts.packages["python3-firewall"] is defined
     - ensure_gitea is defined
@@ -197,7 +199,6 @@
     - Ensure_Gitea.Service_Restart
 - name: Ensure Services
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_gitea is defined
     - ensure_gitea.service_list is defined
     - ensure_gitea.service_list is iterable
@@ -215,3 +216,27 @@
     - Ensure_Gitea.Service_Restart
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
+- name: Post Verification Service Discovery
+  when:
+    - ensure_gitea is defined
+    - ensure_gitea.service_list is defined
+    - ensure_gitea.service_list is iterable
+  ansible.builtin.service_facts:
+- name: Assert Managed Services Are Active
+  when:
+    - ensure_gitea is defined
+    - ensure_gitea.service_list is defined
+    - ensure_gitea.service_list is iterable
+  ansible.builtin.assert:
+    fail_msg: "Service {{ item.name }} is not active"
+    quiet: true
+    that:
+      - >-
+        item.state != 'started' or
+        (ansible_facts['services'][item.name ~ '.service'] is defined and
+        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
+        (ansible_facts['services'][item.name] is defined and
+        ansible_facts['services'][item.name]['state'] == 'running')
+  loop: "{{ ensure_gitea.service_list }}"
+  loop_control:
+    label: "{{ item.name }} will be verified"

roles/ensure_hostname/tasks/main.yml

@@ -1,8 +1,22 @@
 ---
 # tasks file for ensure_hostname
+- name: Assert Target OS Is Supported
+  when:
+    - ansible_facts["system"] is defined
+  ansible.builtin.assert:
+    fail_msg: "Unsupported OS: {{ ansible_facts['system'] | default('unknown') }}"
+    quiet: true
+    that:
+      - ansible_facts["system"] == 'Linux'
 - name: Set Hostname If Localhost
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["fqdn"] == 'localhost.localdomain'
   ansible.builtin.hostname:
     name: '{{ inventory_hostname }}'
+- name: Assert Hostname Verification
+  ansible.builtin.assert:
+    fail_msg: "Hostname is not defined"
+    quiet: true
+    that:
+      - ansible_facts["nodename"] is defined
+      - ansible_facts["nodename"] != ''

roles/ensure_log_rotation/tasks/main.yml

@@ -1,7 +1,17 @@
 ---
 # tasks file for ensure_log_rotation
+- name: Assert Target OS Is Supported
+  when:
+    - ansible_facts["system"] is defined
+  ansible.builtin.assert:
+    fail_msg: "Unsupported OS: {{ ansible_facts['distribution'] | default('unknown') }}"
+    quiet: true
+    that:
+      - ansible_facts["system"] == 'Linux'
+      - >-
+        ansible_facts["distribution"] in ['AlmaLinux', 'CentOS', 'Debian',
+        'Fedora', 'OracleLinux', 'Rocky', 'Ubuntu']
 - name: Include Variables
-  when: ["ansible_facts[\"system\"] == 'Linux'"]
   ansible.builtin.include_vars:
     file: '{{ lookup("first_found", findme) }}'
     name: ensure_log_rotation
@@ -23,17 +33,14 @@
       errors: ignore
 - name: Package Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["packages"] is not defined
   ansible.builtin.package_facts:
 - name: Service Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["services"] is not defined
   ansible.builtin.service_facts:
 - name: Ensure Packages
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_log_rotation is defined
     - ensure_log_rotation.package_list is defined
     - ensure_log_rotation.package_list is iterable
@@ -48,7 +55,6 @@
     - Ensure_Log_Rotation.Service_Facts
 - name: Ensure Configuration
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_log_rotation is defined
     - ensure_log_rotation.template_list is defined
     - ensure_log_rotation.template_list is iterable
@@ -77,7 +83,6 @@
     - Ensure_Log_Rotation.Service_Restart
 - name: Ensure Services
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_log_rotation is defined
     - ensure_log_rotation.service_list is defined
     - ensure_log_rotation.service_list is iterable
@@ -93,3 +98,15 @@
     - Ensure_Log_Rotation.Service_Facts
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
+- name: Assert Logrotate Configuration
+  ansible.builtin.stat:
+    path: /etc/logrotate.conf
+  register: _logrotate_stat
+- name: Assert Logrotate File Exists
+  when:
+    - _logrotate_stat.stat is defined
+  ansible.builtin.assert:
+    fail_msg: "/etc/logrotate.conf does not exist"
+    quiet: true
+    that:
+      - _logrotate_stat.stat.exists

roles/ensure_mariadb/tasks/main.yml

@@ -1,7 +1,17 @@
 ---
 # tasks file for ensure_mariadb
+- name: Assert Target OS Is Supported
+  when:
+    - ansible_facts["system"] is defined
+  ansible.builtin.assert:
+    fail_msg: "Unsupported OS: {{ ansible_facts['distribution'] | default('unknown') }}"
+    quiet: true
+    that:
+      - ansible_facts["system"] == 'Linux'
+      - >-
+        ansible_facts["distribution"] in ['AlmaLinux', 'CentOS', 'Debian',
+        'Fedora', 'OracleLinux', 'Rocky', 'Ubuntu']
 - name: Include Variables
-  when: ["ansible_facts[\"system\"] == 'Linux'"]
   ansible.builtin.include_vars:
     file: '{{ lookup("first_found", findme) }}'
     name: ensure_mariadb
@@ -23,17 +33,14 @@
       errors: ignore
 - name: Package Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["packages"] is not defined
   ansible.builtin.package_facts:
 - name: Service Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["services"] is not defined
   ansible.builtin.service_facts:
 - name: Ensure Sysctl
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_mariadb is defined
     - ensure_mariadb.sysctl_list is defined
     - ensure_mariadb.sysctl_list is iterable
@@ -54,7 +61,6 @@
     - Ensure_Mariadb.Service_Restart
 - name: Ensure Packages
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_mariadb is defined
     - ensure_mariadb.package_list is defined
     - ensure_mariadb.package_list is iterable
@@ -71,7 +77,6 @@
     - Ensure_Mariadb.Service_Restart
 - name: Ensure Seboolean
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_mariadb is defined
     - ensure_mariadb.seboolean_list is defined
     - ensure_mariadb.seboolean_list is iterable
@@ -89,7 +94,6 @@
     - Ensure_Mariadb.Service_Restart
 - name: Ensure Configurations
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_mariadb is defined
     - ensure_mariadb.template_list is defined
     - ensure_mariadb.template_list is iterable
@@ -99,7 +103,7 @@
     group: '{{ item.group | default(omit) }}'
     mode: '{{ item.mode | default(omit) }}'
     owner: '{{ item.owner | default(omit) }}'
-    selevel: '{{ iteml.selevel | default(omit) }}'
+    selevel: '{{ item.selevel | default(omit) }}'
     serole: '{{ item.serole | default(omit) }}'
     setype: '{{ item.setype | default(omit) }}'
     seuser: '{{ item.seuser | default(omit) }}'
@@ -114,7 +118,6 @@
     - Ensure_Mariadb.Service_Restart
 - name: Ensure Firewall
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts.packages["firewalld"] is defined
     - ansible_facts.packages["python3-firewall"] is defined
     - ensure_mariadb is defined
@@ -134,7 +137,6 @@
     - Ensure_Mariadb.Service_Restart
 - name: Ensure Services
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_mariadb is defined
     - ensure_mariadb.service_list is defined
     - ensure_mariadb.service_list is iterable
@@ -230,3 +232,27 @@
   loop: '{{ mariadb_user_list }}'
   loop_control:
     label: '{{ item.name }} will be {{ item.state }}'
+- name: Post Verification Service Discovery
+  when:
+    - ensure_mariadb is defined
+    - ensure_mariadb.service_list is defined
+    - ensure_mariadb.service_list is iterable
+  ansible.builtin.service_facts:
+- name: Assert Managed Services Are Active
+  when:
+    - ensure_mariadb is defined
+    - ensure_mariadb.service_list is defined
+    - ensure_mariadb.service_list is iterable
+  ansible.builtin.assert:
+    fail_msg: "Service {{ item.name }} is not active"
+    quiet: true
+    that:
+      - >-
+        item.state != 'started' or
+        (ansible_facts['services'][item.name ~ '.service'] is defined and
+        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
+        (ansible_facts['services'][item.name] is defined and
+        ansible_facts['services'][item.name]['state'] == 'running')
+  loop: "{{ ensure_mariadb.service_list }}"
+  loop_control:
+    label: "{{ item.name }} will be verified"

roles/ensure_os_patch/tasks/main.yml

@@ -1,7 +1,17 @@
 ---
 # tasks file for ensure_os_patch
+- name: Assert Target OS Is Supported
+  when:
+    - ansible_facts["system"] is defined
+  ansible.builtin.assert:
+    fail_msg: "Unsupported OS: {{ ansible_facts['distribution'] | default('unknown') }}"
+    quiet: true
+    that:
+      - ansible_facts["system"] == 'Linux'
+      - >-
+        ansible_facts["distribution"] in ['AlmaLinux', 'CentOS', 'Debian',
+        'Fedora', 'OracleLinux', 'Rocky', 'Ubuntu']
 - name: Include Variables
-  when: ["ansible_facts[\"system\"] == 'Linux'"]
   ansible.builtin.include_vars:
     file: '{{ lookup("first_found", findme) }}'
     name: ensure_os_patch
@@ -23,17 +33,14 @@
       errors: ignore
 - name: Package Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["packages"] is not defined
   ansible.builtin.package_facts:
 - name: Service Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["services"] is not defined
   ansible.builtin.service_facts:
 - name: Ensure Packages
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_os_patch is defined
     - ensure_os_patch.package_list is defined
     - ensure_os_patch.package_list is iterable
@@ -46,7 +53,6 @@
   notify: [Ensure_Os_Patch.Package_Facts, Ensure_Os_Patch.Service_Facts]
 - name: Ensure Apt Patch
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["pkg_mgr"] == 'apt'
   ansible.builtin.apt:
     autoclean: 'yes'
@@ -56,7 +62,6 @@
   notify: [Ensure_Os_Patch.Package_Facts, Ensure_Os_Patch.Service_Facts]
 - name: Ensure Dnf
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["pkg_mgr"] == 'dnf'
   ansible.builtin.dnf:
     name: '*'
@@ -65,7 +70,6 @@
   notify: [Ensure_Os_Patch.Package_Facts, Ensure_Os_Patch.Service_Facts]
 - name: Ensure Dnf5
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["pkg_mgr"] == 'dnf5'
   ansible.builtin.dnf5:
     name: '*'
@@ -74,7 +78,6 @@
   notify: [Ensure_Os_Patch.Package_Facts, Ensure_Os_Patch.Service_Facts]
 - name: Ensure Services
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_os_patch is defined
     - ensure_os_patch.service_list is defined
     - ensure_os_patch.service_list is iterable
@@ -88,3 +91,22 @@
   notify: [Ensure_Os_Patch.Package_Facts, Ensure_Os_Patch.Service_Facts]
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
+- name: Post Verification Package Discovery
+  when:
+    - ensure_os_patch is defined
+    - ensure_os_patch.package_list is defined
+    - ensure_os_patch.package_list is iterable
+  ansible.builtin.package_facts:
+- name: Assert Managed Packages Are Installed
+  when:
+    - ensure_os_patch is defined
+    - ensure_os_patch.package_list is defined
+    - ensure_os_patch.package_list is iterable
+  ansible.builtin.assert:
+    fail_msg: "Package {{ item.name }} is not installed"
+    quiet: true
+    that:
+      - item.state != 'present' or ansible_facts['packages'][item.name] is defined
+  loop: "{{ ensure_os_patch.package_list }}"
+  loop_control:
+    label: "{{ item.name }} will be verified"

roles/ensure_os_upgrade/tasks/Debian-default.yml

@@ -2,7 +2,6 @@
 # tasks file for ensure_os_upgrade - Debian
 - name: Update sources.list for Debian Upgrade
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["os_family"] == 'Debian'
     - ensure_os_upgrade is defined
     - ensure_os_upgrade.target_codename is defined
@@ -14,7 +13,6 @@
 
 - name: Safe Upgrade Debian Packages
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["os_family"] == 'Debian'
     - ensure_os_upgrade is defined
     - ensure_os_upgrade.target_codename is defined
@@ -27,7 +25,6 @@
 
 - name: Full Upgrade Debian Packages
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["os_family"] == 'Debian'
     - ensure_os_upgrade is defined
     - ensure_os_upgrade.target_codename is defined
@@ -41,7 +38,6 @@
 
 - name: Reboot Debian After Upgrade
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["os_family"] == 'Debian'
     - ensure_os_upgrade is defined
     - ensure_os_upgrade.target_codename is defined

roles/ensure_os_upgrade/tasks/Fedora-default.yml

@@ -2,7 +2,6 @@
 # tasks file for ensure_os_upgrade - Fedora
 - name: Ensure System-upgrade Download
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["distribution"] == 'Fedora'
     - ensure_os_upgrade is defined
     - ensure_os_upgrade.package_list is defined
@@ -13,7 +12,6 @@
     dnf -y system-upgrade download --refresh --releasever={{ ensure_os_upgrade.target_version | int }}
 - name: Ensure System-upgrade Reboot
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["distribution"] == 'Fedora'
     - ensure_os_upgrade is defined
     - ensure_os_upgrade.package_list is defined
@@ -26,7 +24,6 @@
     sleep 5 && dnf -y system-upgrade reboot
 - name: Wait For The Reboot
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["distribution"] == 'Fedora'
     - ensure_os_upgrade is defined
     - ensure_os_upgrade.package_list is defined

roles/ensure_os_upgrade/tasks/Ubuntu-default.yml

@@ -2,7 +2,6 @@
 # tasks file for ensure_os_upgrade - Ubuntu
 - name: Ensure update-manager-core is installed
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["distribution"] == 'Ubuntu'
     - ensure_os_upgrade is defined
   ansible.builtin.apt:
@@ -11,7 +10,6 @@
 
 - name: Configure Ubuntu Release Upgrade Prompt
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["distribution"] == 'Ubuntu'
     - ensure_os_upgrade is defined
     - ensure_os_upgrade.target_version is defined
@@ -22,7 +20,6 @@
 
 - name: Execute Ubuntu Release Upgrade
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["distribution"] == 'Ubuntu'
     - ensure_os_upgrade is defined
     - ensure_os_upgrade.target_version is defined
@@ -34,7 +31,6 @@
 
 - name: Reboot Ubuntu After Upgrade
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["distribution"] == 'Ubuntu'
     - ensure_os_upgrade is defined
     - ensure_os_upgrade.target_version is defined

roles/ensure_os_upgrade/tasks/main.yml

@@ -1,7 +1,17 @@
 ---
 # tasks file for ensure_os_upgrade
+- name: Assert Target OS Is Supported
+  when:
+    - ansible_facts["system"] is defined
+  ansible.builtin.assert:
+    fail_msg: "Unsupported OS: {{ ansible_facts['distribution'] | default('unknown') }}"
+    quiet: true
+    that:
+      - ansible_facts["system"] == 'Linux'
+      - >-
+        ansible_facts["distribution"] in ['AlmaLinux', 'CentOS', 'Debian',
+        'Fedora', 'OracleLinux', 'Rocky', 'Ubuntu']
 - name: Include Variables
-  when: ["ansible_facts[\"system\"] == 'Linux'"]
   ansible.builtin.include_vars:
     file: '{{ lookup("first_found", findme) }}'
     name: ensure_os_upgrade
@@ -23,17 +33,14 @@
       errors: ignore
 - name: Package Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["packages"] is not defined
   ansible.builtin.package_facts:
 - name: Service Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["services"] is not defined
   ansible.builtin.service_facts:
 - name: Ensure Packages
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_os_upgrade is defined
     - ensure_os_upgrade.package_list is defined
     - ensure_os_upgrade.package_list is iterable
@@ -48,7 +55,6 @@
     - Ensure_Os_Upgrade.Service_Facts
 - name: Ensure Services
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_os_upgrade is defined
     - ensure_os_upgrade.service_list is defined
     - ensure_os_upgrade.service_list is iterable
@@ -63,7 +69,6 @@
     - Ensure_Os_Upgrade.Package_Facts
     - Ensure_Os_Upgrade.Service_Facts
 - name: Include Vendor / Version Specific Tasks
-  when: ["ansible_facts[\"system\"] == 'Linux'"]
   ansible.builtin.include_tasks:
     file: '{{ lookup("first_found", findme) }}'
   vars:
@@ -88,3 +93,22 @@
     - Ensure_Os_Upgrade.Service_Facts
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
+- name: Post Verification Package Discovery
+  when:
+    - ensure_os_upgrade is defined
+    - ensure_os_upgrade.package_list is defined
+    - ensure_os_upgrade.package_list is iterable
+  ansible.builtin.package_facts:
+- name: Assert Managed Packages Are Installed
+  when:
+    - ensure_os_upgrade is defined
+    - ensure_os_upgrade.package_list is defined
+    - ensure_os_upgrade.package_list is iterable
+  ansible.builtin.assert:
+    fail_msg: "Package {{ item.name }} is not installed"
+    quiet: true
+    that:
+      - item.state != 'present' or ansible_facts['packages'][item.name] is defined
+  loop: "{{ ensure_os_upgrade.package_list }}"
+  loop_control:
+    label: "{{ item.name }} will be verified"

roles/ensure_podman/tasks/main.yml

@@ -1,7 +1,17 @@
 ---
 # tasks file for ensure_podman
+- name: Assert Target OS Is Supported
+  when:
+    - ansible_facts["system"] is defined
+  ansible.builtin.assert:
+    fail_msg: "Unsupported OS: {{ ansible_facts['distribution'] | default('unknown') }}"
+    quiet: true
+    that:
+      - ansible_facts["system"] == 'Linux'
+      - >-
+        ansible_facts["distribution"] in ['AlmaLinux', 'CentOS', 'Debian',
+        'Fedora', 'OracleLinux', 'Rocky', 'Ubuntu']
 - name: Include Variables
-  when: ["ansible_facts[\"system\"] == 'Linux'"]
   ansible.builtin.include_vars:
     file: '{{ lookup("first_found", findme) }}'
     name: ensure_podman
@@ -23,17 +33,14 @@
       errors: ignore
 - name: Package Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["packages"] is not defined
   ansible.builtin.package_facts:
 - name: Service Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["services"] is not defined
   ansible.builtin.service_facts:
 - name: Ensure Packages
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_podman is defined
     - ensure_podman.package_list is defined
     - ensure_podman.package_list is iterable
@@ -46,7 +53,6 @@
   notify: [Ensure_Podman.Package_Facts, Ensure_Podman.Service_Facts]
 - name: Ensure Services
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_podman is defined
     - ensure_podman.service_list is defined
     - ensure_podman.service_list is iterable
@@ -60,7 +66,6 @@
   notify: [Ensure_Podman.Package_Facts, Ensure_Podman.Service_Facts]
 - name: Ensure Cgroup V2 Have Not Been Disabled
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_podman is defined
     - ansible_facts["distribution"] == 'Fedora'
     - ansible_facts["distribution_major_version"] is version('32', '>=')
@@ -71,7 +76,6 @@
       grubby --update-kernel=ALL --remove-args=systemd.unified_cgroup_hierarchy=0
 - name: Reboot To Disable Cgroups V1
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_podman is defined
     - ansible_facts["distribution"] == 'Fedora'
     - ansible_facts["distribution_major_version"] is version('32', '>=')
@@ -80,3 +84,27 @@
   ansible.builtin.reboot:
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
+- name: Post Verification Service Discovery
+  when:
+    - ensure_podman is defined
+    - ensure_podman.service_list is defined
+    - ensure_podman.service_list is iterable
+  ansible.builtin.service_facts:
+- name: Assert Managed Services Are Active
+  when:
+    - ensure_podman is defined
+    - ensure_podman.service_list is defined
+    - ensure_podman.service_list is iterable
+  ansible.builtin.assert:
+    fail_msg: "Service {{ item.name }} is not active"
+    quiet: true
+    that:
+      - >-
+        item.state != 'started' or
+        (ansible_facts['services'][item.name ~ '.service'] is defined and
+        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
+        (ansible_facts['services'][item.name] is defined and
+        ansible_facts['services'][item.name]['state'] == 'running')
+  loop: "{{ ensure_podman.service_list }}"
+  loop_control:
+    label: "{{ item.name }} will be verified"

roles/ensure_postfix/tasks/main.yml

@@ -1,7 +1,17 @@
 ---
 # tasks file for ensure_postfix
+- name: Assert Target OS Is Supported
+  when:
+    - ansible_facts["system"] is defined
+  ansible.builtin.assert:
+    fail_msg: "Unsupported OS: {{ ansible_facts['distribution'] | default('unknown') }}"
+    quiet: true
+    that:
+      - ansible_facts["system"] == 'Linux'
+      - >-
+        ansible_facts["distribution"] in ['AlmaLinux', 'CentOS', 'Debian',
+        'Fedora', 'OracleLinux', 'Rocky', 'Ubuntu']
 - name: Include Variables
-  when: ["ansible_facts[\"system\"] == 'Linux'"]
   ansible.builtin.include_vars:
     file: '{{ lookup("first_found", findme) }}'
     name: ensure_postfix
@@ -23,17 +33,14 @@
       errors: ignore
 - name: Package Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["packages"] is not defined
   ansible.builtin.package_facts:
 - name: Service Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["services"] is not defined
   ansible.builtin.service_facts:
 - name: Ensure Sysctl
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_postfix is defined
     - ensure_postfix.sysctl_list is defined
     - ensure_postfix.sysctl_list is iterable
@@ -54,7 +61,6 @@
     - Ensure_Postfix.Service_Reload_Config
 - name: Ensure Packages
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_postfix is defined
     - ensure_postfix.package_list is defined
     - ensure_postfix.package_list is iterable
@@ -71,7 +77,6 @@
     - Ensure_Postfix.Service_Reload_Config
 - name: Ensure Seboolean
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_postfix is defined
     - ensure_postfix.seboolean_list is defined
     - ensure_postfix.seboolean_list is iterable
@@ -89,7 +94,6 @@
     - Ensure_Postfix.Service_Reload_Config
 - name: Ensure Configurations
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_postfix is defined
     - ensure_postfix.template_list is defined
     - ensure_postfix.template_list is iterable
@@ -99,7 +103,7 @@
     group: '{{ item.group | default(omit) }}'
     mode: '{{ item.mode | default(omit) }}'
     owner: '{{ item.owner | default(omit) }}'
-    selevel: '{{ iteml.selevel | default(omit) }}'
+    selevel: '{{ item.selevel | default(omit) }}'
     serole: '{{ item.serole | default(omit) }}'
     setype: '{{ item.setype | default(omit) }}'
     seuser: '{{ item.seuser | default(omit) }}'
@@ -114,7 +118,6 @@
     - Ensure_Postfix.Service_Reload_Config
 - name: Ensure Firewall
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts.packages["firewalld"] is defined
     - ansible_facts.packages["python3-firewall"] is defined
     - ensure_postfix is defined
@@ -134,7 +137,6 @@
     - Ensure_Postfix.Service_Reload_Config
 - name: Ensure Services
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_postfix is defined
     - ensure_postfix.service_list is defined
     - ensure_postfix.service_list is iterable
@@ -148,3 +150,27 @@
   notify: [Ensure_Postfix.Package_Facts, Ensure_Postfix.Service_Facts]
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
+- name: Post Verification Service Discovery
+  when:
+    - ensure_postfix is defined
+    - ensure_postfix.service_list is defined
+    - ensure_postfix.service_list is iterable
+  ansible.builtin.service_facts:
+- name: Assert Managed Services Are Active
+  when:
+    - ensure_postfix is defined
+    - ensure_postfix.service_list is defined
+    - ensure_postfix.service_list is iterable
+  ansible.builtin.assert:
+    fail_msg: "Service {{ item.name }} is not active"
+    quiet: true
+    that:
+      - >-
+        item.state != 'started' or
+        (ansible_facts['services'][item.name ~ '.service'] is defined and
+        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
+        (ansible_facts['services'][item.name] is defined and
+        ansible_facts['services'][item.name]['state'] == 'running')
+  loop: "{{ ensure_postfix.service_list }}"
+  loop_control:
+    label: "{{ item.name }} will be verified"

roles/ensure_repo_epel/tasks/main.yml

@@ -1,7 +1,17 @@
 ---
 # tasks file for ensure_repo_epel
+- name: Assert Target OS Is Supported
+  when:
+    - ansible_facts["system"] is defined
+  ansible.builtin.assert:
+    fail_msg: "Unsupported OS: {{ ansible_facts['distribution'] | default('unknown') }}"
+    quiet: true
+    that:
+      - ansible_facts["system"] == 'Linux'
+      - >-
+        ansible_facts["distribution"] in ['AlmaLinux', 'CentOS', 'Debian',
+        'Fedora', 'OracleLinux', 'Rocky', 'Ubuntu']
 - name: Include Variables
-  when: ["ansible_facts[\"system\"] == 'Linux'"]
   ansible.builtin.include_vars:
     file: '{{ lookup("first_found", findme) }}'
     name: ensure_repo_epel
@@ -23,17 +33,14 @@
       errors: ignore
 - name: Package Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["packages"] is not defined
   ansible.builtin.package_facts:
 - name: Service Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["services"] is not defined
   ansible.builtin.service_facts:
 - name: Ensure Packages
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_repo_epel is defined
     - ensure_repo_epel.package_list is defined
     - ensure_repo_epel.package_list is iterable
@@ -48,7 +55,6 @@
   notify: [Ensure_Repo_Epel.Package_Facts, Ensure_Repo_Epel.Service_Facts]
 - name: Ensure Services
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_repo_epel is defined
     - ensure_repo_epel.service_list is defined
     - ensure_repo_epel.service_list is iterable
@@ -62,7 +68,6 @@
   notify: [Ensure_Repo_Epel.Package_Facts, Ensure_Repo_Epel.Service_Facts]
 - name: Read Oracle EPEL Repo File
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["distribution"] == 'OracleLinux'
   ansible.builtin.slurp:
     src: "/etc/yum.repos.d/oracle-epel-ol{{ ansible_facts['distribution_major_version'] }}.repo"
@@ -71,7 +76,6 @@
 
 - name: Prioritize Oracle Epel Repo
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["distribution"] == 'OracleLinux'
     - oracle_epel_repo_file.content is defined
     - (oracle_epel_repo_file.content | b64decode | community.general.from_ini).keys() | select('search', '_EPEL') | length > 0
@@ -85,7 +89,6 @@
     create: false
 - name: Deprioritize Upstream Epel Repo
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["distribution"] == 'OracleLinux'
   community.general.ini_file:
     path: "/etc/yum.repos.d/epel.repo"
@@ -97,3 +100,22 @@
     create: false
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
+- name: Post Verification Package Discovery
+  when:
+    - ensure_repo_epel is defined
+    - ensure_repo_epel.package_list is defined
+    - ensure_repo_epel.package_list is iterable
+  ansible.builtin.package_facts:
+- name: Assert Managed Packages Are Installed
+  when:
+    - ensure_repo_epel is defined
+    - ensure_repo_epel.package_list is defined
+    - ensure_repo_epel.package_list is iterable
+  ansible.builtin.assert:
+    fail_msg: "Package {{ item.name }} is not installed"
+    quiet: true
+    that:
+      - item.state != 'present' or ansible_facts['packages'][item.name] is defined
+  loop: "{{ ensure_repo_epel.package_list }}"
+  loop_control:
+    label: "{{ item.name }} will be verified"

roles/ensure_repo_rpmfusion/tasks/main.yml

@@ -1,7 +1,17 @@
 ---
 # tasks file for ensure_repo_rpmfusion
+- name: Assert Target OS Is Supported
+  when:
+    - ansible_facts["system"] is defined
+  ansible.builtin.assert:
+    fail_msg: "Unsupported OS: {{ ansible_facts['distribution'] | default('unknown') }}"
+    quiet: true
+    that:
+      - ansible_facts["system"] == 'Linux'
+      - >-
+        ansible_facts["distribution"] in ['AlmaLinux', 'CentOS', 'Debian',
+        'Fedora', 'OracleLinux', 'Rocky', 'Ubuntu']
 - name: Include Variables
-  when: ["ansible_facts[\"system\"] == 'Linux'"]
   ansible.builtin.include_vars:
     file: '{{ lookup("first_found", findme) }}'
     name: ensure_repo_rpmfusion
@@ -23,17 +33,14 @@
       errors: ignore
 - name: Package Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["packages"] is not defined
   ansible.builtin.package_facts:
 - name: Service Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["services"] is not defined
   ansible.builtin.service_facts:
 - name: Ensure Packages
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_repo_rpmfusion is defined
     - ensure_repo_rpmfusion.package_list is defined
     - ensure_repo_rpmfusion.package_list is iterable
@@ -50,7 +57,6 @@
     - Ensure_Repo_Rpmfusion.Service_Facts
 - name: Ensure Services
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_repo_rpmfusion is defined
     - ensure_repo_rpmfusion.service_list is defined
     - ensure_repo_rpmfusion.service_list is iterable
@@ -66,3 +72,22 @@
     - Ensure_Repo_Rpmfusion.Service_Facts
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
+- name: Post Verification Package Discovery
+  when:
+    - ensure_repo_rpmfusion is defined
+    - ensure_repo_rpmfusion.package_list is defined
+    - ensure_repo_rpmfusion.package_list is iterable
+  ansible.builtin.package_facts:
+- name: Assert Managed Packages Are Installed
+  when:
+    - ensure_repo_rpmfusion is defined
+    - ensure_repo_rpmfusion.package_list is defined
+    - ensure_repo_rpmfusion.package_list is iterable
+  ansible.builtin.assert:
+    fail_msg: "Package {{ item.name }} is not installed"
+    quiet: true
+    that:
+      - item.state != 'present' or ansible_facts['packages'][item.name] is defined
+  loop: "{{ ensure_repo_rpmfusion.package_list }}"
+  loop_control:
+    label: "{{ item.name }} will be verified"

roles/ensure_rsync/tasks/main.yml

@@ -1,7 +1,17 @@
 ---
 # tasks file for ensure_rsync
+- name: Assert Target OS Is Supported
+  when:
+    - ansible_facts["system"] is defined
+  ansible.builtin.assert:
+    fail_msg: "Unsupported OS: {{ ansible_facts['distribution'] | default('unknown') }}"
+    quiet: true
+    that:
+      - ansible_facts["system"] == 'Linux'
+      - >-
+        ansible_facts["distribution"] in ['AlmaLinux', 'CentOS', 'Debian',
+        'Fedora', 'OracleLinux', 'Rocky', 'Ubuntu']
 - name: Include Variables
-  when: ["ansible_facts[\"system\"] == 'Linux'"]
   ansible.builtin.include_vars:
     file: '{{ lookup("first_found", findme) }}'
     name: ensure_rsync
@@ -23,17 +33,14 @@
       errors: ignore
 - name: Package Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["packages"] is not defined
   ansible.builtin.package_facts:
 - name: Service Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["services"] is not defined
   ansible.builtin.service_facts:
 - name: Ensure Packages
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_rsync is defined
     - ensure_rsync.package_list is defined
     - ensure_rsync.package_list is iterable
@@ -46,7 +53,6 @@
   notify: [Ensure_Rsync.Package_Facts, Ensure_Rsync.Service_Facts]
 - name: Ensure Configurations
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_rsync is defined
     - ensure_rsync.template_list is defined
     - ensure_rsync.template_list is iterable
@@ -56,7 +62,7 @@
     group: '{{ item.group | default(omit) }}'
     mode: '{{ item.mode | default(omit) }}'
     owner: '{{ item.owner | default(omit) }}'
-    selevel: '{{ iteml.selevel | default(omit) }}'
+    selevel: '{{ item.selevel | default(omit) }}'
     serole: '{{ item.serole | default(omit) }}'
     setype: '{{ item.setype | default(omit) }}'
     seuser: '{{ item.seuser | default(omit) }}'
@@ -71,7 +77,6 @@
     - Ensure_Rsync.Service_Restart
 - name: Ensure Services
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_rsync is defined
     - ensure_rsync.service_list is defined
     - ensure_rsync.service_list is iterable
@@ -85,7 +90,6 @@
   notify: [Ensure_Rsync.Package_Facts, Ensure_Rsync.Service_Facts]
 - name: Ensure Selinux Is Configured
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_rsync is defined
     - ensure_rsync.selinux_policy is defined
     - ensure_rsync.selinux_state is defined
@@ -100,7 +104,6 @@
     - Ensure_Rsync.Service_Restart
 - name: Reboot If Required
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_rsync is defined
     - ensure_rsync.selinux_policy is defined
     - ensure_rsync.selinux_state is defined  # This line is correct, no change needed
@@ -110,7 +113,6 @@
   ansible.builtin.reboot:
 - name: Ensure Seboolean
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_rsync is defined
     - ensure_rsync.seboolean_list is defined
     - ensure_rsync.seboolean_list is iterable
@@ -128,3 +130,22 @@
     - Ensure_Rsync.Service_Restart
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
+- name: Post Verification Package Discovery
+  when:
+    - ensure_rsync is defined
+    - ensure_rsync.package_list is defined
+    - ensure_rsync.package_list is iterable
+  ansible.builtin.package_facts:
+- name: Assert Managed Packages Are Installed
+  when:
+    - ensure_rsync is defined
+    - ensure_rsync.package_list is defined
+    - ensure_rsync.package_list is iterable
+  ansible.builtin.assert:
+    fail_msg: "Package {{ item.name }} is not installed"
+    quiet: true
+    that:
+      - item.state != 'present' or ansible_facts['packages'][item.name] is defined
+  loop: "{{ ensure_rsync.package_list }}"
+  loop_control:
+    label: "{{ item.name }} will be verified"

roles/ensure_selinux/tasks/main.yml

@@ -1,7 +1,17 @@
 ---
 # tasks file for ensure_selinux
+- name: Assert Target OS Is Supported
+  when:
+    - ansible_facts["system"] is defined
+  ansible.builtin.assert:
+    fail_msg: "Unsupported OS: {{ ansible_facts['distribution'] | default('unknown') }}"
+    quiet: true
+    that:
+      - ansible_facts["system"] == 'Linux'
+      - >-
+        ansible_facts["distribution"] in ['AlmaLinux', 'CentOS', 'Fedora',
+        'OracleLinux', 'Rocky']
 - name: Include Variables
-  when: ["ansible_facts[\"system\"] == 'Linux'"]
   ansible.builtin.include_vars:
     file: '{{ lookup("first_found", findme) }}'
     name: ensure_selinux
@@ -23,17 +33,14 @@
       errors: ignore
 - name: Package Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["packages"] is not defined
   ansible.builtin.package_facts:
 - name: Service Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["services"] is not defined
   ansible.builtin.service_facts:
 - name: Ensure Packages
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_selinux is defined
     - ensure_selinux.package_list is defined
     - ensure_selinux.package_list is iterable
@@ -46,7 +53,6 @@
   notify: [Ensure_Selinux.Package_Facts, Ensure_Selinux.Service_Facts]
 - name: Ensure Configurations
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_selinux is defined
     - ensure_selinux.template_list is defined
     - ensure_selinux.template_list is iterable
@@ -56,7 +62,7 @@
     group: '{{ item.group | default(omit) }}'
     mode: '{{ item.mode | default(omit) }}'
     owner: '{{ item.owner | default(omit) }}'
-    selevel: '{{ iteml.selevel | default(omit) }}'
+    selevel: '{{ item.selevel | default(omit) }}'
     serole: '{{ item.serole | default(omit) }}'
     setype: '{{ item.setype | default(omit) }}'
     seuser: '{{ item.seuser | default(omit) }}'
@@ -71,7 +77,6 @@
     - Ensure_Selinux.Service_Restart
 - name: Ensure Services
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_selinux is defined
     - ensure_selinux.service_list is defined
     - ensure_selinux.service_list is iterable
@@ -85,7 +90,6 @@
   notify: [Ensure_Selinux.Package_Facts, Ensure_Selinux.Service_Facts]
 - name: Ensure Selinux Is Configured
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_selinux is defined
     - ensure_selinux.selinux_policy is defined
     - ensure_selinux.selinux_state is defined
@@ -95,7 +99,6 @@
   register: ensure_selinux_results
 - name: Reboot If Required
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_selinux is defined
     - ensure_selinux.selinux_policy is defined
     - ensure_selinux.selinux_state is defined
@@ -105,7 +108,6 @@
   ansible.builtin.reboot:
 - name: Ensure Seboolean
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_selinux is defined
     - ensure_selinux.seboolean_list is defined
     - ensure_selinux.seboolean_list is iterable
@@ -118,3 +120,13 @@
     label: '{{ item.name }} will be {{ item.state }}'
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
+- name: Assert SELinux Policy And State
+  when:
+    - ensure_selinux is defined
+    - ensure_selinux.selinux_state is defined
+  ansible.builtin.assert:
+    fail_msg: "SELinux state mismatch"
+    quiet: true
+    that:
+      - ansible_facts["selinux"] is defined
+      - ansible_facts["selinux"]["status"] == 'enabled' or ensure_selinux.selinux_state == 'disabled'

roles/ensure_sudo/tasks/main.yml

@@ -1,7 +1,17 @@
 ---
 # tasks file for ensure_sudo
+- name: Assert Target OS Is Supported
+  when:
+    - ansible_facts["system"] is defined
+  ansible.builtin.assert:
+    fail_msg: "Unsupported OS: {{ ansible_facts['distribution'] | default('unknown') }}"
+    quiet: true
+    that:
+      - ansible_facts["system"] == 'Linux'
+      - >-
+        ansible_facts["distribution"] in ['AlmaLinux', 'CentOS', 'Debian',
+        'Fedora', 'OracleLinux', 'Rocky', 'Ubuntu']
 - name: Include Vendor / Version Specific Variables
-  when: ["ansible_facts[\"system\"] == 'Linux'"]
   ansible.builtin.include_vars:
     file: '{{ lookup("first_found", findme) }}'
     name: ensure_sudo
@@ -23,17 +33,14 @@
       errors: ignore
 - name: Package Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["packages"] is not defined
   ansible.builtin.package_facts:
 - name: Service Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["services"] is not defined
   ansible.builtin.service_facts:
 - name: Ensure Packages
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_sudo is defined
     - ensure_sudo.package_list is defined
     - ensure_sudo.package_list is iterable
@@ -46,7 +53,6 @@
   notify: [Ensure_Sudo.Package_Facts, Ensure_Sudo.Service_Facts]
 - name: Ensure Configurations
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_sudo is defined
     - ensure_sudo.template_list is defined
     - ensure_sudo.template_list is iterable
@@ -56,7 +62,7 @@
     group: '{{ item.group | default(omit) }}'
     mode: '{{ item.mode | default(omit) }}'
     owner: '{{ item.owner | default(omit) }}'
-    selevel: '{{ iteml.selevel | default(omit) }}'
+    selevel: '{{ item.selevel | default(omit) }}'
     serole: '{{ item.serole | default(omit) }}'
     setype: '{{ item.setype | default(omit) }}'
     seuser: '{{ item.seuser | default(omit) }}'
@@ -71,7 +77,6 @@
     - Ensure_Sudo.Service_Restart
 - name: Ensure Services
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_sudo is defined
     - ensure_sudo.service_list is defined
     - ensure_sudo.service_list is iterable
@@ -85,7 +90,6 @@
   notify: [Ensure_Sudo.Package_Facts, Ensure_Sudo.Service_Facts]
 - name: Find Directories Over Log Retention Window Under /var/log/sudo-io
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_sudo is defined
     - sudo_log_retention is defined
     - sudo_log_retention is regex('^[0-9]*[smhdw]$')
@@ -98,7 +102,6 @@
   register: ensure_sudo_results
 - name: And Drop Them
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_sudo is defined
     - sudo_log_retention is defined
     - sudo_log_retention is regex('^[0-9]*[smhdw]$')
@@ -111,3 +114,16 @@
     label: '{{ item.path }} to be removed'
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
+- name: Assert Sudoers Configuration Syntax
+  ansible.builtin.stat:
+    path: /etc/sudoers
+  register: _sudoers_stat
+- name: Assert Sudoers File Exists And Has Secure Permissions
+  when:
+    - _sudoers_stat.stat is defined
+  ansible.builtin.assert:
+    fail_msg: "/etc/sudoers does not exist or has invalid mode"
+    quiet: true
+    that:
+      - _sudoers_stat.stat.exists
+      - _sudoers_stat.stat.mode in ['0440', '0400', '0600']

roles/ensure_timezone/tasks/main.yml

@@ -1,7 +1,17 @@
 ---
 # tasks file for ensure_timezone
+- name: Assert Target OS Is Supported
+  when:
+    - ansible_facts["system"] is defined
+  ansible.builtin.assert:
+    fail_msg: "Unsupported OS: {{ ansible_facts['distribution'] | default('unknown') }}"
+    quiet: true
+    that:
+      - ansible_facts["system"] == 'Linux'
+      - >-
+        ansible_facts["distribution"] in ['AlmaLinux', 'CentOS', 'Debian',
+        'Fedora', 'OracleLinux', 'Rocky', 'Ubuntu']
 - name: Include Variables
-  when: ["ansible_facts[\"system\"] == 'Linux'"]
   ansible.builtin.include_vars:
     file: '{{ lookup("first_found", findme) }}'
     name: ensure_timezone
@@ -23,12 +33,10 @@
       errors: ignore
 - name: Package Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["packages"] is not defined
   ansible.builtin.package_facts:
 - name: Service Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["services"] is not defined
   ansible.builtin.service_facts:
 - name: Set Timezone
@@ -41,7 +49,6 @@
     - Ensure_Timezone.Service_Restart
 - name: Ensure Packages
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_timezone is defined
     - ensure_timezone.package_list is defined
     - ensure_timezone.package_list is iterable
@@ -54,7 +61,6 @@
   notify: [Ensure_Timezone.Package_Facts, Ensure_Timezone.Service_Facts]
 - name: Ensure Configurations
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_timezone is defined
     - ensure_timezone.template_list is defined
     - ensure_timezone.template_list is iterable
@@ -64,7 +70,7 @@
     group: '{{ item.group | default(omit) }}'
     mode: '{{ item.mode | default(omit) }}'
     owner: '{{ item.owner | default(omit) }}'
-    selevel: '{{ iteml.selevel | default(omit) }}'
+    selevel: '{{ item.selevel | default(omit) }}'
     serole: '{{ item.serole | default(omit) }}'
     setype: '{{ item.setype | default(omit) }}'
     seuser: '{{ item.seuser | default(omit) }}'
@@ -79,7 +85,6 @@
     - Ensure_Timezone.Service_Restart
 - name: Ensure Services
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_timezone is defined
     - ensure_timezone.service_list is defined
     - ensure_timezone.service_list is iterable
@@ -93,7 +98,6 @@
   notify: [Ensure_Timezone.Package_Facts, Ensure_Timezone.Service_Facts]
 - name: Ensure Selinux Is Configured
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_timezone is defined
     - ensure_timezone.selinux_policy is defined
     - ensure_timezone.selinux_state is defined
@@ -103,7 +107,6 @@
   register: ensure_timezone_results
 - name: Reboot If Required
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_timezone is defined
     - ensure_timezone.selinux_policy is defined
     - ensure_timezone.selinux_state is defined
@@ -113,7 +116,6 @@
   ansible.builtin.reboot:
 - name: Ensure Seboolean
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_timezone is defined
     - ensure_timezone.seboolean_list is defined
     - ensure_timezone.seboolean_list is iterable
@@ -126,3 +128,27 @@
     label: '{{ item.name }} will be {{ item.state }}'
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
+- name: Post Verification Service Discovery
+  when:
+    - ensure_timezone is defined
+    - ensure_timezone.service_list is defined
+    - ensure_timezone.service_list is iterable
+  ansible.builtin.service_facts:
+- name: Assert Managed Services Are Active
+  when:
+    - ensure_timezone is defined
+    - ensure_timezone.service_list is defined
+    - ensure_timezone.service_list is iterable
+  ansible.builtin.assert:
+    fail_msg: "Service {{ item.name }} is not active"
+    quiet: true
+    that:
+      - >-
+        item.state != 'started' or
+        (ansible_facts['services'][item.name ~ '.service'] is defined and
+        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
+        (ansible_facts['services'][item.name] is defined and
+        ansible_facts['services'][item.name]['state'] == 'running')
+  loop: "{{ ensure_timezone.service_list }}"
+  loop_control:
+    label: "{{ item.name }} will be verified"

roles/ensure_vim/tasks/main.yml

@@ -1,7 +1,17 @@
 ---
 # tasks file for ensure_vim
+- name: Assert Target OS Is Supported
+  when:
+    - ansible_facts["system"] is defined
+  ansible.builtin.assert:
+    fail_msg: "Unsupported OS: {{ ansible_facts['distribution'] | default('unknown') }}"
+    quiet: true
+    that:
+      - ansible_facts["system"] == 'Linux'
+      - >-
+        ansible_facts["distribution"] in ['AlmaLinux', 'CentOS', 'Debian',
+        'Fedora', 'OracleLinux', 'Rocky', 'Ubuntu']
 - name: Include Variables
-  when: ["ansible_facts[\"system\"] == 'Linux'"]
   ansible.builtin.include_vars:
     file: '{{ lookup("first_found", findme) }}'
     name: ensure_vim
@@ -23,17 +33,14 @@
       errors: ignore
 - name: Package Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["packages"] is not defined
   ansible.builtin.package_facts:
 - name: Service Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["services"] is not defined
   ansible.builtin.service_facts:
 - name: Ensure Packages
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_vim is defined
     - ensure_vim.package_list is defined
     - ensure_vim.package_list is iterable
@@ -46,7 +53,6 @@
   notify: [Ensure_Vim.Package_Facts, Ensure_Vim.Service_Facts]
 - name: Ensure Configurations
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_vim is defined
     - ensure_vim.template_list is defined
     - ensure_vim.template_list is iterable
@@ -56,7 +62,7 @@
     group: '{{ item.group | default(omit) }}'
     mode: '{{ item.mode | default(omit) }}'
     owner: '{{ item.owner | default(omit) }}'
-    selevel: '{{ iteml.selevel | default(omit) }}'
+    selevel: '{{ item.selevel | default(omit) }}'
     serole: '{{ item.serole | default(omit) }}'
     setype: '{{ item.setype | default(omit) }}'
     seuser: '{{ item.seuser | default(omit) }}'
@@ -71,7 +77,6 @@
     - Ensure_Vim.Service_Restart
 - name: Ensure Services
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_vim is defined
     - ensure_vim.service_list is defined
     - ensure_vim.service_list is iterable
@@ -85,7 +90,6 @@
   notify: [Ensure_Vim.Package_Facts, Ensure_Vim.Service_Facts]
 - name: Ensure Selinux Is Configured
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_vim is defined
     - ensure_vim.selinux_policy is defined
     - ensure_vim.selinux_state is defined
@@ -100,7 +104,6 @@
     - Ensure_Vim.Service_Restart
 - name: Reboot If Required
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_vim is defined
     - ensure_vim.selinux_policy is defined
     - ensure_vim.selinux_state is defined
@@ -110,7 +113,6 @@
   ansible.builtin.reboot:
 - name: Ensure Seboolean
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_vim is defined
     - ensure_vim.seboolean_list is defined
     - ensure_vim.seboolean_list is iterable
@@ -128,3 +130,22 @@
     - Ensure_Vim.Service_Restart
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
+- name: Post Verification Package Discovery
+  when:
+    - ensure_vim is defined
+    - ensure_vim.package_list is defined
+    - ensure_vim.package_list is iterable
+  ansible.builtin.package_facts:
+- name: Assert Managed Packages Are Installed
+  when:
+    - ensure_vim is defined
+    - ensure_vim.package_list is defined
+    - ensure_vim.package_list is iterable
+  ansible.builtin.assert:
+    fail_msg: "Package {{ item.name }} is not installed"
+    quiet: true
+    that:
+      - item.state != 'present' or ansible_facts['packages'][item.name] is defined
+  loop: "{{ ensure_vim.package_list }}"
+  loop_control:
+    label: "{{ item.name }} will be verified"