From 6ba7c61cb7e3afa22737fbf4617879f7701be033 Mon Sep 17 00:00:00 2001
From: Christoph <ckubu@oopen.de>
Date: Thu, 6 Aug 2026 17:09:17 +0200
Subject: [PATCH] fix(common): avoid localhost become prompts, stabilize redis
 apt upgrade, and lint handlers

---
 hosts                               |  3 ++
 roles/common/handlers/main.yml      | 70 ++++++++++++++++-------------
 roles/common/tasks/redis-server.yml |  3 +-
 3 files changed, 43 insertions(+), 33 deletions(-)

diff --git a/hosts b/hosts
index a2e3e8c..73ccf77 100644
--- a/hosts
+++ b/hosts
@@ -948,6 +948,9 @@ psono-ndm.oopen.de
 # o29.oopen.de . Dissens
 cl-dissens.oopen.de
 
+# Hetzner cloud (CPX22) - Faire Mobilitaet
+ki-fm.oopen.de
+
 # Nextcloud / DokuWiki VBER
 o34.oopen.de
 
diff --git a/roles/common/handlers/main.yml b/roles/common/handlers/main.yml
index c3be85d..0397eff 100644
--- a/roles/common/handlers/main.yml
+++ b/roles/common/handlers/main.yml
@@ -1,12 +1,14 @@
 ---
 
 - name: Update timezone
-  command: dpkg-reconfigure --frontend noninteractive tzdata
+  ansible.builtin.command:
+    cmd: dpkg-reconfigure --frontend noninteractive tzdata
+  changed_when: false
 
-#- name: Restart ssh
-#  shell: sleep 3; systemctl restart sshd
-#  async: 1
-#  poll: 0
+# - name: Restart ssh
+#   shell: sleep 3; systemctl restart sshd
+#   async: 1
+#   poll: 0
 
 # Does NOT Work
 #
@@ -14,108 +16,112 @@
 #    Start request repeated too quickly.
 #
 # See also: https://github.com/ansible/ansible-modules-core/issues/1533
-# 
+
 - name: Restart ssh
-  service:
+  ansible.builtin.service:
     name: ssh
     state: restarted
 
 - name: Reload nfs
-  service:
+  ansible.builtin.service:
     name: nfs-kernel-server
     state: reloaded
-    enabled: yes
+    enabled: true
   when:
     - "groups['nfs_server']|string is search(inventory_hostname)"
 
 - name: Restart postfix
-  service:
+  ansible.builtin.service:
     name: postfix
     state: restarted
 
 - name: Reload bind9
-  service:
+  ansible.builtin.service:
     name: bind9
     state: reloaded
-    enabled: yes
+    enabled: true
 
 
 - name: Restart smbd
-  service:
+  ansible.builtin.service:
     name: smbd
-    daemon_reload: yes
+    daemon_reload: true
     state: restarted
 
 - name: Restart nmbd
-  service:
+  ansible.builtin.service:
     name: nmbd
-    daemon_reload: yes
+    daemon_reload: true
     state: restarted
 
 - name: Reload samba config
-  shell: smbcontrol all reload-config
+  ansible.builtin.command:
+    cmd: smbcontrol all reload-config
+  changed_when: false
   when:
     - inventory_hostname in groups['samba_server']
 
 - name: Restart systemd-journald
-  service:
+  ansible.builtin.service:
     name: systemd-journald
     state: restarted
 
 - name: Restart redis-server
   vars:
     _daemon: "{{ 'redis' if ansible_facts['distribution'] == 'CentOS' else 'redis-server' }}"
-  service:
+  ansible.builtin.service:
     name: "{{ _daemon }}"
     state: restarted
 
 - name: Restart tor service
-  service: 
+  ansible.builtin.service:
     name: tor
     state: restarted
 
 - name: Reload tor service
-  service:
+  ansible.builtin.service:
     name: tor
     state: reloaded
 
 - name: Reload postfwd
-  service:
+  ansible.builtin.service:
     name: postfwd
     state: reloaded
 
 - name: Restart systemd-resolved
-  service:
+  ansible.builtin.service:
     name: systemd-resolved
     state: restarted
 
 - name: Restart nfs-kernel-server
-  service:
+  ansible.builtin.service:
     name: nfs-kernel-server
     state: restarted
 
 - name: Restart ntp
-  service:
+  ansible.builtin.service:
     name: ntpsec
-    daemon_reload: yes
+    daemon_reload: true
     state: restarted
 
 - name: Restart mariadb
-  service:
+  ansible.builtin.service:
     name: mariadb
-    daemon_reload: yes
+    daemon_reload: true
     state: restarted
 
 - name: Restart apache2
-  service:
+  ansible.builtin.service:
     name: apache2
-    daemon_reload: yes
+    daemon_reload: true
     state: restarted
 
 - name: Reload AppArmor profile clamd
-  command: apparmor_parser -r /etc/apparmor.d/usr.sbin.clamd
+  ansible.builtin.command:
+    cmd: apparmor_parser -r /etc/apparmor.d/usr.sbin.clamd
+  changed_when: false
 
 - name: Restart clamav-daemon
-  service:
+  ansible.builtin.service:
     name: clamav-daemon
     state: restarted
diff --git a/roles/common/tasks/redis-server.yml b/roles/common/tasks/redis-server.yml
index 7e503a6..9e3b095 100644
--- a/roles/common/tasks/redis-server.yml
+++ b/roles/common/tasks/redis-server.yml
@@ -40,7 +40,8 @@
 - name: (redis-server.yml) upgrade
   ansible.builtin.apt:
     upgrade: "{{ apt_upgrade_type }}"
-    update_cache: true
+    # apt cache is refreshed in the preceding "update" task
+    update_cache: false
     dpkg_options: "{{ apt_upgrade_dpkg_options | join(',') }}"
   when:
     - ansible_facts['distribution'] == "Debian"