Align ESP sizing to full 512 MiB

without the key, and key cannot be set otherwise awx refuses connection

.ansible-lint

@@ -1,2 +1,4 @@
 skip_list:
   - run-once
+exclude_paths:
+  - roles/global_defaults/

README.md

@@ -51,20 +51,21 @@ The playbook uses the ArchLinux ISO as a foundational tool to provides an effici
 
 ## 2. Global Variables
 
-Global variables apply across your Ansible project and are loaded from `vars.yml` by default. These variables define common settings such as hypervisor connection details and the boot ISO path. They can be overridden by inventory variables for specific hosts or VMs if needed.
+Global variables apply across your Ansible project and can be supplied via inventory or `-e @vars_example.yml`. These variables define common settings such as hypervisor connection details and the boot ISO path. They can be overridden by inventory variables for specific hosts or VMs if needed.
 
 ### 2.1 Core Provisioning
 
 | Variable                | Description                                                | Example Value                             |
 | ----------------------- | ---------------------------------------------------------- | ----------------------------------------- |
 | `install_type`          | Type of installation.                                      | `virtual`, `physical`                     |
-| `hypervisor`            | Type of hypervisor.                                        | `libvirt`, `proxmox`, `vmware`, `none`    |
+| `hypervisor`            | Type of hypervisor (required for virtual installs).        | `libvirt`, `proxmox`, `vmware`, `none`    |
 | `install_drive`         | Drive where the system will be installed.                  | `/dev/sda`                                |
 | `boot_iso`              | Path to the boot ISO image.                                | `local-btrfs:iso/archlinux-x86_64.iso`    |
 | `rhel_iso`              | Path to the RHEL ISO file, required for RHEL 8/9/10.        | `local-btrfs:iso/rhel-9.4-x86_64-dvd.iso` |
 | `custom_iso` (optional) | Skip ArchISO checks and pacman setup on installer media.   | `true`, `false (default)`                 |
-| `cis` (optional)        | Adjusts the installation to be CIS level 3 conformant.     | `true`, `false`                           |
-| `selinux` (optional)    | Toggle SELinux where supported.                            | `true`, `false`                           |
+| `cis` (optional)        | Adjusts the installation to be CIS level 3 conformant.     | `true`, `false (default)`                 |
+| `selinux` (optional)    | Toggle SELinux where supported.                            | `true (default)`, `false`                 |
+| `firewalld_enabled` (optional) | Toggle firewalld package/service enablement.        | `true (default)`, `false`                 |
 
 ### 2.2 Hypervisor Access (virtual installs)
 
@@ -78,7 +79,7 @@ Global variables apply across your Ansible project and are loaded from `vars.yml
 | `hypervisor_node`       | Hypervisor node name.                                      | `node01`             |
 | `hypervisor_storage`    | Storage identifier for VM disks.                           | `local-btrfs`        |
 | `vm_path` (optional)    | Libvirt image dir or VMware folder path.                   | `/var/lib/libvirt/images` |
-| `vmware_ssh`            | If Ansible should use SSH after base VMware setup.         | `true`, `false`      |
+| `vmware_ssh`            | If Ansible should use SSH after base VMware setup.         | `true`, `false (default)`      |
 | `vlan_name` (optional)  | VLAN for the VM's network interface.                       | `vlan100`            |
 | `note` (optional)       | VMware VM annotation.                                      | `Provisioned by Ansible` |
 
@@ -161,7 +162,7 @@ These are prompted by default via `vars_prompt` in `main.yml`, but can be suppli
 | `vm_id`     | Unique identifier for the VM.     | `101`         |
 | `vm_size`   | Disk size allocated in GB.        | `20`          |
 | `vm_memory` | Amount of memory in MB.           | `2048`        |
-| `vm_cpus`   | Number of CPU cores.              | `4`           |
+| `vm_cpus`   | Number of CPU cores (virtual installs). | `4`      |
 | `vm_ballo`  | Ballooning memory size (optional).| `2048`        |
 
 ### 3.5 Post-install Packages
@@ -178,27 +179,28 @@ Before running the playbook, ensure you have Ansible installed and configured co
 
 ### 4.2 Running the Playbook
 
-Execute the playbook using the `ansible-playbook` command, ensuring that all necessary variables are defined, typically by specifying a `vars.yml` file containing the required configurations.
+Execute the playbook using the `ansible-playbook` command, ensuring that all necessary variables are defined, typically by specifying a vars file (such as `vars_example.yml`) containing the required configurations.
 
 ### 4.3 Example Usage
 
-An effective way to use the playbook involves defining all necessary configurations within a `vars.yml` file. This file should include all relevant global variables tailored to your specific deployment requirements. Additionally, you should prepare an inventory file (`inventory.yml`) that lists all the hosts along with any specific inventory variables they might need. Then, you can run the playbook as follows:
+An effective way to use the playbook involves defining all necessary configurations within a vars file (for example, `vars_example.yml`). This file should include all relevant global variables tailored to your specific deployment requirements. Additionally, you should prepare an inventory file (`inventory.yml`) that lists all the hosts along with any specific inventory variables they might need. Then, you can run the playbook as follows:
 
 ```bash
-ansible-playbook -i inventory.yml -e @vars.yml main.yml
+ansible-playbook -i inventory.yml -e @vars_example.yml main.yml
 ```
 
-This command prompts Ansible to execute the `main.yml` playbook, applying configurations defined in both `vars.yml` and the inventory file.
+This command prompts Ansible to execute the `main.yml` playbook, applying configurations defined in both the vars file and the inventory file.
 
-Use `inventory_example.yml`, `vars_example.yml`, and the bare-metal examples as starting points for new inventories.
+Use `inventory_example.yml`, `inventory_libvirt_example.yml`, `vars_example.yml`, and the bare-metal examples as starting points for new inventories.
 
 ## Notes
 
-- `vm_size`/`vm_memory` are required for virtual installs only, physical installs use the full disk.
+- `vm_size`/`vm_memory`/`vm_cpus` are required for virtual installs only, physical installs use the full disk.
 - `vm_dns` and `vm_dns_search` accept comma-separated strings or YAML lists.
 - `hypervisor` determines which backend-specific roles run.
 - Guest tools are installed based on `hypervisor`: `qemu-guest-agent` for `libvirt`/`proxmox`, `open-vm-tools` for `vmware`, otherwise none.
-- With LUKS enabled on Debian/Ubuntu and RHEL-based systems, provisioning uses an ESP (50 MiB), a separate `/boot`
+- Molecule is scaffolded with a delegated driver and a no-op converge for lint-only validation.
+- With LUKS enabled on Debian/Ubuntu and RHEL-based systems, provisioning uses an ESP (512 MiB), a separate `/boot`
   (1 GiB, same as `filesystem` unless `btrfs` uses ext4 on Debian/Ubuntu or xfs on RHEL-based), and the encrypted root;
   adjust sizes via
   `partitioning_efi_size_mib` and `partitioning_boot_size_mib` if needed.

inventory_example.yml

@@ -1,40 +1,50 @@
 ---
 all:
   vars:
-    hypervisor: "proxmox"
     install_type: "virtual"
+    hypervisor: "proxmox"
     install_drive: "/dev/sda"
     boot_iso: "local:iso/archlinux-x86_64.iso"
     vm_nif: "vmbr0"
-    vm_gw: "10.0.0.1"
-    vm_dns:
-      - 1.1.1.1
-      - 1.0.0.1
-    vm_dns_search:
-      - example.com
   children:
     proxmox:
       hosts:
-        proxy01.example.com:
+        app01.example.com:
           ansible_host: 10.0.0.10
-          hostname: "proxy01.example.com"
-          vm_id: 100
+          hostname: "app01.example.com"
           os: "archlinux"
           filesystem: "btrfs"
-          vm_memory: 4096
-          vm_ballo: 2048
+          vm_id: 100
           vm_cpus: 2
+          vm_memory: 4096
           vm_size: 40
           vm_ip: 10.0.0.10
-        database01.example.com:
+          vm_nms: 24
+          vm_gw: 10.0.0.1
+          vm_dns:
+            - 1.1.1.1
+            - 1.0.0.1
+          extra_packages:
+            - jq
+            - tmux
+        db01.example.com:
           ansible_host: 10.0.0.11
-          hostname: "database01.example.com"
-          vm_id: 101
+          hostname: "db01.example.com"
           os: "rhel9"
           filesystem: "xfs"
-          vm_memory: 4096
-          vm_ballo: 2048
+          vm_id: 101
           vm_cpus: 4
-          vm_size: 60
+          vm_memory: 8192
+          vm_size: 80
           vm_ip: 10.0.0.11
+          vm_nms: 24
+          vm_gw: 10.0.0.1
+          vm_dns: "1.1.1.1,1.0.0.1"
           rhel_iso: "local:iso/rhel-9.4-x86_64-dvd.iso"
+          luks_enabled: true
+          luks_passphrase: "CHANGE_ME"
+          luks_auto_decrypt_method: "keyfile"
+          luks_keyfile_size: 128
+          cis: true
+          selinux: false
+          firewalld_enabled: false

inventory_libvirt_example.yml

@@ -0,0 +1,56 @@
+---
+all:
+  vars:
+    install_type: "virtual"
+    hypervisor: "libvirt"
+    install_drive: "/dev/vda"
+    boot_iso: "/var/lib/libvirt/images/archlinux-x86_64.iso"
+  children:
+    libvirt:
+      hosts:
+        web01.example.com:
+          ansible_host: 192.168.122.10
+          hostname: "web01.example.com"
+          os: "debian12"
+          filesystem: "ext4"
+          vm_cpus: 2
+          vm_memory: 2048
+          vm_size: 30
+          vm_ip: 192.168.122.10
+          vm_nms: 24
+          vm_gw: 192.168.122.1
+          vm_dns: 1.1.1.1
+          extra_packages:
+            - nginx
+            - fail2ban
+        vault01.example.com:
+          ansible_host: 192.168.122.11
+          hostname: "vault01.example.com"
+          os: "ubuntu-lts"
+          filesystem: "btrfs"
+          vm_cpus: 2
+          vm_memory: 4096
+          vm_size: 40
+          vm_ip: 192.168.122.11
+          vm_nms: 24
+          vm_gw: 192.168.122.1
+          vm_dns_search: "example.com"
+          luks_enabled: true
+          luks_passphrase: "CHANGE_ME"
+          luks_auto_decrypt_method: "keyfile"
+          firewalld_enabled: false
+        rhel9.example.com:
+          ansible_host: 192.168.122.12
+          hostname: "rhel9.example.com"
+          os: "rhel9"
+          filesystem: "xfs"
+          vm_cpus: 4
+          vm_memory: 8192
+          vm_size: 80
+          vm_ip: 192.168.122.12
+          vm_nms: 24
+          vm_gw: 192.168.122.1
+          vm_dns: "1.1.1.1,1.0.0.1"
+          vm_path: "/srv/libvirt/images"
+          rhel_iso: "/var/lib/libvirt/images/rhel-9.4-x86_64-dvd.iso"
+          vlan_name: "100"

main.yml

@@ -24,70 +24,10 @@
       prompt: |
         What is your root password?
       confirm: true
-  vars_files: vars.yml
   pre_tasks:
-    - name: Validate variables
-      ansible.builtin.assert:
-        that:
-          - install_type in ["virtual", "physical"]
-          - hypervisor in ["libvirt", "proxmox", "vmware", "none"]
-          - filesystem in ["btrfs", "ext4", "xfs"]
-          - install_drive is defined
-          - install_type == "physical" or vm_size is defined
-          - install_type == "physical" or vm_memory is defined
-          - os in ["archlinux", "almalinux", "debian11", "debian12", "debian13", "fedora", "rhel8", "rhel9", "rhel10", "rocky", "ubuntu", "ubuntu-lts"]
-          - os not in ["rhel8", "rhel9", "rhel10"] or rhel_iso is defined
-          - >-
-            install_type == "physical"
-            or (
-              (filesystem == "btrfs" and (vm_size | default(0) | int) >= 10)
-              or (filesystem != "btrfs" and (vm_size | default(0) | int) >= 20)
-            )
-          - >-
-            install_type == "physical"
-            or (
-              (vm_size | default(0) | float)
-              >= (
-                (vm_memory | default(0) | float / 1024 >= 16.0)
-                | ternary(
-                    (vm_memory | default(0) | float / 2048),
-                    [vm_memory | default(0) | float / 1024, 4.0] | max
-                  )
-                + 16
-              )
-            )
-        fail_msg: Invalid input specified, please try again.
-
-    - name: Normalize optional flags
-      ansible.builtin.set_fact:
-        cis: "{{ cis | default(false) | bool }}"
-        custom_iso: "{{ custom_iso | default(false) | bool }}"
-        is_rhel: "{{ os | default('') | lower in ['almalinux', 'fedora', 'rhel8', 'rhel9', 'rhel10', 'rocky'] }}"
-        is_debian: "{{ os | default('') | lower in ['debian11', 'debian12', 'debian13', 'ubuntu', 'ubuntu-lts'] }}"
-      changed_when: false
-
-    - name: Set Python interpreter for RHEL-based installers
-      when:
-        - ansible_python_interpreter is not defined
-        - os | lower in ["almalinux", "rhel8", "rhel9", "rhel10", "rocky"]
-      ansible.builtin.set_fact:
-        ansible_python_interpreter: /usr/bin/python3
-      changed_when: false
-
-    - name: Set SSH access
-      when:
-        - install_type == "virtual"
-        - hypervisor != "vmware"
-      ansible.builtin.set_fact:
-        ansible_user: "{{ user_name }}"
-        ansible_password: "{{ user_password }}"
-        ansible_become_password: "{{ user_password }}"
-        ansible_ssh_extra_args: "-o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no"
-
-    - name: Set connection for VMware
-      when: hypervisor == "vmware"
-      ansible.builtin.set_fact:
-        ansible_connection: vmware_tools
+    - name: Load global defaults
+      ansible.builtin.import_role:
+        name: global_defaults
 
   roles:
     - role: virtualization
@@ -110,7 +50,7 @@
     - role: configuration
 
     - role: cis
-      when: cis | default(false) | bool
+      when: cis_enabled
 
     - role: cleanup
       when: install_type in ["virtual", "physical"]
@@ -122,7 +62,7 @@
         post_reboot_can_connect: >-
           {{
             (ansible_connection | default('ssh')) != 'ssh'
-            or ((vm_ip | default('') | string | length) > 0)
+            or (vm_ip is defined and (vm_ip | string | length) > 0)
             or (
               install_type == 'physical'
               and (ansible_host | default('') | string | length) > 0
@@ -132,7 +72,7 @@
 
     - name: Set final SSH credentials for post-reboot tasks
       when:
-        - post_reboot_can_connect | default(false) | bool
+        - post_reboot_can_connect | bool
       ansible.builtin.set_fact:
         ansible_user: "{{ user_name }}"
         ansible_password: "{{ user_password }}"
@@ -141,25 +81,23 @@
 
     - name: Install post-reboot extra packages
       when:
+        - post_reboot_can_connect | bool
         - extra_packages is defined
-        - post_reboot_can_connect | default(false) | bool
+        - extra_packages | length > 0
       block:
-        - name: Normalize extra package list
-          ansible.builtin.set_fact:
+        - name: Install extra packages
+          vars:
             post_install_extra_packages: >-
               {{
                 (
                   extra_packages
                   if (extra_packages is iterable and extra_packages is not string)
-                  else (extra_packages | default('') | string).split(',')
+                  else (extra_packages | string).split(',')
                 )
                 | map('trim')
                 | reject('equalto', '')
                 | list
               }}
-          changed_when: false
-
-        - name: Install extra packages
           when: post_install_extra_packages | length > 0
           ansible.builtin.package:
             name: "{{ post_install_extra_packages }}"

molecule/default/converge.yml

@@ -0,0 +1,8 @@
+---
+- name: Molecule converge placeholder
+  hosts: all
+  gather_facts: false
+  tasks:
+    - name: Skip destructive provisioning in Molecule
+      ansible.builtin.debug:
+        msg: "Molecule scenario is lint-only; run main.yml against disposable hosts."

molecule/default/molecule.yml

@@ -0,0 +1,19 @@
+---
+dependency:
+  name: galaxy
+driver:
+  name: delegated
+platforms:
+  - name: localhost
+provisioner:
+  name: ansible
+  playbooks:
+    converge: converge.yml
+  inventory:
+    host_vars:
+      localhost:
+        ansible_connection: local
+  lint:
+    name: ansible-lint
+verifier:
+  name: ansible

molecule/default/verify.yml

@@ -0,0 +1,9 @@
+---
+- name: Molecule verify placeholder
+  hosts: all
+  gather_facts: false
+  tasks:
+    - name: Verify placeholder
+      ansible.builtin.assert:
+        that:
+          - true

roles/bootstrap/vars/main.yml

@@ -4,6 +4,7 @@ bootstrap_almalinux:
   - dbus-daemon
   - dhcp-client
   - efibootmgr
+  - "{{ 'firewalld' if firewalld_enabled | bool else '' }}"
   - glibc-langpack-de
   - glibc-langpack-en
   - grub2
@@ -17,10 +18,10 @@ bootstrap_almalinux:
   - ppp
   - shim
   - tmux
-  - "{{ 'cryptsetup' if luks_enabled | default(false) else '' }}"
-  - "{{ 'tpm2-tools' if luks_enabled | default(false) else '' }}"
-  - "{{ 'qemu-guest-agent' if hypervisor | default('none') | lower in ['libvirt', 'proxmox'] else '' }}"
-  - "{{ 'open-vm-tools' if hypervisor | default('none') | lower == 'vmware' else '' }}"
+  - "{{ 'cryptsetup' if luks_enabled else '' }}"
+  - "{{ 'tpm2-tools' if luks_enabled else '' }}"
+  - "{{ 'qemu-guest-agent' if hypervisor | lower in ['libvirt', 'proxmox'] else '' }}"
+  - "{{ 'open-vm-tools' if hypervisor | lower == 'vmware' else '' }}"
   - vim
   - wget
   - zram-generator
@@ -33,7 +34,7 @@ bootstrap_archlinux:
   - dhcpcd
   - efibootmgr
   - fastfetch
-  - firewalld
+  - "{{ 'firewalld' if firewalld_enabled | bool else '' }}"
   - fish
   - fzf
   - grub
@@ -56,10 +57,10 @@ bootstrap_archlinux:
   - sudo
   - tldr
   - tmux
-  - "{{ 'cryptsetup' if luks_enabled | default(false) else '' }}"
-  - "{{ 'tpm2-tools' if luks_enabled | default(false) else '' }}"
-  - "{{ 'qemu-guest-agent' if hypervisor | default('none') | lower in ['libvirt', 'proxmox'] else '' }}"
-  - "{{ 'open-vm-tools' if hypervisor | default('none') | lower == 'vmware' else '' }}"
+  - "{{ 'cryptsetup' if luks_enabled else '' }}"
+  - "{{ 'tpm2-tools' if luks_enabled else '' }}"
+  - "{{ 'qemu-guest-agent' if hypervisor | lower in ['libvirt', 'proxmox'] else '' }}"
+  - "{{ 'open-vm-tools' if hypervisor | lower == 'vmware' else '' }}"
   - vim
   - wireguard-tools
   - zram-generator
@@ -74,8 +75,8 @@ bootstrap_debian11:
     - grub-efi
     - grub-efi-amd64-signed
     - grub2-common
-    - "{{ 'cryptsetup' if luks_enabled | default(false) else '' }}"
-    - "{{ 'cryptsetup-initramfs' if luks_enabled | default(false) else '' }}"
+    - "{{ 'cryptsetup' if luks_enabled else '' }}"
+    - "{{ 'cryptsetup-initramfs' if luks_enabled else '' }}"
     - linux-image-amd64
     - locales
     - logrotate
@@ -90,7 +91,7 @@ bootstrap_debian11:
     - bat
     - curl
     - entr
-    - firewalld
+    - "{{ 'firewalld' if firewalld_enabled | bool else '' }}"
     - fish
     - fzf
     - htop
@@ -109,9 +110,9 @@ bootstrap_debian11:
     - syslog-ng
     - tcpd
     - tldr
-    - "{{ 'tpm2-tools' if luks_enabled | default(false) else '' }}"
-    - "{{ 'qemu-guest-agent' if hypervisor | default('none') | lower in ['libvirt', 'proxmox'] else '' }}"
-    - "{{ 'open-vm-tools' if hypervisor | default('none') | lower == 'vmware' else '' }}"
+    - "{{ 'tpm2-tools' if luks_enabled else '' }}"
+    - "{{ 'qemu-guest-agent' if hypervisor | lower in ['libvirt', 'proxmox'] else '' }}"
+    - "{{ 'open-vm-tools' if hypervisor | lower == 'vmware' else '' }}"
     - vim
     - wget
     - zstd
@@ -124,8 +125,8 @@ bootstrap_debian12:
     - grub-efi
     - grub-efi-amd64-signed
     - grub2-common
-    - "{{ 'cryptsetup' if luks_enabled | default(false) else '' }}"
-    - "{{ 'cryptsetup-initramfs' if luks_enabled | default(false) else '' }}"
+    - "{{ 'cryptsetup' if luks_enabled else '' }}"
+    - "{{ 'cryptsetup-initramfs' if luks_enabled else '' }}"
     - linux-image-amd64
     - locales
     - logrotate
@@ -139,7 +140,7 @@ bootstrap_debian12:
     - curl
     - duf
     - entr
-    - firewalld
+    - "{{ 'firewalld' if firewalld_enabled | bool else '' }}"
     - fish
     - fzf
     - htop
@@ -164,9 +165,9 @@ bootstrap_debian12:
     - systemd-zram-generator
     - tcpd
     - tldr
-    - "{{ 'tpm2-tools' if luks_enabled | default(false) else '' }}"
-    - "{{ 'qemu-guest-agent' if hypervisor | default('none') | lower in ['libvirt', 'proxmox'] else '' }}"
-    - "{{ 'open-vm-tools' if hypervisor | default('none') | lower == 'vmware' else '' }}"
+    - "{{ 'tpm2-tools' if luks_enabled else '' }}"
+    - "{{ 'qemu-guest-agent' if hypervisor | lower in ['libvirt', 'proxmox'] else '' }}"
+    - "{{ 'open-vm-tools' if hypervisor | lower == 'vmware' else '' }}"
     - vim
     - wget
     - zstd
@@ -179,8 +180,8 @@ bootstrap_debian13:
     - grub-efi
     - grub-efi-amd64-signed
     - grub2-common
-    - "{{ 'cryptsetup' if luks_enabled | default(false) else '' }}"
-    - "{{ 'cryptsetup-initramfs' if luks_enabled | default(false) else '' }}"
+    - "{{ 'cryptsetup' if luks_enabled else '' }}"
+    - "{{ 'cryptsetup-initramfs' if luks_enabled else '' }}"
     - linux-image-amd64
     - locales
     - logrotate
@@ -195,7 +196,7 @@ bootstrap_debian13:
     - duf
     - entr
     - fastfetch
-    - firewalld
+    - "{{ 'firewalld' if firewalld_enabled | bool else '' }}"
     - fish
     - fzf
     - htop
@@ -217,9 +218,9 @@ bootstrap_debian13:
     - syslog-ng
     - systemd-zram-generator
     - tcpd
-    - "{{ 'tpm2-tools' if luks_enabled | default(false) else '' }}"
-    - "{{ 'qemu-guest-agent' if hypervisor | default('none') | lower in ['libvirt', 'proxmox'] else '' }}"
-    - "{{ 'open-vm-tools' if hypervisor | default('none') | lower == 'vmware' else '' }}"
+    - "{{ 'tpm2-tools' if luks_enabled else '' }}"
+    - "{{ 'qemu-guest-agent' if hypervisor | lower in ['libvirt', 'proxmox'] else '' }}"
+    - "{{ 'open-vm-tools' if hypervisor | lower == 'vmware' else '' }}"
     - vim
     - wget
     - zstd
@@ -233,6 +234,7 @@ bootstrap_fedora:
   - duf
   - efibootmgr
   - entr
+  - "{{ 'firewalld' if firewalld_enabled | bool else '' }}"
   - fish
   - fzf
   - glibc-langpack-de
@@ -252,10 +254,10 @@ bootstrap_fedora:
   - ripgrep
   - shim
   - tmux
-  - "{{ 'cryptsetup' if luks_enabled | default(false) else '' }}"
-  - "{{ 'tpm2-tools' if luks_enabled | default(false) else '' }}"
-  - "{{ 'qemu-guest-agent' if hypervisor | default('none') | lower in ['libvirt', 'proxmox'] else '' }}"
-  - "{{ 'open-vm-tools' if hypervisor | default('none') | lower == 'vmware' else '' }}"
+  - "{{ 'cryptsetup' if luks_enabled else '' }}"
+  - "{{ 'tpm2-tools' if luks_enabled else '' }}"
+  - "{{ 'qemu-guest-agent' if hypervisor | lower in ['libvirt', 'proxmox'] else '' }}"
+  - "{{ 'open-vm-tools' if hypervisor | lower == 'vmware' else '' }}"
   - vim-default-editor
   - wget
   - zoxide
@@ -266,6 +268,7 @@ bootstrap_rhel8:
   - bind-utils
   - dhcp-client
   - efibootmgr
+  - "{{ 'firewalld' if firewalld_enabled | bool else '' }}"
   - glibc-langpack-de
   - glibc-langpack-en
   - grub2
@@ -280,10 +283,10 @@ bootstrap_rhel8:
   - python39
   - shim
   - tmux
-  - "{{ 'cryptsetup' if luks_enabled | default(false) else '' }}"
-  - "{{ 'tpm2-tools' if luks_enabled | default(false) else '' }}"
-  - "{{ 'qemu-guest-agent' if hypervisor | default('none') | lower in ['libvirt', 'proxmox'] else '' }}"
-  - "{{ 'open-vm-tools' if hypervisor | default('none') | lower == 'vmware' else '' }}"
+  - "{{ 'cryptsetup' if luks_enabled else '' }}"
+  - "{{ 'tpm2-tools' if luks_enabled else '' }}"
+  - "{{ 'qemu-guest-agent' if hypervisor | lower in ['libvirt', 'proxmox'] else '' }}"
+  - "{{ 'open-vm-tools' if hypervisor | lower == 'vmware' else '' }}"
   - vim
   - zstd
 
@@ -291,6 +294,7 @@ bootstrap_rhel9:
   - bind-utils
   - dhcp-client
   - efibootmgr
+  - "{{ 'firewalld' if firewalld_enabled | bool else '' }}"
   - glibc-langpack-de
   - glibc-langpack-en
   - grub2
@@ -305,10 +309,10 @@ bootstrap_rhel9:
   - python
   - shim
   - tmux
-  - "{{ 'cryptsetup' if luks_enabled | default(false) else '' }}"
-  - "{{ 'tpm2-tools' if luks_enabled | default(false) else '' }}"
-  - "{{ 'qemu-guest-agent' if hypervisor | default('none') | lower in ['libvirt', 'proxmox'] else '' }}"
-  - "{{ 'open-vm-tools' if hypervisor | default('none') | lower == 'vmware' else '' }}"
+  - "{{ 'cryptsetup' if luks_enabled else '' }}"
+  - "{{ 'tpm2-tools' if luks_enabled else '' }}"
+  - "{{ 'qemu-guest-agent' if hypervisor | lower in ['libvirt', 'proxmox'] else '' }}"
+  - "{{ 'open-vm-tools' if hypervisor | lower == 'vmware' else '' }}"
   - vim
   - zram-generator
   - zstd
@@ -316,6 +320,7 @@ bootstrap_rhel9:
 bootstrap_rhel10:
   - bind-utils
   - efibootmgr
+  - "{{ 'firewalld' if firewalld_enabled | bool else '' }}"
   - glibc-langpack-de
   - glibc-langpack-en
   - grub2
@@ -330,10 +335,10 @@ bootstrap_rhel10:
   - python
   - shim
   - tmux
-  - "{{ 'cryptsetup' if luks_enabled | default(false) else '' }}"
-  - "{{ 'tpm2-tools' if luks_enabled | default(false) else '' }}"
-  - "{{ 'qemu-guest-agent' if hypervisor | default('none') | lower in ['libvirt', 'proxmox'] else '' }}"
-  - "{{ 'open-vm-tools' if hypervisor | default('none') | lower == 'vmware' else '' }}"
+  - "{{ 'cryptsetup' if luks_enabled else '' }}"
+  - "{{ 'tpm2-tools' if luks_enabled else '' }}"
+  - "{{ 'qemu-guest-agent' if hypervisor | lower in ['libvirt', 'proxmox'] else '' }}"
+  - "{{ 'open-vm-tools' if hypervisor | lower == 'vmware' else '' }}"
   - vim
   - zram-generator
   - zstd
@@ -343,6 +348,7 @@ bootstrap_rocky:
   - dbus-daemon
   - dhcp-client
   - efibootmgr
+  - "{{ 'firewalld' if firewalld_enabled | bool else '' }}"
   - glibc-langpack-de
   - glibc-langpack-en
   - grub2
@@ -357,10 +363,10 @@ bootstrap_rocky:
   - shim
   - telnet
   - tmux
-  - "{{ 'cryptsetup' if luks_enabled | default(false) else '' }}"
-  - "{{ 'tpm2-tools' if luks_enabled | default(false) else '' }}"
-  - "{{ 'qemu-guest-agent' if hypervisor | default('none') | lower in ['libvirt', 'proxmox'] else '' }}"
-  - "{{ 'open-vm-tools' if hypervisor | default('none') | lower == 'vmware' else '' }}"
+  - "{{ 'cryptsetup' if luks_enabled else '' }}"
+  - "{{ 'tpm2-tools' if luks_enabled else '' }}"
+  - "{{ 'qemu-guest-agent' if hypervisor | lower in ['libvirt', 'proxmox'] else '' }}"
+  - "{{ 'open-vm-tools' if hypervisor | lower == 'vmware' else '' }}"
   - util-linux-core
   - vim
   - wget
@@ -375,8 +381,8 @@ bootstrap_ubuntu:
     - grub-efi
     - grub-efi-amd64-signed
     - grub2-common
-    - "{{ 'cryptsetup' if luks_enabled | default(false) else '' }}"
-    - "{{ 'cryptsetup-initramfs' if luks_enabled | default(false) else '' }}"
+    - "{{ 'cryptsetup' if luks_enabled else '' }}"
+    - "{{ 'cryptsetup-initramfs' if luks_enabled else '' }}"
     - linux-image-generic
     - locales
     - lvm2
@@ -394,7 +400,7 @@ bootstrap_ubuntu:
     - eza
     - fdupes
     - fio
-    - firewalld
+    - "{{ 'firewalld' if firewalld_enabled | bool else '' }}"
     - fish
     - htop
     - jq
@@ -419,9 +425,9 @@ bootstrap_ubuntu:
     - tcpd
     - tldr
     - tmux
-    - "{{ 'tpm2-tools' if luks_enabled | default(false) else '' }}"
-    - "{{ 'qemu-guest-agent' if hypervisor | default('none') | lower in ['libvirt', 'proxmox'] else '' }}"
-    - "{{ 'open-vm-tools' if hypervisor | default('none') | lower == 'vmware' else '' }}"
+    - "{{ 'tpm2-tools' if luks_enabled else '' }}"
+    - "{{ 'qemu-guest-agent' if hypervisor | lower in ['libvirt', 'proxmox'] else '' }}"
+    - "{{ 'open-vm-tools' if hypervisor | lower == 'vmware' else '' }}"
     - traceroute
     - util-linux-extra
     - vim
@@ -438,8 +444,8 @@ bootstrap_ubuntu_lts:
     - grub-efi
     - grub-efi-amd64-signed
     - grub2-common
-    - "{{ 'cryptsetup' if luks_enabled | default(false) else '' }}"
-    - "{{ 'cryptsetup-initramfs' if luks_enabled | default(false) else '' }}"
+    - "{{ 'cryptsetup' if luks_enabled else '' }}"
+    - "{{ 'cryptsetup-initramfs' if luks_enabled else '' }}"
     - linux-image-generic
     - locales
     - lvm2
@@ -457,7 +463,7 @@ bootstrap_ubuntu_lts:
     - eza
     - fdupes
     - fio
-    - firewalld
+    - "{{ 'firewalld' if firewalld_enabled | bool else '' }}"
     - fish
     - htop
     - jq
@@ -482,9 +488,9 @@ bootstrap_ubuntu_lts:
     - tcpd
     - tldr
     - tmux
-    - "{{ 'tpm2-tools' if luks_enabled | default(false) else '' }}"
-    - "{{ 'qemu-guest-agent' if hypervisor | default('none') | lower in ['libvirt', 'proxmox'] else '' }}"
-    - "{{ 'open-vm-tools' if hypervisor | default('none') | lower == 'vmware' else '' }}"
+    - "{{ 'tpm2-tools' if luks_enabled else '' }}"
+    - "{{ 'qemu-guest-agent' if hypervisor | lower in ['libvirt', 'proxmox'] else '' }}"
+    - "{{ 'open-vm-tools' if hypervisor | lower == 'vmware' else '' }}"
     - traceroute
     - util-linux-extra
     - vim

roles/cis/defaults/main.yml

@@ -0,0 +1,21 @@
+---
+cis_permission_targets: >-
+  {{
+    [
+      { "path": "/mnt/etc/ssh/sshd_config", "mode": "0600" },
+      { "path": "/mnt/etc/cron.hourly", "mode": "0700" },
+      { "path": "/mnt/etc/cron.daily", "mode": "0700" },
+      { "path": "/mnt/etc/cron.weekly", "mode": "0700" },
+      { "path": "/mnt/etc/cron.monthly", "mode": "0700" },
+      { "path": "/mnt/etc/cron.d", "mode": "0700" },
+      { "path": "/mnt/etc/crontab", "mode": "0600" },
+      { "path": "/mnt/etc/logrotate.conf", "mode": "0644" },
+      { "path": "/mnt/usr/sbin/pppd", "mode": "0754" } if os not in ["rhel8", "rhel9", "rhel10"] else None,
+      {
+        "path": "/mnt/usr/bin/"
+        + ("fusermount3" if os in ["archlinux", "debian12", "fedora", "rhel9", "rhel10", "rocky"] else "fusermount"),
+        "mode": "755"
+      },
+      { "path": "/mnt/usr/bin/" + ("write.ul" if os == "debian11" else "write"), "mode": "755" }
+    ] | reject("none")
+  }}

roles/cis/tasks/permissions.yml

@@ -1,25 +1,4 @@
 ---
-- name: Build CIS permission targets
-  ansible.builtin.set_fact:
-    cis_permission_targets: >-
-      {{
-        [
-          { "path": "/mnt/etc/ssh/sshd_config", "mode": "0600" },
-          { "path": "/mnt/etc/cron.hourly", "mode": "0700" },
-          { "path": "/mnt/etc/cron.daily", "mode": "0700" },
-          { "path": "/mnt/etc/cron.weekly", "mode": "0700" },
-          { "path": "/mnt/etc/cron.monthly", "mode": "0700" },
-          { "path": "/mnt/etc/cron.d", "mode": "0700" },
-          { "path": "/mnt/etc/crontab", "mode": "0600" },
-          { "path": "/mnt/etc/logrotate.conf", "mode": "0644" },
-          { "path": "/mnt/usr/sbin/pppd", "mode": "0754" } if os not in ["rhel8", "rhel9", "rhel10"] else None,
-          { "path": "/mnt/usr/bin/" + ("fusermount3" if os in ["archlinux", "debian12", "fedora", "rhel9",
-            "rhel10", "rocky"] else "fusermount"), "mode": "755" },
-          { "path": "/mnt/usr/bin/" + ("write.ul" if os == "debian11" else "write"), "mode": "755" }
-        ] | reject("none")
-      }}
-  changed_when: false
-
 - name: Check CIS permission targets
   ansible.builtin.stat:
     path: "{{ item.path }}"

roles/cis/tasks/security_lines.yml

@@ -10,8 +10,8 @@
     - {path: /mnt/etc/security/pwquality.conf, content: ucredit = -1}
     - {path: /mnt/etc/security/pwquality.conf, content: ocredit = -1}
     - {path: /mnt/etc/security/pwquality.conf, content: lcredit = -1}
-    - {path: '/mnt/etc/{{ "bashrc" if is_rhel | default(false) else "bash.bashrc" }}', content: umask 077}
-    - {path: '/mnt/etc/{{ "bashrc" if is_rhel | default(false) else "bash.bashrc" }}', content: export TMOUT=3000}
+    - {path: '/mnt/etc/{{ "bashrc" if is_rhel else "bash.bashrc" }}', content: umask 077}
+    - {path: '/mnt/etc/{{ "bashrc" if is_rhel else "bash.bashrc" }}', content: export TMOUT=3000}
     - {path: '/mnt/{{ "usr/lib/systemd/journald.conf" if os == "fedora" else "etc/systemd/journald.conf" }}', content: Storage=persistent}
     - {path: /mnt/etc/sudoers, content: Defaults        logfile="/var/log/sudo.log"}
     - {path: /mnt/etc/pam.d/su, content: auth required pam_wheel.so}

roles/cleanup/defaults/main.yml

@@ -0,0 +1,5 @@
+---
+cleanup_libvirt_image_dir: >-
+  {{ vm_path if vm_path is defined and vm_path | length > 0 else '/var/lib/libvirt/images' }}
+cleanup_libvirt_cloudinit_path: >-
+  {{ [cleanup_libvirt_image_dir, hostname ~ '-cloudinit.iso'] | ansible.builtin.path_join }}

roles/cleanup/tasks/libvirt.yml

@@ -4,15 +4,6 @@
   delegate_to: localhost
   become: false
   block:
-    - name: Set libvirt image paths
-      vars:
-        cleanup_libvirt_image_dir_value: "{{ vm_path | default('/var/lib/libvirt/images') }}"
-      ansible.builtin.set_fact:
-        cleanup_libvirt_image_dir: "{{ cleanup_libvirt_image_dir_value }}"
-        cleanup_libvirt_cloudinit_path: >-
-          {{ [cleanup_libvirt_image_dir_value, hostname ~ '-cloudinit.iso'] | ansible.builtin.path_join }}
-      changed_when: false
-
     - name: Read current VM XML definition
       community.libvirt.virt:
         command: get_xml
@@ -38,7 +29,7 @@
       changed_when: false
 
     - name: Remove boot ISO device from VM XML (source match)
-      when: boot_iso is defined and (boot_iso | length > 0)
+      when: boot_iso is defined and boot_iso | length > 0
       community.general.xml:
         xmlstring: "{{ cleanup_libvirt_domain_xml }}"
         xpath: "/domain/devices/disk[contains(source/@file, '{{ boot_iso | basename }}')]"
@@ -46,7 +37,7 @@
       register: cleanup_libvirt_xml_strip_boot_source
 
     - name: Update cleaned VM XML after removing boot ISO source match
-      when: boot_iso is defined and (boot_iso | length > 0)
+      when: boot_iso is defined and boot_iso | length > 0
       ansible.builtin.set_fact:
         cleanup_libvirt_domain_xml: "{{ cleanup_libvirt_xml_strip_boot_source.xmlstring }}"
       changed_when: false

roles/cleanup/tasks/vmware.yml

@@ -24,7 +24,7 @@
             unit_number: 1
             controller_type: sata
             type: iso
-            iso_path: "{{ rhel_iso | default(omit) }}"
+            iso_path: "{{ rhel_iso if rhel_iso is defined and rhel_iso | length > 0 else omit }}"
             state: absent
       failed_when: false
 

roles/configuration/tasks/bootloader.yml

@@ -3,16 +3,8 @@
   block:
     - name: Install Bootloader
       vars:
-        configuration_use_efibootmgr: "{{ is_rhel | default(false) }}"
-        configuration_efi_dir: >-
-          {{
-            partitioning_efi_mountpoint
-            | default(
-                "/boot/efi"
-                if (is_rhel | default(false)) or (os | lower in ["ubuntu", "ubuntu-lts"])
-                else "/boot"
-              )
-          }}
+        configuration_use_efibootmgr: "{{ is_rhel | bool }}"
+        configuration_efi_dir: "{{ partitioning_efi_mountpoint }}"
         configuration_bootloader_id: >-
           {{ "ubuntu" if os | lower in ["ubuntu", "ubuntu-lts"] else os }}
         configuration_efi_vendor: >-
@@ -47,7 +39,7 @@
             else (
               '/usr/bin/env PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin '
               + '/usr/sbin/update-initramfs -u -k all'
-              if is_debian | default(false)
+              if is_debian | bool
               else '/usr/bin/dracut --regenerate-all --force'
             )
           }}
@@ -62,9 +54,9 @@
         configuration_grub_cfg_cmd: >-
           {{
             '/usr/sbin/grub2-mkconfig -o '
-            + (partitioning_efi_mountpoint | default('/boot/efi'))
+            + partitioning_efi_mountpoint
             + '/EFI/' + configuration_efi_vendor + '/grub.cfg'
-            if is_rhel | default(false)
+            if is_rhel | bool
             else '/usr/sbin/grub-mkconfig -o /boot/grub/grub.cfg'
           }}
       ansible.builtin.command: "arch-chroot /mnt {{ configuration_grub_cfg_cmd }}"

roles/configuration/tasks/encryption.yml

@@ -1,31 +1,17 @@
 ---
 - name: Configure disk encryption
-  when: partitioning_luks_enabled | default(luks_enabled | default(false)) | bool
+  when: partitioning_luks_enabled | bool
   vars:
     configuration_luks_passphrase_effective: >-
-      {{ (partitioning_luks_passphrase | default(luks_passphrase | default(''))) | string }}
+      {{ partitioning_luks_passphrase | string }}
   block:
     - name: Set LUKS configuration facts
       vars:
         configuration_luks_mapper_name_value: >-
-          {{
-            partitioning_luks_mapper_name
-            | default(luks_mapper_name | default('SYSTEM_DECRYPTED'))
-          }}
-        configuration_luks_device_value: >-
-          {{
-            partitioning_luks_device
-            | default(
-                install_drive
-                ~ (
-                  partitioning_root_partition_suffix
-                  | default(partitioning_main_partition_suffix | default(2))
-                  | string
-                )
-              )
-          }}
+          {{ partitioning_luks_mapper_name }}
+        configuration_luks_device_value: "{{ partitioning_luks_device }}"
         configuration_luks_tpm2_pcrs_raw: >-
-          {{ partitioning_luks_tpm2_pcrs | default(luks_tpm2_pcrs | default('')) }}
+          {{ partitioning_luks_tpm2_pcrs }}
         configuration_luks_tpm2_pcrs_effective_value: >-
           {{
             (
@@ -43,17 +29,17 @@
         configuration_luks_uuid: "{{ partitioning_luks_uuid | default('') }}"
         configuration_luks_device: "{{ configuration_luks_device_value }}"
         configuration_luks_options: >-
-          {{ partitioning_luks_options | default(luks_options | default('discard,tries=3')) }}
+          {{ partitioning_luks_options }}
         configuration_luks_auto_method: >-
           {{
-            (partitioning_luks_auto_decrypt | default(luks_auto_decrypt | default(true)) | bool)
+            (partitioning_luks_auto_decrypt | bool)
             | ternary(
-                partitioning_luks_auto_decrypt_method | default(luks_auto_decrypt_method | default('tpm2')),
+                partitioning_luks_auto_decrypt_method,
                 'manual'
               )
           }}
         configuration_luks_tpm2_device: >-
-          {{ partitioning_luks_tpm2_device | default(luks_tpm2_device | default('auto')) }}
+          {{ partitioning_luks_tpm2_device }}
         configuration_luks_tpm2_pcrs: "{{ configuration_luks_tpm2_pcrs_raw }}"
         configuration_luks_tpm2_pcrs_effective: "{{ configuration_luks_tpm2_pcrs_effective_value }}"
         configuration_luks_keyfile_path: >-
@@ -151,7 +137,7 @@
 
     - name: Ensure keyfile pattern for initramfs-tools
       when:
-        - is_debian | default(false)
+        - is_debian | bool
         - configuration_luks_keyfile_in_use
       ansible.builtin.lineinfile:
         path: /mnt/etc/cryptsetup-initramfs/conf-hook
@@ -215,14 +201,14 @@
           }})
 
     - name: Ensure dracut config directory exists
-      when: is_rhel | default(false)
+      when: is_rhel | bool
       ansible.builtin.file:
         path: /mnt/etc/dracut.conf.d
         state: directory
         mode: "0755"
 
     - name: Configure dracut for LUKS
-      when: is_rhel | default(false)
+      when: is_rhel | bool
       ansible.builtin.copy:
         dest: /mnt/etc/dracut.conf.d/crypt.conf
         content: |
@@ -233,13 +219,13 @@
         mode: "0644"
 
     - name: Read kernel cmdline defaults
-      when: is_rhel | default(false)
+      when: is_rhel | bool
       ansible.builtin.slurp:
         src: /mnt/etc/kernel/cmdline
       register: configuration_kernel_cmdline_slurp
 
     - name: Build kernel cmdline with LUKS args
-      when: is_rhel | default(false)
+      when: is_rhel | bool
       vars:
         configuration_kernel_cmdline_current_value: >-
           {{ configuration_kernel_cmdline_slurp.content | b64decode | trim }}
@@ -265,14 +251,14 @@
       changed_when: false
 
     - name: Write kernel cmdline with LUKS args
-      when: is_rhel | default(false)
+      when: is_rhel | bool
       ansible.builtin.copy:
         dest: /mnt/etc/kernel/cmdline
         mode: "0644"
         content: "{{ configuration_kernel_cmdline_new }}\n"
 
     - name: Find BLS entries
-      when: is_rhel | default(false)
+      when: is_rhel | bool
       ansible.builtin.find:
         paths: /mnt/boot/loader/entries
         patterns: "*.conf"
@@ -281,7 +267,7 @@
 
     - name: Update BLS options with LUKS args
       when:
-        - is_rhel | default(false)
+        - is_rhel | bool
         - configuration_kernel_bls_entries.files | length > 0
       ansible.builtin.lineinfile:
         path: "{{ item.path }}"
@@ -292,13 +278,13 @@
         label: "{{ item.path }}"
 
     - name: Read grub defaults
-      when: not is_rhel | default(false)
+      when: not is_rhel | bool
       ansible.builtin.slurp:
         src: /mnt/etc/default/grub
       register: configuration_grub_slurp
 
     - name: Build grub command lines with LUKS args
-      when: not is_rhel | default(false)
+      when: not is_rhel | bool
       vars:
         configuration_grub_content_value: "{{ configuration_grub_slurp.content | b64decode }}"
         configuration_grub_cmdline_linux_value: >-
@@ -362,7 +348,7 @@
         configuration_grub_cmdline_default_new: "{{ configuration_grub_cmdline_default_new_value }}"
 
     - name: Update GRUB_CMDLINE_LINUX_DEFAULT for LUKS
-      when: not is_rhel | default(false)
+      when: not is_rhel | bool
       ansible.builtin.lineinfile:
         path: /mnt/etc/default/grub
         regexp: '^GRUB_CMDLINE_LINUX_DEFAULT='

roles/configuration/tasks/encryption/keyfile.yml

@@ -16,7 +16,7 @@
           {{
             lookup(
               'community.general.random_string',
-              length=(partitioning_luks_keyfile_size | default(luks_keyfile_size | default(64)) | int),
+              length=(partitioning_luks_keyfile_size | int),
               override_all='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789'
             )
           }}
@@ -61,7 +61,7 @@
     - name: Regenerate keyfile and retry adding to LUKS header
       when:
         - configuration_luks_keyfile_unlock_test.rc != 0
-        - configuration_luks_keyfile_copy.changed | default(false) | bool
+        - configuration_luks_keyfile_copy is defined and configuration_luks_keyfile_copy.changed | bool
         - configuration_luks_addkey_result is failed
       block:
         - name: Regenerate LUKS keyfile
@@ -71,7 +71,7 @@
               {{
                 lookup(
                   'community.general.random_string',
-                  length=(partitioning_luks_keyfile_size | default(luks_keyfile_size | default(64)) | int),
+                  length=(partitioning_luks_keyfile_size | int),
                   override_all='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789'
                 )
               }}

roles/configuration/tasks/extras.yml

@@ -1,7 +1,7 @@
 ---
 - name: Append vim configurations to vimrc
   ansible.builtin.blockinfile:
-    path: "{{ '/mnt/etc/vim/vimrc' if is_debian | default(false) else '/mnt/etc/vimrc' }}"
+    path: "{{ '/mnt/etc/vim/vimrc' if is_debian | bool else '/mnt/etc/vimrc' }}"
     block: |
       set encoding=utf-8
       set number

roles/configuration/tasks/grub.yml

@@ -1,6 +1,6 @@
 ---
 - name: Configure grub defaults
-  when: not is_rhel | default(false)
+  when: not is_rhel | bool
   ansible.builtin.lineinfile:
     dest: /mnt/etc/default/grub
     regexp: "{{ item.regexp }}"
@@ -12,7 +12,7 @@
       line: GRUB_TIMEOUT=1
 
 - name: Ensure grub defaults file exists for RHEL-based systems
-  when: is_rhel | default(false)
+  when: is_rhel | bool
   block:
     - name: Build RHEL kernel command line defaults
       vars:
@@ -106,7 +106,7 @@
         label: "{{ item.path }}"
 
 - name: Enable GRUB cryptodisk for encrypted /boot
-  when: partitioning_grub_enable_cryptodisk | default(false) | bool
+  when: partitioning_grub_enable_cryptodisk | bool
   ansible.builtin.lineinfile:
     path: /mnt/etc/default/grub
     regexp: '^GRUB_ENABLE_CRYPTODISK='

roles/configuration/tasks/locales.yml

@@ -10,7 +10,7 @@
 - name: Setup locales
   block:
     - name: Configure locale.gen
-      when: not is_rhel | default(false)
+      when: not is_rhel | bool
       ansible.builtin.lineinfile:
         dest: /mnt/etc/locale.gen
         regexp: "{{ item.regex }}"
@@ -19,7 +19,7 @@
         - {regex: en_US\.UTF-8 UTF-8, line: en_US.UTF-8 UTF-8}
 
     - name: Generate locales
-      when: not is_rhel | default(false)
+      when: not is_rhel | bool
       ansible.builtin.command: arch-chroot /mnt /usr/sbin/locale-gen
       register: configuration_locale_result
       changed_when: configuration_locale_result.rc == 0
@@ -57,7 +57,7 @@
         configuration_hostname_entries: >-
           {{ [configuration_hostname_fqdn, configuration_hostname_short] | unique | join(' ') }}
         configuration_hosts_line: >-
-          {{ vm_ip | default(inventory_hostname) }}    {{ configuration_hostname_entries }}
+          {{ (vm_ip if vm_ip is defined and vm_ip | length > 0 else inventory_hostname) }}    {{ configuration_hostname_entries }}
       ansible.builtin.lineinfile:
         path: /mnt/etc/hosts
         line: "{{ configuration_hosts_line }}"

roles/configuration/tasks/selinux.yml

@@ -1,9 +1,9 @@
 ---
 - name: Fix SELinux
-  when: is_rhel | default(false)
+  when: is_rhel | bool
   block:
     - name: Fix SELinux by pre-labeling the filesystem before first boot
-      when: os | lower in ['almalinux', 'rhel8', 'rhel9', 'rhel10', 'rocky'] and (selinux | default(true) | bool)
+      when: os | lower in ['almalinux', 'rhel8', 'rhel9', 'rhel10', 'rocky'] and selinux | bool
       ansible.builtin.command: >
         arch-chroot /mnt /sbin/setfiles -v -F
         -e /dev -e /proc -e /sys -e /run
@@ -12,7 +12,7 @@
       changed_when: configuration_setfiles_result.rc == 0
 
     - name: Disable SELinux
-      when: os | lower == "fedora" or not (selinux | default(true) | bool)
+      when: os | lower == "fedora" or not selinux | bool
       ansible.builtin.lineinfile:
         path: /mnt/etc/selinux/config
         regexp: ^SELINUX=

roles/configuration/tasks/services.yml

@@ -2,6 +2,7 @@
 - name: Enable Systemd Services
   ansible.builtin.command: >
     arch-chroot /mnt systemctl enable NetworkManager
+    {{ ' firewalld' if firewalld_enabled | bool else '' }}
     {{
       ' ssh' if os | lower in ['ubuntu', 'ubuntu-lts'] else
       (' sshd' if os | lower not in ['debian11', 'debian12', 'debian13'] else '')
@@ -12,3 +13,10 @@
     }}
   register: configuration_enable_services_result
   changed_when: configuration_enable_services_result.rc == 0
+
+- name: Disable firewalld when disabled
+  when: not firewalld_enabled | bool
+  ansible.builtin.command: arch-chroot /mnt systemctl disable --now firewalld
+  register: configuration_disable_firewalld_result
+  changed_when: configuration_disable_firewalld_result.rc == 0
+  failed_when: false

roles/configuration/tasks/sudo.yml

@@ -1,7 +1,7 @@
 ---
 - name: Give sudo access to wheel group
   ansible.builtin.copy:
-    content: "{{ '%sudo ALL=(ALL) ALL' if is_debian | default(false) else '%wheel ALL=(ALL) ALL' }}"
+    content: "{{ '%sudo ALL=(ALL) ALL' if is_debian | bool else '%wheel ALL=(ALL) ALL' }}"
     dest: /mnt/etc/sudoers.d/01-wheel
     mode: "0440"
     validate: /usr/sbin/visudo --check --file=%s

roles/configuration/tasks/users.yml

@@ -2,7 +2,7 @@
 - name: Create user account
   vars:
     configuration_user_group: >-
-      {{ "sudo" if is_debian | default(false) else "wheel" }}
+      {{ "sudo" if is_debian | bool else "wheel" }}
     configuration_useradd_cmd: >-
       arch-chroot /mnt /usr/sbin/useradd --create-home --user-group
       --groups {{ configuration_user_group }} {{ user_name }}
@@ -18,7 +18,7 @@
   changed_when: configuration_user_result.rc == 0
 
 - name: Ensure .ssh directory exists
-  when: user_public_key is defined
+  when: user_public_key | length > 0
   ansible.builtin.file:
     path: /mnt/home/{{ user_name }}/.ssh
     state: directory
@@ -27,7 +27,7 @@
     mode: "0700"
 
 - name: Add SSH public key to authorized_keys
-  when: user_public_key is defined
+  when: user_public_key | length > 0
   ansible.builtin.lineinfile:
     path: /mnt/home/{{ user_name }}/.ssh/authorized_keys
     line: "{{ user_public_key }}"

roles/configuration/templates/network.j2

@@ -7,14 +7,14 @@ type=ethernet
 mac-address={{ configuration_net_mac }}
 
 [ipv4]
-{% set dns_value = vm_dns | default('') %}
+{% set dns_value = vm_dns if vm_dns is defined else '' %}
 {% set dns_list_raw = dns_value if dns_value is iterable and dns_value is not string else dns_value.split(',') %}
 {% set dns_list = dns_list_raw | map('trim') | reject('equalto', '') | list %}
-{% set search_value = vm_dns_search | default('') %}
+{% set search_value = vm_dns_search if vm_dns_search is defined else '' %}
 {% set search_list_raw = search_value if search_value is iterable and search_value is not string else search_value.split(',') %}
 {% set search_list = search_list_raw | map('trim') | reject('equalto', '') | list %}
 {% if vm_ip is defined and vm_ip | length %}
-address1={{ vm_ip }}/{{ vm_nms | default(24) }}{{ (',' ~ vm_gw) if (vm_gw is defined and vm_gw | length) else '' }}
+address1={{ vm_ip }}/{{ vm_nms }}{{ (',' ~ vm_gw) if (vm_gw is defined and vm_gw | length) else '' }}
 method=manual
 {% else %}
 method=auto

roles/environment/tasks/main.yml

@@ -17,7 +17,7 @@
 
     - name: Abort if the host is not booted from the Arch install media
       when:
-        - not (custom_iso | default(false) | bool)
+        - not (custom_iso | bool)
         - not environment_archiso_stat.stat.exists
       ansible.builtin.fail:
         msg: This host is not booted from the Arch install media!
@@ -40,10 +40,9 @@
     - name: Set IP-Address
       when:
         - hypervisor == "vmware"
-        - vm_ip is defined
-        - vm_ip | length
+        - vm_ip is defined and vm_ip | length > 0
       ansible.builtin.command: >-
-        ip addr replace {{ vm_ip }}/{{ vm_nms | default(24) }}
+        ip addr replace {{ vm_ip }}/{{ vm_nms }}
         dev {{ environment_interface_name }}
       register: environment_ip_result
       changed_when: environment_ip_result.rc == 0
@@ -51,10 +50,8 @@
     - name: Set Default Gateway
       when:
         - hypervisor == "vmware"
-        - vm_gw is defined
-        - vm_gw | length
-        - vm_ip is defined
-        - vm_ip | length
+        - vm_gw is defined and vm_gw | length > 0
+        - vm_ip is defined and vm_ip | length > 0
       ansible.builtin.command: "ip route replace default via {{ vm_gw }}"
       register: environment_gateway_result
       changed_when: environment_gateway_result.rc == 0
@@ -65,7 +62,7 @@
       changed_when: false
 
     - name: Configure SSH for root login
-      when: hypervisor == "vmware" and (vmware_ssh is defined and vmware_ssh | bool)
+      when: hypervisor == "vmware" and vmware_ssh | bool
       block:
         - name: Allow login
           ansible.builtin.replace:
@@ -91,14 +88,14 @@
     - name: Prepare installer environment
       block:
         - name: Speed-up Bootstrap process
-          when: not (custom_iso | default(false) | bool)
+          when: not (custom_iso | bool)
           ansible.builtin.lineinfile:
             path: /etc/pacman.conf
             regexp: ^#ParallelDownloads =
             line: ParallelDownloads = 20
 
         - name: Wait for pacman lock to be released
-          when: not (custom_iso | default(false) | bool)
+          when: not (custom_iso | bool)
           ansible.builtin.wait_for:
             path: /var/lib/pacman/db.lck
             state: absent
@@ -107,7 +104,7 @@
 
         - name: Setup Pacman
           when:
-            - not (custom_iso | default(false) | bool)
+            - not (custom_iso | bool)
             - "'os' not in item or os in item.os"
           community.general.pacman:
             update_cache: true
@@ -141,7 +138,7 @@
                 state: mounted
 
         - name: Configure RHEL Repos for installation
-          when: is_rhel | default(false)
+          when: is_rhel | bool
           block:
             - name: Create directories for repository files and RPM GPG keys
               ansible.builtin.file:

roles/global_defaults/defaults/main.yml

@@ -0,0 +1,26 @@
+---
+hypervisor: "none"
+custom_iso: false
+cis: false
+selinux: true
+vmware_ssh: false
+firewalld_enabled: true
+
+cis_enabled: "{{ cis | bool }}"
+
+luks_enabled: false
+luks_mapper_name: "SYSTEM_DECRYPTED"
+luks_auto_decrypt: true
+luks_auto_decrypt_method: "tpm2"
+luks_tpm2_device: "auto"
+luks_tpm2_pcrs: ""
+luks_keyfile_size: 64
+luks_options: "discard,tries=3"
+luks_type: "luks2"
+luks_cipher: "aes-xts-plain64"
+luks_hash: "sha512"
+luks_iter_time: 4000
+luks_key_size: 512
+luks_pbkdf: "argon2id"
+luks_use_urandom: true
+luks_verify_passphrase: true

roles/global_defaults/tasks/main.yml

@@ -0,0 +1,113 @@
+---
+- name: Global defaults loaded
+  ansible.builtin.debug:
+    msg: Global defaults loaded.
+  changed_when: false
+
+- name: Validate variables
+  ansible.builtin.assert:
+    that:
+      - install_type is defined and install_type in ["virtual", "physical"]
+      - hypervisor in ["libvirt", "proxmox", "vmware", "none"]
+      - >-
+        install_type is defined and (
+          install_type == "physical"
+          or hypervisor in ["libvirt", "proxmox", "vmware"]
+        )
+      - filesystem is defined and filesystem in ["btrfs", "ext4", "xfs"]
+      - install_drive is defined and install_drive | length > 0
+      - hostname is defined and hostname | length > 0
+      - >-
+        os is defined and os in [
+          "archlinux", "almalinux", "debian11", "debian12", "debian13", "fedora",
+          "rhel8", "rhel9", "rhel10", "rocky", "ubuntu", "ubuntu-lts"
+        ]
+      - >-
+        os is defined and (
+          os not in ["rhel8", "rhel9", "rhel10"]
+          or (rhel_iso is defined and rhel_iso | length > 0)
+        )
+      - >-
+        install_type is defined and (
+          install_type == "physical"
+          or (boot_iso is defined and boot_iso | length > 0)
+        )
+      - >-
+        install_type is defined and (
+          install_type == "physical"
+          or (vm_cpus is defined and (vm_cpus | int) > 0)
+        )
+      - >-
+        install_type is defined and (
+          install_type == "physical"
+          or (vm_size is defined and (vm_size | float) > 0)
+        )
+      - >-
+        install_type is defined and (
+          install_type == "physical"
+          or (vm_memory is defined and (vm_memory | float) > 0)
+        )
+      - >-
+        install_type is defined and filesystem is defined and (
+          install_type == "physical"
+          or (
+            vm_size is defined
+            and (
+              (filesystem == "btrfs" and (vm_size | int) >= 10)
+              or (filesystem != "btrfs" and (vm_size | int) >= 20)
+            )
+          )
+        )
+      - >-
+        install_type is defined and (
+          install_type == "physical"
+          or (
+            vm_size is defined
+            and vm_memory is defined
+            and (
+              (vm_size | float)
+              >= (
+                (vm_memory | float / 1024 >= 16.0)
+                | ternary(
+                    (vm_memory | float / 2048),
+                    [vm_memory | float / 1024, 4.0] | max
+                  )
+                + 16
+              )
+            )
+          )
+        )
+      - >-
+        vm_ip is not defined
+        or vm_ip | length == 0
+        or (vm_nms is defined and (vm_nms | int) > 0)
+    fail_msg: Invalid input specified, please try again.
+
+- name: Set OS family flags
+  ansible.builtin.set_fact:
+    is_rhel: "{{ os | lower in ['almalinux', 'fedora', 'rhel8', 'rhel9', 'rhel10', 'rocky'] }}"
+    is_debian: "{{ os | lower in ['debian11', 'debian12', 'debian13', 'ubuntu', 'ubuntu-lts'] }}"
+  changed_when: false
+
+- name: Set Python interpreter for RHEL-based installers
+  when:
+    - ansible_python_interpreter is not defined
+    - os | lower in ["almalinux", "rhel8", "rhel9", "rhel10", "rocky"]
+  ansible.builtin.set_fact:
+    ansible_python_interpreter: /usr/bin/python3
+  changed_when: false
+
+- name: Set SSH access
+  when:
+    - install_type == "virtual"
+    - hypervisor != "vmware"
+  ansible.builtin.set_fact:
+    ansible_user: "{{ user_name }}"
+    ansible_password: "{{ user_password }}"
+    ansible_become_password: "{{ user_password }}"
+    ansible_ssh_extra_args: "-o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no"
+
+- name: Set connection for VMware
+  when: hypervisor == "vmware"
+  ansible.builtin.set_fact:
+    ansible_connection: vmware_tools

roles/partitioning/defaults/main.yml

@@ -1,34 +1,37 @@
 ---
-partitioning_luks_enabled: "{{ luks_enabled | default(false) | bool }}"
-partitioning_luks_mapper_name: "{{ luks_mapper_name | default('SYSTEM_DECRYPTED') }}"
-partitioning_luks_type: "{{ luks_type | default('luks2') }}"
-partitioning_luks_cipher: "{{ luks_cipher | default('aes-xts-plain64') }}"
-partitioning_luks_hash: "{{ luks_hash | default('sha512') }}"
-partitioning_luks_iter_time: "{{ luks_iter_time | default(4000) }}"
-partitioning_luks_key_size: "{{ luks_key_size | default(512) }}"
-partitioning_luks_pbkdf: "{{ luks_pbkdf | default('argon2id') }}"
-partitioning_luks_use_urandom: "{{ luks_use_urandom | default(true) | bool }}"
-partitioning_luks_verify_passphrase: "{{ luks_verify_passphrase | default(true) | bool }}"
-partitioning_luks_auto_decrypt: "{{ luks_auto_decrypt | default(true) | bool }}"
-partitioning_luks_auto_decrypt_method: "{{ luks_auto_decrypt_method | default('tpm2') }}"
-partitioning_luks_tpm2_device: "{{ luks_tpm2_device | default('auto') }}"
-partitioning_luks_tpm2_pcrs: "{{ luks_tpm2_pcrs | default('') }}"
-partitioning_luks_keyfile_size: "{{ luks_keyfile_size | default(64) }}"
-partitioning_luks_options: "{{ luks_options | default('discard,tries=3') }}"
+partitioning_luks_enabled: "{{ luks_enabled | bool }}"
+partitioning_luks_passphrase: "{{ luks_passphrase }}"
+partitioning_luks_mapper_name: "{{ luks_mapper_name }}"
+partitioning_luks_type: "{{ luks_type }}"
+partitioning_luks_cipher: "{{ luks_cipher }}"
+partitioning_luks_hash: "{{ luks_hash }}"
+partitioning_luks_iter_time: "{{ luks_iter_time }}"
+partitioning_luks_key_size: "{{ luks_key_size }}"
+partitioning_luks_pbkdf: "{{ luks_pbkdf }}"
+partitioning_luks_use_urandom: "{{ luks_use_urandom | bool }}"
+partitioning_luks_verify_passphrase: "{{ luks_verify_passphrase | bool }}"
+partitioning_luks_auto_decrypt: "{{ luks_auto_decrypt | bool }}"
+partitioning_luks_auto_decrypt_method: "{{ luks_auto_decrypt_method }}"
+partitioning_luks_tpm2_device: "{{ luks_tpm2_device }}"
+partitioning_luks_tpm2_pcrs: "{{ luks_tpm2_pcrs }}"
+partitioning_luks_keyfile_size: "{{ luks_keyfile_size }}"
+partitioning_luks_options: "{{ luks_options }}"
 partitioning_boot_partition_suffix: 1
 partitioning_main_partition_suffix: 2
-partitioning_efi_size_mib: 50
+partitioning_efi_size_mib: 512
+partitioning_efi_start_mib: 1
+partitioning_efi_end_mib: "{{ (partitioning_efi_start_mib | int) + (partitioning_efi_size_mib | int) }}"
 partitioning_boot_size_mib: 1024
 partitioning_separate_boot: >-
   {{
     (partitioning_luks_enabled | bool)
-    and (os | default('') | lower not in ['archlinux'])
+    and (os | lower not in ['archlinux'])
   }}
 partitioning_boot_fs_fstype: >-
   {{
-    (filesystem | default('') | lower)
-    if (filesystem | default('') | lower) != 'btrfs'
-    else ('xfs' if (is_rhel | default(false)) else 'ext4')
+    (filesystem | lower)
+    if (filesystem | lower) != 'btrfs'
+    else ('xfs' if is_rhel else 'ext4')
   }}
 partitioning_boot_fs_partition_suffix: >-
   {{
@@ -46,11 +49,11 @@ partitioning_efi_mountpoint: >-
     if (partitioning_separate_boot | bool)
     else (
       '/boot/efi'
-      if (is_rhel | default(false)) or (os | default('') | lower in ['ubuntu', 'ubuntu-lts'])
+      if is_rhel or (os | lower in ['debian11', 'debian12', 'debian13', 'ubuntu', 'ubuntu-lts'])
       else '/boot'
     )
   }}
-partitioning_boot_end_mib: "{{ (partitioning_efi_size_mib | int) + (partitioning_boot_size_mib | int) }}"
+partitioning_boot_end_mib: "{{ (partitioning_efi_end_mib | int) + (partitioning_boot_size_mib | int) }}"
 partitioning_reserved_gb: >-
   {{
     (
@@ -63,13 +66,14 @@ partitioning_layout: >-
     [
       {
         'number': 1,
-        'part_end': (partitioning_efi_size_mib | string) + 'MiB',
+        'part_start': (partitioning_efi_start_mib | string) + 'MiB',
+        'part_end': (partitioning_efi_end_mib | string) + 'MiB',
         'name': 'efi',
         'flags': ['boot', 'esp']
       },
       {
         'number': 2,
-        'part_start': (partitioning_efi_size_mib | string) + 'MiB',
+        'part_start': (partitioning_efi_end_mib | string) + 'MiB',
         'part_end': (partitioning_boot_end_mib | string) + 'MiB',
         'name': 'boot'
       },
@@ -83,13 +87,14 @@ partitioning_layout: >-
     [
       {
         'number': 1,
-        'part_end': (partitioning_efi_size_mib | string) + 'MiB',
+        'part_start': (partitioning_efi_start_mib | string) + 'MiB',
+        'part_end': (partitioning_efi_end_mib | string) + 'MiB',
         'name': 'boot',
         'flags': ['boot', 'esp']
       },
       {
         'number': 2,
-        'part_start': (partitioning_efi_size_mib | string) + 'MiB',
+        'part_start': (partitioning_efi_end_mib | string) + 'MiB',
         'name': 'root'
       }
     ]
@@ -107,8 +112,24 @@ partitioning_root_device: >-
     if (partitioning_luks_enabled | bool)
     else install_drive ~ (partitioning_root_partition_suffix | string)
   }}
-partitioning_vm_size_effective: "{{ (partitioning_vm_size | default(vm_size | default(0))) | float }}"
-partitioning_vm_memory_effective: "{{ (partitioning_vm_memory | default(vm_memory | default(0))) | float }}"
+partitioning_vm_size_effective: >-
+  {{
+    (
+      partitioning_vm_size
+      if (partitioning_vm_size is defined and (partitioning_vm_size | float) > 0)
+      else (vm_size if vm_size is defined else 0)
+    )
+    | float
+  }}
+partitioning_vm_memory_effective: >-
+  {{
+    (
+      partitioning_vm_memory
+      if (partitioning_vm_memory is defined and (partitioning_vm_memory | float) > 0)
+      else (vm_memory if vm_memory is defined else 0)
+    )
+    | float
+  }}
 partitioning_swap_size_gb: >-
   {{
     ((partitioning_vm_memory_effective / 1024) >= 16.0)

roles/partitioning/tasks/btrfs.yml

@@ -10,7 +10,7 @@
           {{
             '-K'
             if (partitioning_luks_enabled | bool)
-            and not ('discard' in (partitioning_luks_options | default('') | lower))
+            and not ('discard' in (partitioning_luks_options | lower))
             else omit
           }}
 
@@ -28,7 +28,7 @@
       changed_when: false
 
     - name: Make root subvolumes
-      when: cis | bool or item.subvol not in ['var_log_audit']
+      when: cis_enabled or item.subvol not in ['var_log_audit']
       ansible.builtin.command: btrfs su cr /mnt/{{ '@' if item.subvol == 'root' else '@' + item.subvol }}
       args:
         creates: /mnt/{{ '@' if item.subvol == 'root' else '@' + item.subvol }}
@@ -43,7 +43,7 @@
       register: partitioning_btrfs_subvol_result
 
     - name: Set quotas for subvolumes
-      when: cis | bool
+      when: cis_enabled
       ansible.builtin.command: btrfs qgroup limit {{ item.quota }} /mnt/{{ '@' if item.subvol == 'root' else '@' + item.subvol }}
       loop:
         - {subvol: home, quota: 2G}

roles/partitioning/tasks/ext4.yml

@@ -1,6 +1,6 @@
 ---
 - name: Create and format ext4 logical volumes
-  when: cis | bool or item.lv not in ['home', 'var', 'var_log', 'var_log_audit']
+  when: cis_enabled or item.lv not in ['home', 'var', 'var_log', 'var_log_audit']
   community.general.filesystem:
     dev: /dev/sys/{{ item.lv }}
     fstype: ext4
@@ -13,7 +13,7 @@
     - {lv: var_log_audit}
 
 - name: Remove Unsupported features for older Systems
-  when: (os | lower in ['almalinux', 'debian11', 'rhel8', 'rhel9', 'rocky']) and (cis | bool or item.lv not in ['home', 'var', 'var_log', 'var_log_audit'])
+  when: (os | lower in ['almalinux', 'debian11', 'rhel8', 'rhel9', 'rocky']) and (cis_enabled or item.lv not in ['home', 'var', 'var_log', 'var_log_audit'])
   ansible.builtin.command: tune2fs -O "^orphan_file,^metadata_csum_seed" "/dev/sys/{{ item.lv }}"
   loop:
     - {lv: root}

roles/partitioning/tasks/main.yml

@@ -1,8 +1,8 @@
 ---
 - name: Detect system memory for swap sizing
   when:
-    - partitioning_vm_memory is not defined
-    - vm_memory is not defined
+    - partitioning_vm_memory is not defined or (partitioning_vm_memory | float) <= 0
+    - vm_memory is not defined or (vm_memory | float) <= 0
   block:
     - name: Read system memory
       ansible.builtin.command: awk '/MemTotal/ {print int($2/1024)}' /proc/meminfo
@@ -17,9 +17,9 @@
 - name: Set partitioning vm_size for physical installs
   when:
     - install_type == "physical"
-    - partitioning_vm_size is not defined
-    - vm_size is not defined
-    - install_drive is defined
+    - partitioning_vm_size is not defined or (partitioning_vm_size | float) <= 0
+    - vm_size is not defined or (vm_size | float) <= 0
+    - install_drive | length > 0
   block:
     - name: Detect install drive size
       ansible.builtin.command: "lsblk -b -dn -o SIZE {{ install_drive }}"
@@ -157,7 +157,7 @@
   when: partitioning_luks_enabled | bool
   vars:
     partitioning_luks_passphrase_effective: >-
-      {{ (partitioning_luks_passphrase | default(luks_passphrase | default(''))) | string }}
+      {{ partitioning_luks_passphrase | string }}
   block:
     - name: Validate LUKS passphrase
       ansible.builtin.assert:
@@ -207,7 +207,7 @@
             state: opened
             name: "{{ partitioning_luks_mapper_name }}"
             passphrase: "{{ partitioning_luks_passphrase_effective }}"
-            allow_discards: "{{ 'discard' in (partitioning_luks_options | default('') | lower) }}"
+            allow_discards: "{{ 'discard' in (partitioning_luks_options | lower) }}"
           register: partitioning_luks_open_result
           no_log: true
       rescue:
@@ -235,7 +235,7 @@
             state: opened
             name: "{{ partitioning_luks_mapper_name }}"
             passphrase: "{{ partitioning_luks_passphrase_effective }}"
-            allow_discards: "{{ 'discard' in (partitioning_luks_options | default('') | lower) }}"
+            allow_discards: "{{ 'discard' in (partitioning_luks_options | lower) }}"
           register: partitioning_luks_open_retry
           no_log: true
 
@@ -257,7 +257,59 @@
         pvs: "{{ partitioning_root_device }}"
 
     - name: Create LVM logical volumes
-      when: cis | bool or item.lv not in ['home', 'var', 'var_log', 'var_log_audit']
+      when: cis_enabled or item.lv not in ['home', 'var', 'var_log', 'var_log_audit']
+      vars:
+        partitioning_lvm_swap_target_gb: >-
+          {{
+            (
+              ((partitioning_vm_memory_effective | float / 1024) > 16.0)
+              | ternary(
+                  (partitioning_vm_memory_effective | float / 2048) | int,
+                  (partitioning_vm_memory_effective | float / 1024)
+                )
+            ) | float
+          }}
+        partitioning_lvm_available_gb: >-
+          {{
+            (
+              (partitioning_vm_size_effective | float)
+              - (partitioning_reserved_gb | float)
+              - (cis_enabled | ternary(7.5, 0))
+              - partitioning_lvm_swap_target_gb
+            ) | float
+          }}
+        partitioning_lvm_root_gb: >-
+          {{
+            [
+              (
+                ((partitioning_lvm_available_gb | float) < 4)
+                | ternary(
+                    4,
+                    (
+                      ((partitioning_lvm_available_gb | float) > 12)
+                      | ternary(
+                          ((partitioning_vm_size_effective | float) * 0.4)
+                          | round(0, 'ceil'),
+                          partitioning_lvm_available_gb
+                        )
+                    )
+                  )
+              ),
+              4
+            ] | max
+          }}
+        partitioning_lvm_swap_gb: >-
+          {{
+            ((partitioning_lvm_available_gb | float) < 4)
+            | ternary(
+                (
+                  (partitioning_lvm_available_gb | float)
+                  + (partitioning_lvm_swap_target_gb | float)
+                  - 4
+                ),
+                partitioning_lvm_swap_target_gb
+              )
+          }}
       community.general.lvol:
         vg: sys
         lv: "{{ item.lv }}"
@@ -265,27 +317,9 @@
         state: present
       loop:
         - lv: root
-          size: >-
-            {{ [(((((partitioning_vm_size_effective | float) - (partitioning_reserved_gb | float) - ((cis | bool) | ternary(7.5, 0)) - (((partitioning_vm_memory_effective | float / 1024) > 16.0)
-                 | ternary(((partitioning_vm_memory_effective | float / 2048) | int), (partitioning_vm_memory_effective | float / 1024)))) < 4)
-                 | ternary(4,((((partitioning_vm_size_effective | float) - (partitioning_reserved_gb | float) - ((cis | bool) | ternary(7.5, 0)) -
-                (((partitioning_vm_memory_effective | float / 1024) > 16.0)
-                 | ternary(
-                     ((partitioning_vm_memory_effective | float / 2048) | int),
-                     (partitioning_vm_memory_effective | float / 1024)
-                   )))
-            > 12)
-                  | ternary(((partitioning_vm_size_effective | float) * 0.4) | round(0, 'ceil'),((partitioning_vm_size_effective | float) - (partitioning_reserved_gb | float) - ((cis | bool)
-                  | ternary(7.5, 0)) - (((partitioning_vm_memory_effective | float / 1024) > 16.0)
-                  | ternary(((partitioning_vm_memory_effective | float / 2048) | int), (partitioning_vm_memory_effective | float / 1024))))))))), 4 ] | max | string +
-            'G' }}
+          size: "{{ partitioning_lvm_root_gb | string + 'G' }}"
         - lv: swap
-          size: >-
-            {{ ((((partitioning_vm_size_effective | float) - (partitioning_reserved_gb | float) - ((cis | bool) | ternary(7.5, 0))) - (((partitioning_vm_memory_effective | float / 1024) > 16.0)
-                | ternary(((partitioning_vm_memory_effective | float / 2048) | int), (partitioning_vm_memory_effective | float / 1024)))) < 4)
-                | ternary((((partitioning_vm_size_effective | float) - (partitioning_reserved_gb | float) - ((cis | bool) | ternary(7.5, 0))) - 4), (((partitioning_vm_memory_effective | float / 1024)
-            > 16.0)
-                | ternary(((partitioning_vm_memory_effective | float / 2048) | int), (partitioning_vm_memory_effective | float / 1024)))) | string + 'G' }}
+          size: "{{ partitioning_lvm_swap_gb | string + 'G' }}"
         - lv: home
           size: "{{ ([([(((partitioning_vm_size_effective | float) - 20) * 0.1), 2] | max), 20] | min) | string + 'G' }}"
         - {lv: var, size: "2G"}
@@ -346,7 +380,7 @@
       changed_when: false
 
     - name: Get UUIDs for LVM filesystems
-      when: filesystem != 'btrfs' and (cis | bool or item not in ['home', 'var', 'var_log', 'var_log_audit'])
+      when: filesystem != 'btrfs' and (cis_enabled or item not in ['home', 'var', 'var_log', 'var_log_audit'])
       ansible.builtin.command: blkid -s UUID -o value /dev/sys/{{ item }}
       loop:
         - root
@@ -363,18 +397,18 @@
       ansible.builtin.set_fact:
         partitioning_uuid_root: "{{ partitioning_uuid_result.results[0].stdout_lines }}"
         partitioning_uuid_swap: "{{ partitioning_uuid_result.results[1].stdout_lines }}"
-        partitioning_uuid_home: "{{ partitioning_uuid_result.results[2].stdout_lines if cis | bool else '' }}"
-        partitioning_uuid_var: "{{ partitioning_uuid_result.results[3].stdout_lines if cis | bool else '' }}"
-        partitioning_uuid_var_log: "{{ partitioning_uuid_result.results[4].stdout_lines if cis | bool else '' }}"
-        partitioning_uuid_var_log_audit: "{{ partitioning_uuid_result.results[5].stdout_lines if cis | bool else '' }}"
+        partitioning_uuid_home: "{{ partitioning_uuid_result.results[2].stdout_lines if cis_enabled else '' }}"
+        partitioning_uuid_var: "{{ partitioning_uuid_result.results[3].stdout_lines if cis_enabled else '' }}"
+        partitioning_uuid_var_log: "{{ partitioning_uuid_result.results[4].stdout_lines if cis_enabled else '' }}"
+        partitioning_uuid_var_log_audit: "{{ partitioning_uuid_result.results[5].stdout_lines if cis_enabled else '' }}"
 
 - name: Mount filesystems
   block:
     - name: Mount filesystems and subvolumes
       when:
         - >-
-            cis | bool or (
-              not cis and (
+            cis_enabled or (
+              not cis_enabled and (
                 (filesystem == 'btrfs' and item.path in ['/home', '/var/log', '/var/cache/pacman/pkg'])
                 or (item.path not in ['/home', '/var', '/var/log', '/var/log/audit', '/var/cache/pacman/pkg'])
               )

roles/partitioning/tasks/xfs.yml

@@ -1,6 +1,6 @@
 ---
 - name: Create and format XFS logical volumes
-  when: cis | bool or item.lv not in ['home', 'var', 'var_log', 'var_log_audit']
+  when: cis_enabled or item.lv not in ['home', 'var', 'var_log', 'var_log_audit']
   community.general.filesystem:
     dev: /dev/sys/{{ item.lv }}
     fstype: xfs

roles/virtualization/defaults/main.yml

@@ -1,11 +1,19 @@
 ---
+virtualization_libvirt_image_dir: >-
+  {{ vm_path if vm_path is defined and vm_path | length > 0 else '/var/lib/libvirt/images' }}
+virtualization_libvirt_disk_path: >-
+  {{ [virtualization_libvirt_image_dir, hostname ~ '.qcow2'] | ansible.builtin.path_join }}
+virtualization_libvirt_cloudinit_path: >-
+  {{ [virtualization_libvirt_image_dir, hostname ~ '-cloudinit.iso'] | ansible.builtin.path_join }}
+virtualization_mac_address: >-
+  {{ '52:54:00' | community.general.random_mac(seed=hostname) }}
+
 virtualization_tpm2_enabled: >-
   {{
-    (partitioning_luks_enabled | default(luks_enabled | default(false)) | bool)
-    and (partitioning_luks_auto_decrypt | default(luks_auto_decrypt | default(true)) | bool)
+    (partitioning_luks_enabled | bool)
+    and (partitioning_luks_auto_decrypt | bool)
     and (
-      (partitioning_luks_auto_decrypt_method | default(luks_auto_decrypt_method | default('tpm2')))
-      | lower
+      (partitioning_luks_auto_decrypt_method | lower)
       == 'tpm2'
     )
   }}

roles/virtualization/tasks/libvirt.yml

@@ -1,16 +1,4 @@
 ---
-- name: Set libvirt image paths
-  delegate_to: localhost
-  vars:
-    virtualization_libvirt_image_dir_value: "{{ vm_path | default('/var/lib/libvirt/images') }}"
-  ansible.builtin.set_fact:
-    virtualization_libvirt_image_dir: "{{ virtualization_libvirt_image_dir_value }}"
-    virtualization_libvirt_disk_path: >-
-      {{ [virtualization_libvirt_image_dir_value, hostname ~ '.qcow2'] | ansible.builtin.path_join }}
-    virtualization_libvirt_cloudinit_path: >-
-      {{ [virtualization_libvirt_image_dir_value, hostname ~ '-cloudinit.iso'] | ansible.builtin.path_join }}
-  changed_when: false
-
 - name: Create VM disk
   delegate_to: localhost
   ansible.builtin.command:
@@ -23,13 +11,6 @@
       - "{{ vm_size }}G"
     creates: "{{ virtualization_libvirt_disk_path }}"
 
-- name: Generate VM MAC address
-  delegate_to: localhost
-  ansible.builtin.set_fact:
-    virtualization_mac_address: >-
-      {{ '52:54:00' | community.general.random_mac(seed=hostname) }}
-  changed_when: false
-
 - name: Render cloud config templates
   delegate_to: localhost
   ansible.builtin.template:

roles/virtualization/tasks/proxmox.yml

@@ -2,7 +2,7 @@
 - name: Deploy VM on Proxmox
   delegate_to: localhost
   vars:
-    virtualization_dns_value: "{{ vm_dns | default('') }}"
+    virtualization_dns_value: "{{ vm_dns if vm_dns is defined else '' }}"
     virtualization_dns_list_raw: >-
       {{
         virtualization_dns_value
@@ -11,7 +11,7 @@
       }}
     virtualization_dns_list: >-
       {{ virtualization_dns_list_raw | map('trim') | reject('equalto', '') | list }}
-    virtualization_search_value: "{{ vm_dns_search | default('') }}"
+    virtualization_search_value: "{{ vm_dns_search if vm_dns_search is defined else '' }}"
     virtualization_search_list_raw: >-
       {{
         virtualization_search_value
@@ -33,7 +33,7 @@
     cpu: host
     cores: "{{ vm_cpus }}"
     memory: "{{ vm_memory }}"
-    balloon: "{{ vm_ballo | default(omit) }}"
+    balloon: "{{ vm_ballo if vm_ballo is defined and vm_ballo | int > 0 else omit }}"
     numa_enabled: true
     hotplug: network,disk
     update: "{{ virtualization_tpm2_enabled | bool }}"
@@ -57,14 +57,14 @@
       }}
     ide:
       ide0: "{{ boot_iso }},media=cdrom"
-      ide1: "{{ rhel_iso + ',media=cdrom' if rhel_iso is defined else omit }}"
+      ide1: "{{ rhel_iso + ',media=cdrom' if rhel_iso is defined and rhel_iso | length > 0 else omit }}"
       ide2: "{{ hypervisor_storage }}:cloudinit"
     net:
-      net0: virtio,bridge={{ vm_nif }}{% if vlan_name is defined and vlan_name %},tag={{ vlan_name }}{% endif %}
+      net0: virtio,bridge={{ vm_nif }}{% if vlan_name is defined and vlan_name | length > 0 %},tag={{ vlan_name }}{% endif %}
     ipconfig:
       ipconfig0: >-
         {{
-          'ip=' ~ vm_ip ~ '/' ~ (vm_nms | default(24))
+          'ip=' ~ vm_ip ~ '/' ~ vm_nms
           ~ (',gw=' ~ vm_gw if vm_gw is defined and vm_gw | length else '')
           if vm_ip is defined and vm_ip | length
           else 'ip=dhcp'

roles/virtualization/tasks/vmware.yml

@@ -8,11 +8,11 @@
     validate_certs: false
     datacenter: "{{ hypervisor_datacenter }}"
     cluster: "{{ hypervisor_cluster }}"
-    folder: "{{ vm_path | default(omit) }}"
+    folder: "{{ vm_path if vm_path is defined and vm_path | length > 0 else omit }}"
     name: "{{ hostname }}"
     guest_id: otherLinux64Guest
     annotation: |
-      {{ note | default('') }}
+      {{ note if note is defined else '' }}
     state: "{{ 'poweredoff' if virtualization_tpm2_enabled | bool else 'poweredon' }}"
     disk:
       - size_gb: "{{ vm_size }}"
@@ -41,12 +41,12 @@
             "state": "present",
             "type": "iso",
             "iso_path": rhel_iso
-          } ] if rhel_iso is defined and rhel_iso|length > 0 else [] )
+          } ] if rhel_iso is defined and rhel_iso | length > 0 else [] )
       }}
     networks:
       - name: "{{ vm_nif }}"
         type: dhcp
-        vlan: "{{ vlan_name | default(omit) }}"
+        vlan: "{{ vlan_name if vlan_name is defined and vlan_name | length > 0 else omit }}"
 
 - name: Ensure vTPM2 is enabled when required
   when: virtualization_tpm2_enabled | bool
@@ -57,7 +57,7 @@
     password: "{{ hypervisor_password }}"
     validate_certs: false
     datacenter: "{{ hypervisor_datacenter }}"
-    folder: "{{ vm_path | default(omit) }}"
+    folder: "{{ vm_path if vm_path is defined and vm_path | length > 0 else omit }}"
     name: "{{ hostname }}"
     state: present
 

roles/virtualization/templates/cloud-network-config.yml.j2

@@ -5,15 +5,15 @@ network:
       match:
         macaddress: "{{ virtualization_mac_address }}"
 {% set has_static = vm_ip is defined and vm_ip | length %}
-{% set dns_value = vm_dns | default('') %}
+{% set dns_value = vm_dns if vm_dns is defined else '' %}
 {% set dns_list_raw = dns_value if dns_value is iterable and dns_value is not string else dns_value.split(',') %}
 {% set dns_list = dns_list_raw | map('trim') | reject('equalto', '') | list %}
-{% set search_value = vm_dns_search | default('') %}
+{% set search_value = vm_dns_search if vm_dns_search is defined else '' %}
 {% set search_list_raw = search_value if search_value is iterable and search_value is not string else search_value.split(',') %}
 {% set search_list = search_list_raw | map('trim') | reject('equalto', '') | list %}
 {% if has_static %}
       addresses:
-        - "{{ vm_ip }}/{{ vm_nms | default(24) }}"
+        - "{{ vm_ip }}/{{ vm_nms }}"
 {% if vm_gw is defined and vm_gw | length %}
       gateway4: "{{ vm_gw }}"
 {% endif %}

roles/virtualization/templates/vm.xml.j2

@@ -1,7 +1,7 @@
 <domain type='kvm'>
   <name>{{ hostname }}</name>
   <memory>{{ vm_memory | int * 1024 }}</memory>
-  {% if vm_ballo is defined %}<currentMemory>{{ vm_ballo | int * 1024 }}</currentMemory>{% endif %}
+  {% if vm_ballo is defined and vm_ballo | int > 0 %}<currentMemory>{{ vm_ballo | int * 1024 }}</currentMemory>{% endif %}
   <vcpu placement='static'>{{ vm_cpus }}</vcpu>
   <os>
     <type arch='x86_64' machine="pc-q35-8.0">hvm</type>
@@ -37,7 +37,7 @@
       <source file="{{ virtualization_libvirt_cloudinit_path }}"/>
       <target dev="sdb" bus="sata"/>
     </disk>
-    {% if rhel_iso is defined %}
+    {% if rhel_iso is defined and rhel_iso | length > 0 %}
     <disk type="file" device="cdrom">
       <driver name="qemu" type="raw"/>
       <source file="{{ rhel_iso }}"/>
@@ -49,7 +49,7 @@
       <source network='default'/>
       <model type='virtio'/>
     </interface>
-    {% if virtualization_tpm2_enabled | default(false) %}
+    {% if virtualization_tpm2_enabled %}
     <tpm model='tpm-crb'>
       <backend type='emulator' version='2.0'/>
     </tpm>

vars_baremetal_example.yml

@@ -6,6 +6,10 @@ install_drive: "/dev/sda"
 os: "archlinux"
 filesystem: "btrfs"
 
+cis: false
+selinux: true
+firewalld_enabled: true
+
 luks_enabled: true
 luks_passphrase: "1234"
 luks_mapper_name: "SYSTEM_DECRYPTED"

vars_example.yml

@@ -5,6 +5,9 @@ vm_ip: "{{ inventory_hostname }}"
 install_type: "virtual"
 install_drive: "/dev/sda"  # Use /dev/vda for virtio/libvirt.
 custom_iso: false  # Set true to skip ArchISO-specific validation and pacman setup.
+cis: false  # Set true to enable CIS hardening.
+selinux: true  # Toggle SELinux where supported.
+firewalld_enabled: true  # Toggle firewalld package and service.
 
 hypervisor_url: "pve01.example.com"
 hypervisor_username: "root@pam"