style: satisfy linter

.ansible-lint

@@ -37,6 +37,8 @@ use_default_rules: true
 skip_list:
   - skip_this_tag
   - git-latest
+  - name[casing]
+  - package-latest
 
 # Any rule that has the 'opt-in' tag will not be loaded unless its 'id' is
 # mentioned in the enable_list:

handlers/main.yml

 ---
 - name: save iptables rules (Debian)
+  when: ansible_os_family == "Debian"
   block:
     - name: Ordner für iptables-Config erstellen
       ansible.builtin.file:
@@ -21,9 +22,9 @@
       ansible.builtin.command: 'netfilter-persistent save'
       listen: "save iptables rules"
       changed_when: false
-  when: ansible_os_family == "Debian"
 
 - name: save iptables rules (RedHat)
+  when: ansible_os_family == "RedHat"
   block:
     - name: make sure iptables config file exists
       ansible.builtin.file:
@@ -34,10 +35,9 @@
         mode: 0600
       listen: "save iptables rules"
     - name: save rules
-      ansible.builtin.command: /usr/sbin/iptables-save        # noqa 303
+      ansible.builtin.command: /usr/sbin/iptables-save        # noqa command-instead-of-module
       listen: "save iptables rules"
       changed_when: false
-  when: ansible_os_family == "RedHat"
 
 - name: activate kernel parameter changes
   ansible.builtin.command: sysctl -p

tasks/configure_umask.yml

@@ -13,6 +13,8 @@
       umask 026
 
 - name: libpam-umask installieren (Debian)
+  when: ansible_os_family == "Debian"
+  tags: [apt]
   block:
     - name: Paket installieren
       ansible.builtin.apt:
@@ -33,8 +35,6 @@
           # Das Paket libpam-umask passt die Standard-Umask eines Benutzers mit
           # Hilfe von PAM an.
           session    optional     pam_umask.so umask=026
-  when: ansible_os_family == "Debian"
-  tags: [apt]
 
 - name: set default login umask
   ansible.builtin.lineinfile:

tasks/install_rkhunter.yml

@@ -118,7 +118,7 @@
   register: rkhunter_units
 
 - name: check if rkhunter Systemd units are already disabled
-  ansible.builtin.command: "systemctl is-enabled rkhunter.{{ item.path | basename }}"
+  ansible.builtin.command: "systemctl is-enabled rkhunter.{{ item.path | basename }}"    # noqa command-instead-of-module
   loop: "{{ rkhunter_units.files }}"
   register: rkhunter_disabled
   changed_when: false