Refactor user profile handling in system and NIS user tasks for improved clarity and efficiency

roles/common/tasks/nis-user-systemfiles.yml

@@ -59,19 +59,91 @@
     - profile
 
 
-# 1) Für jeden NIS-User prüfen, ob eine lokale _profile.j2 existiert
-- name: (nis-user-systemfiles.yml) stat user _profile.j2
+# Priorität für .profile:
+# 1. Wenn für den konkreten NIS-User eine eigene _profile.j2 existiert, diese verwenden.
+# 2. Sonst, wenn es eine allgemeine DEFAULT/_profile.j2 gibt, daraus .profile erstellen.
+# 3. Sonst, wenn für den konkreten NIS-User eine eigene _profile-Datei existiert, diese als .profile kopieren.
+
+- name: (nis-user-systemfiles.yml) stat user-specific _profile.j2
+  ansible.builtin.stat:
+    path: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/{{ item.name }}/_profile.j2"
+  delegate_to: localhost
+  become: false
+  loop: "{{ nis_user }}"
+  register: common_profile_user_template_stats
+  loop_control:
+    label: "{{ item.name }}"
+
+- name: (nis-user-systemfiles.yml) stat user-specific _profile
+  ansible.builtin.stat:
+    path: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/{{ item.name }}/_profile"
+  delegate_to: localhost
+  become: false
+  loop: "{{ nis_user }}"
+  register: common_profile_user_plain_stats
+  loop_control:
+    label: "{{ item.name }}"
+
+- name: (nis-user-systemfiles.yml) stat default _profile.j2
   ansible.builtin.stat:
     path: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/DEFAULT/_profile.j2"
   delegate_to: localhost
   become: false
   loop: "{{ nis_user }}"
-  register: common_profile_template_stats
+  register: common_profile_default_template_stats
   loop_control:
     label: "{{ item.name }}"
 
-# 2) Falls _profile.j2 vorhanden, .profile aus Template rendern
-- name: (nis-user-systemfiles.yml) template .profile if _profile.j2 exists
+- name: (nis-user-systemfiles.yml) template .profile from user-specific _profile.j2 if it exists
+  ansible.builtin.template:
+    src: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/{{ user.name }}/_profile.j2"
+    dest: "~{{ user.name }}/.profile"
+    owner: "{{ user.name }}"
+    group: "{{ user.name }}"
+    mode: "0644"
+  become: true
+  loop: "{{ nis_user | zip(common_profile_user_template_stats.results) | list }}"
+  loop_control:
+    label: "{{ user.name }}"
+  when:
+    - user_template_stat.stat.exists | bool
+  vars:
+    user: "{{ item.0 }}"
+    user_template_stat: "{{ item.1 }}"
+  tags: [bash]
+
+- name: (nis-user-systemfiles.yml) copy .profile from user-specific _profile as fallback
+  ansible.builtin.copy:
+    src: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/{{ user.name }}/_profile"
+    dest: "~{{ user.name }}/.profile"
+    owner: "{{ user.name }}"
+    group: "{{ user.name }}"
+    mode: "0644"
+  become: true
+  loop: >-
+    {{
+      nis_user
+      | zip(
+          common_profile_user_template_stats.results,
+          common_profile_user_plain_stats.results,
+          common_profile_default_template_stats.results
+        )
+      | list
+    }}
+  loop_control:
+    label: "{{ user.name }}"
+  when:
+    - not user_template_stat.stat.exists | bool
+    - not default_template_stat.stat.exists | bool
+    - user_profile_stat.stat.exists | bool
+  vars:
+    user: "{{ item.0 }}"
+    user_template_stat: "{{ item.1 }}"
+    user_profile_stat: "{{ item.2 }}"
+    default_template_stat: "{{ item.3 }}"
+  tags: [bash]
+
+- name: (nis-user-systemfiles.yml) template .profile from default _profile.j2 if no user-specific profile exists
   ansible.builtin.template:
     src: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/DEFAULT/_profile.j2"
     dest: "~{{ user.name }}/.profile"
@@ -79,14 +151,26 @@
     group: "{{ user.name }}"
     mode: "0644"
   become: true
-  loop: "{{ nis_user | zip(common_profile_template_stats.results) | list }}"
+  loop: >-
+    {{
+      nis_user
+      | zip(
+          common_profile_user_template_stats.results,
+          common_profile_user_plain_stats.results,
+          common_profile_default_template_stats.results
+        )
+      | list
+    }}
   loop_control:
     label: "{{ user.name }}"
   when:
-    - stat_result.stat.exists | bool
+    - not user_template_stat.stat.exists | bool
+    - default_template_stat.stat.exists | bool
   vars:
     user: "{{ item.0 }}"
-    stat_result: "{{ item.1 }}"
+    user_template_stat: "{{ item.1 }}"
+    user_profile_stat: "{{ item.2 }}"
+    default_template_stat: "{{ item.3 }}"
   tags: [bash]
 
 

roles/common/tasks/system-user-systemfiles.yml

@@ -4,13 +4,33 @@
 # Check if local template directories exists
 # ---
 
+- name: (system-user-systemfiles.yml) build filtered user lists
+  ansible.builtin.set_fact:
+    # Nur echte System-User behandeln; Nutzer, die auch als NIS-User definiert sind,
+    # werden hier herausgefiltert, damit die folgenden Datei-Tasks sie nicht mehr
+    # mit System-User-Templates versorgen.
+    common_system_user_files_system_users: >-
+      {{
+        system_users
+        | rejectattr('name', 'in', (nis_user | default([]) | map(attribute='name') | list))
+        | list
+      }}
+    # Gleiche Filterung für Default-User, damit die System-User-Dateien ebenfalls
+    # nur noch für Nutzer erzeugt werden, die nicht zugleich NIS-User sind.
+    common_system_user_files_default_users: >-
+      {{
+        default_user
+        | rejectattr('name', 'in', (nis_user | default([]) | map(attribute='name') | list))
+        | list
+      }}
+
 # system_user
 - name: (system-user-systemfiles.yml) Check if local template directory exists for default users
   ansible.builtin.stat:
     path: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/{{ item.name }}"
   delegate_to: localhost
   become: false
-  with_items: "{{ system_users }}"
+  with_items: "{{ common_system_user_files_system_users }}"
   loop_control:
     label: '{{ item.name }}'
   register: common_local_template_dir_system_users
@@ -32,7 +52,7 @@
   ansible.builtin.stat:
     path: "~{{ item.name }}/.profile.ORIG"
   register: common_profile_user_orig_exists
-  loop: "{{ system_users }}"
+  loop: "{{ common_system_user_files_system_users }}"
   loop_control:
     label: '{{ item.name }}'
   tags:
@@ -61,7 +81,7 @@
     path: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/{{ item.name }}/_profile"
   delegate_to: localhost
   become: false
-  loop: "{{ default_user }}"
+  loop: "{{ common_system_user_files_default_users }}"
   register: common_profile_stats
   loop_control:
     label: "{{ item.name }}"
@@ -83,7 +103,7 @@
     group: "{{ user.name }}"
     mode: "0644"
   become: true
-  loop: "{{ default_user | zip(common_profile_stats.results) | list }}"
+  loop: "{{ common_system_user_files_default_users | zip(common_profile_stats.results) | list }}"
   loop_control:
     label: "{{ user.name }}"
   when:
@@ -102,7 +122,7 @@
     group: "{{ user.name }}"
     mode: "0644"
   become: true
-  loop: "{{ default_user | zip(common_profile_stats.results) | list }}"
+  loop: "{{ common_system_user_files_default_users | zip(common_profile_stats.results) | list }}"
   loop_control:
     label: "{{ user.name }}"
   when:
@@ -167,7 +187,7 @@
   ansible.builtin.stat:
     path: "~{{ item.name }}/.bashrc.ORIG"
   register: common_bashrc_user_orig_exists
-  loop: "{{ system_users }}"
+  loop: "{{ common_system_user_files_system_users }}"
   loop_control:
     label: '{{ item.name }}'
   tags:
@@ -195,7 +215,7 @@
     path: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/{{ item.name }}/_bashrc"
   delegate_to: localhost
   become: false
-  loop: "{{ default_user }}"
+  loop: "{{ common_system_user_files_default_users }}"
   register: common_bashrc_stats
   loop_control:
     label: "{{ item.name }}"
@@ -217,7 +237,7 @@
     group: "{{ user.name }}"
     mode: "0644"
   become: true
-  loop: "{{ default_user | zip(common_bashrc_stats.results) | list }}"
+  loop: "{{ common_system_user_files_default_users | zip(common_bashrc_stats.results) | list }}"
   loop_control:
     label: "{{ user.name }}"
   when:
@@ -236,7 +256,7 @@
     group: "{{ user.name }}"
     mode: "0644"
   become: true
-  loop: "{{ default_user | zip(common_bashrc_stats.results) | list }}"
+  loop: "{{ common_system_user_files_default_users | zip(common_bashrc_stats.results) | list }}"
   loop_control:
     label: "{{ user.name }}"
   when:
@@ -302,7 +322,7 @@
     path: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/{{ item.name }}/_vimrc"
   delegate_to: localhost
   become: false
-  loop: "{{ default_user }}"
+  loop: "{{ common_system_user_files_default_users }}"
   register: common_vimrc_stats
   loop_control:
     label: '{{ item.name }}'
@@ -315,7 +335,7 @@
     owner: "{{ user.name }}"
     group: "{{ user.name }}"
     mode: '0644'
-  loop: "{{ default_user | zip(common_vimrc_stats.results) | list }}"
+  loop: "{{ common_system_user_files_default_users | zip(common_vimrc_stats.results) | list }}"
   loop_control:
     label: "{{ user.name }}"
   when:
@@ -333,7 +353,7 @@
     path: "{{ inventory_dir }}/files/{{ nis_domain }}/homedirs/{{ item.name }}/.vim"
   delegate_to: localhost
   become: false
-  loop: "{{ default_user }}"
+  loop: "{{ common_system_user_files_default_users }}"
   register: common_dotvim_stats
   loop_control:
     label: "{{ item.name }}"
@@ -346,7 +366,7 @@
     dest: "~{{ user.name }}/"
     mode: preserve           # oder weglassen; 0644 wäre für Verzeichnisse falsch
   become: true
-  loop: "{{ default_user | zip(common_dotvim_stats.results) | list }}"
+  loop: "{{ common_system_user_files_default_users | zip(common_dotvim_stats.results) | list }}"
   loop_control:
     label: "{{ user.name }}"
   when:
@@ -366,7 +386,7 @@
     recurse: true
     state: directory
   become: true
-  loop: "{{ default_user | zip(common_dotvim_stats.results) | list }}"
+  loop: "{{ common_system_user_files_default_users | zip(common_dotvim_stats.results) | list }}"
   loop_control:
     label: "{{ user.name }}"
   when: