Handle ansible-lint errors that required manual touches

handlers/main.yml

@@ -22,9 +22,10 @@
     state: restarted
 
 - name: Save iptables rules (Debian/Ubuntu and CentOS/RHEL/Fedora)
-  ansible.builtin.shell: "{{ iptables_save_command }}"
+  ansible.builtin.shell: "{{ iptables_save_command }}" # noqa command-instead-of-shell could have shell redirection
   when: ansible_os_family == 'Debian' or ansible_os_family == 'RedHat'
   listen: "save iptables"
+  changed_when: true # always save iptables rules
 
 - name: Build and install policy
   ansible.builtin.command: "{{ item }}"
@@ -34,3 +35,5 @@
     - "checkmodule -M -m -o {{ openvpn_selinux_module }}.mod {{ openvpn_selinux_module }}.te"
     - "semodule_package -o {{ openvpn_selinux_module }}.pp -m {{ openvpn_selinux_module }}.mod"
     - "semodule -i {{ openvpn_selinux_module }}.pp"
+  changed_when: true
+  when: ansible_selinux.status == 'enabled'

meta/main.yml

@@ -6,21 +6,18 @@ galaxy_info:
   description: OpenVPN playbook for CentOS/Fedora/RHEL/RHEL clones & Ubuntu/Debian
 
   license: MIT
-  min_ansible_version: 2.9
+  min_ansible_version: "2.9"
 
   platforms:
     - name: EL
       versions:
-        - 7
-        - 8
+        - "8"
+        - "9"
     - name: Fedora
       versions:
-        - 32
-        - 33
-        - 34
-    - name: Ubuntu
-      versions:
-        - trusty
+        - "38"
+        - "39"
+        - "40"
   galaxy_tags:
     - networking
 

tasks/compile_ldap_plugin.yml

@@ -13,7 +13,8 @@
     path: "{{ openvpn_auth_ldap_bin_path }}"
   register: openvpn_auth_ldap_bin
 
-- when:
+- name: Compile openvpn-auth-ldap plugin
+  when:
     - not openvpn_auth_ldap_bin.stat.exists or not re2c_bin.stat.exists
   block:
     - name: Install gcc objc repo

tasks/firewalld.yml

@@ -51,7 +51,7 @@
 
 # workaround for --permanent not working on non-NetworkManager managed ifaces
 # https://bugzilla.redhat.com/show_bug.cgi?id=1112742
-- name: Check if ifcfg-{{ ansible_default_ipv4.interface }} exists
+- name: Check if ifcfg file exists for {{ ansible_default_ipv4.interface }}
   ansible.builtin.stat:
     path: "/etc/sysconfig/network-scripts/ifcfg-{{ ansible_default_ipv4.interface }}"
   register: ifcfg

tasks/iptables.yml

@@ -84,8 +84,9 @@
   notify: "save iptables"
 
 - name: Save existing iptables rule before start iptables service
-  ansible.builtin.shell: "{{ iptables_save_command }}"
+  ansible.builtin.shell: "{{ iptables_save_command }}" # noqa command-instead-of-shell
   when: __iptables_installed.changed | bool # noqa no-handler
+  changed_when: true
 
 - name: Enable iptables
   ansible.builtin.service:

tasks/server_keys.yml

@@ -66,7 +66,10 @@
     mode: "0400"
 
 - name: Sign server key
-  ansible.builtin.command: openssl x509 -req -in server.csr -out server.crt -CA ca.crt -CAkey ca-key.pem -sha256 -days 3650 -CAcreateserial -extfile openssl-server.ext
+  ansible.builtin.command: >
+    openssl x509 -req -in server.csr -out server.crt
+    -CA ca.crt -CAkey ca-key.pem -sha256 -days 3650
+    -CAcreateserial -extfile openssl-server.ext
   args:
     chdir: "{{ openvpn_key_dir }}"
     creates: server.crt

tests/ansible-role-openvpn

@@ -0,0 +1 @@
+..

tests/test.yml

@@ -1,5 +1,6 @@
 ---
-- hosts: 127.0.0.1
+- name: Run CI tests
+  hosts: 127.0.0.1
   connection: local
   vars:
     ci_build: true