From 6d1c3577df84b3c73d0a3cef89fc96e84b63e482 Mon Sep 17 00:00:00 2001
From: Sandwich <sandwich@archworks.co>
Date: Sat, 21 Feb 2026 02:39:03 +0100
Subject: [PATCH] refactor(global_defaults): add idempotency guards to
 normalization tasks

---
 roles/global_defaults/tasks/hypervisor.yml | 41 ++++++++++++----------
 roles/global_defaults/tasks/system.yml     | 15 ++++----
 2 files changed, 31 insertions(+), 25 deletions(-)

diff --git a/roles/global_defaults/tasks/hypervisor.yml b/roles/global_defaults/tasks/hypervisor.yml
index 320815a..a62bb42 100644
--- a/roles/global_defaults/tasks/hypervisor.yml
+++ b/roles/global_defaults/tasks/hypervisor.yml
@@ -1,21 +1,24 @@
 ---
-- name: Ensure hypervisor input is a dictionary
-  ansible.builtin.set_fact:
-    hypervisor: "{{ hypervisor | default({}) }}"
-
-- name: Validate hypervisor input
-  ansible.builtin.assert:
-    that:
-      - hypervisor is mapping
-      - hypervisor.type is defined
-      - hypervisor.type | string | length > 0
-    fail_msg: "hypervisor must be a dictionary and hypervisor.type must be set (e.g. libvirt|proxmox|vmware|xen|none)."
-    quiet: true
-
 - name: Normalize hypervisor configuration
-  vars:
-    merged: "{{ hypervisor_defaults | combine(hypervisor, recursive=True) }}"
-  ansible.builtin.set_fact:
-    hypervisor_cfg: "{{ merged }}"
-    hypervisor_type: "{{ merged.type | string | lower }}"
-  no_log: true
+  when: hypervisor_cfg is not defined
+  block:
+    - name: Ensure hypervisor input is a dictionary
+      ansible.builtin.set_fact:
+        hypervisor: "{{ hypervisor | default({}) }}"
+
+    - name: Validate hypervisor input
+      ansible.builtin.assert:
+        that:
+          - hypervisor is mapping
+          - hypervisor.type is defined
+          - hypervisor.type | string | length > 0
+        fail_msg: "hypervisor must be a dictionary and hypervisor.type must be set (e.g. libvirt|proxmox|vmware|xen|none)."
+        quiet: true
+
+    - name: Merge hypervisor defaults with input
+      vars:
+        merged: "{{ hypervisor_defaults | combine(hypervisor, recursive=True) }}"
+      ansible.builtin.set_fact:
+        hypervisor_cfg: "{{ merged }}"
+        hypervisor_type: "{{ merged.type | string | lower }}"
+      no_log: true
diff --git a/roles/global_defaults/tasks/system.yml b/roles/global_defaults/tasks/system.yml
index dbfe222..0b1ee4a 100644
--- a/roles/global_defaults/tasks/system.yml
+++ b/roles/global_defaults/tasks/system.yml
@@ -1,9 +1,12 @@
 ---
-- name: Validate raw system input types
-  ansible.builtin.include_tasks: _validate_input.yml
+- name: Normalize system and disk configuration
+  when: system_cfg is not defined
+  block:
+    - name: Validate raw system input types
+      ansible.builtin.include_tasks: _validate_input.yml
 
-- name: Normalize system configuration
-  ansible.builtin.include_tasks: _normalize_system.yml
+    - name: Normalize system configuration
+      ansible.builtin.include_tasks: _normalize_system.yml
 
-- name: Normalize disk configuration
-  ansible.builtin.include_tasks: _normalize_disks.yml
+    - name: Normalize disk configuration
+      ansible.builtin.include_tasks: _normalize_disks.yml