init

.ansible-lint

+---
+# based on documentation available at
+# https://ansible-lint.readthedocs.io/en/latest/configuring/
+
+# exclude_paths included in this file are parsed relative to this file's location
+# and not relative to the CWD of execution. CLI arguments passed to the --exclude
+# option will be parsed relative to the CWD of execution.
+exclude_paths:
+  - .cache/    # implicit unless exclude_paths is defined in config
+  - .git/
+  - .githooks/
+  - backups/
+# parseable: true
+# quiet: true
+# verbosity: 1
+
+# Mock modules or roles in order to pass ansible-playbook --syntax-check
+# mock_modules:
+#   - zuul_return
+#   # note the foo.bar is invalid as being neither a module or a collection
+#   - fake_namespace.fake_collection.fake_module
+#   - fake_namespace.fake_collection.fake_module.fake_submodule
+# mock_roles:
+#   - mocked_role
+#   - author.role_name # old standalone galaxy role
+#   - fake_namespace.fake_collection.fake_role # role within a collection
+
+# Enable checking of loop variable prefixes in roles
+loop_var_prefix: "{role}_"
+
+use_default_rules: true
+# Load custom rules from this specific folder
+# rulesdir:
+#   - ./rule/directory/
+
+# This makes linter to fully ignore rules/tags listed below
+skip_list:
+  - skip_this_tag
+  - git-latest
+  - name[casing]
+  - package-latest
+
+# Any rule that has the 'opt-in' tag will not be loaded unless its 'id' is
+# mentioned in the enable_list:
+enable_list:
+  - empty-string-compare    # opt-in
+  - no-log-password         # opt-in
+  - no-same-owner           # opt-in
+  # add yaml here if you want to avoid ignoring yaml checks when yamllint
+  # library is missing. Normally its absence just skips using that rule.
+  - yaml
+# Report only a subset of tags and fully ignore any others
+# tags:
+#   - var-spacing
+
+# This makes the linter display but not fail for rules/tags listed below:
+warn_list:
+  - skip_this_tag
+  - git-latest
+  - experimental    # experimental is included in the implicit list
+  # - role-name
+
+# Offline mode disables installation of requirements.yml
+offline: false
+
+# Define required Ansible's variables to satisfy syntax check
+# extra_vars:
+#   foo: bar
+#   multiline_string_variable: |
+#     line1
+#     line2
+#   complex_variable: ":{;\t$()"
+
+# Uncomment to enforce action validation with tasks, usually is not
+# needed as Ansible syntax check also covers it.
+# skip_action_validation: false
+
+# List of additional kind:pattern to be added at the top of the default
+# match list, first match determines the file kind.
+kinds:
+  # - playbook: "**/examples/*.{yml,yaml}"
+  # - galaxy: "**/folder/galaxy.yml"
+  # - tasks: "**/tasks/*.yml"
+  # - vars: "**/vars/*.yml"
+  # - meta: "**/meta/main.yml"
+  - yaml: "**/*.yaml-too"

.config/molecule/config.yml

+---
+prerun: false

.gitattributes

+# CRLF vs. LF:
+* text=auto
+
+# make 'git diff' use ansible-vault for vault files, so you can see decrypted
+# content if you have the password
+*.vault diff=ansible-vault merge=binary

.githooks/pre-commit

+#!/usr/bin/env bash
+#
+# An example hook script to verify what is about to be committed.
+# Called by "git commit" with no arguments.  The hook should
+# exit with non-zero status after issuing an appropriate message if
+# it wants to stop the commit.
+#
+# To enable this hook, rename this file to "pre-commit".
+
+if git rev-parse --verify HEAD >/dev/null 2>&1
+then
+	against=HEAD
+else
+	# Initial commit: diff against an empty tree object
+	against=$(git hash-object -t tree /dev/null)
+fi
+
+# If you want to allow non-ASCII filenames set this variable to true.
+allownonascii=$(git config --bool hooks.allownonascii)
+
+# Redirect output to stderr.
+exec 1>&2
+
+# Cross platform projects tend to avoid non-ASCII filenames; prevent
+# them from being added to the repository. We exploit the fact that the
+# printable range starts at the space character and ends with tilde.
+if [ "$allownonascii" != "true" ] &&
+	# Note that the use of brackets around a tr range is ok here, (it's
+	# even required, for portability to Solaris 10's /usr/bin/tr), since
+	# the square bracket bytes happen to fall in the designated range.
+	test $(git diff --cached --name-only --diff-filter=A -z $against |
+	  LC_ALL=C tr -d '[ -~]\0' | wc -c) != 0
+then
+	cat <<\EOF
+Error: Attempt to add a non-ASCII file name.
+
+This can cause problems if you want to work with people on other platforms.
+
+To be portable it is advisable to rename the file.
+
+If you know what you are doing you can disable this check using:
+
+  git config hooks.allownonascii true
+EOF
+	exit 1
+fi
+
+# If there are whitespace errors, print the offending file names and fail.
+# exec git diff-index --check --cached $against --
+
+
+
+################################################################################
+## Everything below this is customized, everything above is from the example. ##
+################################################################################
+
+### PREPARE
+
+# Expand aliases and make alias command work in the bash script.
+shopt -s expand_aliases
+
+REPOPATH="$(git rev-parse --show-toplevel)"
+GREP_CMD='grep -Rn --color'
+GREP_EXCLUDES="--exclude-dir=\.git --exclude-dir=\.githooks --exclude=*\.example"
+
+### YAMLLINT stage
+STAGED_FILES=$(git diff --cached --name-only --diff-filter=ACM)
+YAML_FILES=$(git diff --cached --name-only --diff-filter=ACM | grep ".yml$")
+if [[ ${YAML_FILES} != "" ]]; then
+	for file in ${YAML_FILES}; do
+		yamllint "${file}"
+		if [[ ${?} -ne 0 ]]; then
+			exit 1
+		fi
+	done
+fi && echo "SUCCESS: Yamllint stage."
+
+### VAULT detection stage
+VAULT_FILES=$(git diff --cached --name-only --diff-filter=ACM | grep ".vault$")
+if [[ ${VAULT_FILES} != "" ]]; then
+	echo "ERROR: Vaultfiles found:"
+	for file in ${VAULT_FILES}; do
+		echo "- ${file}"
+	done
+	exit 1
+fi
+# https://docs.ansible.com/ansible/latest/user_guide/vault.html#vault-format
+if [[ ${STAGED_FILES} != "" ]]; then
+	for file in ${STAGED_FILES}; do
+		grep -e "\$ANSIBLE_VAULT;[[:digit:]]\.[[:digit:]];AES256" "${file}"
+		[[ ${?} -eq 0 ]] && echo "ERROR: Ansible-Vault in String found in file '${file}'." && exit 1
+	done
+fi
+echo "SUCCESS: Vault detection stage."
+
+### URL detection stage
+${GREP_CMD} ${GREP_EXCLUDES} -e "http[s]*.*git.*SLUB" -e "http[s]*.*git.*slub" -e "git@" "${REPOPATH}"
+if [[ ${?} -eq 0 ]]; then
+	echo "ERROR: found internal URLs."
+	exit 1;
+fi
+echo "SUCCESS: URL detection stage."
+
+### IP address detection stage
+# This is pretty basic regex matching, but it's a start.
+IP_REGEX='[^a-zA-ZäöÜÄÖÜß/\\\-][0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}'
+${GREP_CMD} ${GREP_EXCLUDES} -e "${IP_REGEX}" "${REPOPATH}" | grep -v "127.0.0"
+if [[ ${?} -eq 0 ]]; then
+	echo "ERROR: found IP address."
+	exit 1;
+fi
+echo "SUCCESS: IP address detection stage."
+
+### SSH-Key detection stage
+${GREP_CMD} ${GREP_EXCLUDES} -e "ssh-[dr]sa " "${REPOPATH}"
+if [[ ${?} -eq 0 ]]; then
+	echo "ERROR: found SSH key."
+	exit 1;
+fi
+echo "SUCCESS: SSH Key detection stage."
+
+
+
+
+### DONE
+# Return explicit 0.
+exit 0;

.gitignore

+# Compiled source #
+###################
+*.bin
+*.class
+*.dll
+*.exe
+*.o
+*.so
+*.pyc
+__pycache__
+
+# Packages #
+############
+# it's better to unpack these files and commit the raw source
+# git has its own built in compression methods
+*.7z
+*.dmg
+*.gz
+*.iso
+*.jar
+*.rar
+*.tar
+*.zip
+*.tar.gz
+*.tgz
+
+# Logs and databases #
+######################
+*.log
+*.sql
+*.sqlite
+
+# OS generated files #
+######################
+.DS_Store
+.DS_Store?
+._*
+.Spotlight-V100
+.Trashes
+ehthumbs.db
+Thumbs.db
+
+# Linux packages #
+##################
+*.deb
+*.rpm
+
+# Ansible specific files #
+##########################
+
+*.retry
+*.vault
+inventory.*
+inv.*
+*.pass
+
+# Vim #
+#######
+
+# swap
+[._]*.s[a-v][a-z]
+[._]*.sw[a-p]
+[._]s[a-v][a-z]
+[._]sw[a-p]
+ # session
+Session.vim
+# temporary
+.netrwhist
+# auto-generated tag files
+tags
+
+# Vagrant #
+###########
+
+.vagrant/
+*.box
+
+# Temporary/Build/Backup #
+##########################
+
+backups/
+build/
+.factcache/
+
+# CONFIDENTIAL #
+################
+
+ssh_host_*
+

.gitlab-ci.yml

+---
+# A pipeline is composed of independent jobs that run scripts, grouped into stages.
+# Stages run in sequential order, but jobs within stages run in parallel.
+#
+# For more information, see: https://docs.gitlab.com/ee/ci/yaml/index.html#stages
+
+stages:          # List of stages for jobs, and their order of execution
+  - test
+
+default:
+  before_script:
+    - source /opt/molecule/bin/activate
+    - ansible --version
+    - molecule --version
+  after_script:
+    - source /opt/molecule/bin/activate
+    - molecule destroy --scenario-name ${SCENARIO}
+
+variables:
+  SCENARIO: "default"
+  ANSIBLE_VAULT_PASSWORD_FILE: "${CI_PROJECT_DIR}/molecule/${SCENARIO}/../../../../../lza_amrepo_backup.pass"
+  ANSIBLE_FORCE_COLOR: 'true'
+  PY_COLORS: '1'
+
+test-job:
+  stage: test
+  tags:
+    - "shell"
+  script:
+    # # make sure that Ansible Vaults are present and can be decrypted
+    - echo "${VAULT_INSTALL_COMMON}" > ${ANSIBLE_VAULT_PASSWORD_FILE}
+    - export ANSIBLE_VAULT_IDENTITY_LIST="${ANSIBLE_VAULT_PASSWORD_FILE}"
+    # - rm -rf ../ansible_vaults/
+    # - git clone https://gitlab+deploy-token-25:${VAULT_ACCESS_TOKEN}@git.slub-dresden.de/slub-referat-2-3/ansible_vaults.git ../ansible_vaults/; \
+    # run Molecule tests
+    - molecule syntax --scenario-name ${SCENARIO}
+    # We cannot use `molecule lint` anymore because:
+    # - https://github.com/ansible-community/molecule/pull/3802 "Remove lint command"
+    # - https://github.com/ansible-community/molecule/discussions/3825#discussioncomment-4908366
+    - yamllint --strict --format colored ./
+    - ansible-lint --format full --profile production --strict --force-color ./
+    - molecule create --scenario-name ${SCENARIO}
+    - molecule converge --scenario-name ${SCENARIO}
+    - molecule idempotence --scenario-name ${SCENARIO}
+    # - molecule verify --scenario-name ${SCENARIO}

.gitlab/issue_templates/Default.md

+## Expected Behavior
+
+
+## Actual Behavior
+
+
+## Steps to Reproduce the Problem
+
+  1.
+  1.
+  1.
+
+## Specifications
+
+  - Version/Commit:
+  - Platform:

.gitlab/merge_request_templates/Default.md

+Fixes #
+
+## Proposed Changes
+
+  -
+  -
+  -

.yamllint

+---
+# Based on ansible-lint config
+extends: default
+
+rules:
+  braces:
+    max-spaces-inside: 1
+    level: error
+  brackets:
+    max-spaces-inside: 1
+    level: error
+  colons:
+    max-spaces-after: -1
+    level: error
+  commas:
+    max-spaces-after: -1
+    level: error
+  comments: disable
+  comments-indentation: disable
+  document-start: disable
+  empty-lines:
+    max: 3
+    level: error
+  hyphens:
+    level: error
+  indentation: disable
+  key-duplicates: enable
+  line-length: disable
+  new-line-at-end-of-file: disable
+  new-lines:
+    type: unix
+  trailing-spaces: disable
+  truthy: disable

CODE-OF-CONDUCT.md

+# Code of Conduct
+
+Just be excellent to each other. That's it. EoC.

README.md

+# Ansible-Role "ansible_lza_amrepo_backup"
+
+## What does it do?
+
+This role provides all necessary tasks to install a server that will pull regular backups of Artefactual's GitHub repositories, including Archivematica.
+
+## What do I need?
+
+### Prerequisites
+
+To use this role, the following software must be installed on your workstation:
+* ansible
+
+To deploy this role to a managed host, the following software must be installed on the target:
+* Python3
+* SSHd
+
+### Dependencies
+
+Other roles required by this role can be easily installed using `ansible-galaxy` if necessary. As the roles reside in SLUB's local Git server instance, you might need a password for certain repositories despite most of them being publicly available. This command will install the required roles in the correct location so they are found in the search path:
+```
+	ansible-galaxy install -r requirements.yml -p ../
+```
+
+### Infrastructure
+
+It is recommended to use Debian VMs as deployed by SLUB's GUBS tool with this role. Otherwise you will not have access to the software packages that are located in SLUB's private Debian package repository.
+
+## Can i have a Quick Start?
+
+Most options already have sensible defaults in `ansible.cfg`. However, you can override these defaults using CLI options/flags if you want to. The flags can be combined if necessary, and most of them have long versions as well. Get more information using `ansible-playbook --help`.
+
+To simply run the playbook, just call the `site.yml` playbook like this:
+```bash
+ansible-playbook site.yml -u <username>
+```
+If you want to limit the execution to a subset of all hosts that are listed in the inventory, use the `-l` or `--limit` option like this:
+```bash
+ansible-playbook site.yml -l <hostna*>
+ansible-playbook site.yml -l <hostname>
+ansible-playbook site.yml -l <hostname1>:<hostname2>:...
+ansible-playbook site.yml -l <inventory_group>
+ansible-playbook site.yml --limit=<hostna*>
+```
+
+If you do not have Vault password files in the directory above the role direcory, you have to give the Vault password before execution:
+```
+	ansible-playbook site.yml --ask-vault-pass
+```
+
+You can use your own inventory file by adding the `-i` or `--inventory=INVENTORY` option:
+```
+	ansible-playbook site.yml -i inventory.yml
+	ansible-playbook site.yml --inventory=inventory.yml
+```
+
+Tasks in this role have been tagged to enable users to only run subsets of tasks. This can be leveraged to decrease run times or run only certain tasks after small changes.
+To list all available tags, use:
+```
+	ansible-playbook site.yml --list-tags
+```
+You can then run only certain tagged tasks by using the `--tags` option:
+```
+	ansible-playbook site.yml -t tag1,tag2,...,tagN
+	ansible-playbook site.yml --tags=tag1,tag2,...,tagN
+```
+
+## How can I run tests?
+
+Tests have been implemented using the Molecule framework. The details on using the test suite are described below `molecule/`.
+
+To run some quick tests, you can do:
+```bash
+# pure syntax check
+molecule syntax
+# run yamllint and ansible-lint
+molecule lint
+# list available test scenarios, e.g. based on different OS images or platforms
+molecule list
+# create the test environment for a specific scenario (can be left out for "default")
+molecule create [-s scenario]
+# run your tasks against the test env
+molecule converge [-s scenario]      # multiple times if needed
+# run idempotence checks to se if any of the tasks keeps changing (subsequent runs shouldn't trigger changes)
+molecule idempotence [-s scenario]
+# cleanup test env (remove VM/container)
+molecule destroy [-s scenario]
+```
+
+We recommend running those tests before pushing any code to the Git server.
+
+On every `git push`, the GitLab-CI pipeline will run a similar set of tests to ensure that all changes are working. Find the details in the `.gitlab-ci.yml` file located at the project root directory.
+
+## What can be configured?
+
+### Ansible Role
+
+Many variables have been "hidden" in encrypted Ansible Vaults. For security reasons, these Vaults are maintained in a separate private internal repository of SLUB's Git. However, in order to better understand the data within the vaults, you can find `\*.vault.example` files below the `vars/` directory.
+
+If you work outside of SLUBArchive and have no access to the vault repository, make sure to put the necessary vaults in the expected paths at `../ansible_vaults/<ROLENAME>/`.
+
+Variable defaults have been set in `defaults/main.yml`. You can overwrite them with your own values by setting them in `vars/main.yml`.
+
+### Git configuration
+
+Just run the `setup_gitconfig.sh` script that comes with the repo to correctly setup all necessary local Git configurations.
+
+## What changes have been made lately?
+
+All changes can be found in the `CHANGELOG` file located at the project root directory. Alternatively, you can have a look at the commit log to get a detailed view.
+
+## Who is maintaining this project?
+
+All authors/maintainers are listed in the `kudos.txt` file located at the project root directory.
+
+## How can I contribute?
+
+If you have any comments or find bugs, please contact langzeitarchiv@slub-dresden.de, create an issue or send us a pull request.
+
+Details on how to contribute to this project can be found at the `CONTRIBUTING.md` file located at the project root directory.
+
+If you have commited to the project yourself, you can leave a note in the `kudos.txt` file located at the project root directory. Be assured of our eternal gratitude.
+
+## Is there a Code of Conduct?
+
+Yes there is. You can find it in the `CODE-OF-CONDUCT.md` file located at the project root directory. It's kept very brief by design.

ansible.cfg

+[defaults]
+# If set, configures the path to the Vault password file as an alternative to
+# specifying --vault-password-file on the command line.
+#vault_identity_list = ../vault_password_file_1.pass, ../vault_password_file_2.pass
+vault_identity_list = ../../../lza_amrepo_backup.pass
+
+# Path to default inventory file
+# Administrators can override this by using the "-i <inventoryfile>" CLI
+# argument.
+inventory           = inv.ini
+
+# Remote user name
+# We DELIBERATELY set this to an non-existent non-root username to make sure
+# the role can only be run if an Administrator knows the correct remote_user
+# name and passes it as a CLI argument.
+remote_user         = non-root-user
+
+# By default, ansible will use the 'linear' strategy but you may want to try
+# another one
+strategy            = free
+
+# Don't like cows?  that's unfortunate.
+# Set to 1 if you don't want cowsay support or export ANSIBLE_NOCOWS=1
+nocows = 1
+
+# Custom role path that guarantees roles are always found, no matter where a
+# user checks them out.
+roles_path = ../:~/.ansible/roles:/usr/share/ansible/roles:/etc/ansible/roles
+
+# Toggle to control displaying skipped task/host entries in a task in the
+# default callback.
+# https://docs.ansible.com/ansible/latest/reference_appendices/config.html#display-skipped-hosts
+# DEFAULT: display_skipped_hosts = true
+display_skipped_hosts = false
+display_ok_hosts: false
+
+use_persistent_connections=true
+
+# list all Ansible Callback Plugins: "ansible-doc -t callback -l"
+# online documentation: https://docs.ansible.com/ansible/latest/plugins/callback.html
+# run code profiling for performance analysis
+# callbacks_enabled = profile_roles, profile_tasks, timer
+# get formatted output
+# callbacks_enabled = yaml
+# get minimal output
+# callbacks_enabled = dense
+
+# set default output callback plugin
+stdout_callback = yaml
+
+### CALLBACKS
+# Setting a callback plugin for ad-hoc commands
+bin_ansible_callbacks = True
+# Setting a callback for playbook tasks
+callbacks_enabled: yaml
+
+### FACT GATHERING
+gathering = smart
+
+### FACT CACHING
+# Use 'yaml' as backend
+fact_caching = community.general.yaml
+# Prefix for cache keys
+fact_caching_prefix = ansible_facts_
+# Path in which the cache plugin will save the files
+fact_caching_connection = ./.factcache/
+# Cache for 6 hours
+fact_caching_timeout = 21600
+
+### FORKS
+forks = 20
+
+[inventory]
+# Ignore these extensions when parsing a directory as inventory source.
+ignore_extensions = .pyc, .pyo, .swp, .bak, ~, .rpm, .md, .txt, ~, .orig, .ini, .cfg, .retry
+
+[ssh_connection]
+# Enabling pipelining reduces the number of SSH operations required to
+# execute a module on the remote server. This can result in a significant
+# performance improvement when enabled, however when using "sudo:" you must
+# first disable 'requiretty' in /etc/sudoers
+# By default, this option is disabled to preserve compatibility with
+# sudoers configurations that have requiretty (the default on many distros).
+pipelining = True
+# based on https://www.treitos.com/blog/2020/improving-ansible-performance.html
+ssh_args = -o ControlMaster=auto -o ControlPersist=3600s -o PreferredAuthentications=publickey
+control_path = %(directory)s/ansible-ssh-%%h-%%p-%%r

defaults/main.yml

+---
+# defaults file for ansible_lza_amrepo_backup

files/id_ed25519_deploykey

+$ANSIBLE_VAULT;1.1;AES256
+35313938353266616435343733366539353139373763323266376331633436663234336137343565
+6431323565383234313366366439346165363464613237640a643266616133333361396262653136
+35616633336438373938393765333766653335656265356230346230613062656333313031666134
+3366663139363635640a303330386562666634306261353463343036636335353432613933306136
+34396639623661333830663763386131363837313336623263386638393730616237363133306133
+32663563353566646131326466386466366362363264373936313532316237383036623538393737
+32366261396265326464663030633865626433366231346665663261376464353330393835643736
+64666165313862633330333338333235383265373263396362306435316462373335326565373663
+37653565626430613238663464366337343863356437653632363734623939636637633737373130
+64373761643435626565386364333662343135363363303266666366643139356333633862656237
+35386233336434336234303963623136393133656139313438663130313764623766623864323738
+62353561623461396536316435363630356233646331396139303635333834626530653263326438
+37336261376334303931306230613636303864303063383638373737633533336665656333623134
+35313361373138373731323131316166663566343431383636363038376166363262323561393831
+36616330653738333363376636613133613636633732376439363136623230366335633634376534
+32326561363063616464643530663634393766323261333265303765623466323566306535623338
+36633630396434343061656431643963636634313431643639306232396139366564386166386338
+63333934653131636334646333386430636666373935346662343964643432633633373736613235
+64346339363139306262616635643966643431373739303335333734633438396135343830356230
+35376562376565623166333761343462386539393838646338613863663262383162373635333963
+39326163656665363630633438363362646133343563336234323664376138643232626534656439
+64356436373364643730653332396237623230663837653039356330623835383431613638383166
+31333635313865393931616332363966353764366337613335663765336135666336643838353133
+36343839623533373661656532303633656637313661363331353034643536366161353238343865
+61373338316431653661343739313832333162303838336533316364313463613866313937633733
+3036616430353066623862363463643039653661333334613961

files/id_ed25519_deploykey.pub

+$ANSIBLE_VAULT;1.1;AES256
+30643564623836623262376435316662616538636366356630383635353830393433306538656437
+3638383164613063653862313838353839623332616533650a336336383265343437363763396566
+38663930636538326137383231323636323432623763656661366531343061373866636435636161
+3732653866663631640a663536393333666162383934363435363136633034373436353736653361
+37383732623833623033613265336238653061323661643232333365616264663237646562643862
+34383631323633333062363033306665613438363633316633386333326632323665656335356266
+37323535366466613338313338346464656262376639326138666562343461656562393666663732
+63663430396230393936333737616337333761633339626639383135346364656237653036656165
+62396263616235643635363766326434333633343332396333616437323137346538336535646533
+6533393166356261633364613032643033316565636234333036

handlers/main.yml

+---
+# handlers file for ansible_lza_amrepo_backup
+- name: save iptables rules (Debian)
+  when: ansible_os_family == "Debian"
+  block:
+    - name: Ordner für iptables-Config erstellen
+      ansible.builtin.file:
+        path: "/etc/iptables"
+        state: directory
+        owner: "root"
+        group: "root"
+        mode: "0755"
+      listen: "save iptables rules"
+    - name: install netfilter-persistent to be able to save iptables rules
+      ansible.builtin.apt:
+        name: netfilter-persistent
+        state: present
+      listen: "save iptables rules"
+    # we exclude this task from being linted for "no-changed-when", because handlers only ever run if there's a change triggered by a task
+    - name: save iptables rules
+      ansible.builtin.command: 'netfilter-persistent save'      # noqa no-changed-when
+      listen: "save iptables rules"
+
+- name: save iptables rules (RedHat)
+  when: ansible_os_family == "RedHat"
+  block:
+    - name: make sure iptables config file exists
+      ansible.builtin.file:
+        path: "/etc/sysconfig/iptables"
+        state: touch
+        owner: "root"
+        group: "root"
+        mode: "0600"
+      listen: "save iptables rules"
+    # we exclude this task from being linted for "no-changed-when", because handlers only ever run if there's a change triggered by a task
+    - name: save rules
+      ansible.builtin.command:
+        cmd: "/usr/sbin/iptables-save > /etc/sysconfig/iptables"        # noqa no-changed-when
+      listen: "save iptables rules"
+
+- name: update package cache    # noqa no-changed-when
+  ansible.builtin.package:
+    update_cache: true
+
+- name: restart dsmcad
+  ansible.builtin.systemd:
+    name: "dsmcad.service"
+    state: restarted

kudos.txt

+# kudos.txt - Express gratitude to your contributors.
+# https://github.com/kudos-txt
+
+project:
+  - name: ansible_lza_amrepo_backup
+    site: https://git.slub-dresden.de/path/to/repo
+#    blog: <blog url>
+#    help: <support url>
+#    news: <news url>, <news feed url>
+#    mail: <mail@domain.tld>
+#    chat: <service:nick>, <service:channel>, <url>
+#    note: <free text notes>
+
+contributor:
+#  - name: <name or nick of the contributor>
+#    role: <role in the project>
+#    site: <website url>
+#    blog: <blog url>
+#    mail: <mail@domain.tld>
+#    chat: <service:nick>, <service:channel>, <url>
+#    home: <country>, <region>, <zip>, <city>, <address>
+#    work: <company>, <job title>, <job description>
+#    note: <free text notes>
+  - name: Jörg Sachse
+    role: Maintainer
+    mail: Joerg.Sachse@slub-dresden.de
+    home: Germany, Saxony, 01059, Dresden, Zellescher Weg 18
+    work: SLUB Dresden, Digital Preservationist &IT Administrator & Installation Wizard
+
+#partner:
+#  - name: <name of the partner>
+#    site: <website url>
+#    blog: <blog url>
+#    help: <support url>
+#    news: <news url>, <news feed url>
+#    mail: <mail@domain.tld>
+#    chat: <service:nick>, <service:channel>, <url>
+#    note: <free text notes>
+
+#software:
+#  - name: <name of the software>
+#    site: <website url>
+#    blog: <blog url>
+#    help: <support url>
+#    news: <news url>, <news feed url>
+#    mail: <mail@domain.tld>
+#    chat: <service:nick>, <service:channel>, <url>
+#    note: <free text notes>