From e8fb4245d1e7260f33263379b0a0b07e14df8974 Mon Sep 17 00:00:00 2001
From: Alexander Kazantsev <a.kazantsev@gigacoms.ru>
Date: Fri, 15 May 2026 15:52:05 +0300
Subject: [PATCH 1/7] ip_spoofing removal

---
 roles/rocky9/tasks/ip_spoofing.yml   | 17 -----------------
 roles/rocky9/tasks/sysctl_tuning.yml |  3 ---
 2 files changed, 20 deletions(-)
 delete mode 100644 roles/rocky9/tasks/ip_spoofing.yml

diff --git a/roles/rocky9/tasks/ip_spoofing.yml b/roles/rocky9/tasks/ip_spoofing.yml
deleted file mode 100644
index 757ab8b..0000000
--- a/roles/rocky9/tasks/ip_spoofing.yml
+++ /dev/null
@@ -1,17 +0,0 @@
----
-# Активируем защиту от IP-спуфинга.
-- ansible.posix.sysctl:
-    name: net.ipv4.conf.default.rp_filter
-    value: 1
-    state: present
-    sysctl_file: /etc/sysctl.d/ip_spoofing.conf
-- ansible.posix.sysctl:
-    name: net.ipv4.conf.all.rp_filter
-    value: 1
-    state: present
-    sysctl_file: /etc/sysctl.d/ip_spoofing.conf
-- ansible.posix.sysctl:
-    name: net.ipv4.conf.lo.rp_filter
-    value: 1
-    state: present
-    sysctl_file: /etc/sysctl.d/ip_spoofing.conf
diff --git a/roles/rocky9/tasks/sysctl_tuning.yml b/roles/rocky9/tasks/sysctl_tuning.yml
index e56ce0e..2fa2387 100644
--- a/roles/rocky9/tasks/sysctl_tuning.yml
+++ b/roles/rocky9/tasks/sysctl_tuning.yml
@@ -5,9 +5,6 @@
 - name: TCP/UDP Tuning
   ansible.builtin.include_tasks: tcp_tune.yml
 
-- name: IP ip_spoofing
-  ansible.builtin.include_tasks: ip_spoofing.yml
-
 - name: IP Forwarding
   ansible.builtin.include_tasks: ip_forward.yml
 

From d01b269593868680516eb028ef717b2199b4ca74 Mon Sep 17 00:00:00 2001
From: Alexander Kazantsev <a.kazantsev@gigacoms.ru>
Date: Fri, 15 May 2026 16:00:12 +0300
Subject: [PATCH 2/7] sysctl tuning

---
 roles/rocky9/tasks/install_packages.yml |  2 +-
 roles/rocky9/tasks/ip_bridge.yml        |  6 +--
 roles/rocky9/tasks/kernel_tune.yml      | 24 +++++-----
 roles/rocky9/tasks/sysctl_tuning.yml    | 49 ++++++-------------
 roles/rocky9/tasks/tcp_tune.yml         | 62 ++++++++++++-------------
 5 files changed, 62 insertions(+), 81 deletions(-)

diff --git a/roles/rocky9/tasks/install_packages.yml b/roles/rocky9/tasks/install_packages.yml
index 8c4be7f..1707525 100644
--- a/roles/rocky9/tasks/install_packages.yml
+++ b/roles/rocky9/tasks/install_packages.yml
@@ -94,7 +94,7 @@
 
 - name: Обновить всё
   become: true
-  ansible.builtin.package:
+  ansible.builtin.dnf:
     name: "*"
     state: latest
 
diff --git a/roles/rocky9/tasks/ip_bridge.yml b/roles/rocky9/tasks/ip_bridge.yml
index fcacfe6..82c5eff 100644
--- a/roles/rocky9/tasks/ip_bridge.yml
+++ b/roles/rocky9/tasks/ip_bridge.yml
@@ -6,19 +6,19 @@
     name: net.bridge.bridge-nf-call-ip6tables
     value: 0
     state: present
-    sysctl_file: /etc/sysctl.d/ip_bridge.conf
+    sysctl_file: /etc/sysctl.d/03-bridge.conf
   when: br_netfilter_status.stat.exists
 - name: net.bridge.bridge-nf-call-iptables
   ansible.posix.sysctl:
     name: net.bridge.bridge-nf-call-iptables
     value: 0
     state: present
-    sysctl_file: /etc/sysctl.d/ip_bridge.conf
+    sysctl_file: /etc/sysctl.d/03-bridge.conf
   when: br_netfilter_status.stat.exists
 - name: net.bridge.bridge-nf-call-arptables
   ansible.posix.sysctl:
     name: net.bridge.bridge-nf-call-arptables
     value: 0
     state: present
-    sysctl_file: /etc/sysctl.d/ip_bridge.conf
+    sysctl_file: /etc/sysctl.d/03-bridge.conf
   when: br_netfilter_status.stat.exists
diff --git a/roles/rocky9/tasks/kernel_tune.yml b/roles/rocky9/tasks/kernel_tune.yml
index 60cf6fe..d0bca50 100644
--- a/roles/rocky9/tasks/kernel_tune.yml
+++ b/roles/rocky9/tasks/kernel_tune.yml
@@ -11,7 +11,7 @@
     name: kernel.sysrq 
     value: 0
     state: present
-    sysctl_file: /etc/sysctl.d/kernel_tune.conf
+    sysctl_file: /etc/sysctl.d/01-kernel.conf
 
 # Добавление к файлу дампа ядра PID процесса
 - name: kernel.core_uses_pid
@@ -19,21 +19,21 @@
     name: kernel.core_uses_pid
     value: 1
     state: present
-    sysctl_file: /etc/sysctl.d/kernel_tune.conf
+    sysctl_file: /etc/sysctl.d/01-kernel.conf
 # Здесь указывается максимальное количество байт в одном сообщении при передачи их между процессами
 - name: kernel.msgmnb
   ansible.posix.sysctl:
     name: kernel.msgmnb
     value: 65536
     state: present
-    sysctl_file: /etc/sysctl.d/kernel_tune.conf
+    sysctl_file: /etc/sysctl.d/01-kernel.conf
 # Здесь определяется максимальный размер сообщения, которое может быть отправлено от одного процесса другому.
 - name: kernel.msgmax
   ansible.posix.sysctl:
     name: kernel.msgmax
     value: 65536
     state: present
-    sysctl_file: /etc/sysctl.d/kernel_tune.conf
+    sysctl_file: /etc/sysctl.d/01-kernel.conf
 
 # Максимальный размер (в байтах) на сегменте shared memory.
 - name: kernel.shmmax
@@ -41,14 +41,14 @@
     name: kernel.shmmax
     value: 68719476736
     state: present
-    sysctl_file: /etc/sysctl.d/kernel_tune.conf
+    sysctl_file: /etc/sysctl.d/01-kernel.conf
 # Общее количество разделяемой памяти (в страницах), какое все процессы на сервере могут использовать.
 - name: kernel.shmall
   ansible.posix.sysctl:
     name: kernel.shmall
     value: 4294967296
     state: present
-    sysctl_file: /etc/sysctl.d/kernel_tune.conf
+    sysctl_file: /etc/sysctl.d/01-kernel.conf
 
 # Лимит одновременно открытых файлов в системе
 - name: fs.file-max
@@ -56,7 +56,7 @@
     name: fs.file-max
     value: 1000000
     state: present
-    sysctl_file: /etc/sysctl.d/kernel_tune.conf
+    sysctl_file: /etc/sysctl.d/01-kernel.conf
 
 # Максимальный размер буфера приема данных для всех соединений.
 - name: net.core.rmem_max
@@ -64,32 +64,32 @@
     name: net.core.rmem_max
     value: 33554432
     state: present
-    sysctl_file: /etc/sysctl.d/kernel_tune.conf
+    sysctl_file: /etc/sysctl.d/01-kernel.conf
 # Максимальный размер буфера передачи данных для всех соединений.
 - name: net.core.wmem_max
   ansible.posix.sysctl:
     name: net.core.wmem_max
     value: 33554432
     state: present
-    sysctl_file: /etc/sysctl.d/kernel_tune.conf
+    sysctl_file: /etc/sysctl.d/01-kernel.conf
 # Размер буфера приема данных по умолчанию для всех соединений.
 - name: net.core.rmem_default
   ansible.posix.sysctl:
     name: net.core.rmem_default
     value: 8388608
     state: present
-    sysctl_file: /etc/sysctl.d/kernel_tune.conf
+    sysctl_file: /etc/sysctl.d/01-kernel.conf
 # Размер буфера передачи данных по умолчанию для всех соединений.
 - name: net.core.wmem_default
   ansible.posix.sysctl:
     name: net.core.wmem_default
     value: 4194394
     state: present
-    sysctl_file: /etc/sysctl.d/kernel_tune.conf
+    sysctl_file: /etc/sysctl.d/01-kernel.conf
 # Максимальный размер буфера приема данных для всех соединений.
 - name: net.core.optmem_max
   ansible.posix.sysctl:
     name: net.core.optmem_max
     value: 40960
     state: present
-    sysctl_file: /etc/sysctl.d/kernel_tune.conf
+    sysctl_file: /etc/sysctl.d/01-kernel.conf
diff --git a/roles/rocky9/tasks/sysctl_tuning.yml b/roles/rocky9/tasks/sysctl_tuning.yml
index 2fa2387..37c84d4 100644
--- a/roles/rocky9/tasks/sysctl_tuning.yml
+++ b/roles/rocky9/tasks/sysctl_tuning.yml
@@ -1,4 +1,17 @@
 ---
+- name: Find all files in /etc/sysctl.d
+  ansible.builtin.find:
+    paths: /etc/sysctl.d
+    recurse: yes
+    file_type: any
+  register: files_to_delete
+
+- name: Remove all files from /etc/sysctl.d
+  ansible.builtin.file:
+    path: "{{ item.path }}"
+    state: absent
+  loop: "{{ files_to_delete.files }}"
+
 - name: Kernel Tuning
   ansible.builtin.include_tasks: kernel_tune.yml
 
@@ -17,48 +30,16 @@
   ansible.builtin.include_tasks: ip_bridge.yml
   when: br_netfilter_status.stat.exists
 
-#  - name: Deploy kernel_tune.conf
-#  ansible.builtin.template:
-#    src: kernel_tune.conf.j2
-#    dest: /etc/sysctl.d/kernel_tune.conf
-#    mode: "0644"
-# - name: Deploy tcp_tune.conf
-#  ansible.builtin.template:
-#    src: tcp_tune.conf.j2
-#    dest: /etc/sysctl.d/tcp_tune.conf
-#    mode: "0644"
-# - name: Deploy ip_spoofing.conf
-#  ansible.builtin.template:
-#    src: ip_spoofing.conf.j2
-#    dest: /etc/sysctl.d/ip_spoofing.conf
-#    mode: "0644"
-# - name: Deploy ip_forward.conf
-#  ansible.builtin.template:
-#    src: ip_forward.conf.j2
-#    dest: /etc/sysctl.d/ip_forward.conf
-#    mode: "0644"
-# - name: Deploy ip_bridge.conf
-#  ansible.builtin.template:
-#    src: ip_bridge.conf.j2
-#    dest: /etc/sysctl.d/ip_bridge.conf
-#    mode: "0644"
-# - name: Deploy httpd-tune.conf
-#  ansible.builtin.template:
-#    src: httpd-tune.conf.j2
-#    dest: /etc/sysctl.d/httpd-tune.conf
-#    mode: "0644"
-# limit for using memory
-
 - name: vm.overcommit_ratio
   ansible.posix.sysctl:
     name: vm.overcommit_ratio
     value: 100
     state: present
-    sysctl_file: /etc/sysctl.d/ip_httpd.conf
+    sysctl_file: /etc/sysctl.d/04-ip_httpd.conf
 
 - name: vm.overcommit_memory
   ansible.posix.sysctl:
     name: vm.overcommit_memory
     value: 2
     state: present
-    sysctl_file: /etc/sysctl.d/ip_httpd.conf
+    sysctl_file: /etc/sysctl.d/04-ip_httpd.conf
diff --git a/roles/rocky9/tasks/tcp_tune.yml b/roles/rocky9/tasks/tcp_tune.yml
index 2109c74..7126fc5 100644
--- a/roles/rocky9/tasks/tcp_tune.yml
+++ b/roles/rocky9/tasks/tcp_tune.yml
@@ -8,7 +8,7 @@
     name: net.ipv4.tcp_syncookies
     value: 0
     state: present
-    sysctl_file: /etc/sysctl.d/tcp_tune.conf
+    sysctl_file: /etc/sysctl.d/02-tcp.conf
 
 # Векторная (минимум, по умолчанию, максимум) переменная в файле tcp_rmem содержит 3 целых числа, определяющих размер буфера сокетов TCP/UDP.
 # Минимум: каждый сокет TCP имеет право использовать эту память по факту своего создания. Возможность использования такого буфера гарантируется
@@ -25,75 +25,75 @@
     name: net.ipv4.tcp_rmem
     value: 4096 8388608 16777216
     state: present
-    sysctl_file: /etc/sysctl.d/tcp_tune.conf
+    sysctl_file: /etc/sysctl.d/02-tcp.conf
 # На передачу TCP пакетов
 - name: net.ipv4.tcp_wmem
   ansible.posix.sysctl:
     name: net.ipv4.tcp_wmem
     value: 4096 4194394 16777216
     state: present
-    sysctl_file: /etc/sysctl.d/tcp_tune.conf
+    sysctl_file: /etc/sysctl.d/02-tcp.conf
 # Для TCP протокола в целом
 - name: net.ipv4.tcp_mem
   ansible.posix.sysctl:
     name: net.ipv4.tcp_mem
     value: 8388608 12582912 16777216
     state: present
-    sysctl_file: /etc/sysctl.d/tcp_tune.conf
+    sysctl_file: /etc/sysctl.d/02-tcp.conf
 # Для UDP протокола в целом
 - name: net.ipv4.udp_mem
   ansible.posix.sysctl:
     name: net.ipv4.udp_mem
     value: 8388608 12582912 16777216
     state: present
-    sysctl_file: /etc/sysctl.d/tcp_tune.conf
+    sysctl_file: /etc/sysctl.d/02-tcp.conf
 - name: net.ipv4.udp_rmem_min
   ansible.posix.sysctl:
     name: net.ipv4.udp_rmem_min
     value: 16384
     state: present
-    sysctl_file: /etc/sysctl.d/tcp_tune.conf
+    sysctl_file: /etc/sysctl.d/02-tcp.conf
 - name: net.ipv4.udp_wmem_min
   ansible.posix.sysctl:
     name: net.ipv4.udp_wmem_min
     value: 16384
     state: present
-    sysctl_file: /etc/sysctl.d/tcp_tune.conf
+    sysctl_file: /etc/sysctl.d/02-tcp.conf
 # Параметр определяет максимальное количество пакетов в очереди на обработку, если интерфейс получает пакеты быстрее, чем ядро может их обработать.
 - name: net.core.netdev_max_backlog
   ansible.posix.sysctl:
     name: net.core.netdev_max_backlog
     value: 500000
     state: present
-    sysctl_file: /etc/sysctl.d/tcp_tune.conf
+    sysctl_file: /etc/sysctl.d/02-tcp.conf
 # Максимальное число запоминаемых запросов на соединение (TCP Syn), для которых не было получено подтверждения от подключающегося клиента.
 - name: net.ipv4.tcp_max_syn_backlog
   ansible.posix.sysctl:
     name: net.ipv4.tcp_max_syn_backlog
     value: 5480000
     state: present
-    sysctl_file: /etc/sysctl.d/tcp_tune.conf
+    sysctl_file: /etc/sysctl.d/02-tcp.conf
 # Увеличим возможное количество сокетов в состоянии TIME_WAIT.
 - name: net.ipv4.tcp_max_tw_buckets
   ansible.posix.sysctl:
     name: net.ipv4.tcp_max_tw_buckets
     value: 5480000
     state: present
-    sysctl_file: /etc/sysctl.d/tcp_tune.conf
+    sysctl_file: /etc/sysctl.d/02-tcp.conf
 # Разрешаем повторное использование TIME-WAIT сокетов в случаях, если протокол считает это безопасным.
 - name: net.ipv4.tcp_tw_reuse
   ansible.posix.sysctl:
     name: net.ipv4.tcp_tw_reuse
     value: 1
     state: present
-    sysctl_file: /etc/sysctl.d/tcp_tune.conf
+    sysctl_file: /etc/sysctl.d/02-tcp.conf
 
 # Разрешаем быструю утилизацию сокетов находящихся в состоянии TIME_WAIT DEPRICATRED
 # - ansible.posix.sysctl:
 #    name: net.ipv4.tcp_tw_recycle
 #    value: 1
 #    state: present
-#    sysctl_file: /etc/sysctl.d/tcp_tune.conf
+#    sysctl_file: /etc/sysctl.d/02-tcp.conf
 
 # Параметр tcp_fin_timeout определяет время сохранения сокета в состоянии FIN-WAIT-2 после его закрытия локальной стороной.
 # Партнер может не закрыть это соединение никогда.
@@ -102,7 +102,7 @@
     name: net.ipv4.tcp_fin_timeout
     value: 3
     state: present
-    sysctl_file: /etc/sysctl.d/tcp_tune.conf
+    sysctl_file: /etc/sysctl.d/02-tcp.conf
 # Разрешить выборочные подтверждения протокола TCP. Опция необходима для эффективного использования всей доступной
 # пропускной способности некоторых сетей
 - name: net.ipv4.tcp_sack
@@ -110,28 +110,28 @@
     name: net.ipv4.tcp_sack
     value: 1
     state: present
-    sysctl_file: /etc/sysctl.d/tcp_tune.conf
+    sysctl_file: /etc/sysctl.d/02-tcp.conf
 # Число попыток повтора передачи пакетов SYNACK для пассивных соединений TCP.
 - name: net.ipv4.tcp_synack_retries
   ansible.posix.sysctl:
     name: net.ipv4.tcp_synack_retries
     value: 1
     state: present
-    sysctl_file: /etc/sysctl.d/tcp_tune.conf
+    sysctl_file: /etc/sysctl.d/02-tcp.conf
 # Определяет максимальное число допустимых в системе сокетов TCP, не связанных каким-либо идентификатором пользовательского файла (user file handle).
 - name: net.ipv4.tcp_max_orphans
   ansible.posix.sysctl:
     name: net.ipv4.tcp_max_orphans
     value: 65536
     state: present
-    sysctl_file: /etc/sysctl.d/tcp_tune.conf
+    sysctl_file: /etc/sysctl.d/02-tcp.conf
 # Определяется число неудачных попыток, после которого уничтожается соединение TCP, закрытое на локальной стороне.
 - name: net.ipv4.tcp_orphan_retries
   ansible.posix.sysctl:
     name: net.ipv4.tcp_orphan_retries
     value: 0
     state: present
-    sysctl_file: /etc/sysctl.d/tcp_tune.conf
+    sysctl_file: /etc/sysctl.d/02-tcp.conf
 # Проверка наличия подключения по средствам keepalive сообщений. Активируется только для тех сокетов, которые были созданы с флагом SO_KEEPALIVE.
 # Через какой промежуток времени после установки подключения начать слать keepalive сообщения (в сек)
 - name: net.ipv4.tcp_keepalive_time
@@ -139,21 +139,21 @@
     name: net.ipv4.tcp_keepalive_time
     value: 600
     state: present
-    sysctl_file: /etc/sysctl.d/tcp_tune.conf
+    sysctl_file: /etc/sysctl.d/02-tcp.conf
 # Интервал, с которым слать keepalive пакеты (в сек)
 - name: net.ipv4.tcp_keepalive_intvl
   ansible.posix.sysctl:
     name: net.ipv4.tcp_keepalive_intvl
     value: 20
     state: present
-    sysctl_file: /etc/sysctl.d/tcp_tune.conf
+    sysctl_file: /etc/sysctl.d/02-tcp.conf
 # После скольки неудачных пробах считать соединение разорванным
 - name: net.ipv4.tcp_keepalive_probes
   ansible.posix.sysctl:
     name: net.ipv4.tcp_keepalive_probes
     value: 2
     state: present
-    sysctl_file: /etc/sysctl.d/tcp_tune.conf
+    sysctl_file: /etc/sysctl.d/02-tcp.conf
 # Запрещаем технологию slow start (малый размер окна) в TCP подключениях,
 # в которых долгое время не было трафика.
 - name: net.ipv4.tcp_slow_start_after_idle
@@ -161,21 +161,21 @@
     name: net.ipv4.tcp_slow_start_after_idle
     value: 0
     state: present
-    sysctl_file: /etc/sysctl.d/tcp_tune.conf
+    sysctl_file: /etc/sysctl.d/02-tcp.conf
 # Увеличиваем диапазон локальных портов, доступных для установки исходящих подключений.
 - name: net.ipv4.ip_local_port_range
   ansible.posix.sysctl:
     name: net.ipv4.ip_local_port_range
     value: 2000 65000
     state: present
-    sysctl_file: /etc/sysctl.d/tcp_tune.conf
+    sysctl_file: /etc/sysctl.d/02-tcp.conf
 # Разрешает временные метки протокола TCP. Их наличие позволяет управлять работой протокола в условиях серьезных нагрузок.
 - name: net.ipv4.tcp_timestamps
   ansible.posix.sysctl:
     name: net.ipv4.tcp_timestamps
     value: 1
     state: present
-    sysctl_file: /etc/sysctl.d/tcp_tune.conf
+    sysctl_file: /etc/sysctl.d/02-tcp.conf
 # Параметр отвечающий за алгоритмы сегментации TCP пакетов при передаче данных.
 # Cubic - алгоритм для высоконагруженных систем, но более структурированный, нежели BIC.
 # Включён по умолчанию в linux ядре начиная с версии 2.6.19
@@ -185,7 +185,7 @@
     name: net.ipv4.tcp_congestion_control
     value: bbr
     state: present
-    sysctl_file: /etc/sysctl.d/tcp_tune.conf
+    sysctl_file: /etc/sysctl.d/02-tcp.conf
 # Параметр определяет дисциплину обработки очередей 
 # FQ делят пропускную способность между всеми соединениями, даёт лучшую пропускную способность в связке с BBR
 - name: net.core.default_qdisc
@@ -193,7 +193,7 @@
     name: net.core.default_qdisc
     value: "fq"
     state: present
-    sysctl_file: /etc/sysctl.d/tcp_tune.conf
+    sysctl_file: /etc/sysctl.d/02-tcp.conf
 
 # Не сохранять результаты измерений TCP соединения в кеше при его закрытии
 - name: net.ipv4.tcp_no_metrics_save
@@ -201,7 +201,7 @@
     name: net.ipv4.tcp_no_metrics_save
     value: 1
     state: present
-    sysctl_file: /etc/sysctl.d/tcp_tune.conf
+    sysctl_file: /etc/sysctl.d/02-tcp.conf
 # Разрешаем динамическое изменение размера окна TCP стека (окно увеличивается, если не было потерь
 # пакетов при передаче в рамках TCP подключения)
 - name: net.ipv4.tcp_window_scaling
@@ -209,28 +209,28 @@
     name: net.ipv4.tcp_window_scaling
     value: 1
     state: present
-    sysctl_file: /etc/sysctl.d/tcp_tune.conf
+    sysctl_file: /etc/sysctl.d/02-tcp.conf
 # Защита от TIME_WAIT атак.
 - name: net.ipv4.tcp_rfc1337
   ansible.posix.sysctl:
     name: net.ipv4.tcp_rfc1337
     value: 1
     state: present
-    sysctl_file: /etc/sysctl.d/tcp_tune.conf
+    sysctl_file: /etc/sysctl.d/02-tcp.conf
 # Не отвечаем на ICMP ECHO запросы, переданные на широковещательный адрес.
 - name: net.ipv4.icmp_echo_ignore_broadcasts
   ansible.posix.sysctl:
     name: net.ipv4.icmp_echo_ignore_broadcasts
     value: 1
     state: present
-    sysctl_file: /etc/sysctl.d/tcp_tune.conf
+    sysctl_file: /etc/sysctl.d/02-tcp.conf
 # Не отвечаем на ошибочно сформированные сообщения.
 - name: net.ipv4.icmp_ignore_bogus_error_responses
   ansible.posix.sysctl:
     name: net.ipv4.icmp_ignore_bogus_error_responses
     value: 1
     state: present
-    sysctl_file: /etc/sysctl.d/tcp_tune.conf
+    sysctl_file: /etc/sysctl.d/02-tcp.conf
 # Максимальное число открытых сокетов, ждущих соединения.
 # Максимум в CentOS 7
 - name: net.core.somaxconn
@@ -238,4 +238,4 @@
     name: net.core.somaxconn
     value: 65535
     state: present
-    sysctl_file: /etc/sysctl.d/tcp_tune.conf
+    sysctl_file: /etc/sysctl.d/02-tcp.conf

From 090bc3a1679c786d289d39267af06da90e8e90b3 Mon Sep 17 00:00:00 2001
From: Alexander Kazantsev <a.kazantsev@gigacoms.ru>
Date: Fri, 15 May 2026 16:02:32 +0300
Subject: [PATCH 3/7] lint fix

---
 .ansible-lint                        | 1 +
 roles/rocky9/tasks/kernel_tune.yml   | 2 +-
 roles/rocky9/tasks/sysctl_tuning.yml | 2 +-
 roles/rocky9/tasks/tcp_tune.yml      | 2 +-
 4 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/.ansible-lint b/.ansible-lint
index b029eb5..b9033cb 100644
--- a/.ansible-lint
+++ b/.ansible-lint
@@ -19,3 +19,4 @@ warn_list:
 skip_list:
   - var-naming[no-role-prefix]
   - name
+  - packages-latest
diff --git a/roles/rocky9/tasks/kernel_tune.yml b/roles/rocky9/tasks/kernel_tune.yml
index d0bca50..bf7b414 100644
--- a/roles/rocky9/tasks/kernel_tune.yml
+++ b/roles/rocky9/tasks/kernel_tune.yml
@@ -8,7 +8,7 @@
 # Отключаем отслеживание ядром нажатие специальных сочетаний клавиш
 - name: kernel.sysrq
   ansible.posix.sysctl:
-    name: kernel.sysrq 
+    name: kernel.sysrq
     value: 0
     state: present
     sysctl_file: /etc/sysctl.d/01-kernel.conf
diff --git a/roles/rocky9/tasks/sysctl_tuning.yml b/roles/rocky9/tasks/sysctl_tuning.yml
index 37c84d4..a3cefd9 100644
--- a/roles/rocky9/tasks/sysctl_tuning.yml
+++ b/roles/rocky9/tasks/sysctl_tuning.yml
@@ -2,7 +2,7 @@
 - name: Find all files in /etc/sysctl.d
   ansible.builtin.find:
     paths: /etc/sysctl.d
-    recurse: yes
+    recurse: true
     file_type: any
   register: files_to_delete
 
diff --git a/roles/rocky9/tasks/tcp_tune.yml b/roles/rocky9/tasks/tcp_tune.yml
index 7126fc5..9fbe34c 100644
--- a/roles/rocky9/tasks/tcp_tune.yml
+++ b/roles/rocky9/tasks/tcp_tune.yml
@@ -186,7 +186,7 @@
     value: bbr
     state: present
     sysctl_file: /etc/sysctl.d/02-tcp.conf
-# Параметр определяет дисциплину обработки очередей 
+# Параметр определяет дисциплину обработки очередей
 # FQ делят пропускную способность между всеми соединениями, даёт лучшую пропускную способность в связке с BBR
 - name: net.core.default_qdisc
   ansible.posix.sysctl:

From 96b524bed8b14cdd65dc41419ccd3d95004c7deb Mon Sep 17 00:00:00 2001
From: Alexander Kazantsev <a.kazantsev@gigacoms.ru>
Date: Fri, 15 May 2026 16:30:28 +0300
Subject: [PATCH 4/7] fix

---
 roles/rocky9/tasks/main.yml           |  3 ---
 roles/rocky9/tasks/security_setup.yml | 12 ++++++------
 2 files changed, 6 insertions(+), 9 deletions(-)

diff --git a/roles/rocky9/tasks/main.yml b/roles/rocky9/tasks/main.yml
index 00355dd..2af5f13 100644
--- a/roles/rocky9/tasks/main.yml
+++ b/roles/rocky9/tasks/main.yml
@@ -12,9 +12,6 @@
     group: root
     mode: "0644"
 
-#- name: Create users
-#  ansible.builtin.include_tasks: create_users.yml
-
 - name: Syctl tuning
   ansible.builtin.include_tasks: sysctl_tuning.yml
 
diff --git a/roles/rocky9/tasks/security_setup.yml b/roles/rocky9/tasks/security_setup.yml
index 600a4b1..b597e00 100644
--- a/roles/rocky9/tasks/security_setup.yml
+++ b/roles/rocky9/tasks/security_setup.yml
@@ -1,7 +1,7 @@
 ---
 - name: Установка зависимостей SELinux
   become: true
-  package:
+  ansible.builtin.package:
     name: "{{ (ansible_facts['distribution_major_version'] | int >= 8) | ternary('python3-libselinux', 'libselinux-python') }}"
     state: present
 
@@ -9,11 +9,11 @@
   ansible.posix.selinux:
     state: disabled
 
-- name: Explicitly specifying positional matched groups in replacement
-  ansible.builtin.replace:
-    path: /etc/ssh/sshd_config
-    regexp: ^(ListenAddress[ ]+)[^\n]+$
-    replace: \g<1>0.0.0.0
+#- name: Explicitly specifying positional matched groups in replacement
+#  ansible.builtin.replace:
+#    path: /etc/ssh/sshd_config
+#    regexp: ^(ListenAddress[ ]+)[^\n]+$
+#    replace: \g<1>0.0.0.0
 
 # - name: Disable Root Login
 #   template:

From 8b1b0b8dc5e7e28672b09f8b3983c819dd6c4396 Mon Sep 17 00:00:00 2001
From: Alexander Kazantsev <a.kazantsev@gigacoms.ru>
Date: Fri, 15 May 2026 21:08:06 +0300
Subject: [PATCH 5/7] lint fixes

---
 roles/rocky9/tasks/ip_forward.yml     |  2 +-
 roles/rocky9/tasks/security_setup.yml |  2 +-
 roles/root-cert/tasks/red_hat.yml     | 14 ++++++++++----
 3 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/roles/rocky9/tasks/ip_forward.yml b/roles/rocky9/tasks/ip_forward.yml
index e75f38b..c9f76c4 100644
--- a/roles/rocky9/tasks/ip_forward.yml
+++ b/roles/rocky9/tasks/ip_forward.yml
@@ -21,7 +21,7 @@
 # Когда rp_filter нужно отключать (0) или ослаблять (2):
 # - Использование асимметричной маршрутизации (когда пакеты приходят через провайдера А, а уходят через провайдера Б).
 # - Настройка сложных схем балансировки трафика (BGP, Multipath).
-# - Использование политик маршрутизации (Policy Based Routing via ip rule). 
+# - Использование политик маршрутизации (Policy Based Routing via ip rule).
 #   При строгом режиме 1 ядро проверяет обратный путь по дефолтной таблице main,
 #   игнорируя кастомные таблицы, что приводит к ложному отбрасыванию пакетов.
 - name: net.ipv4.conf.default.rp_filter
diff --git a/roles/rocky9/tasks/security_setup.yml b/roles/rocky9/tasks/security_setup.yml
index b597e00..b652dba 100644
--- a/roles/rocky9/tasks/security_setup.yml
+++ b/roles/rocky9/tasks/security_setup.yml
@@ -9,7 +9,7 @@
   ansible.posix.selinux:
     state: disabled
 
-#- name: Explicitly specifying positional matched groups in replacement
+# - name: Explicitly specifying positional matched groups in replacement
 #  ansible.builtin.replace:
 #    path: /etc/ssh/sshd_config
 #    regexp: ^(ListenAddress[ ]+)[^\n]+$
diff --git a/roles/root-cert/tasks/red_hat.yml b/roles/root-cert/tasks/red_hat.yml
index a7e7f70..8a8d84d 100644
--- a/roles/root-cert/tasks/red_hat.yml
+++ b/roles/root-cert/tasks/red_hat.yml
@@ -1,21 +1,27 @@
 ---
 - name: Make sure the folder exists (Red Hat)
-  file:
+  ansible.builtin.file:
     path: /etc/pki/ca-trust/source/anchors
     state: directory
+    owner: root
+    group: root
+    mode: "0755"
 
 - name: Copy PEM into folder (Red Hat)
-  copy:
+  ansible.builtin.copy:
     src: "{{ install_root_cert_pem }}"
     dest: "/etc/pki/ca-trust/source/anchors/{{ install_root_cert_pem | basename }}"
+    owner: root
+    group: root
+    mode: "0644"
   register: result
 
 - name: Update CA Trust (Red Hat)
-  command: update-ca-trust
+  ansible.builtin.command: update-ca-trust
   when: result is changed
 
 - name: Update CA Trust (Red Hat < 7)
-  command: update-ca-trust enable
+  ansible.builtin.command: update-ca-trust enable
   when:
     - result is changed
     - ansible_distribution_version|int < 7

From 04a8acf0aaa9bd9cb1c80a92eab846cc32692a9f Mon Sep 17 00:00:00 2001
From: Alexander Kazantsev <a.kazantsev@gigacoms.ru>
Date: Fri, 15 May 2026 21:13:55 +0300
Subject: [PATCH 6/7] lint fixes

---
 playbooks/rocky9.yml              | 9 ++++-----
 roles/rocky9/defaults/main.yml    | 7 -------
 roles/root-cert/defaults/main.yml | 2 +-
 roles/root-cert/tasks/darwin.yml  | 6 +++---
 roles/root-cert/tasks/debian.yml  | 6 +++---
 roles/root-cert/tasks/main.yml    | 2 +-
 6 files changed, 12 insertions(+), 20 deletions(-)

diff --git a/playbooks/rocky9.yml b/playbooks/rocky9.yml
index 48e22ff..2c85bcc 100644
--- a/playbooks/rocky9.yml
+++ b/playbooks/rocky9.yml
@@ -1,7 +1,7 @@
 ---
 - name: Initial Rocky9 Configuration
 
-  hosts: 
+  hosts:
     - rocky9-template
   # kuber-node01
   #    - 172.20.21.193
@@ -18,8 +18,8 @@
     - openssh
 
   vars:
-    #ansible_ssh_user: root
-    #ansible_ssh_password: nmklop90
+    # ansible_ssh_user: root
+    # ansible_ssh_password: nmklop90
     epel_repo: true
     reboot_system: false
     hostname: "{{ ansible_hostname }}.local.mrwho.ru"
@@ -31,7 +31,7 @@
     openssh_enable_persourcepenalties: true
     openssh_persource_authfail_penalty: "10s"  # Aggressive penalty
     openssh_persource_maxstartups: "5:30:10"   # Very restrictive
-    # Disable all port forwarding 
+    # Disable all port forwarding
     openssh_disable_forwarding_comprehensive: false
     openssh_x11_forwarding: false
     # Restrict to strongest cryptography only
@@ -69,4 +69,3 @@
       - root
       - admin
       - test
-
diff --git a/roles/rocky9/defaults/main.yml b/roles/rocky9/defaults/main.yml
index 8263697..67d9f55 100644
--- a/roles/rocky9/defaults/main.yml
+++ b/roles/rocky9/defaults/main.yml
@@ -1,11 +1,4 @@
 ---
-#hostname: centos01.local.mrwho.ru
-#ip4_addr: 172.20.21.101/24
-#ip4_gate: 172.20.21.1
-#ip4_dns:
-#  - 172.20.21.1
-#  - 192.168.1.1
-#reboot_system: false
 
 epel_repo_url: "https://dl.fedoraproject.org/pub/epel/epel-release-latest-{{ ansible_facts.distribution_major_version }}.noarch.rpm"
 epel_repo_gpg_key_url: "https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-{{ ansible_facts.distribution_major_version }}"
diff --git a/roles/root-cert/defaults/main.yml b/roles/root-cert/defaults/main.yml
index d9bbe20..b1d336d 100644
--- a/roles/root-cert/defaults/main.yml
+++ b/roles/root-cert/defaults/main.yml
@@ -1,2 +1,2 @@
 ---
-install_root_cert_pem: root_ca.crt
\ No newline at end of file
+install_root_cert_pem: root_ca.crt
diff --git a/roles/root-cert/tasks/darwin.yml b/roles/root-cert/tasks/darwin.yml
index 8840c0f..cc4f94d 100644
--- a/roles/root-cert/tasks/darwin.yml
+++ b/roles/root-cert/tasks/darwin.yml
@@ -4,12 +4,12 @@
 
 - block:
   - name: Copy certificate to temporary location
-    copy:
+    ansible.builtin.copy:
       src: "{{ install_root_cert_pem }}"
       dest: "{{ install_root_cert_tmp_path }}"
 
   - name: Add certificate to Mac OS keychain
-    command: security add-trusted-cert -d -r trustRoot -k "/Library/Keychains/System.keychain" "{{ install_root_cert_tmp_path }}"
+    ansible.builtin.command: security add-trusted-cert -d -r trustRoot -k "/Library/Keychains/System.keychain" "{{ install_root_cert_tmp_path }}"
 
   # - name: Add certificate to Mac OS (openssl)
   #   copy:
@@ -21,6 +21,6 @@
 
   always:
     - name: Remove temporary certificate
-      file:
+      ansible.builtin.file:
         path: "{{ install_root_cert_tmp_path }}"
         state: absent
diff --git a/roles/root-cert/tasks/debian.yml b/roles/root-cert/tasks/debian.yml
index c97ceef..191a050 100644
--- a/roles/root-cert/tasks/debian.yml
+++ b/roles/root-cert/tasks/debian.yml
@@ -1,16 +1,16 @@
 ---
 - name: Make sure the folder exists (Debian, Ubuntu)
-  file:
+  ansible.builtin.file:
     path: /usr/local/share/ca-certificates
     state: directory
 
 # Note that the .crt is actually a .pem renamed
 - name: Copy the certificate (Debian, Ubuntu)
-  copy:
+  ansible.builtin.copy:
     src: "{{ install_root_cert_pem }}"
     dest: "/usr/local/share/ca-certificates/{{ install_root_cert_pem | basename }}.crt"
   register: result
 
 - name: Update CA Trust (Debian, Ubuntu)
-  command: update-ca-certificates
+  ansible.builtin.command: update-ca-certificates
   when: result is changed
diff --git a/roles/root-cert/tasks/main.yml b/roles/root-cert/tasks/main.yml
index edec5bf..1e284f3 100644
--- a/roles/root-cert/tasks/main.yml
+++ b/roles/root-cert/tasks/main.yml
@@ -1,5 +1,5 @@
 ---
-#- name: Check that the root certificate exists
+# - name: Check that the root certificate exists
 #  become: no
 #  local_action: "stat path={{ install_root_cert_pem }}"
 #  register: result

From 39145902871af46589d5e9fd196edbf6dd8ea849 Mon Sep 17 00:00:00 2001
From: Alexander Kazantsev <a.kazantsev@gigacoms.ru>
Date: Fri, 15 May 2026 21:20:01 +0300
Subject: [PATCH 7/7] lint

---
 roles/openssh/meta/main.yml              | 6 +++---
 roles/rocky9/tasks/set_nic_names_eth.yml | 2 +-
 roles/root-cert/tasks/darwin.yml         | 8 ++++----
 3 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/roles/openssh/meta/main.yml b/roles/openssh/meta/main.yml
index b1ec81b..caf0035 100644
--- a/roles/openssh/meta/main.yml
+++ b/roles/openssh/meta/main.yml
@@ -41,9 +41,9 @@ galaxy_info:
         - "10"
     - name: Rocky
       versions:
-        - "8"
-        - "9"
-        - "10"
+        - "8.0"
+        - "9.0"
+        - "all"
     - name: Fedora
       versions:
         - "43"
diff --git a/roles/rocky9/tasks/set_nic_names_eth.yml b/roles/rocky9/tasks/set_nic_names_eth.yml
index 98149a0..9aa9843 100644
--- a/roles/rocky9/tasks/set_nic_names_eth.yml
+++ b/roles/rocky9/tasks/set_nic_names_eth.yml
@@ -91,4 +91,4 @@
     owner: root
     group: root
     mode: "0644"
-  loop: "{{ physical_interfaces[0:] }}"
\ No newline at end of file
+  loop: "{{ physical_interfaces[0:] }}"
diff --git a/roles/root-cert/tasks/darwin.yml b/roles/root-cert/tasks/darwin.yml
index cc4f94d..c28e611 100644
--- a/roles/root-cert/tasks/darwin.yml
+++ b/roles/root-cert/tasks/darwin.yml
@@ -3,10 +3,10 @@
     install_root_cert_tmp_path: "{{ install_root_cert_tmp_folder }}/{{ install_root_cert_pem | basename }}"
 
 - block:
-  - name: Copy certificate to temporary location
-    ansible.builtin.copy:
-      src: "{{ install_root_cert_pem }}"
-      dest: "{{ install_root_cert_tmp_path }}"
+    - name: Copy certificate to temporary location
+      ansible.builtin.copy:
+        src: "{{ install_root_cert_pem }}"
+       dest: "{{ install_root_cert_tmp_path }}"
 
   - name: Add certificate to Mac OS keychain
     ansible.builtin.command: security add-trusted-cert -d -r trustRoot -k "/Library/Keychains/System.keychain" "{{ install_root_cert_tmp_path }}"