alias

roles/autofs_client/tasks/main.yml

@@ -1,5 +1,7 @@
-- block:
+- name: Setup autofs
-  - name: include vault
+  become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
+  block:
+    - name: Include vault
       ansible.builtin.include_vars:
         file: jaydee.yml
     - name: Install autofs
@@ -10,30 +12,44 @@
         state: present
 
     - name: Creating a file with content
-    copy:
+      ansible.builtin.copy:
         dest: "/etc/auto.auth"
         content: |
           username={{ samba_user }}
           password={{ samba_password }}
+        mode: '0700'
+        owner: root
+        group: root
 
     - name: Creating a file with content
-    copy:
+      ansible.builtin.copy:
         dest: "/etc/auto.nas-movies"
         content: |
           movies  -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0777,file_mode=0777,uid=jd,rw    ://nas.home.lan/movies
+        mode: '0700'
+        owner: root
+        group: root
+
     - name: Creating a file with content
-    copy:
+      ansible.builtin.copy:
         dest: "/etc/auto.nas-music"
         content: |
           music   -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0777,file_mode=0777,uid=jd,rw    ://nas.home.lan/music
+        mode: '0700'
+        owner: root
+        group: root
+
     - name: Creating a file with content
-    copy:
+      ansible.builtin.copy:
         dest: "/etc/auto.nas-shows"
         content: |
           shows   -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0777,file_mode=0777,uid=jd,rw    ://nas.home.lan/shows
+        mode: '0700'
+        owner: root
+        group: root
 
     - name: Creating a file with content
-    copy:
+      ansible.builtin.copy:
         dest: "/etc/auto.nas"
         content: |
           nas-data   -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0755,file_mode=0755,uid=jd,rw    ://nas.home.lan/Data
@@ -43,6 +59,9 @@
           nas-install   -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0755,file_mode=0755,uid=jd,rw    ://nas.home.lan/install
           nas-downloads   -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0755,file_mode=0755,uid=jd,rw    ://nas.home.lan/downloads
           nas-games   -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0755,file_mode=0755,uid=jd,rw    ://nas.home.lan/qda_2
+        mode: '0700'
+        owner: root
+        group: root
     # - name: Reconfigure autofs Server
     #   ansible.builtin.lineinfile:
     #     path: /etc/auto.master
@@ -70,14 +89,7 @@
         path: /etc/auto.master
         line: /media/nas   /etc/auto.nas --timeout 360 --ghost
 
-
-
-
-
-
-
     - name: Restart docker service
       ansible.builtin.service:
         name: autofs
         state: restarted
-  become: true

roles/docker/tasks/main.yml

@@ -1,6 +1,8 @@
-- block:
+- name: Setup docker
-  - name: print arch
+  become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
-    debug:
+  block:
+    - name: Print arch
+      ansible.builtin.debug:
         msg: "{{ ansible_architecture }}"
     - name: Install docker
       ansible.builtin.apt:
@@ -14,32 +16,61 @@
         state: present
         update_cache: true
     - name: Get keys for raspotify
-    ansible.builtin.shell:
+      ansible.builtin.command:
         install -m 0755 -d /etc/apt/keyrings
+      changed_when: my_output.rc != 0
 
-  - name: Get keys for raspotify
+    - name: Add an Apt signing key to a specific keyring file
-    ansible.builtin.shell:
+      ansible.builtin.apt_key:
-      curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
+        url: https://download.docker.com/linux/debian/gpg
+        keyring: /etc/apt/keyrings/docker.asc
       when:
         - ansible_distribution == "Debian"  and ansible_distribution_major_version  == "12"
-  - name: Get keys for raspotify
+
-    ansible.builtin.shell:
+    # - name: Get keys for raspotify
-      curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc     
+    #   ansible.builtin.shell:
+    #     curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
+    #   when:
+    #     - ansible_distribution == "Debian"  and ansible_distribution_major_version  == "12"
+
+    - name: Add an Apt signing key to a specific keyring file
+      ansible.builtin.apt_key:
+        url: https://download.docker.com/linux/ubuntu/gpg
+        keyring: /etc/apt/keyrings/docker.asc
       when:
         - ansible_distribution == "Ubuntu"
 
-  - name: Get keys for raspotify
+    # - name: Get keys for raspotify
-    ansible.builtin.shell:
+    #   ansible.builtin.shell:
-      chmod a+r /etc/apt/keyrings/docker.asc
+    #     curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
+    #   when:
+    #     - ansible_distribution == "Ubuntu"
+    - name: Change file ownership, group and permissions
+      ansible.builtin.file:
+        path: /etc/apt/keyrings/docker.asc
+        owner: root
+        group: root
+        mode: '0644'
+
+    # - name: Get keys for raspotify
+    #   ansible.builtin.shell:
+    #     chmod a+r /etc/apt/keyrings/docker.asc
 
     - name: Get keys for raspotify
-    ansible.builtin.shell: echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
+      ansible.builtin.shell: echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc]\
+       https://download.docker.com/linux/debian $(. /etc/os-release && echo "$VERSION_CODENAME") stable" |\
+       sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
       when:
         - ansible_distribution == "Debian"  and ansible_distribution_major_version  == "12"
+      changed_when: my_output.rc != 0
+
     - name: Get keys for raspotify
-    ansible.builtin.shell: echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
+      ansible.builtin.shell: echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc]\
+       https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable" |\
+       sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
       when:
         - ansible_distribution == "Ubuntu"
+      changed_when: my_output.rc != 0
 
     - name: Install docker
       ansible.builtin.apt:
@@ -61,34 +92,57 @@
         path: /etc/docker/certs
         state: directory
         mode: '0700'
+        owner: root
+        group: root
+
     - name: Copy files
-    copy:
+      ansible.builtin.copy:
         src: server-key.pem
         dest: /etc/docker/certs/
+        mode: '0600'
+        owner: root
+        group: root
     - name: Copy files
-    copy:
+      ansible.builtin.copy:
         src: ca.pem
         dest: /etc/docker/certs/
+        mode: '0600'
+        owner: root
+        group: root
     - name: Copy files
-    copy:
+      ansible.builtin.copy:
         src: server-cert.pem
         dest: /etc/docker/certs/
+        mode: '0600'
+        owner: root
+        group: root
     - name: Creating a file with content
-    copy:
+      ansible.builtin.copy:
         dest: "/etc/systemd/system/docker.service.d/override.conf"
         content: |
           [Service]
           ExecStart=
-        ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock --tlsverify     --tlscacert=/etc/docker/certs/ca.pem     --tlscert=/etc/docker/certs/server-cert.pem     --tlskey=/etc/docker/certs/server-key.pem     -H=0.0.0.0:2376
+          ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock --tlsverify \
+          --tlscacert=/etc/docker/certs/ca.pem --tlscert=/etc/docker/certs/server-cert.pem \
+          --tlskey=/etc/docker/certs/server-key.pem -H=0.0.0.0:2376
+        mode: '0600'
+        owner: root
+        group: root
       notify: restart_docker
       when: mode == "nocert"
+
     - name: Creating a file with content
-    copy:
+      ansible.builtin.copy:
         dest: "/etc/systemd/system/docker.service.d/override.conf"
         content: |
           [Service]
           ExecStart=
-        ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock --tlsverify     --tlscacert=/etc/docker/certs/ca.pem     --tlscert=/etc/docker/certs/server-cert.pem     --tlskey=/etc/docker/certs/server-key.pem     -H=0.0.0.0:2376
+          ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock --tlsverify \
+          --tlscacert=/etc/docker/certs/ca.pem --tlscert=/etc/docker/certs/server-cert.pem \
+          --tlskey=/etc/docker/certs/server-key.pem -H=0.0.0.0:2376
+        mode: '0600'
+        owner: root
+        group: root
       notify: restart_docker
       when: mode != "nocert"
 
@@ -108,6 +162,3 @@
         plugin_name: grafana/loki-docker-driver:3.3.2
         alias: loki
         state: present
-
-
-  become: true

roles/fail2ban/tasks/main.yml

@@ -1,4 +1,6 @@
-- block:
+- name: Setup Fail2ban
+  become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
+  block:
     - name: Install fail2ban packages
       ansible.builtin.apt:
         name:
@@ -7,27 +9,36 @@
   # add line  to /etc/hosts
   # 127.0.0.1 m-server localhost....
     - name: Copy files
-    copy:
+      ansible.builtin.copy:
         src: "{{ item }}"
         dest: /etc/fail2ban/jail.d/
+        mode: '0700'
+        owner: root
+        group: root
       with_fileglob:
         - "jail.d/*.conf"
 
     - name: Copy files
-    copy:
+      ansible.builtin.copy:
         src: "{{ item }}"
         dest: /etc/fail2ban/filter.d/
+        mode: '0700'
+        owner: root
+        group: root
       with_fileglob:
         - "filter.d/*.conf"
 
     - name: Copy files
-    copy:
+      ansible.builtin.copy:
         src: "{{ item }}"
         dest: /etc/fail2ban/action.d/
+        mode: '0700'
+        owner: root
+        group: root
       with_fileglob:
         - "action.d/*.conf"
 
-  - name: disable sendmail service
+    - name: Disable sendmail service
       ansible.builtin.service:
         name: sendmail.service
         state: stopped
@@ -38,4 +49,3 @@
         name: fail2ban.service
         state: restarted
         enabled: true
-  become: true

roles/loki-agent/tasks/main.yml

@@ -1,20 +0,0 @@
-- block:
-  - name: Get keys
-    ansible.builtin.shell: curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import && chmod 644 /usr/share/keyrings/wazuh.gpg
-  - name: Add repo
-    ansible.builtin.shell: echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list
-  - name: Update cache
-    ansible.builtin.apt:
-      update_cache: true
-  - name: Instal wazuh
-    ansible.builtin.apt:
-      name: wazuh-agent
-    environment:
-      WAZUH_MANAGER: 'm-server.home.lan'
-      WAZUH_AGENT_NAME: "{{ inventory_hostname }}"
-  - name: Restart wazuh service
-    ansible.builtin.service:
-      name: wazuh-agent
-      state: restarted
-      enabled: true
-  become: true

roles/loki-agent/vars/main.yml

@@ -1 +0,0 @@
-ZABBIX_SERVER: "zabbix.home.lan"

roles/matter-server/tasks/main.yml

@@ -1,4 +1,6 @@
-- block:
+- name: Setup matter server
+  become: "{{ 'no' if inventory_hostname == 'nas.home.lan' else 'yes' }}"
+  block:
     - name: Reconfigure config
       ansible.builtin.lineinfile:
         path: /etc/sysctl.conf
@@ -7,4 +9,4 @@
     - name: Restart agent
       ansible.builtin.shell: echo 80 > /proc/sys/net/ipv4/igmp_max_memberships
       notify: restart_matter_server
-  become: true
+      changed_when: my_output.rc != 0

roles/monitoring/tasks/main.yml

@@ -36,7 +36,7 @@
   when:
     - ansible_facts.architecture == "armv7l" or ansible_facts.architecture == "aarch64"
   become: true
-  ignore_errors: true
+  failed_when: my_output.rc != 0
 
 - name: Install a .deb package from the internet3
   ansible.builtin.apt:
@@ -50,21 +50,22 @@
     # deb: https://repo.zabbix.com/zabbix/6.4/debian/pool/main/z/zabbix-release/zabbix-release_6.4-1+debian12_all.deb
     deb: https://repo.zabbix.com/zabbix/7.2/debian/pool/main/z/zabbix-release/zabbix-release_7.2-1+debian12_all.deb
   when:
-    - ansible_facts.architecture != "armv7l" and  ansible_facts.architecture != "aarch64" and ansible_distribution == "Debian"  and ansible_distribution_major_version  == "12"
+    - ansible_facts.architecture != "armv7l"
-  ignore_errors: true
+    - ansible_facts.architecture != "aarch64"
+    - ansible_distribution == "Debian"
+    - ansible_distribution_major_version  == "12"
+  failed_when: my_output.rc != 0
   become: true
-# - name: Install a .deb package localy
+
-#   ansible.builtin.apt:
-#     deb: /tmp/zabbix-release_6.4-1+ubuntu22.04_all.deb
 - name: Install zabbix packages
   ansible.builtin.apt:
     name:
       - zabbix-agent2
       - zabbix-agent2-plugin-mongodb
       - zabbix-agent2-plugin-postgresql
-    update_cache: yes
+    update_cache: false
   become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
-  ignore_errors: true
+  failed_when: my_output.rc != 0
   when: inventory_hostname != 'nas.home.lan'
 
 - name: Reconfigure zabbix agent Server
@@ -147,7 +148,7 @@
   ansible.builtin.user:
     name: zabbix
     groups: video
-    append: yes
+    append: true
   when: inventory_hostname != 'nas.home.lan'
   become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
 
@@ -160,6 +161,8 @@
   become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
 
 - name: Restart agent
-  ansible.builtin.shell: /etc/init.d/ZabbixAgent.sh restart
+  ansible.builtin.command: /etc/init.d/ZabbixAgent.sh restart
   when: inventory_hostname == 'nas.home.lan'
+  changed_when: my_output.rc != 0
   become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
+  

roles/mqtt-srv/tasks/main.yml

@@ -1,5 +1,7 @@
-- block:
+- name: Setup mqtt_srv
-  - name: include vault
+  become: "{{ 'no' if inventory_hostname == 'nas.home.lan' else 'yes' }}"
+  block:
+    - name: Include vault
       ansible.builtin.include_vars:
         file: jaydee.yml
     - name: Delete content & directory
@@ -9,13 +11,14 @@
     - name: GIT pull
       tags:
         - git_pull
-    git:
+      ansible.builtin.git:
         repo: "https://{{ git_user | urlencode }}:{{ git_password_mqtt | urlencode }}@gitlab.sectorq.eu/jaydee/mqtt_srv.git"
         dest: "{{ dest_folder }}"
-      update: yes
+        update: true
-      clone: yes
+        clone: true
         version: main
-  - debug:
+    - name: Print message
+      ansible.builtin.debug:
         msg: "{{ inventory_hostname }}"
 
     - name: Upload service config
@@ -23,14 +26,18 @@
         src: "{{ dest_folder }}/mqtt_srv.service"
         dest: /etc/systemd/system/mqtt_srv.service
         remote_src: true
+        mode: '0755'
+        owner: root
+        group: root
       when: inventory_hostname != 'nas.home.lan'
 
     - name: Upload service script
       ansible.builtin.copy:
         src: "{{ dest_folder }}/mqtt_srv.py"
         dest: /usr/bin/mqtt_srv.py
-      mode: '755'
+        mode: '0755'
         owner: root
+        group: root
         remote_src: true
       when: inventory_hostname != 'nas.home.lan'
 
@@ -43,7 +50,6 @@
         remote_src: true
       when: inventory_hostname != 'nas.home.lan'
 
-    
     # - name: Upload service script1
     #   ansible.builtin.copy:
     #     src: scripts/mqtt_srv.sh
@@ -72,8 +78,10 @@
         remote_src: true
       when: inventory_hostname == 'nas.home.lan'
 
-  - debug:
+    - name: Print message
+      ansible.builtin.debug:
         msg: "{{ dest_folder }}"
+
     - name: Upload service script2
       ansible.builtin.copy:
         src: "{{ dest_folder }}/mqtt_srv.py"
@@ -84,7 +92,8 @@
       when: inventory_hostname == 'nas.home.lan'
 
     - name: Install bottle python package
-    ansible.builtin.shell: pip  install {{ item }}  --break-system-packages
+      ansible.builtin.pip:
+        name: "{{ item }}"
       loop:
         - paho-mqtt
         - getmac
@@ -112,5 +121,5 @@
       async: 10
       poll: 0
       when: inventory_hostname == 'nas.home.lan'
+      changed_when: my_output.rc != 0
       
-  become: "{{ 'no' if inventory_hostname == 'nas.home.lan' else 'yes' }}"

roles/omv_backup/tasks/main.yml

@@ -1,23 +1,24 @@
 - name: Omv Setup
-  become: true
+  become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
   block:
-    - name: include vault
+    - name: Include vault
       ansible.builtin.include_vars:
         file: jaydee.yml
     - name: Delete content & directory
       ansible.builtin.file:
         state: absent
         path: "{{ dest_folder }}"
-    - name: GIT pull
+    - name: Pull repo
       tags:
         - git_pull
-      git:
+      ansible.builtin.git:
         repo: "https://{{ git_user | urlencode }}:{{ git_password_mqtt | urlencode }}@gitlab.sectorq.eu/jaydee/omv_backup.git"
         dest: "{{ dest_folder }}"
-        update: yes
+        update: true
-        clone: yes
+        clone: true
         version: main
-    - debug:
+    - name: Print
+      ansible.builtin.debug:
         msg: "{{ inventory_hostname }}"
     - name: Create a directory if it does not exist
       ansible.builtin.file:
@@ -42,6 +43,9 @@
         src: "{{ dest_folder }}/requirements.txt"
         dest: /myapps/requirements.txt
         remote_src: true
+        mode: '0755'
+        owner: root
+        group: root
       when: inventory_hostname != 'nas.home.lan'
 
     - name: Install venv
@@ -62,6 +66,9 @@
       ansible.builtin.copy:
         src: omv_backup.service
         dest: /etc/systemd/system/omv_backup.service
+        mode: '0755'
+        owner: root
+        group: root
       when: inventory_hostname == 'amd.home.lan'
     - name: Restart omv service
       ansible.builtin.service:

roles/prevent_policy/tasks/main.yml

@@ -1,6 +1,8 @@
-- block:
+- name: Setup policies
+  become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
+  block:
     - name: Creating a file with content
-    copy:
+      ansible.builtin.copy:
         dest: "/etc/polkit-1/rules.d/50_disable_pol.rules"
         content: |
           polkit.addRule(function(action, subject) {
@@ -8,5 +10,6 @@
                 return polkit.Result.YES;
             }
           });
-  become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
+        mode: '0644'
-    
+        owner: root
+        group: root

roles/promtail/tasks/main.yml

@@ -1,15 +1,24 @@
 ---
-- block:
+- name: Promtail
+  become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
+  block:
     - name: Create dir
       ansible.builtin.file:
         path: /etc/apt/keyrings/
         owner: root
         group: root
-
     - name: Create Banner
       ansible.builtin.shell: wget -q -O - https://apt.grafana.com/gpg.key | gpg --dearmor > /etc/apt/keyrings/grafana.gpg
       register: my_output
       changed_when: my_output.rc != 0
+  # - name: < Fetch file that requires authentication.
+  #         username/password only available since 2.8, in older versions you need to use url_username/url_password
+  #   ansible.builtin.get_url:
+  #     url: https://apt.grafana.com/gpg.key
+  #     dest: /etc/foo.conf
+  #     username: bar
+  #     password: '{{ mysecret }}'
+  #   changed_when: my_output.rc != 0
 
     - name: Create Banner
       ansible.builtin.shell: echo "deb [signed-by=/etc/apt/keyrings/grafana.gpg] https://apt.grafana.com stable main" | tee /etc/apt/sources.list.d/grafana.list
@@ -65,4 +74,3 @@
       ansible.builtin.service:
         name: promtail
         state: restarted
-  become: true

roles/sendmail/handlers/main.yml

@@ -1,5 +0,0 @@
-- name: restart_docker
-  ansible.builtin.service:
-    name: docker.service
-    state: restarted
-  become: true

roles/sendmail/tasks/main.yml

@@ -1,57 +0,0 @@
-- block:
-  - name: Install docker
-    ansible.builtin.apt:
-      name: 
-        - ca-certificates
-        - curl 
-        - telnet
-        - net-tools
-        - python3-pip
-        - python3-dev
-      state: present
-      update_cache: true
-  - name: Get keys for raspotify
-    ansible.builtin.shell:
-      install -m 0755 -d /etc/apt/keyrings
-
-  - name: Get keys for raspotify
-    ansible.builtin.shell:
-      curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
-
-  - name: Get keys for raspotify
-    ansible.builtin.shell:
-      chmod a+r /etc/apt/keyrings/docker.asc
-
-  - name: Get keys for raspotify
-    ansible.builtin.shell: echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
-
-  - name: Install docker
-    ansible.builtin.apt:
-      name: 
-        - docker-ce
-        - docker-ce-cli
-        - containerd.io
-        - docker-buildx-plugin
-        - docker-compose-plugin
-      update_cache: true
-
-  - name: Create a directory docker.service.d
-    ansible.builtin.file:
-      path: /etc/systemd/system/docker.service.d/
-      state: directory
-      mode: '0755'
-
-  - name: Creating a file with content
-    copy:
-      dest: "/etc/systemd/system/docker.service.d/override.conf"
-      content: |
-        [Service]
-        ExecStart=
-        ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock -H tcp://0.0.0.0:2375
-    notify: restart_docker
-
-  - name: Just force systemd to reread configs
-    ansible.builtin.systemd:
-      daemon_reload: true
-
-  become: true

roles/wazuh-agent/tasks/main.yml

@@ -1,20 +1,32 @@
-- block:
+- name: Setup loki agent
+  become: "{{ 'no' if inventory_hostname == 'nas.home.lan' else 'yes' }}"
+  block:
     - name: Get keys
-    ansible.builtin.shell: curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import && chmod 644 /usr/share/keyrings/wazuh.gpg
+      ansible.builtin.command: |
+        curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH |\
+        gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg \
+        --import && chmod 644 /usr/share/keyrings/wazuh.gpg
+      changed_when: my_output.rc != 0
+
     - name: Add repo
-    ansible.builtin.shell: echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list
+      ansible.builtin.command: |
+        echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" |\
+        tee -a /etc/apt/sources.list.d/wazuh.list
+      changed_when: my_output.rc != 0
+
     - name: Update cache
       ansible.builtin.apt:
         update_cache: true
+
     - name: Instal wazuh
       ansible.builtin.apt:
         name: wazuh-agent
       environment:
         WAZUH_MANAGER: 'm-server.home.lan'
         WAZUH_AGENT_NAME: "{{ inventory_hostname }}"
+
     - name: Restart wazuh service
       ansible.builtin.service:
         name: wazuh-agent
         state: restarted
         enabled: true
-  become: true