fix(roles): set become: false on tasks delegated to localhost

When a playbook sets `become: true` at the play level, tasks
delegated to the controller (`delegate_to: 'localhost'`) inherit
that and try to call sudo on the controller, failing with
`sudo: a password is required` when the controller has no
passwordless sudo. Set `become: false` explicitly on every such
task across the collection.

Also sets the missing `run_once: true` in
`repo_monitoring_plugins/tasks/RedHat.yml` to match the Debian
variant, demonstrates the pattern in `roles/example`, and
documents it in CONTRIBUTING.md.

Closes #242

Author: markuslf

CHANGELOG.md

@@ -24,6 +24,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+* **role:example**: Demonstrate the `delegate_to: 'localhost'` + `become: false` pattern (download on the controller, copy to the target) so role authors can copy it consistently.
 * **role:apache_httpd**: bump Core Rule Set to 4.26.0
 * **role:apache_httpd**: Update the two reverse-proxy snippets in `EXAMPLES.md` to use `ProxyPass` instead of `RewriteRule ^/(.*) ... [proxy,last]`. The RewriteRule variant `%`-decodes the URI pattern and forwards characters such as `?` unencoded to the backend, which breaks WebDAV apps (file-not-found on rename in Nextcloud). The examples now also carry a comment explaining the choice and link to the corresponding [blog post](https://www.linuxfabrik.ch/blog/nextcloud-rewriterules-vs-proxypass).
 
@@ -50,6 +51,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+* **roles**: Set `become: false` on tasks delegated to localhost across the collection. Previously these tasks inherited `become: true` from the playbook level and tried to call `sudo` on the Ansible controller, which fails on controllers without a passwordless sudo setup with `sudo: a password is required`. Affected are all `repo_*` roles, the `*_vm` cloud roles (`exoscale_vm`, `hetzner_vm`, `infomaniak_vm`), all `icingaweb2_module_*` roles that download artefacts, `monitoring_plugins`, `shared`, plus several others. Existing playbooks that were working without playbook-level `become: true` are unaffected ([#242](https://github.com/Linuxfabrik/lfops/issues/242)).
+* **role:repo_monitoring_plugins**: Add the missing `run_once: true` on the local repo-key download task on Red Hat platforms, matching the Debian variant. The key is now downloaded once per run instead of once per host.
 * **role:network**: README still claimed the role disables zeroconf, but the corresponding `NOZEROCONF=yes` task was removed in 2024 (NetworkManager no longer adds the zeroconf route by default). Bring the README in line with what the role actually does and call out the Hetzner-specific `hc-utils` cleanup explicitly.
 * **role:haveged**: Setting `haveged__service_state: 'stopped'` produced the invalid systemctl command `stopp` because of a `[:-2]` slice in the task name. The role now uses `ansible.builtin.service` directly with the configured state, so all four valid values (`reloaded` / `restarted` / `started` / `stopped`) work as expected.
 * **role:unattended_upgrades**: Correct README description; the role deactivates Unattended Upgrades by setting both `APT::Periodic` flags to `0` in `/etc/apt/apt.conf.d/20auto-upgrades` (Debian/Ubuntu), it does not remove the `unattended-upgrades` package.

CONTRIBUTING.md

@@ -259,6 +259,21 @@ When creating a new role, make sure to deliver:
     * `ansible.builtin.template` over `ansible.builtin.copy`, `ansible.builtin.lineinfile` or `ansible.builtin.blockinfile`. Templating the whole file leads to more consistent, deterministic, and expected results.
 * Do not use `state: 'latest'` for the `ansible.builtin.package` module as this is not idempotent. Always use `state: 'present'`.
 * Always use `delegate_to: 'localhost'` instead of `local_action`.
+* Always set `become: false` on every task delegated to localhost. When a play sets `become: true` at the play level (the typical case), it propagates to delegated tasks too and tries to escalate via sudo on the Ansible controller. On a controller without passwordless sudo this fails with `sudo: a password is required`, even though the delegated task only writes to `/tmp` or hits a remote API and does not need root locally. Example:
+
+    ```yaml
+    - name: 'curl --output /tmp/ansible.example.tar.gz https://example.com/releases/example.tar.gz'
+      ansible.builtin.get_url:
+        url: 'https://example.com/releases/example.tar.gz'
+        dest: '/tmp/ansible.example.tar.gz'
+        mode: 0o644
+      delegate_to: 'localhost'
+      become: false
+      run_once: true
+      changed_when: false # not an actual config change on the target
+      check_mode: false # run task even if `--check` is specified
+    ```
+
 * Always provide `changed_when`, `creates`, or `removes` for `ansible.builtin.command` and `ansible.builtin.shell` tasks to ensure idempotency. Use `changed_when: false` for read-only commands.
 * When deploying files with `ansible.builtin.template`, always set `backup`, `src`, `dest`, `owner`, `group`, and `mode`.
 * Prefer `ansible.builtin.assert` over `ansible.builtin.fail` with `when` for validation checks. There is basically no technical difference; this guideline is only for consistency.

roles/acme_sh/tasks/issue-cert.yml

@@ -6,6 +6,7 @@
   check_mode: false # run task even if `--check` is specified
   register: 'acme_sh__curl_result'
   delegate_to: 'localhost'
+  become: false
 
 - name: 'check if acme-challenge was reachable'
   ansible.builtin.assert:

roles/apache_solr/tasks/main.yml

@@ -11,6 +11,7 @@
       dest: '/tmp/solr-{{ apache_solr__version }}.tgz'
       checksum: '{{ apache_solr__checksum }}'
     delegate_to: 'localhost'
+    become: false
     check_mode: false # run task even if `--check` is specified
     changed_when: false # just gathering info, no actual change
     when:
@@ -22,6 +23,7 @@
       dest: '/tmp/solr-{{ apache_solr__version }}.tgz'
       checksum: '{{ apache_solr__checksum }}'
     delegate_to: 'localhost'
+    become: false
     check_mode: false # run task even if `--check` is specified
     changed_when: false # just gathering info, no actual change
     when:

roles/blocky/tasks/main.yml

@@ -30,6 +30,7 @@
       register: 'blocky__github_release'
       check_mode: false # run task even if `--check` is specified
       delegate_to: 'localhost'
+      become: false
       run_once: true
 
     - name: 'Store the latest release version'
@@ -45,6 +46,7 @@
       dest: '/tmp/ansible.blocky_{{ blocky__github_version }}_Linux_x86_64.tar.gz'
       mode: 0o644
     delegate_to: 'localhost'
+    become: false
     changed_when: false # not an actual config change on the server
     check_mode: false # run task even if `--check` is specified
 
@@ -53,6 +55,7 @@
       src: '/tmp/ansible.blocky_{{ blocky__github_version }}_Linux_x86_64.tar.gz'
       dest: '/tmp'
     delegate_to: 'localhost'
+    become: false
     ignore_errors: '{{ ansible_check_mode }}' # ignore errors if `--check` is specified
 
   - name: 'scp /tmp/blocky {{ inventory_hostname }}:/usr/local/sbin/blocky'

roles/example/tasks/main.yml

@@ -84,13 +84,26 @@
       name: '{{ __example__required_packages }}'
       state: 'present'
 
-  - name: 'curl --output /tmp/example-{{ example__version }}.tar.gz https://example.com/releases/example-{{ example__version }}.tar.gz'
+  # download on the controller (`delegate_to: 'localhost'`) and copy to the target afterwards,
+  # so that targets without internet access can still be provisioned.
+  # always set `become: false` on tasks delegated to localhost. otherwise `become: true`
+  # from the playbook level propagates and triggers sudo on the controller, which is
+  # unneeded for a download into /tmp and usually fails because no sudo password is set.
+  - name: 'curl --output /tmp/ansible.example-{{ example__version }}.tar.gz https://example.com/releases/example-{{ example__version }}.tar.gz' # noqa risky-file-permissions (temporary file)
     ansible.builtin.get_url:
       url: 'https://example.com/releases/example-{{ example__version }}.tar.gz'
-      dest: '/tmp/example-{{ example__version }}.tar.gz'
-      owner: 'root'
-      group: 'root'
+      dest: '/tmp/ansible.example-{{ example__version }}.tar.gz'
       mode: 0o644
+    delegate_to: 'localhost'
+    become: false
+    run_once: true
+    changed_when: false # not an actual config change on the target
+    check_mode: false # run task even if `--check` is specified
+
+  - name: 'Copy /tmp/ansible.example-{{ example__version }}.tar.gz to the target' # noqa risky-file-permissions (temporary file)
+    ansible.builtin.copy:
+      src: '/tmp/ansible.example-{{ example__version }}.tar.gz'
+      dest: '/tmp/example-{{ example__version }}.tar.gz'
 
   - name: 'tar xzf /tmp/example-{{ example__version }}.tar.gz -C /opt/example'
     ansible.builtin.unarchive:

roles/exoscale_vm/tasks/main.yml

@@ -8,6 +8,7 @@
       name: '{{ exoscale_vm__name }}'
       state: 'present'
     delegate_to: 'localhost'
+    become: false
     when:
       - 'exoscale_vm__security_group_rules is defined and exoscale_vm__security_group_rules | length > 0'
       - 'exoscale_vm__state != "absent"'
@@ -26,6 +27,7 @@
       type: '{{ item["type"] | default("ingress") }}'
     loop: '{{ exoscale_vm__security_group_rules }}'
     delegate_to: 'localhost'
+    become: false
     when:
       - 'exoscale_vm__security_group_rules is defined and exoscale_vm__security_group_rules | length > 0'
       - 'exoscale_vm__state != "absent"'
@@ -61,6 +63,7 @@
       --output-format json
     register: 'exoscale_vm__instance_list_result'
     delegate_to: 'localhost'
+    become: false
     changed_when: false # just gathering information, no actual change happening here
 
   - name: 'Create the VM at Exoscale'
@@ -82,6 +85,7 @@
       {% endif %}
       '{{ exoscale_vm__name }}'
     delegate_to: 'localhost'
+    become: false
     when:
       - 'exoscale_vm__state != "absent"'
       - 'exoscale_vm__name not in  exoscale_vm__instance_list_result["stdout"] | from_json | map(attribute="name")'
@@ -95,6 +99,7 @@
       --force
       '{{ exoscale_vm__name }}'
     delegate_to: 'localhost'
+    become: false
     when:
       - 'exoscale_vm__state == "absent"'
       - 'exoscale_vm__name in exoscale_vm__instance_list_result["stdout"] | from_json | map(attribute="name")'
@@ -122,6 +127,7 @@
       - 'exoscale_vm__state != "absent"'
       - 'item["cidr"] is defined'
     delegate_to: 'localhost'
+    become: false
 
   - name: "Manage the VM's networks"
     ngine_io.cloudstack.cs_instance_nic:
@@ -135,6 +141,7 @@
     loop: '{{ exoscale_vm__private_networks }}'
     when: 'exoscale_vm__state != "absent"'
     delegate_to: 'localhost'
+    become: false
 
   tags:
     - 'exoscale_vm'
@@ -151,6 +158,7 @@
       name: '{{ exoscale_vm__name }}'
       state: 'absent'
     delegate_to: 'localhost'
+    become: false
     when:
       - 'exoscale_vm__security_group_rules is defined and exoscale_vm__security_group_rules | length > 0'
       - 'exoscale_vm__state == "absent"'

roles/firewall/tasks/main.yml

@@ -119,6 +119,7 @@
     changed_when: false # not a config change on the server
     check_mode: false # run task even if `--check` is specified
     delegate_to: 'localhost'
+    become: false
     run_once: true
     vars:
       __firewall__fwbuilder_repo_url: >-
@@ -138,6 +139,7 @@
       single_branch: true
     changed_when: false # not a config change on the server
     delegate_to: 'localhost'
+    become: false
     run_once: true
     check_mode: false # run task even if `--check` is specified
     vars:

roles/glpi_agent/tasks/main.yml

@@ -13,6 +13,7 @@
       register: 'glpi_agent__github_release'
       check_mode: false # run task even if `--check` is specified
       delegate_to: 'localhost'
+      become: false
       run_once: true
 
     - name: 'Store the latest release version'
@@ -28,6 +29,7 @@
       dest: '/tmp/ansible.glpi-agent-{{ glpi_agent__github_version }}-1.noarch.rpm'
       mode: 0o644
     delegate_to: 'localhost'
+    become: false
     changed_when: false # not an actual config change on the server
     check_mode: false # run task even if `--check` is specified
 

roles/grafana/tasks/main.yml

@@ -272,6 +272,7 @@
     loop_control:
       label: '{{ item["json"]["name"] | d(item) }}'
     delegate_to: 'localhost'
+    become: false
     when:
       - 'not grafana__skip_token_to_bitwarden'
       - 'not (item["skipped"] is defined and item["skipped"])'