Fix all ansible-lint production profile violations

Resolves all 151 violations flagged by ansible-lint at the production
profile. Changes by category:

yaml[truthy]
  Replace yes/no with true/false throughout all task files, defaults,
  handlers, molecule playbooks and inventory group_vars.

name[play], name[missing], name[template]
  Name every previously-unnamed play and include_tasks call; rewrite
  task names that embed Jinja templates in a non-trailing position to
  use plain English descriptions instead.

no-changed-when
  Add changed_when to every command/shell/raw task that lacked it:
  - 'Test' echo task (changed_when: false)
  - mkswap / swapon swap tasks (changed_when reflects actual change)
  - raw bootstrap tasks in molecule prepare playbooks (changed_when: false)
  - Superset admin-user create command (changed_when: true — always runs)
  - nginx test-and-reload shell (changed_when: true)

risky-file-permissions
  Add mode: "0644" to nginx config template tasks that were missing it.

command-instead-of-module
  Replace 'command: systemctl daemon-reload' handler with
  ansible.builtin.systemd(daemon_reload: true).
  Suppress the remaining curl|sh uv-installer task with # noqa since
  the uv standalone installer has no module equivalent.

risky-shell-pipe
  Add set -o pipefail to the uv installer shell command.

jinja[spacing]
  Fix {{home_dir}}/www → {{ home_dir }}/www in django defaults.

yaml[brackets], yaml[trailing-spaces], yaml[indentation]
  Fix formatting in .github/workflows/molecule-test.yml.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: kaapstorm

.github/workflows/molecule-test.yml

@@ -1,38 +1,37 @@
+---
 name: Molecule Test
 
 on:
   push:
-    branches: [ master, nh/refactor ]
+    branches: [master, nh/refactor]
   pull_request:
-    branches: [ master, nh/refactor ]
-
+    branches: [master, nh/refactor]
 jobs:
   test:
     name: Molecule Test
     runs-on: ubuntu-latest
     strategy:
       matrix:
         role: [postgres, redis, nginx]
-    
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v4
-    
-    - name: Set up Python
-      uses: actions/setup-python@v4
-      with:
-        python-version: '3.11'
-    
-    - name: Install dependencies
-      run: |
-        python -m pip install --upgrade pip
-        pip install ansible molecule molecule-docker docker
-        ansible-galaxy collection install -r requirements.yml
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: "3.11"
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install ansible molecule molecule-docker docker
+          ansible-galaxy collection install -r requirements.yml
 
-    - name: Run Molecule test
-      run: |
-        cd roles/${{ matrix.role }}
-        molecule test
-      env:
-        PY_COLORS: '1'
-        ANSIBLE_FORCE_COLOR: '1'
+      - name: Run Molecule test
+        run: |
+          cd roles/${{ matrix.role }}
+          molecule test
+        env:
+          PY_COLORS: "1"
+          ANSIBLE_FORCE_COLOR: "1"

.readthedocs.yml

@@ -1,3 +1,4 @@
+---
 # See https://docs.readthedocs.io/en/stable/config-file/v2.html for details
 
 version: 2

commcare_sync.yml

@@ -1,14 +1,14 @@
 ---
 # Issue: https://github.com/ansible/ansible/issues/57529#issuecomment-513143430
-- hosts: all
+- name: Gather facts
+  hosts: all
 
 - name: Create CommCare Data Pipeline server.
   hosts: all
-  become: yes
+  become: true
   become_user: root
 
-  gather_facts: no
-
+  gather_facts: false
 
   roles:
     - postgres
@@ -18,5 +18,3 @@
       when: superset_enabled
     - django
     - commcare_sync
-
-...

git-hooks/install.sh

@@ -0,0 +1,52 @@
+#!/bin/bash
+
+function usage()
+{
+    cat << EOF
+usage: $0 options
+
+This script installs git hooks
+
+OPTIONS:
+   -h      Show this message
+   -f      don't ask before overwriting your current git hooks
+   -r      remove existing hooks but do not add the new ones
+EOF
+}
+
+OPT='-i'
+FUNC='link_hooks'
+
+while getopts "hfr" OPTION
+do
+    case $OPTION in
+        h)
+            usage
+            exit
+            ;;
+        f)
+            OPT='-f'
+            ;;
+        r)
+            FUNC='remove_hooks'
+            ;;
+        ?)
+            usage
+            exit 1
+            ;;
+    esac
+done
+
+function link_hooks() {
+    hook=$1
+    base_path=$2
+    ln -s -f $OPT ../../git-hooks/$hook.sh $base_path/hooks/$hook
+}
+
+function remove_hooks() {
+    hook=$1
+    base_path=$2
+    rm $OPT $base_path/hooks/$hook
+}
+
+${FUNC} 'pre-commit' '.git'

git-hooks/pre-commit.sh

@@ -0,0 +1,41 @@
+#!/bin/bash
+#
+# Pre-commit hook that verifies if all files containing 'vault' in the name
+# are encrypted.
+# If not, commit will fail with an error message
+#
+# File should be .git/hooks/pre-commit and executable
+VAULT_FILE_INCLUDE_PATTERN='(/vault.yml|.*.vault|.*vault.*)$'
+VAULT_FILE_EXCLUDE_PATTERN='^tests|development|^src/commcare_cloud/environment/secrets/backends/ansible_vault/|src/commcare_cloud/manage_commcare_cloud/list_vault_keys.py'
+REQUIRED='ANSIBLE_VAULT'
+
+EXIT_STATUS=0
+wipe="\033[1m\033[0m"
+yellow='\033[1;33m'
+# carriage return hack. Leave it on 2 lines.
+cr='
+'
+for f in $(git diff --cached --name-only | grep -E "$VAULT_FILE_INCLUDE_PATTERN" | grep -E -v "$VAULT_FILE_EXCLUDE_PATTERN")
+do
+  MATCH=`grep -L $REQUIRED $f | head -n 1`
+  if [ -n "${MATCH// }" ] ; then
+    UNENCRYPTED_FILES="$f$cr$UNENCRYPTED_FILES"
+    EXIT_STATUS=1
+  fi
+done
+if [ $EXIT_STATUS = 0 ] ; then
+  exit 0
+else
+  echo '# COMMIT REJECTED'
+  echo '# Looks like unencrypted ansible-vault files are part of the commit:'
+  echo '#'
+  while read -r line; do
+    if [ -n "$line" ]; then
+      echo -e "#\t${yellow}unencrypted:   $line${wipe}"
+    fi
+  done <<< "$UNENCRYPTED_FILES"
+  echo '#'
+  echo "# Please encrypt them with 'ansible-vault encrypt <file>'"
+  echo "#   (or force the commit with '--no-verify')."
+  exit $EXIT_STATUS
+fi

inventories/dev/group_vars/commcare_sync/vars.yml

@@ -2,19 +2,17 @@
 
 public_host: 192.168.11.10
 
-superset_enabled: yes
-superset_public_host: superset.vagrant.local  # this needs to be manually mapped to 192.168.11.10 in /etc/hosts
+superset_enabled: true
+superset_public_host: superset.vagrant.local # this needs to be manually mapped to 192.168.11.10 in /etc/hosts
 superset_feature_flags: []
-
 app_user: "{{ ansible_user }}"
 
-django_allow_public_signups: no
+django_allow_public_signups: false
 
 # These variables are encrypted and stored in an ansible vault:
 vault_default_db_password: <secret1>
 vault_default_superset_password: <secret2>
 vault_mapbox_api_key: <secret3>
 vault_django_secret_key: <secret4>
-vault_django_fernet_keys: '["<secret5>"]'  # JSON-formatted list
+vault_django_fernet_keys: '["<secret5>"]' # JSON-formatted list
 vault_superset_secret_key: <secret6>
-...

inventories/dev/hosts.yml

@@ -11,5 +11,3 @@ all:
     commcare_sync:
       hosts:
         local1:
-
-...

inventories/example/group_vars/commcare_sync/vars.yml

@@ -2,7 +2,7 @@
 
 public_host: commcare-sync.example.com
 
-superset_enabled: yes
+superset_enabled: true
 superset_public_host: superset.example.com
 
 app_user: "{{ ansible_user }}"
@@ -11,6 +11,4 @@ app_user: "{{ ansible_user }}"
 postgresql_backup_enabled: false
 # Add any other DBs separated with spaces
 postgresql_backup_db_list: "superset"
-postgresql_backups_to_keep: 5  # 0 will ignore this setting
-
-...
+postgresql_backups_to_keep: 5 # 0 will ignore this setting

inventories/example/hosts.yml

@@ -11,4 +11,3 @@ all:
     commcare_sync:
       hosts:
         local1:
-...

roles/commcare_sync/defaults/main.yml

@@ -3,23 +3,21 @@
 ansible_python_interpreter: /usr/bin/python3
 base_python_package: "python3"
 
-apt_update_cache: yes
+apt_update_cache: true
 
-swap_file_enabled: no
+swap_file_enabled: false
 swap_file: /swapfile
 swap_file_size_kb: 512
 
-ssl_enabled: no
+ssl_enabled: false
 
 superset_secret_key: "{{ vault_superset_secret_key }}"
 
-certbot_auto_renew: yes
+certbot_auto_renew: true
 
 certbot_script: /opt/certbot-auto
 certbot_dir: /etc/letsencrypt
 certbot_admin_email: admin@example.com
 certbot_domains:
   - example.com
   - www.example.com
-
-...