lint yaml files

.yamllint

+---
+
+extends: default
+
+rules:
+  comments-indentation:
+    level: warning
+  document-start:
+    level: error
+  empty-lines:
+    max: 1
+  empty-values:
+    forbid-in-flow-mappings: true
+    forbid-in-block-mappings: true
+  line-length:
+    level: warning
+  octal-values:
+    forbid-implicit-octal: true
+    level: warning

acmetool/defaults/main.yml

@@ -6,4 +6,4 @@ acmetool_key_type: rsa
 acmetool_rsa_key_size: 4096
 
 acmetool_mail: "{{ adminaddr }}"
-acmetool_enable_proxy: True
+acmetool_enable_proxy: true

acmetool/tasks/main.yml

@@ -9,11 +9,11 @@
 
 - name: ensure we have our response file
   template:
-    src: response-file.yml
+    src: response-file.yml.j2
     dest: /var/lib/acme/quickstart-reponses.yml
     owner: root
     group: root
-    mode: 0644
+    mode: '0644'
   tags:
     - acmetool
     - config
@@ -21,12 +21,13 @@
 - name: check if acmetool is configured
   command: acmetool status
   register: acmetool_status
-  changed_when: no
+  changed_when: false
   tags:
     - acmetool
     - config
 
 - name: initially configure acmetool
+  # yamllint disable-line rule:line-length
   command: acmetool quickstart --expert --batch --response-file /var/lib/acme/quickstart-reponses.yml
   when: not acmetool_status.stdout|search(acmetool_endpoint)
   tags:
@@ -39,7 +40,7 @@
     dest: /etc/default/acme-reload
     owner: root
     group: root
-    mode: 0644
+    mode: '0644'
   tags:
     - acmetool
     - config
@@ -50,7 +51,7 @@
     state: directory
     owner: root
     group: root
-    mode: 0755
+    mode: '0755'
   notify:
     - reload systemd service files
   when: acmetool_enable_proxy
@@ -64,7 +65,7 @@
     dest: /etc/systemd/system/acmetool.service.d/nginx-proxy.conf
     owner: root
     group: root
-    mode: 0644
+    mode: '0644'
   notify:
     - reload systemd service files
   when: acmetool_enable_proxy
@@ -78,7 +79,7 @@
     dest: "/var/lib/acme/desired/{{item.hostnames[0]}}"
     owner: root
     group: root
-    mode: 0644
+    mode: '0644'
   with_items: "{{acmetool_certificates}}"
   notify:
     - update certificates
@@ -87,7 +88,10 @@
     - certificates
 
 - name: ensure certificates are updated regularly
-  systemd: name=acmetool.timer enabled=yes state=started
+  systemd:
+    name: acmetool.timer
+    enabled: true
+    state: started
   tags:
     - acmetool
     - services

debian-repository/tasks/main.yml

@@ -4,7 +4,7 @@
 - name: ensure we have a repo group
   group:
     name: repo
-    system: yes
+    system: true
     state: present
   tags:
     - debian-repository
@@ -14,10 +14,10 @@
   user:
     name: repo
     group: repo
-    system: yes
+    system: true
     home: /srv/repo
     shell: /usr/bin/nologin
-    createhome: no
+    createhome: false
     state: present
   tags:
     - debian-repository
@@ -31,4 +31,3 @@
     - packages
     - debian-repository
     - webservices
-

dokuwiki/defaults/main.yml

@@ -5,7 +5,7 @@ dokuwiki:
     user: dokuwiki
     group: dokuwiki
     version: 2018-04-22a
-    ad: no
+    ad: false
     ad_domain: example.com
     ad_basedn: dc=example,dc=com
     ad_controller: ad.example.com

dokuwiki/handlers/main.yml

@@ -4,7 +4,7 @@
   command: "{{ item.path }}/bin/delete_old_files.py"
   args:
     chdir: "{{ item.path }}"
-  become: yes
+  become: true
   become_user: "{{ item.user }}"
   with_items: "{{ dokuwiki }}"
 

dokuwiki/tasks/main.yml

@@ -15,7 +15,7 @@
   group:
     name: "{{ item.group }}"
     state: present
-    system: yes
+    system: true
   with_items: "{{ dokuwiki }}"
   tags:
     - dokuwiki
@@ -26,10 +26,10 @@
     name: "{{ item.user }}"
     group: "{{ item.group }}"
     state: present
-    system: yes
+    system: true
     shell: /usr/bin/nologin
     home: "{{ item.path }}"
-    createhome: no
+    createhome: false
   with_items: "{{ dokuwiki }}"
   tags:
     - dokuwiki
@@ -60,8 +60,8 @@
 
 - name: gather installed versions
   command: "cat {{ item.path }}/VERSION"
-  ignore_errors: yes
-  changed_when: no
+  ignore_errors: true
+  changed_when: false
   register: versions
   with_items: "{{ dokuwiki }}"
   tags:
@@ -70,7 +70,8 @@
 
 - name: backup dokuwiki data on update
   command: /bin/true
-  changed_when: yes
+  changed_when: true
+  # yamllint disable-line rule:line-length
   when: item.1 is failed or item.1 is skipped or item.0.version != item.1.stdout|regex_replace(' .*')
   with_together:
     - "{{ dokuwiki }}"
@@ -85,8 +86,9 @@
 
 - name: ensure dokuwiki files are in place
   unarchive:
+    # yamllint disable-line rule:line-length
     src: "https://download.dokuwiki.org/src/dokuwiki/dokuwiki-{{ item.0.version }}.tgz"
-    remote_src: yes
+    remote_src: true
     dest: "{{ item.0.path }}"
     owner: "{{ item.0.user }}"
     group: "{{ item.0.group }}"
@@ -94,6 +96,7 @@
       - --strip-components=1
       - --overwrite
       - -p
+  # yamllint disable-line rule:line-length
   when: item.1 is failed or item.1 is skipped or item.0.version != item.1.stdout|regex_replace(' .*')
   with_together:
     - "{{ dokuwiki }}"
@@ -158,7 +161,7 @@
     owner: "{{ item.user }}"
     group: "{{ item.group }}"
     mode: '0664'
-    force: no
+    force: false
   with_items: "{{ dokuwiki }}"
   notify:
     - reindex search

mediawiki/defaults/main.yml

@@ -12,6 +12,6 @@ mediawiki_dbtype: postgres
 mediawiki_dbhost: localhost
 mediawiki_dbname: "{{ mediawiki_name }}"
 mediawiki_dbuser: "{{ mediawiki_name }}"
-mediawiki_dbpassword: 
+mediawiki_dbpassword: ""
 
-mediawiki_use_ldap: yes
+mediawiki_use_ldap: true

mediawiki/handlers/main.yml

@@ -8,7 +8,7 @@
   service:
     name: "mediawiki-{{ mediawiki_name }}"
     state: restarted
-    enabled: yes
+    enabled: true
 
 - name: create tmpfiles
   shell: systemd-tmpfiles --create

mediawiki/tasks/main.yml

@@ -5,7 +5,7 @@
   apt:
     name: mediawiki
     state: present
-    install_recommends: no
+    install_recommends: false
   when: debian_version == "jessie"
   tags:
     - mediawiki
@@ -24,7 +24,7 @@
   group:
     name: "{{ mediawiki_group }}"
     state: present
-    system: yes
+    system: true
   tags:
     - mediawiki
     - webservices
@@ -34,10 +34,10 @@
     name: "{{ mediawiki_user }}"
     group: "{{ mediawiki_group }}"
     state: present
-    system: yes
+    system: true
     shell: /usr/bin/nologin
     home: "{{ mediawiki_web_root }}"
-    createhome: no
+    createhome: false
   tags:
     - mediawiki
     - webservices
@@ -76,7 +76,7 @@
     state: link
     src: "/usr/share/mediawiki/{{ item }}"
     dest: "{{ mediawiki_web_root }}/{{ mediawiki_name }}/{{ item }}"
-    force: yes
+    force: true
   with_items: "{{ mediawiki_other_files.stdout_lines }}"
   tags:
     - mediawiki
@@ -88,7 +88,7 @@
     dest: "/etc/tmpfiles.d/10-mediawiki-{{ mediawiki_name }}.conf"
     owner: root
     group: root
-    mode: 0644
+    mode: '0644'
   notify:
     - create tmpfiles
   tags:
@@ -110,7 +110,7 @@
     dest: "/etc/cron.d/mediawiki-{{ mediawiki_name }}-maint"
     owner: root
     group: root
-    mode: 0644
+    mode: '0644'
   tags:
     - mediawiki
     - webservices

mediawiki/tasks/mysql.yml

@@ -18,4 +18,3 @@
   tags:
     - mediawiki
     - webservices
-

mediawiki/tasks/postgres.yml

@@ -24,8 +24,8 @@
     name: "{{ mediawiki_dbuser }}"
     password: "{{ mediawiki_dbpassword }}"
     state: present
-  no_log: True
-  become: yes
+  no_log: true
+  become: true
   become_user: postgres
   tags:
     - mediawiki
@@ -36,7 +36,7 @@
     name: "{{ mediawiki_dbname }}"
     owner: "{{ mediawiki_dbuser }}"
     state: present
-  become: yes
+  become: true
   become_user: postgres
   tags:
     - mediawiki
@@ -49,7 +49,7 @@
     privs: ALL
     state: present
     type: database
-  become: yes
+  become: true
   become_user: postgres
   tags:
     - mediawiki

php-fpm/tasks/main.yml

@@ -29,7 +29,7 @@
     dest: "/etc/php/7.0/fpm/pool.d/{{ fpm_pool }}.conf"
     owner: root
     group: root
-    mode: 0644
+    mode: '0644'
   when: debian_version == "stretch"
   notify:
     - restart php-fpm
@@ -43,7 +43,7 @@
     dest: "/etc/php/7.0/fpm/pool.d/{{item.name}}.conf"
     owner: root
     group: root
-    mode: 0644
+    mode: '0644'
   when: debian_version == "stretch"
   with_items: "{{fpm_pools|default([])}}"
   notify:

sentry/defaults/main.yml

@@ -11,16 +11,16 @@ sentry_db_host: null
 sentry_redis_url: redis://localhost:6379/0
 sentry_web_host: localhost
 sentry_web_port: 9000
-sentry_mail_active: no
+sentry_mail_active: false
 sentry_mail_host: mail.example.com
 sentry_mail_user: null
 sentry_mail_password: null
-sentry_mail_use_tls: no
+sentry_mail_use_tls: false
 sentry_mail_from: "sentry@example.com"
 sentry_storage_dir: "/tmp/sentry-files"
 sentry_default_user_mail: sentry@example.com
 sentry_default_user_password: null
-sentry_use_ldap: yes
+sentry_use_ldap: true
 sentry_ldap_uri: "ldaps://auth.example.com"
 sentry_ldap_distinguished_name: "dc=example,dc=com"
 sentry_ldap_deny_group: null

sentry/tasks/main.yml

@@ -22,7 +22,10 @@
     - monitoring
 
 - name: ensure we have the sentry group
-  group: name="{{sentry_group}}" state=present system=yes
+  group:
+    name: "{{sentry_group}}"
+    state: present
+    system: true
   tags:
     - sentry
     - webservices
@@ -33,10 +36,10 @@
     name: "{{sentry_user}}"
     group: "{{sentry_group}}"
     state: present
-    system: yes
+    system: true
     shell: /usr/bin/nologin
     home: "{{sentry_root_dir}}"
-    createhome: no
+    createhome: false
   tags:
     - sentry
     - webservices
@@ -46,7 +49,7 @@
   file:
     path: "{{sentry_root_dir}}"
     state: directory
-    mode: 0750
+    mode: '0750'
     owner: root
     group: sentry
   tags:
@@ -69,31 +72,22 @@
     - monitoring
 
 - name: ensure uwsgi is executable
-  file: path="{{sentry_root_dir}}/bin/uwsgi" mode="o+rx"
-  tags:
-    - sentry
-    - webservices
-    - monitoring
-
-- name: get the database password
-  local_action: pass name="db/{{sentry_db_host}}-pgsql-sentry" state=present generate=20 store=FSMPI_PASSWORD_STORE_DIR limit=yes
-  register: sentry_db_password
-  when: sentry_db_host is not none and sentry_db_password is none
-  no_log: yes
+  file:
+    path: "{{sentry_root_dir}}/bin/uwsgi"
+    mode: "o+rx"
   tags:
     - sentry
     - webservices
     - monitoring
-    - password
-    - postgres
 
 - name: ensure we have a postgres database user
   postgresql_user:
     name: "{{sentry_db_user}}"
     state: present
-    password: "{{sentry_db_password.password|default(sentry_db_password)|default(omit)}}"
+    # yamllint disable-line rule:line-length
+    password: "{{ lookup('passwordstore', 'db/{{sentry_db_host}}-pgsql-sentry create=true length=20') if sentry_db_host is not None and sentry_db_password is None }}"
     role_attr_flags: NOSUPERUSER,NOCREATEDB
-  become: yes
+  become: true
   become_user: postgres
   delegate_to: "{{sentry_db_host|default(omit)}}"
   tags:
@@ -107,7 +101,7 @@
     name: "{{sentry_db_name}}"
     owner: "{{sentry_db_user}}"
     state: present
-  become: yes
+  become: true
   become_user: postgres
   delegate_to: "{{sentry_db_host|default(omit)}}"
   tags:
@@ -123,7 +117,7 @@
     privs: ALL
     state: present
     type: database
-  become: yes
+  become: true
   become_user: postgres
   delegate_to: "{{sentry_db_host|default(omit)}}"
   tags:
@@ -135,7 +129,9 @@
 - name: ensure the user may login
   lineinfile:
     dest: /etc/postgresql/9.6/main/pg_hba.conf
+    # yamllint disable-line rule:line-length
     insertafter: "host    all             all             127.0.0.1/32            md5"
+    # yamllint disable-line rule:line-length
     line: "host    {{sentry_db_name}}          {{sentry_db_user}}          monitoring.fsmpi.rwth-aachen.de md5"
   delegate_to: "{{sentry_db_host|default(omit)}}"
   notify:
@@ -148,7 +144,7 @@
 
 - name: ensure the database supports citext
   command: "psql {{sentry_db_name}} -c 'CREATE EXTENSION IF NOT EXISTS citext'"
-  become: yes
+  become: true
   become_user: postgres
   delegate_to: "{{sentry_db_host|default(omit)}}"
   tags:
@@ -161,11 +157,11 @@
 
 - name: ensure sentry is configured
   template:
-    src: "{{item}}"
+    src: "{{item}}.j2"
     dest: "{{sentry_root_dir}}"
     owner: root
     group: "{{sentry_group}}"
-    mode: 0640
+    mode: '0640'
   with_items:
     - config.yml
     - sentry.conf.py
@@ -178,11 +174,12 @@
     - config
 
 # if this fails with 137/kill -9, this might be OOM
-- name: upgrade the sentry database (this may take some time and use much memory)
+- name: upgrade the sentry database (this may take some time and memory)
+  # yamllint disable-line rule:line-length
   shell: "SENTRY_CONF={{sentry_root_dir}} {{sentry_root_dir}}/bin/sentry upgrade"
   args:
     stdin: n
-  become: yes
+  become: true
   become_user: "{{sentry_user}}"
   tags:
     - sentry
@@ -196,7 +193,7 @@
     dest: /etc/systemd/system
     owner: root
     group: root
-    mode: 0644
+    mode: '0644'
   with_items:
     - sentry-web.service
     - sentry-cron.service
@@ -211,7 +208,9 @@
     - service
 
 - name: ensure sentry is activated
-  systemd: name=sentry-web enabled=yes
+  systemd:
+    name: sentry-web
+    enabled: true
   tags:
     - sentry
     - webservices

shibboleth/tasks/main.yml

@@ -3,6 +3,7 @@
 
 - name: activate the shibboleth apt repository
   apt_repository:
+    # yamllint disable-line rule:line-length
     repo: "deb [arch=amd64] https://repo.fsmpi.rwth-aachen.de/ {{ansible_facts.distribution_release}} shibboleth"
     state: present
   notify:
@@ -37,7 +38,7 @@
     dest: /etc/shibboleth/shibboleth2.xml
     owner: root
     group: root
-    mode: 0644
+    mode: '0644'
   notify:
     - reload shibd
   tags:
@@ -50,7 +51,7 @@
     dest: /etc/shibboleth/attribute-map.xml
     owner: root
     group: root
-    mode: 0644
+    mode: '0644'
   notify:
     - reload shibd
   tags:
@@ -63,7 +64,7 @@
     dest: /etc/supervisor/conf.d/
     owner: root
     group: root
-    mode: 0644
+    mode: '0644'
   with_items:
     - shibauthorizer.conf
     - shibresponder.conf
@@ -80,7 +81,7 @@
     dest: /etc/nginx/snippets/
     owner: root
     group: root
-    mode: 0644
+    mode: '0644'
   tags:
     - shibboleth
     - nginx
@@ -89,7 +90,7 @@
 - name: ensure the services are running
   systemd:
     name: "{{item}}"
-    enabled: yes
+    enabled: true
     state: started
   with_items:
     - supervisor