Moved what otherwise would've been handlers to task section to reduce complexity of implementation

roles/bootstrap/handlers/clamav.yml

@@ -1,94 +0,0 @@
----
-#@TODO write handlers for configuring clamav
-#@NOTE https://wiki.archlinux.org/title/ClamAV
-- name: Create freshclam file
-  become: yes
-  become_method: sudo
-  copy:
-    src: clamav/freshclam.conf
-    dest: /etc/clamav/freshclam.conf
-    force: yes
-    backup: yes
-- name: Create clamd file
-  become: yes
-  become_method: sudo
-  copy:
-    src: clamav/clamd.conf
-    dest: /etc/clamav/clamd.conf
-    force: yes
-    backup: yes
-- name: Create clamd file
-  become: yes
-  become_method: sudo
-  copy:
-    src: clamav/clamav-milter.conf
-    dest: /etc/clamav/clamav-milter.conf
-    force: yes
-    backup: yes
-- name: Update clamav virus definitions
-  become: yes
-  become_method: sudo
-  command: freshclam
-- name: Start and enable clamav service
-  service:
-    name: clamav-daemon
-    state: started
-    enabled: yes
-- name: Start and enable clamav onaccess service
-  become: yes
-  become_method: sudo
-  service:
-    name: clamav-clamonacc
-    state: started
-    enabled: yes
-- name: Restart clamav service
-  become: yes
-  become_method: sudo
-  service:
-    name: clamav-daemon
-    state: restarted
-- name: Restart clamav onaccess service
-  become: yes
-  become_method: sudo
-  service:
-    name: clamav-clamonacc
-    state: restarted
-- name: Create freshclam log file
-  become: yes
-  become_method: sudo
-  file:
-    path: /var/log/clamav/freshclam.log
-    state: touch
-    mode: 600
-    owner: clamav
-- name: Start and enable freshclam virus definition update service
-  become: yes
-  become_method: sudo
-  service:
-    name: clamav-freshclam
-    state: started
-    enabled: yes
-- name: Restart freshclam virus definition update service
-  become: yes
-  become_method: sudo
-  service:
-    name: clamav-freshclam
-    state: restarted
-- name: Install Fangfrisch
-  become: yes
-  become_method: sudo
-  package:
-    name: fangfrisch
-    state: present
-- name: Create database structure for fangfrisch
-  become_user: clamav
-  become_method: sudo
-  command:
-    argv: [/usr/bin/fangfrisch, --conf, /etc/fangfrisch/fangfrisch.conf, initdb]
-- name: Start and enable fangfrisch virus definition updates
-  become: yes
-  become_method: sudo
-  service:
-    name: fangfrisch.timer
-    state: started
-    enabled: yes

roles/bootstrap/handlers/crowdsec.yml

@@ -1,53 +0,0 @@
----
-#@TODO write handlers for configuring crowdsec
-- name: Enroll your crowdsec installation
-  become: yes
-  become_method: sudo
-  command:
-    argv: [cscli, console, enroll -e, context, "{{ enrollment_key }}"]
-  register: crowdsec_enrolled
-- name: Install caddy crowdsec collection 
-  become: yes
-  become_method: sudo
-  command:
-    argv: [cscli, collections, install, crowdsecurity/caddy]
-- name: Install proftpd crowdsec collection
-  become: yes
-  become_method: sudo
-  command:
-    argv: [cscli, collections, install, crowdsecurity/proftpd]
-- name: Install sshd crowdsec collection
-  become: yes
-  become_method: sudo
-  command:
-    argv: [cscli, collections, install, crowdsecurity/sshd]
-- name: Install postgresql crowdsec collection
-  become: yes
-  become_method: sudo
-  command:
-    argv: [cscli, collections, install, crowdsecurity/pgsql]
-- name: Install denial-of-service HTTP crowdsec collection
-  become: yes
-  become_method: sudo
-  command:
-    argv: [cscli, collections, install, crowdsecurity/http-dos]
-- name: Install HTTP crowdsec collection
-  become: yes
-  become_method: sudo
-  command:
-    argv: [cscli, collections, install, crowdsecurity/base-http-scenarios]
-- name: Install Postfix crowdsec collection
-  become: yes
-  become_method: sudo
-  command:
-    argv: [cscli, collections, install, crowdsecurity/postfix]
-- name: Update crowdsec objects
-  become: yes
-  become_method: sudo
-  command:
-    argv: [cscli, hub, update]
-- name: Upgrade crowdsec objects
-  become: yes
-  become_method: sudo
-  command:
-    argv: [cscli, hub, upgrade]

roles/bootstrap/handlers/fail2ban.yml

@@ -1,76 +0,0 @@
----
-- name: Check if path to fail2ban configuration files exists
-  stat:
-    path: /etc/fail2ban/jail.d
-  register: fail2path
-- name: Check if path to systemd fail2ban service configuration files exists
-  stat:
-    path: /etc/systemd/system/fail2ban.service.d
-  register: fail2serve_path
-- name: Create relevant fail2ban configuration directory
-  become: yes
-  become_method: sudo
-  file:
-    path: /etc/fail2ban/jail.d
-    state: directory
-  register: fail2bandir_created
-  when: not fail2path.stat.exists
-- name: Create relevant fail2ban configuration directory
-  become: yes
-  become_method: sudo
-  file:
-    path: /etc/systemd/system/fail2ban.service.d
-    state: directory
-  register: fail2servdir_created
-  when: not fail2serve_path.stat.exists
-- name: Copy protftpd jail file
-  become: yes
-  become_method: sudo
-  copy:
-    src: ftp.local
-    dest: /etc/fail2ban/jail.d/ftp.local
-    force: yes
-    backup: yes
-  when: fail2path.stat.exists
-- name: Copy sshd jail file
-  become: yes
-  become_method: sudo
-  copy:
-    src: sshd.local
-    dest: /etc/fail2ban/jail.d/sshd.local
-    force: yes
-    backup: yes
-  when: fail2path.stat.exists
-- name: Copy fail2ban modified service configuration
-  become: yes
-  become_method: sudo
-  copy:
-    src: override.conf
-    dest: /etc/systemd/system/fail2ban.service.d/sshd.local
-    force: yes
-    backup: yes
-  when: fail2serve_path.stat.exists
-- name: Reload fail2ban service
-  become: yes
-  become_method: sudo
-  service:
-    name: fail2ban
-    state: reloaded
-  register: fail2ban_reloaded
-- name: Start and enable fail2ban service
-  become: yes
-  become_method: sudo
-  service:
-    name: fail2ban
-    state: started
-    enabled: yes
-  register: fail2ban_running
-  when: fail2ban_reloaded
-- name: Restart fail2ban service
-  become: yes
-  become_method: sudo
-  service:
-    name: fail2ban
-    state: restarted
-  register: fail2ban_restarted
-  when: fail2ban_reloaded

roles/bootstrap/handlers/git.yml

@@ -1,113 +0,0 @@
----
-- name: Set default git text editor
-  become: yes
-  become_method: sudo
-  community.general.git_config:
-    name: core.editor
-    value: vim
-    scope: system
-    add_mode: replace_all
-    state: present
-  register: gitedit_set
-- name: Create directory for some git files
-  file:
-    path: "{{ homedir }}/.config/git"
-    state: directory
-  register: gitdir_created
-- name: Create git commit message template file
-  copy:
-    src: git/gitmessage
-    dest: "{{ homedir }}/.config/git/gitmessage"
-    force: yes
-    backup: yes
-  register: gittemp_created
-- name: Set a commit template file for git
-  community.general.git_config:
-    name: commit.template
-    value: "{{ homedir }}/.config/git/gitmessage"
-    scope: global
-    add_mode: replace_all
-    state: present
-  register: gittemp_set
-- name: Set git key format to OpenPGP
-  community.general.git_config:
-    name: gpg.format
-    value: "openpgp"
-    scope: global
-    add_mode: replace_all
-    state: present
-  register: gitkeyformat_set
-  #@TODO: Add a gpg section to group_var or host_var vaults
-- name: Set a user signing key for git
-  community.general.git_config:
-    name: user.signingkey
-    value: "{{ gpg_sign_id }}"
-    scope: global
-    add_mode: replace_all
-    state: present
-  register: gitsignkey_registered
-- name: Set key signage to occur for commits by default in git
-  community.general.git_config:
-    name: commit.gpgSign
-    value: "true"
-    scope: global
-    add_mode: replace_all
-    state: present
-- name: Set key signage to occur for tagging by default in git
-  community.general.git_config:
-    name: tag.gpgSign
-    value: "true"
-    scope: global
-    add_mode: replace_all
-    state: present
-- name: Create a boilerplate gitignore file for git
-  copy:
-    src: git/gitignore.sample
-    dest: "{{ homedir }}/.config/git/gitignore"
-    force: yes
-    backup: yes
-  register: gitgignore_created
-- name: Set boilerplate gitignore file in global scope
-  community.general.git_config:
-    name: core.excludesfile
-    value: "{{ homedir }}/.config/git/gitignore"
-    scope: global
-    add_mode: replace_all
-    state: present
-  register: gitgignore_set
-- name: Set autocorrect for git
-  become: yes
-  become_method: sudo
-  community.general.git_config:
-    name: help.autocorrect
-    value: 0
-    scope: system
-    add_mode: replace_all
-    state: present
-  register: gitautocorr_set
-- name: Set git to replace CRLF endings when pulling
-  become: yes
-  become_method: sudo
-  community.general.git_config:
-    name: core.autocrlf
-    value: input
-    scope: system
-    add_mode: replace_all
-    state: present
-  register: gitcrlf_set
-- name: Set git username
-  community.general.git_config:
-    name: user.name
-    value: "{{ official_name | default(accts.username, true) }}"
-    scope: global
-    add_mode: replace_all
-    state: present
-  register: gituser_set
-- name: Set git user email
-  community.general.git_config:
-    name: user.email
-    value: "{{ official_email | default(accts.email, true) }}"
-    scope: global
-    add_mode: replace_all
-    state: present
-  register: gitemail_set

roles/bootstrap/handlers/gpg.yml

@@ -1,86 +0,0 @@
----
-- name: Copy and import GPG keypairs to remote host
-  block:
-    - name: Create cipher directory for gocryptfs
-      file:
-        path: "{{ homedir }}/.ciphers"
-        state: directory
-    - name: Create a gocryptfs vault
-      command:
-        argv: [/usr/bin/gocryptfs, -init, "{{ homedir }}/.ciphers"]
-        stdin: "{{ gcfs_password }}"
-      register: gcfs_masterkey_created
-    - name: Create temporary file for password
-      tempfile:
-        prefix: gcfs_passfile
-        state: file
-      register: tempfile_created
-    - name: Put password in temporary file
-      lineinfile:
-        path: "{{ tempfile_created.path }}"
-        line: "{{ gcfs_password }}"
-        state: present
-    - name: Create directory for storing gocryptfs decryption configuration files
-      file:
-        path: "{{ homedir }}/.fskeys/ciphers"
-        state: directory
-    - name: Get gocryptfs decryption configuration file metadata
-      stat:
-        path: "{{ homedir }}/.ciphers"
-      when: gcfs_masterkey_created.rc == 0
-      register: gcfs_vault
-    - name: Copy gocryptfs decryption configuration to this directory
-      copy:
-        remote_src: "{{ homedir }}/.ciphers/gocryptfs.conf"
-        dest: "{{ homedir }}/.fskeys/ciphers/gocryptfs.conf"
-        force: yes
-        backup: yes
-      when: gcfs_vault.stat.exists and gcfs_masterkey_created.rc == 0
-    - name: Create directory in which to mount decrypted gocryptfs vault
-      file:
-        path: "{{ homedir }}/.mnt/plains"
-        state: directory
-    - name: Mount the gocryptfs vault
-      ansible.posix.mount:
-        src: "{{ homedir }}/.ciphers"
-        path: "{{ homedir }}/.mnt/plains"
-        state: mounted
-        fstype: fuse./usr/bin/gocryptfs
-        opts: "nofail,passfile={{ tempfile_created.path }},config={{ homedir }}/.fskeys/ciphers/gocryptfs.conf"
-      register: gcfs_mounted
-      when: gcfs_vault.stat.exists and gcfs_masterkey_created.rc == 0
-    - name: Create directory in decrypted gocryptfs vault
-      file:
-        path: "{{ homedir }}/.mnt/plains/gpg"
-        state: directory
-      when: gcfs_mounted
-    - name: Copy GPG keypair
-      copy:
-        src: "gpg/{{ accts.username }}/main.priv.asc"
-        dest: "{{ homedir }}/.mnt/secrets/gpg/main.priv.asc"
-        force: yes
-        backup: yes
-      register: gpgkeys_copied
-      when: gcfs_mounted
-    #@TODO: Create handler that copies gcfs_masterkey_created text into decrypted vault in-between here
-    - name: Import GPG keypair
-      become: yes
-      become_method: sudo
-      command:
-        argv: [gpg, --import, "{{ homedir }}/.mnt/secrets/gpg/main.priv.asc"]
-      register: gpgkeys_imported
-      when: gpgkeys_copied and gcfs_mounted
-    # - name: Unmount the gocryptfs vault
-    #   ansible.posix.mount:
-    #     path: "{{ homedir }}/.mnt/plains"
-    #     state: unmounted
-    #     fstype: fuse
-    #     opts: "u"
-    #   register: gcfs_unmounted
-    #   when: gpg_keys_copied and gcfs_mounted
-    - name: Unmount the gocryptfs vault
-      command:
-        argv: [fusermount, -u, "{{ homedir }}/.mnt/plains"]
-      when: gpgkeys_copied and gcfs_mounted
-  register: gpg_keypair_copy
-  tags: ['copy_gpg']