Ansible-Bootstrap/roles/partitioning/tasks/main.yml

---
- name: Partition install drive
  block:
    - name: Prepare partitions
      failed_when: false
      ansible.builtin.command: "{{ item.cmd }}"
      changed_when: result.rc == 0
      register: result
      loop:
        - { cmd: umount -l /mnt }
        - { cmd: vgremove -f sys }
        - { cmd: 'find /dev -wholename "{{ install_drive }}*" -exec wipefs --force --all {} \;' }
      loop_control:
        label: "{{ item.cmd }}"

    - name: Define partitions
      community.general.parted:
        device: "{{ install_drive }}"
        label: gpt
        number: "{{ item.number }}"
        part_end: "{{ item.part_end | default(omit) }}"
        part_start: "{{ item.part_start | default(omit) }}"
        name: "{{ item.name }}"
        flags: "{{ item.flags | default(omit) }}"
        state: present
      loop:
        - { number: 1, part_end: 500MiB, name: boot, flags: [boot, esp] }
        - { number: 2, part_start: 500MiB, name: root }

- name: Create LVM logical volumes
  block:
    - name: Create LVM volume group
      community.general.lvg:
        vg: sys
        pvs: "{{ install_drive }}{{ main_partition_suffix }}"

    - name: Create LVM logical volumes
      when: cis | bool or item.lv not in ['home', 'var', 'var_log', 'var_log_audit']
      community.general.lvol:
        vg: sys
        lv: "{{ item.lv }}"
        size: "{{ item.size }}"
        state: present
      loop:
        - lv: root
          size: >-
            {{ (
                (vm_size | float -
                 ((vm_memory | float / 1024 >= 16.0) | ternary(
                    (vm_memory | float / 2048) | int,
                    [vm_memory | float / 1024, 4.0] | max
                 )) - 0.5 -
                 (cis | bool | ternary(0, 7.5))
                ) > 12.0
            ) | ternary(
                (vm_size | float * 0.4) | round(0, 'ceil'),
                vm_size | float -
                ((vm_memory | float / 1024 >= 16.0) | ternary(
                    (vm_memory | float / 2048) | int,
                    [vm_memory | float / 1024, 4.0] | max
                )) - 0.5 -
                (cis | bool | ternary(7.5, 0))
            ) | string + 'G' }}

        - lv: swap
          size: >-
            {{ ((vm_memory | float / 1024 >= 16.0) | ternary(
                (vm_memory | float / 2048) | int,
                [vm_memory | float / 1024, 4.0] | max
            )) | string + 'G' }}

        - lv: home
          size: "2G"

        - lv: var
          size: "2G"

        - lv: var_log
          size: "2G"

        - lv: var_log_audit
          size: "1.5G"

- name: Create filesystems
  block:
    - name: Create FAT32 filesystem in boot partition
      community.general.filesystem:
        dev: "{{ install_drive }}{{ boot_partition_suffix }}"
        fstype: vfat
        opts: -F32 -n BOOT
        force: true

    - name: Create swap filesystem
      community.general.filesystem:
        fstype: swap
        dev: /dev/sys/swap

    - name: Create filesystem
      ansible.builtin.include_tasks: "{{ filesystem }}.yml"

    - name: Get UUID for boot filesystem
      ansible.builtin.command: blkid -s UUID -o value '{{ install_drive }}{{ boot_partition_suffix }}'
      changed_when: false
      register: boot_uuid

    - name: Get UUID for main filesystem
      ansible.builtin.command: blkid -s UUID -o value '{{ install_drive }}{{ main_partition_suffix }}'
      changed_when: false
      register: main_uuid

    - name: Get UUIDs for LVM filesystems
      when: cis | bool or item not in ['home', 'var', 'var_log', 'var_log_audit']
      ansible.builtin.command: blkid -s UUID -o value /dev/sys/{{ item }}
      changed_when: false
      register: uuid_result
      loop:
        - root
        - swap
        - home
        - var
        - var_log
        - var_log_audit

    - name: Assign UUIDs to Variables
      ansible.builtin.set_fact:
        uuid_root: "{{ uuid_result.results[0].stdout_lines }}"
        uuid_swap: "{{ uuid_result.results[1].stdout_lines }}"
        uuid_home: "{{ uuid_result.results[2].stdout_lines if cis | bool else '' }}"
        uuid_var: "{{ uuid_result.results[3].stdout_lines if cis | bool else '' }}"
        uuid_var_log: "{{ uuid_result.results[4].stdout_lines if cis | bool else '' }}"
        uuid_var_log_audit: "{{ uuid_result.results[5].stdout_lines if cis | bool else '' }}"

- name: Mount filesystems
  block:
    - name: Mount filesystems and subvolumes
      when:
        - cis | bool or (not cis and (item.path == '/var/log' and filesystem == 'btrfs')
          or (item.path not in ['/home', '/var', '/var/log', '/var/log/audit']))
      ansible.posix.mount:
        path: /mnt{{ item.path }}
        src: "{{ 'UUID=' + (main_uuid.stdout if filesystem == 'btrfs' else item.uuid) }}"
        fstype: "{{ filesystem }}"
        opts: "{{ item.opts }}"
        state: mounted
      loop:
        - path: ""
          uuid: "{{ uuid_root[0] | default(omit) }}"
          opts: "defaults"
        - path: /home
          uuid: "{{ uuid_home[0] | default(omit) }}"
          opts: "{{ 'defaults,nosuid,nodev' if filesystem != 'btrfs'
                else 'rw,nosuid,nodev,relatime,compress=zstd:15,ssd,space_cache=v2,discard=async,subvol=@home' }}"
        - path: /var
          uuid: "{{ uuid_var[0] | default(omit) }}"
          opts: "defaults,nosuid,nodev"
        - path: /var/log
          uuid: "{{ uuid_var_log[0] | default(omit) }}"
          opts: "defaults,nosuid,nodev,noexec"
        - path: /var/log/audit
          uuid: "{{ uuid_var_log_audit[0] | default(omit) }}"
          opts: "defaults,nosuid,nodev,noexec"

    - name: Mount tmp and var_tmp filesystems
      ansible.posix.mount:
        path: /mnt{{ item.path }}
        src: tmpfs
        fstype: tmpfs
        opts: defaults,nosuid,nodev,noexec
        state: mounted
      loop:
        - { path: /tmp }
        - { path: /var/tmp }

    - name: Mount boot filesystem
      ansible.posix.mount:
        path: "{{ '/mnt/boot/efi' if os | lower in ['rhel8'] else '/mnt/boot' }}"
        src: UUID={{ boot_uuid.stdout }}
        fstype: vfat
        state: mounted

    - name: Activate swap
      ansible.builtin.command: "{{ 'swapon -U ' + uuid_swap[0] }}"
      changed_when: result.rc == 0
      register: result