Rearange existing roles to make more sense

roles/actual/handlers/main.yml

@@ -4,3 +4,8 @@
   ansible.builtin.systemd:
     name: nginx.service
     state: restarted
+- name: Restart ufw
+  become: true
+  ansible.builtin.systemd:
+    name: ufw.service
+    state: restarted

roles/actual/tasks/main.yml

@@ -1,9 +1,4 @@
 ---
-- name: Install Podman
-  become: true
-  ansible.builtin.apt:
-    name: podman
-    state: present
 - name: Create a new user
   ansible.builtin.include_role:
     name: user
@@ -42,6 +37,13 @@
     dest: /etc/nginx/conf.d/actual.conf
     mode: '0644'
   notify: Restart Nginx
+- name: Allow https through firewall
+  become: true
+  community.general.ufw:
+    rule: allow
+    port: https
+    proto: tcp
+  notify: Restart ufw
 - name: Debug
   ansible.builtin.debug:
     msg: "Don't forget to manually add a DNS record for actual.kleinendorst.info pointing to: {{ ansible_facts['default_ipv4']['address'] }}."

roles/basic-intalls/handlers/main.yml

@@ -0,0 +1,6 @@
+---
+- name: Restart ufw
+  become: true
+  ansible.builtin.systemd:
+    name: ufw.service
+    state: restarted

roles/basic-intalls/tasks/main.yml

@@ -0,0 +1,57 @@
+---
+- name: Install basic packages
+  become: true
+  ansible.builtin.apt:
+    pkg:
+      - git
+      - vim
+      - ufw
+      - podman
+      - snapd
+    state: present
+- name: Install Snap Core
+  become: true
+  community.general.snap:
+    name: core
+    state: present
+- name: Set default policy (incoming)
+  become: true
+  community.general.ufw:
+    direction: incoming
+    policy: deny
+  notify: Restart ufw
+- name: Set default policy (outgoing)
+  become: true
+  community.general.ufw:
+    direction: outgoing
+    policy: allow
+  notify: Restart ufw
+- name: Set default policy (routed)
+  become: true
+  community.general.ufw:
+    direction: routed
+    policy: allow
+  notify: Restart ufw
+- name: Allow forwarding in ufw
+  become: true
+  ansible.builtin.lineinfile:
+    path: /etc/ufw/sysctl.conf
+    regexp: '^#net/ipv4/ip_forward=1$'
+    line: 'net/ipv4/ip_forward=1'
+  notify: Restart ufw
+- name: Allow all access to ssh
+  become: true
+  community.general.ufw:
+    rule: allow
+    port: ssh
+    proto: tcp
+  notify: Restart ufw
+- name: Enable ufw
+  become: true
+  community.general.ufw:
+    state: enabled
+- name: Install Snapcraft
+  become: true
+  ansible.builtin.apt:
+    name:
+    state: present

roles/cloudflare-ddns/tasks/main.yml

@@ -5,11 +5,11 @@
   vars:
     user_username: "{{ cloudflare_ddns_user }}"
     user_password: "{{ cloudflare_ddns_user_password }}"
-- name: Install Python dependencies # noqa: package-latest
+- name: Install Python dependencies
   become: true
   ansible.builtin.apt:
     pkg: python3-pip
-    state: latest
+    state: present
 - name: Copy over DDNS scripting
   become: true
   become_user: "{{ cloudflare_ddns_user }}"
@@ -27,7 +27,7 @@
     source ./venv/bin/activate
     pip3 install -r ./requirements.txt
   args:
-    executable: /bin/bash
+    executable: /usr/bin/zsh
     creates: ~/bin/cloudflare_ddns/venv
 - name: Create directory for storing public IP change logs and config
   become: true

roles/hostname/tasks/main.yml

@@ -0,0 +1,11 @@
+---
+- name: Configure hostname
+  become: true
+  ansible.builtin.hostname:
+    name: "{{ hostname }}"
+- name: Remove existing /etc/hosts entry for hostname and add FQDN name
+  become: true
+  ansible.builtin.lineinfile:
+    path: /etc/hosts
+    regexp: "^127.0.1.1.*$"
+    line: "{{ ansible_facts['default_ipv4']['address'] }} {{ hostname }}.kleinendorst.info {{ hostname }}"

roles/pi-hole/tasks/main.yml

@@ -1,9 +1,4 @@
 ---
-- name: Install Podman
-  become: true
-  ansible.builtin.apt:
-    name: podman
-    state: present
 - name: Create a user for running the pi-hole podman container
   ansible.builtin.include_role:
     name: user
@@ -79,34 +74,6 @@
 - name: Debug
   ansible.builtin.debug:
     msg: "Don't forget to manually add a DNS record for pi-hole.kleinendorst.info pointing to: {{ ansible_facts['default_ipv4']['address'] }}."
-- name: Install ufw
-  become: true
-  ansible.builtin.apt:
-    name: ufw
-    state: present
-- name: Set default policy (incoming)
-  become: true
-  community.general.ufw:
-    direction: incoming
-    policy: deny
-- name: Set default policy (outgoing)
-  become: true
-  community.general.ufw:
-    direction: outgoing
-    policy: allow
-- name: Allow forwarding in ufw
-  become: true
-  ansible.builtin.lineinfile:
-    path: /etc/ufw/sysctl.conf
-    regexp: '^#net/ipv4/ip_forward=1$'
-    line: 'net/ipv4/ip_forward=1'
-- name: Configure firewall to allow forward requests
-  become: true
-  ansible.builtin.lineinfile:
-    path: /etc/default/ufw
-    regexp: '^DEFAULT_FORWARD_POLICY="DROP"$'
-    line: 'DEFAULT_FORWARD_POLICY="ACCEPT"'
-  notify: Restart ufw
 - name: Add forwarding rules for ufw
   become: true
   ansible.builtin.blockinfile:
@@ -119,13 +86,6 @@
       -A PREROUTING -p udp --dport 53 -j REDIRECT --to-port 5053
       COMMIT
   notify: Restart ufw
-- name: Allow all access to ssh
-  become: true
-  community.general.ufw:
-    rule: allow
-    port: ssh
-    proto: tcp
-  notify: Restart ufw
 - name: Allow all access to https
   become: true
   community.general.ufw:
@@ -147,7 +107,3 @@
     port: '53'
     proto: tcp
   notify: Restart ufw
-- name: Enable ufw
-  become: true
-  community.general.ufw:
-    state: enabled

roles/snapcraft/tasks/main.yml

@@ -1,11 +0,0 @@
----
-- name: Install Snapcraft
-  become: true
-  ansible.builtin.apt:
-    name: snapd
-    state: present
-- name: Install Snap Core
-  become: true
-  community.general.snap:
-    name: core
-    state: present

roles/user/tasks/main.yml

@@ -14,14 +14,13 @@
 - name: Set fact for defining the user which should run the next modules
   ansible.builtin.set_fact:
     target_user: "{{ ansible_facts['user_id'] if user_username is undefined else user_username }}"
-- name: Ensuring ZSH is installed # noqa: package-latest
+- name: Ensuring ZSH is installed
   become: true
   ansible.builtin.apt:
     pkg:
       - acl # Needed to prevent this error: https://stackoverflow.com/questions/46352173/ansible-failed-to-set-permissions-on-the-temporary
-      - git
       - zsh
-    state: latest
+    state: present
 - name: Install Oh My ZSH # noqa: command-instead-of-module   ignore error since we're removing the script after install.
   become: true
   become_user: "{{ target_user }}"