Implemented variable mapping to reduce complexity

constructor.yml

@@ -1,12 +1,20 @@
 ---
-# general setup
-- name: general setup
+- name:   variable mapping   
+  hosts:  all
+  vars:
+    activate_all_timers:          "{{ activate_all_timers | lower | bool }}"
+    nginx_matomo_tracking:        "{{ nginx_matomo_tracking | lower | bool }}"
+    execute_updates:              "{{ execute_updates | lower | bool }}"
+    force_backup_before_update:   "{{ force_backup_before_update | lower | bool }}"
+    enable_central_database:      "{{ enable_central_database | lower | bool }}"
+
+- name: update device
   hosts:  all
   become: true
   tasks:
   roles:
     - role: update
-      when: execute_updates | bool
+      when: execute_updates
 
 - name: setup standard wireguard
   hosts: wireguard_server

roles/backup-docker-to-local/tasks/main.yml

@@ -37,7 +37,7 @@
 - name: configure backup-docker-to-local.timer.tpl
   template: src=backup-docker-to-local.timer.j2 dest=/etc/systemd/system/backup-docker-to-local.timer
   register: backup_docker_to_local_timer
-  changed_when: backup_docker_to_local_timer.changed or activate_all_timers | bool
+  changed_when: backup_docker_to_local_timer.changed or activate_all_timers
   notify: restart backup-docker-to-local.timer
   when: run_once_backup_docker_to_local is not defined
 

roles/backup-remote-to-local/meta/main.yml

@@ -4,3 +4,4 @@ dependencies:
   - cleanup-backups-timer
   - cleanup-failed-docker-backups
   - system-maintenance-lock
+  - user-root

roles/backup-remote-to-local/tasks/main.yml

@@ -17,7 +17,7 @@
 - name: create backup-remote-to-local.timer
   template: src=backup-remote-to-local.timer.j2 dest=/etc/systemd/system/backup-remote-to-local.timer
   register: backup_backup_remote_to_local_timer
-  changed_when: backup_backup_remote_to_local_timer.changed or activate_all_timers | bool
+  changed_when: backup_backup_remote_to_local_timer.changed or activate_all_timers
   notify: restart backup-remote-to-local timer
 
 - name: create backups-remote-to-local.sh

roles/cleanup-backups-timer/tasks/main.yml

@@ -3,7 +3,7 @@
     src:  "cleanup-backups.timer.j2"
     dest: "/etc/systemd/system/cleanup-backups.timer"
   register: cleanup_backups_timer
-  changed_when: cleanup_backups_timer.changed or activate_all_timers | bool
+  changed_when: cleanup_backups_timer.changed or activate_all_timers
   notify: restart cleanup-backups.timer
   when: run_once_cleanup_backups_timer is not defined
 

roles/cleanup-disc-space/tasks/main.yml

@@ -20,5 +20,5 @@
     src: cleanup-disc-space.timer.j2
     dest: /etc/systemd/system/cleanup-disc-space.timer
   register: cleanup_disc_space_timer
-  changed_when: cleanup_disc_space_timer.changed or activate_all_timers | bool
+  changed_when: cleanup_disc_space_timer.changed or activate_all_timers
   notify: restart cleanup-disc-space.timer

roles/cleanup-failed-docker-backups/tasks/main.yml

@@ -24,7 +24,7 @@
     src: cleanup-failed-docker-backups.timer.j2
     dest: /etc/systemd/system/cleanup-failed-docker-backups.timer
   register: cleanup_failed_docker_backups_timer
-  changed_when: cleanup_failed_docker_backups_timer.changed or activate_all_timers | bool
+  changed_when: cleanup_failed_docker_backups_timer.changed or activate_all_timers
   notify: restart cleanup-failed-docker-backups.timer
   when: run_once_cleanup_failed_docker_backups is not defined
 

roles/cleanup-failed-docker-backups/templates/cleanup-failed-docker-backups.service.j2

@@ -5,4 +5,4 @@ OnFailure=systemd-notifier@%n.service
 [Service]
 Type=oneshot
 ExecStartPre=/bin/sh -c '/usr/bin/python {{ path_system_lock_script }} {{ system_maintenance_services | join(' ')  }} --ignore {{system_maintenance_cleanup_services| join(' ') }} --timeout "{{sytem_maintenance_lock_timeoutbackup_services}}"'
-ExecStart=/bin/sh -c '/usr/bin/yes | /usr/bin/bash {{backup_docker_to_local_cleanup_folder}}cleanup.sh {{backup_docker_to_local_cleanup_machine_id}} {{backup_docker_to_local_cleanup_trigger_directory}}'
+ExecStart=/bin/sh -c '/usr/bin/yes | /usr/bin/bash {{backup_docker_to_local_cleanup_folder}}cleanup-all.sh {{backup_docker_to_local_cleanup_trigger_directory}}'

roles/docker-akaunting/templates/docker-compose.yml.j2

@@ -14,7 +14,7 @@ services:
       - env/run.env
     environment:
       - AKAUNTING_SETUP
-{% if not ( enable_central_database | lower | bool )  %}
+{% if not enable_central_database %}
     depends_on:
       - database
 
@@ -23,6 +23,6 @@ services:
 
 volumes:
   data:
-{% if not ( enable_central_database | lower | bool )  %}
+{% if not enable_central_database %}
   database:
 {% endif %}

roles/docker-attendize/templates/docker-compose.yml.j2

@@ -9,7 +9,7 @@ services:
       - .:/usr/share/nginx/html
       - .:/var/www
     depends_on:
-{% if not ( enable_central_database | lower | bool )  %}
+{% if not enable_central_database %}
       - database
 {% endif %}
       - maildev
@@ -20,7 +20,7 @@ services:
   worker:
     image: attendize_worker:latest
     depends_on:
-{% if not ( enable_central_database | lower | bool )  %}
+{% if not enable_central_database %}
       - database
 {% endif %}
       - maildev
@@ -36,7 +36,7 @@ services:
 
 {% include 'templates/docker-redis-service.yml.j2' %}
 
-{% if not ( enable_central_database | lower | bool )  %}
+{% if not enable_central_database %}
     depends_on:
       - database
 
@@ -45,6 +45,6 @@ services:
 
 volumes:
   redis:
-{% if not ( enable_central_database | lower | bool )  %}
+{% if not enable_central_database %}
   database:
 {% endif %}

roles/docker-funkwhale/templates/docker-compose.yml.j2

@@ -10,7 +10,7 @@ services:
     restart: always
     image: funkwhale/api:${FUNKWHALE_VERSION:-latest}
     depends_on:
-{% if not ( enable_central_database | lower | bool )  %}
+{% if not enable_central_database %}
       - postgres
 % endif %}      
       - redis
@@ -25,7 +25,7 @@ services:
     restart: always
     image: funkwhale/api:${FUNKWHALE_VERSION:-latest}
     depends_on:
-{% if not ( enable_central_database | lower | bool )  %}
+{% if not enable_central_database %}
       - postgres
 % endif %}
       - redis
@@ -62,7 +62,7 @@ services:
       # override those variables in your .env file if needed
       - "${FUNKWHALE_API_IP}:${FUNKWHALE_API_PORT}:80"
 
-{% if not ( enable_central_database | lower | bool )  %}
+{% if not enable_central_database %}
 {% include 'templates/docker-postgres-service.yml.j2' %}
 {% endif %}
 
@@ -70,6 +70,6 @@ volumes:
   data:
   redis:
 
-{% if not ( enable_central_database | lower | bool )  %}
+{% if not enable_central_database %}
   database:
 {% endif %}

roles/docker-gitea/templates/docker-compose.yml.j2

@@ -27,20 +27,18 @@ services:
       - data:/data
       - /etc/timezone:/etc/timezone:ro
       - /etc/localtime:/etc/localtime:ro
-{% if not ( enable_central_database | lower | bool )  %}
+{% if not enable_central_database %}
     depends_on:
       - database
-    links:
-      - database
 {% include 'templates/docker-mariadb-service.yml.j2' %}
 {% endif %}
 
 volumes:
   data:
-{% if not ( enable_central_database | lower | bool )  %}
+{% if not enable_central_database %}
   database:
 {% endif %}
 
 networks:
   default:
-    driver: bridge
+    driver: bridge

roles/docker-gitlab/templates/docker-compose.yml.j2

@@ -33,7 +33,7 @@ services:
       - 'data:/var/opt/gitlab'
     shm_size: '256m'
     depends_on:
-{% if not ( enable_central_database | lower | bool )  %}
+{% if not enable_central_database %}
       database:
         condition: service_healthy
 {% endif %}
@@ -41,7 +41,7 @@ services:
 
 {% include 'templates/docker-redis-service.yml.j2' %}
 
-{% if not ( enable_central_database | lower | bool )  %}
+{% if not enable_central_database %}
 {% include 'templates/docker-postgres-service.yml.j2' %}
 {% endif %}
 
@@ -50,6 +50,6 @@ volumes:
   config:
   logs:
   data:
-{% if not ( enable_central_database | lower | bool )  %}
+{% if not enable_central_database %}
   database:
 {% endif %}

roles/docker-joomla/templates/docker-compose.yml.j2

@@ -11,8 +11,8 @@ services:
       JOOMLA_DB_PASSWORD: "{{database_password}}"
       JOOMLA_DB_NAME: "{{database_databasename}}"
     restart: always
-{% if not ( enable_central_database | lower | bool )  %}
-    links:
+{% if not enable_central_database %}
+    depends_on:
       - database
 {% endif %}
     volumes:
@@ -20,12 +20,12 @@ services:
     ports:
       - "127.0.0.1:{{http_port}}:80"
 
-{% if not ( enable_central_database | lower | bool )  %}
+{% if not enable_central_database %}
 {% include 'templates/docker-mariadb-service.yml.j2' %}
 {% endif %}
 
 volumes:
   data:
-{% if not ( enable_central_database | lower | bool )  %}
+{% if not enable_central_database %}
   database:
 {% endif %}

roles/docker-listmonk/templates/docker-compose.yml.j2

@@ -12,7 +12,7 @@ services:
     volumes:
       - ./config.toml:/listmonk/config.toml
 
-{% if not ( enable_central_database | lower | bool )  %}
+{% if not enable_central_database %}
     depends_on:
       - database
 

roles/docker-mailu/tasks/main.yml

@@ -61,5 +61,5 @@
     src:  "deploy-letsencrypt-mailu.timer.j2" 
     dest: "/etc/systemd/system/deploy-letsencrypt-mailu.timer"
   register: deploy_letsencrypt_mailu_timer
-  changed_when: deploy_letsencrypt_mailu_timer.changed or activate_all_timers | bool
+  changed_when: deploy_letsencrypt_mailu_timer.changed or activate_all_timers
   notify: restart deploy-letsencrypt-mailu.timer

roles/docker-mailu/templates/docker-compose.yml.j2

@@ -49,7 +49,7 @@ services:
     depends_on:
       resolver:
         condition: service_started
-{% if not ( enable_central_database | lower | bool )  %}
+{% if not enable_central_database %}
       database:
         condition: service_healthy
 {% endif %}
@@ -71,7 +71,7 @@ services:
       - resolver
       - front
       - redis
-{% if not ( enable_central_database | lower | bool )  %}
+{% if not enable_central_database %}
       - database
 {% endif %}
     logging:
@@ -202,12 +202,12 @@ services:
       - webmail
     dns:
       - 192.168.203.254
-{% if not ( enable_central_database | lower | bool )  %}
+{% if not enable_central_database %}
 {% include 'templates/docker-postgres-service.yml.j2' %}
 {% endif %}
 
 volumes:
-{% if not ( enable_central_database | lower | bool )  %}
+{% if not enable_central_database %}
   database:
 {% endif %}
   smtp_queue:

roles/docker-mastodon/templates/docker-compose.yml.j2

@@ -20,7 +20,7 @@ services:
     ports:
       - "127.0.0.1:{{http_port}}:3000"
     depends_on:
-{% if not ( enable_central_database | lower | bool )  %}
+{% if not enable_central_database %}
       - database
 {% endif %}
       - redis
@@ -42,7 +42,7 @@ services:
     ports:
       - "127.0.0.1:{{stream_port}}:4000"
     depends_on:
-{% if not ( enable_central_database | lower | bool )  %}
+{% if not enable_central_database %}
       - database
 {% endif %}
       - redis
@@ -54,7 +54,7 @@ services:
     env_file: .env.production
     command: bundle exec sidekiq
     depends_on:
-{% if not ( enable_central_database | lower | bool )  %}
+{% if not enable_central_database %}
       - database
 {% endif %}
       - redis
@@ -67,12 +67,12 @@ services:
       test: ['CMD-SHELL', "ps aux | grep '[s]idekiq\ 6' || false"]
     logging:
       driver: journald
-{% if not ( enable_central_database | lower | bool )  %}
+{% if not enable_central_database %}
 {% include 'templates/docker-postgres-service.yml.j2' %}
 {% endif %}
 
 volumes:
-{% if not ( enable_central_database | lower | bool )  %}
+{% if not enable_central_database %}
   database:
 {% endif %}
   redis:

roles/docker-mastodon/templates/mastodon.conf.j2

@@ -8,7 +8,7 @@ server {
 
   {% include 'roles/letsencrypt/templates/ssl_header.j2' %}
 
-  {% if nginx_matomo_tracking | bool %}
+  {% if nginx_matomo_tracking %}
     {% include 'roles/nginx-matomo-tracking/templates/matomo-tracking.conf.j2' %}
   {% endif %}
 

roles/docker-matomo/templates/docker-compose.yml.j2

@@ -16,14 +16,14 @@ services:
       MATOMO_DATABASE_DBNAME: "{{database_databasename}}"
     volumes:
       - data:/var/www/html
-{% if not ( enable_central_database | lower | bool )  %}
+{% if not enable_central_database %}
     depends_on:
       - database
 {% include 'templates/docker-mariadb-service.yml.j2' %}
 
 {% endif %}
 volumes:
-{% if not ( enable_central_database | lower | bool )  %}
+{% if not enable_central_database %}
   database:
 {% endif %}
   data:

roles/docker-matrix-compose/templates/docker-compose.yml.j2

@@ -16,7 +16,7 @@ services:
       - SYNAPSE_REPORT_STATS=no
     ports:
       - "127.0.0.1:{{synapse_http_port}}:8008"
-{% if not ( enable_central_database | lower | bool )  %}
+{% if not enable_central_database %}
     depends_on:
       - database
 {% include 'templates/docker-postgres-service.yml.j2' %}
@@ -60,7 +60,7 @@ services:
   #  - instagram_bridge_data:/data  
 
 volumes:
-{% if not ( enable_central_database | lower | bool )  %}
+{% if not enable_central_database %}
   database:
 {% endif %}
   synapse_data:

roles/docker-mediawiki/tasks/main.yml

@@ -9,7 +9,7 @@
         log_driver: journald
         image: mediawiki
         restart: always
-        links:
+        depends_on:
           - database
         volumes:
           - "mediawiki-data:/var/www/html/"

roles/docker-mybb/templates/docker-compose.yml.j2

@@ -9,7 +9,7 @@ services:
     restart: always
     volumes:
       - data:/var/www/html
-{% if not ( enable_central_database | lower | bool )  %}
+{% if not enable_central_database %}
     depends_on:
       - database
 {% endif %}
@@ -26,12 +26,12 @@ services:
     - "{{docker_compose_instance_confd_directory}}:{{target_mount_conf_d_directory}}:ro"
     - "data:/var/www/html:ro"
 
-{% if not ( enable_central_database | lower | bool )  %}
+{% if not enable_central_database %}
 {% include 'templates/docker-mariadb-service.yml.j2' %}
 {% endif %}
 
 volumes:
-{% if not ( enable_central_database | lower | bool )  %}
+{% if not enable_central_database %}
   database:
 {% endif %}
   data:

roles/docker-nextcloud/templates/docker-compose.yml.j2

@@ -13,7 +13,7 @@ services:
       MYSQL_USER: "{{database_username}}"
       MYSQL_PASSWORD: "{{database_password}}"
       MYSQL_HOST: {{database_host}}:3306
-{% if not ( enable_central_database | lower | bool )  %}
+{% if not enable_central_database %}
     depends_on:
       - database
 
@@ -45,12 +45,12 @@ services:
       - data:/var/www/html
     entrypoint: /cron.sh
     depends_on:
-{% if not ( enable_central_database | lower | bool )  %}
+{% if not enable_central_database %}
       - database
 {% endif %}
       - redis
 volumes:
-{% if not ( enable_central_database | lower | bool )  %}
+{% if not enable_central_database %}
   database:
 {% endif %}
   data:

roles/docker-nextcloud/templates/nextcloud.conf.j2

@@ -4,7 +4,7 @@ server
 
   {% include 'roles/letsencrypt/templates/ssl_header.j2' %}
 
-  {% if nginx_matomo_tracking | bool %}
+  {% if nginx_matomo_tracking %}
     {% include 'roles/nginx-matomo-tracking/templates/matomo-tracking.conf.j2' %}
   {% endif %}
 

roles/docker-openproject/templates/docker-compose.yml.j2

@@ -5,7 +5,7 @@ networks:
   backend:
 
 volumes:
-{% if not ( enable_central_database | lower | bool )  %}
+{% if not enable_central_database %}
   database:
 {% endif %}
   data:
@@ -30,13 +30,13 @@ x-op-app: &app
     IMAP_ENABLED: "${IMAP_ENABLED:-false}"
   volumes:
     - "data:/var/openproject/assets"
-{% if not ( enable_central_database | lower | bool )  %}
+{% if not enable_central_database %}
     - "database:/var/openproject/pgdata"
 {% endif %}
 
 services:
 
-{% if not ( enable_central_database | lower | bool )  %}
+{% if not enable_central_database %}
 {% include 'templates/docker-postgres-service.yml.j2' %}
 {% endif %}
     networks:
@@ -62,7 +62,7 @@ services:
       - frontend
     volumes:
       - "data:/var/openproject/assets"
-{% if not ( enable_central_database | lower | bool )  %}
+{% if not enable_central_database %}
       - "database:/var/openproject/pgdata"
 {% endif %}
 
@@ -73,7 +73,7 @@ services:
       - frontend
       - backend
     depends_on:
-{% if not ( enable_central_database | lower | bool )  %}
+{% if not enable_central_database %}
       - database
 {% endif %}
       - cache
@@ -102,7 +102,7 @@ services:
     networks:
       - backend
     depends_on:
-{% if not ( enable_central_database | lower | bool )  %}
+{% if not enable_central_database %}
       - database
 {% endif %}
       - cache
@@ -114,7 +114,7 @@ services:
     networks:
       - backend
     depends_on:
-{% if not ( enable_central_database | lower | bool )  %}
+{% if not enable_central_database %}
       - database
 {% endif %}
       - cache

roles/docker-peertube/templates/docker-compose.yml.j2

@@ -15,7 +15,7 @@ services:
     restart: "always"
     depends_on:
       - redis
-{% if not ( enable_central_database | lower | bool )  %}
+{% if not enable_central_database %}
       - database
 
 {% include 'templates/docker-postgres-service.yml.j2' %}
@@ -27,7 +27,7 @@ services:
       - .env
 volumes:
   assets:
-{% if not ( enable_central_database | lower | bool )  %}
+{% if not enable_central_database %}
   database:
 {% endif %}
   data:

roles/docker-peertube/templates/peertube.conf.j2

@@ -3,7 +3,7 @@ server {
 
   {% include 'roles/letsencrypt/templates/ssl_header.j2' %}
 
-  {% if nginx_matomo_tracking | bool %}
+  {% if nginx_matomo_tracking %}
     {% include 'roles/nginx-matomo-tracking/templates/matomo-tracking.conf.j2' %}
   {% endif %}
 

roles/docker-pixelfed/templates/docker-compose.yml.j2

@@ -15,7 +15,7 @@ services:
     ports:
       - "{{http_port}}:80"
     depends_on:
-{% if not ( enable_central_database | lower | bool )  %}
+{% if not enable_central_database %}
       - database
 {% endif %}
       - redis
@@ -39,7 +39,7 @@ services:
     depends_on:
       - redis
       - application
-{% if not ( enable_central_database | lower | bool )  %}
+{% if not enable_central_database %}
     
       - database
 
@@ -49,7 +49,7 @@ services:
 {% include 'templates/docker-redis-service.yml.j2' %}
 
 volumes:
-{% if not ( enable_central_database | lower | bool )  %}
+{% if not enable_central_database %}
   database:
 {% endif %}
   redis:

roles/docker-wordpress/templates/docker-compose.yml.j2

@@ -17,7 +17,7 @@ services:
       WORDPRESS_DB_NAME:      "{{database_databasename}}"
     volumes:
       - data:/var/www/html
-{% if not ( enable_central_database | lower | bool )  %}    
+{% if not enable_central_database %}    
     depends_on:
       - database
 
@@ -25,7 +25,7 @@ services:
 {% endif %}
 
 volumes:
-{% if not ( enable_central_database | lower | bool )  %}
+{% if not enable_central_database %}
   database:
 {% endif %}
   data:

roles/docker-yourls/templates/docker-compose.yml.j2

@@ -16,7 +16,7 @@ services:
       YOURLS_SITE: "https://{{domain}}"
       YOURLS_USER: "{{yourls_user}}"
       YOURLS_PASS: "{{yourls_user_password}}"
-{% if not ( enable_central_database | lower | bool )  %}
+{% if not enable_central_database %}
     depends_on:
       - database
 

roles/heal-docker/tasks/main.yml

@@ -23,7 +23,7 @@
     src: heal-docker.timer.j2
     dest: "/etc/systemd/system/heal-docker.timer"
   register: heal_docker_timer
-  changed_when: heal_docker_timer.changed or activate_all_timers | bool
+  changed_when: heal_docker_timer.changed or activate_all_timers
   notify: restart heal-docker.timer
   when: run_once_heal_docker is not defined
 

roles/health-btrfs/tasks/main.yml

@@ -20,5 +20,5 @@
     src: health-btrfs.timer.j2
     dest: "/etc/systemd/system/health-btrfs.timer"
   register: health_btrs_timer
-  changed_when: health_btrs_timer.changed or activate_all_timers | bool
+  changed_when: health_btrs_timer.changed or activate_all_timers
   notify: restart health-btrfs.timer

roles/health-disc-space/tasks/main.yml

@@ -20,5 +20,5 @@
     src: health-disc-space.timer.j2
     dest: /etc/systemd/system/health-disc-space.timer
   register: health_disc_space_timer
-  changed_when: health_disc_space_timer.changed or activate_all_timers | bool
+  changed_when: health_disc_space_timer.changed or activate_all_timers
   notify: restart health-disc-space.timer

roles/health-docker-container/tasks/main.yml

@@ -21,7 +21,7 @@
     src: health-docker-container.timer.j2
     dest: "/etc/systemd/system/health-docker-container.timer"
   register: health_docker_container_timer
-  changed_when: health_docker_container_timer.changed or activate_all_timers | bool
+  changed_when: health_docker_container_timer.changed or activate_all_timers
   notify: restart health-docker-container.timer
   when: run_once_health_docker_container is not defined
 

roles/health-docker-volumes/tasks/main.yml

@@ -21,7 +21,7 @@
     src: health-docker-volumes.timer.j2
     dest: "/etc/systemd/system/health-docker-volumes.timer"
   register: health_docker_volumes_timer
-  changed_when: health_docker_volumes_timer.changed or activate_all_timers | bool
+  changed_when: health_docker_volumes_timer.changed or activate_all_timers
   notify: restart health-docker-volumes.timer
   when: run_once_health_docker_volumes is not defined
 

roles/health-journalctl/tasks/main.yml

@@ -20,5 +20,5 @@
     src: health-journalctl.timer.j2
     dest: /etc/systemd/system/health-journalctl.timer
   register: health_journalctl_timer
-  changed_when: health_journalctl_timer.changed or activate_all_timers | bool
+  changed_when: health_journalctl_timer.changed or activate_all_timers
   notify: restart health-journalctl.timer

roles/health-nginx/tasks/main.yml

@@ -29,7 +29,7 @@
     src: health-nginx.timer.j2
     dest: "/etc/systemd/system/health-nginx.timer"
   register: health_nginx_timer
-  changed_when: health_nginx_timer.changed or activate_all_timers | bool
+  changed_when: health_nginx_timer.changed or activate_all_timers
   notify: restart health-nginx.timer
   when: run_once_health_nginx is not defined
 

roles/health-nginx/templates/health-nginx.py.j2

@@ -31,7 +31,7 @@ for filename in os.listdir(config_path):
         # Determine expected status codes based on the domain
         if domain == '{{domain_listmonk}}':
             expected_statuses = [401]
-{% if nginx_matomo_tracking | bool %}
+{% if nginx_matomo_tracking %}
         elif parts[0] == 'www' or domain in redirected_domains:
             expected_statuses = [301]
 {% endif %}

roles/nginx-certbot/tasks/main.yml

@@ -16,7 +16,7 @@
     src:  certbot.timer.j2
     dest: /etc/systemd/system/certbot.timer
   register: certbot_timer
-  changed_when: certbot_timer.changed or activate_all_timers | bool
+  changed_when: certbot_timer.changed or activate_all_timers
   notify: restart certbot timer
   when: run_once_nginx_certbot is not defined
 

roles/nginx-docker-reverse-proxy/templates/domain.conf.j2

@@ -3,7 +3,7 @@ server
   server_name {{domain}};
 
   # Include Matomo Tracking Code
-  {% if nginx_matomo_tracking | bool %}
+  {% if nginx_matomo_tracking %}
     {% include 'roles/nginx-matomo-tracking/templates/matomo-tracking.conf.j2' %}
   {% endif %}
 

roles/nginx-homepage/templates/homepage.nginx.conf.j2

@@ -5,7 +5,7 @@ server
   
   {% include 'roles/letsencrypt/templates/ssl_header.j2' %}
 
-  {% if nginx_matomo_tracking | bool %}
+  {% if nginx_matomo_tracking %}
     {% include 'roles/nginx-matomo-tracking/templates/matomo-tracking.conf.j2' %}
   {% endif %}
 

roles/update-docker/tasks/main.yml

@@ -2,7 +2,7 @@
   systemd:
     name: backup-docker-to-local-everything.service
     state: started
-  when: force_backup_before_update | bool
+  when: force_backup_before_update
 
 - name: create {{update_docker_script}}
   copy:

roles/user-administrator/tasks/main.yml

@@ -8,7 +8,16 @@
     ssh_key_type: rsa
     ssh_key_bits: 8192
   when: run_once_user_administrator is not defined
-    
+
+- name: "set correct rights for {{path_administrator_home}}"
+  file:
+    path: "{{path_administrator_home}}"
+    state: directory
+    owner: administrator
+    group: administrator
+    mode: 0700
+  when: run_once_user_administrator is not defined
+
 - name: "create {{path_administrator_scripts}}"
   file:
     path: "{{path_administrator_home}}scripts"

roles/user-root/README.md

@@ -0,0 +1,29 @@
+Certainly! Below is a README file in English for an Ansible role that includes the tasks you've provided:
+# Root User
+
+## Overview
+This Ansible role is designed to manage the generation and handling of an SSH key for the root user on a target system. It ensures that an SSH key is generated if it does not already exist and displays the public key. This role is particularly useful for setting up secure SSH access for root users in automated environments.
+
+## Role Variables
+- `run_once_user_root`: A variable to ensure that certain tasks are only run once. This is used for idempotency purposes.
+
+## Tasks
+1. **Check if the SSH key for root already exists**: Verifies the existence of an SSH public key for the root user.
+2. **Generate a SSH key for root if it does not exist**: Generates a new SSH key pair (RSA 4096 bits) for the root user if it is not already present.
+3. **Display the public SSH key**: Outputs the content of the generated public SSH key.
+4. **Output the public SSH key**: Debug task to display the SSH public key in the Ansible output.
+5. **Run the user_root tasks once**: Sets a fact to ensure that the tasks for generating and displaying the key are executed only once.
+
+## Usage
+To use this role, include it in your playbook and set any necessary variables in your playbook's `vars` section. Ensure you have the necessary permissions to execute tasks as the root user.
+
+```yaml
+- hosts: servers
+  become: yes
+  roles:
+    - ssh_key_generator_root
+```
+
+## Important Notes
+- Running this role will affect the root user's SSH configuration on the target system. Ensure you understand the implications of modifying root SSH keys.
+- Always test the role in a controlled environment before deploying to production.

roles/user-root/tasks/main.yml

@@ -0,0 +1,26 @@
+- name: Check if the SSH key for root already exists
+  ansible.builtin.stat:
+    path: "/root/.ssh/id_rsa.pub"
+  register: ssh_key
+
+- name: Generate a SSH key for root if it does not exist
+  ansible.builtin.openssh_keypair:
+    path: "/root/.ssh/id_rsa"
+    type: rsa
+    size: 4096
+  when: not ssh_key.stat.exists and run_once_user_administrator is not defined
+
+- name: Display the public SSH key
+  command: cat /root/.ssh/id_rsa.pub
+  register: public_key
+  when: not ssh_key.stat.exists and run_once_user_administrator is not defined
+
+- name: Output the public SSH key
+  debug:
+    msg: "{{ public_key.stdout }}"
+  when: not ssh_key.stat.exists and run_once_user_administrator is not defined
+
+- name: run the user_administrator tasks once
+  set_fact:
+    run_once_user_administrator: true
+  when: run_once_user_administrator is not defined

tasks/implement-matomo-tracking.yml

@@ -1,4 +1,4 @@
 - name: Activate NGINX matomo tracking
   include_role:
     name: nginx-matomo-tracking
-  when: nginx_matomo_tracking | bool and domain is defined
+  when: nginx_matomo_tracking and domain is defined