From 8b1b0b8dc5e7e28672b09f8b3983c819dd6c4396 Mon Sep 17 00:00:00 2001
From: Alexander Kazantsev <a.kazantsev@gigacoms.ru>
Date: Fri, 15 May 2026 21:08:06 +0300
Subject: [PATCH] lint fixes

---
 roles/rocky9/tasks/ip_forward.yml     |  2 +-
 roles/rocky9/tasks/security_setup.yml |  2 +-
 roles/root-cert/tasks/red_hat.yml     | 14 ++++++++++----
 3 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/roles/rocky9/tasks/ip_forward.yml b/roles/rocky9/tasks/ip_forward.yml
index e75f38b..c9f76c4 100644
--- a/roles/rocky9/tasks/ip_forward.yml
+++ b/roles/rocky9/tasks/ip_forward.yml
@@ -21,7 +21,7 @@
 # Когда rp_filter нужно отключать (0) или ослаблять (2):
 # - Использование асимметричной маршрутизации (когда пакеты приходят через провайдера А, а уходят через провайдера Б).
 # - Настройка сложных схем балансировки трафика (BGP, Multipath).
-# - Использование политик маршрутизации (Policy Based Routing via ip rule). 
+# - Использование политик маршрутизации (Policy Based Routing via ip rule).
 #   При строгом режиме 1 ядро проверяет обратный путь по дефолтной таблице main,
 #   игнорируя кастомные таблицы, что приводит к ложному отбрасыванию пакетов.
 - name: net.ipv4.conf.default.rp_filter
diff --git a/roles/rocky9/tasks/security_setup.yml b/roles/rocky9/tasks/security_setup.yml
index b597e00..b652dba 100644
--- a/roles/rocky9/tasks/security_setup.yml
+++ b/roles/rocky9/tasks/security_setup.yml
@@ -9,7 +9,7 @@
   ansible.posix.selinux:
     state: disabled
 
-#- name: Explicitly specifying positional matched groups in replacement
+# - name: Explicitly specifying positional matched groups in replacement
 #  ansible.builtin.replace:
 #    path: /etc/ssh/sshd_config
 #    regexp: ^(ListenAddress[ ]+)[^\n]+$
diff --git a/roles/root-cert/tasks/red_hat.yml b/roles/root-cert/tasks/red_hat.yml
index a7e7f70..8a8d84d 100644
--- a/roles/root-cert/tasks/red_hat.yml
+++ b/roles/root-cert/tasks/red_hat.yml
@@ -1,21 +1,27 @@
 ---
 - name: Make sure the folder exists (Red Hat)
-  file:
+  ansible.builtin.file:
     path: /etc/pki/ca-trust/source/anchors
     state: directory
+    owner: root
+    group: root
+    mode: "0755"
 
 - name: Copy PEM into folder (Red Hat)
-  copy:
+  ansible.builtin.copy:
     src: "{{ install_root_cert_pem }}"
     dest: "/etc/pki/ca-trust/source/anchors/{{ install_root_cert_pem | basename }}"
+    owner: root
+    group: root
+    mode: "0644"
   register: result
 
 - name: Update CA Trust (Red Hat)
-  command: update-ca-trust
+  ansible.builtin.command: update-ca-trust
   when: result is changed
 
 - name: Update CA Trust (Red Hat < 7)
-  command: update-ca-trust enable
+  ansible.builtin.command: update-ca-trust enable
   when:
     - result is changed
     - ansible_distribution_version|int < 7