reorder fields & other linting

54 files changed, 181 insertions, 191 deletions

diff --git a/roles/apt/defaults/main.yml b/roles/apt/defaults/main.yml
index 63fe41d..b36ed87 100644
--- a/roles/apt/defaults/main.yml
+++ b/roles/apt/defaults/main.yml
@@ -1,3 +1,3 @@
 apt_unattended_upgrades: false
 apt_unattended_reboot: true
-apt_unattended_reboot_time: "02:00"
+apt_unattended_reboot_time: '02:00'
diff --git a/roles/apt/tasks/main.yml b/roles/apt/tasks/main.yml
index 049c732..7a1e1dd 100644
--- a/roles/apt/tasks/main.yml
+++ b/roles/apt/tasks/main.yml
@@ -7,16 +7,16 @@
   register: apt_result
 
 - name: Show upgraded packages
+  when: apt_result is changed
   ansible.builtin.debug:
     var: apt_result.packages | sort
-  when: apt_result is changed
 
 - name: Reboot
+  when: apt_result is changed
   become: true
   ansible.builtin.reboot:
     # 3 minutes is plenty.
     reboot_timeout: 180
-  when: apt_result is changed
 
 - name: Clean up dependencies
   become: true
@@ -27,10 +27,10 @@
   register: apt_result
 
 - name: Show removed dependencies
+  when: apt_result is changed
   ansible.builtin.debug:
     var: apt_result.packages | sort
-  when: apt_result is changed
 
 - name: Configure unattended-upgrades
-  ansible.builtin.include_tasks: unattended_upgrades.yml
   when: apt_unattended_upgrades
+  ansible.builtin.include_tasks: unattended_upgrades.yml
diff --git a/roles/apt/tasks/unattended_upgrades.yml b/roles/apt/tasks/unattended_upgrades.yml
index 7bcc124..cf305d4 100644
--- a/roles/apt/tasks/unattended_upgrades.yml
+++ b/roles/apt/tasks/unattended_upgrades.yml
@@ -11,7 +11,7 @@
     dest: /etc/apt/apt.conf.d/50unattended-upgrades
     owner: root
     group: root
-    mode: '644'
+    mode: '0644'
 
 # https://wiki.debian.org/UnattendedUpgrades says that 20auto-upgrades and
 # 02periodic are _alternatives_ (and, presumably, not mechanisms that can be
@@ -29,4 +29,4 @@
     dest: /etc/apt/apt.conf.d/02periodic
     owner: root
     group: root
-    mode: '644'
+    mode: '0644'
diff --git a/roles/apt_install/tasks/main.yml b/roles/apt_install/tasks/main.yml
index 2d0b9d9..71abdd8 100644
--- a/roles/apt_install/tasks/main.yml
+++ b/roles/apt_install/tasks/main.yml
@@ -7,6 +7,6 @@
   register: apt_install_result
 
 - name: Show installed packages
+  when: apt_install_result is changed
   ansible.builtin.debug:
     var: apt_install_result.packages | sort
-  when: apt_install_result is changed
diff --git a/roles/apt_repo/handlers/main.yml b/roles/apt_repo/handlers/main.yml
index 384682b..15ee5b9 100644
--- a/roles/apt_repo/handlers/main.yml
+++ b/roles/apt_repo/handlers/main.yml
@@ -1,5 +1,5 @@
 - name: Refresh apt repositories
+  listen: apt_repo_update
   become: true
   ansible.builtin.apt:
     update_cache: true
-  listen: apt_repo_update
diff --git a/roles/apt_repo/tasks/main.yml b/roles/apt_repo/tasks/main.yml
index 8cee575..dd8215f 100644
--- a/roles/apt_repo/tasks/main.yml
+++ b/roles/apt_repo/tasks/main.yml
@@ -11,7 +11,7 @@
     state: directory
     owner: root
     group: root
-    mode: '755'
+    mode: '0755'
 
 - name: 'Add key: {{ apt_repo_name }}'
   become: true
@@ -20,7 +20,7 @@
     dest: '{{ apt_repo_key_path }}'
     owner: root
     group: root
-    mode: '644'
+    mode: '0644'
   notify: apt_repo_update
 
 - name: Get host distro
@@ -39,7 +39,7 @@
     dest: '/etc/apt/sources.list.d/{{ apt_repo_name }}.list'
     owner: root
     group: root
-    mode: '644'
+    mode: '0644'
   notify: apt_repo_update
 
 - name: Refresh apt repositories if necessary
diff --git a/roles/apt_repo/templates/repo.list.j2 b/roles/apt_repo/templates/repo.list.j2
index a495ecd..0f93d76 100644
--- a/roles/apt_repo/templates/repo.list.j2
+++ b/roles/apt_repo/templates/repo.list.j2
@@ -1,3 +1,5 @@
 {{ ansible_managed | comment }}
 
-deb [signed-by={{ apt_repo_key_path }}] {{ apt_repo_url }}{{ apt_repo_append_distro | ternary(ansible_facts["distribution"] | lower, "") }} {{ apt_repo_codename | default(ansible_facts["distribution_release"]) }} {{ apt_repo_component }}
+{% set distro = apt_repo_append_distro | ternary(ansible_facts['distribution'] | lower, '') %}
+{% set codename = apt_repo_codename | default(ansible_facts["distribution_release"]) %}
+deb [signed-by={{ apt_repo_key_path }}] {{ apt_repo_url }}{{ distro }} {{ codename }} {{ apt_repo_component }}
diff --git a/roles/cloud_init_wait/tasks/main.yml b/roles/cloud_init_wait/tasks/main.yml
index d9ad4a0..5c7f8d2 100644
--- a/roles/cloud_init_wait/tasks/main.yml
+++ b/roles/cloud_init_wait/tasks/main.yml
@@ -1,6 +1,6 @@
 - name: 'Wait for {{ cloud_init_wait_path }}'
-  ansible.builtin.include_role:
-    name: file_wait
   vars:
     file_wait_path: '{{ cloud_init_wait_path }}'
     file_wait_seconds: '{{ cloud_init_wait_seconds }}'
+  ansible.builtin.include_role:
+    name: file_wait
diff --git a/roles/config_links/tasks/main.yml b/roles/config_links/tasks/main.yml
index 2ad4b0d..c014040 100644
--- a/roles/config_links/tasks/main.yml
+++ b/roles/config_links/tasks/main.yml
@@ -1,9 +1,9 @@
 - name: Fail if invalid action
+  when: |
+    config_links_action not in ['update', 'remove']
   ansible.builtin.fail:
     msg: |
       Action parameter must be either 'update' or 'remove'
-  when: |
-    config_links_action not in ['update', 'remove']
 
 - name: Create temporary directory
   ansible.builtin.tempfile:
@@ -22,18 +22,18 @@
         accept_hostkey: true
 
     - name: Run links-update
+      when: config_links_action == 'update'
       ansible.builtin.command:
         cmd: '{{ config_links_repo.path }}/links-update'
         chdir: '{{ config_links_path }}'
       changed_when: true
-      when: config_links_action == 'update'
 
     - name: Run links-remove
+      when: config_links_action == 'remove'
       ansible.builtin.command:
         cmd: '{{ config_links_repo.path }}/links-remove'
         chdir: '{{ config_links_path }}'
       changed_when: true
-      when: config_links_action == 'remove'
 
   always:
     - name: Clean up
diff --git a/roles/cups/handlers/main.yml b/roles/cups/handlers/main.yml
index ca35bae..6e6b246 100644
--- a/roles/cups/handlers/main.yml
+++ b/roles/cups/handlers/main.yml
@@ -1,13 +1,14 @@
 # Don't restart if it's not running.
 - name: Collect service facts
-  ansible.builtin.service_facts:
   listen: cups_restart
+  ansible.builtin.service_facts:
 
 - name: Restart CUPS if necessary
-  become: true
+  listen: cups_restart
   when: |
-    'cups.service' in ansible_facts.services and ansible_facts.services['cups.service'].state == 'running'
+    'cups.service' in ansible_facts.services
+    and ansible_facts.services['cups.service'].state == 'running'
+  become: true
   ansible.builtin.systemd_service:
     name: cups
     state: restarted
-  listen: cups_restart
diff --git a/roles/cups/tasks/main.yml b/roles/cups/tasks/main.yml
index f513fe6..0c9281b 100644
--- a/roles/cups/tasks/main.yml
+++ b/roles/cups/tasks/main.yml
@@ -51,21 +51,21 @@
     dest: /etc/papersize
     owner: root
     group: root
-    mode: '644'
+    mode: '0644'
   notify: cups_restart
 
 - name: Configure logging to journald
   become: true
+  loop:
+    - AccessLog
+    - ErrorLog
+    - PageLog
   ansible.builtin.lineinfile:
     path: /etc/cups/cups-files.conf
     create: false
     search_string: '{{ item }}'
     line: '{{ item }} syslog'
   notify: cups_restart
-  loop:
-    - AccessLog
-    - ErrorLog
-    - PageLog
 
 - name: Run handlers if neccessary
   ansible.builtin.meta: flush_handlers
diff --git a/roles/digitalocean_volume/tasks/main.yml b/roles/digitalocean_volume/tasks/main.yml
index c3ef5b6..add784f 100644
--- a/roles/digitalocean_volume/tasks/main.yml
+++ b/roles/digitalocean_volume/tasks/main.yml
@@ -1,15 +1,15 @@
 - name: 'Mount volume: {{ digitalocean_volume_name }}'
   become: true
   ansible.posix.mount:
-    path: "{{ digitalocean_volume_dir }}"
+    path: '{{ digitalocean_volume_dir }}'
     src: '/dev/disk/by-id/scsi-0DO_Volume_{{ digitalocean_volume_name }}'
     state: mounted
     fstype: '{{ digitalocean_volume_fs }}'
     opts: defaults,nofail,discard
 
 - name: Set up service dependencies
-  ansible.builtin.include_role:
-    name: systemd_depend_mount
   vars:
     systemd_depend_mount_dir: '{{ digitalocean_volume_dir }}'
     systemd_depend_mount_services: '{{ digitalocean_volume_dependent_services }}'
+  ansible.builtin.include_role:
+    name: systemd_depend_mount
diff --git a/roles/docker/handlers/main.yml b/roles/docker/handlers/main.yml
index df1b1a1..cee8a9a 100644
--- a/roles/docker/handlers/main.yml
+++ b/roles/docker/handlers/main.yml
@@ -1,13 +1,14 @@
 # Don't restart if it's not running.
 - name: Collect service facts
-  ansible.builtin.service_facts:
   listen: docker_configured
+  ansible.builtin.service_facts:
 
 - name: Restart Docker service
-  become: true
+  listen: docker_configured
   when: |
-    'docker.service' in ansible_facts.services and ansible_facts.services['docker.service'].state == 'running'
+    'docker.service' in ansible_facts.services
+    and ansible_facts.services['docker.service'].state == 'running'
+  become: true
   ansible.builtin.systemd_service:
     name: docker
     state: restarted
-  listen: docker_configured
diff --git a/roles/docker/tasks/logging.yml b/roles/docker/tasks/logging.yml
index 52b70c9..d701424 100644
--- a/roles/docker/tasks/logging.yml
+++ b/roles/docker/tasks/logging.yml
@@ -14,7 +14,7 @@
         state: directory
         owner: root
         group: root
-        mode: '755'
+        mode: '0755'
 
     - name: Write daemon.json
       ansible.builtin.copy:
@@ -22,7 +22,7 @@
         content: '{{ docker_daemon_json.content | combine({"log-driver": docker_logging_driver}) | to_nice_json }}'
         owner: root
         group: root
-        mode: '644'
+        mode: '0644'
       notify: docker_configured
 
 - name: Restart Docker service if necessary
diff --git a/roles/docker/tasks/main.yml b/roles/docker/tasks/main.yml
index 6e21a2c..9d0eeb6 100644
--- a/roles/docker/tasks/main.yml
+++ b/roles/docker/tasks/main.yml
@@ -5,13 +5,13 @@
       - distribution_release
 
 - name: Set platform-specific variables
-  ansible.builtin.include_vars: "{{ __docker_vars_file }}"
   loop:
     - "{{ ansible_facts['distribution'] }}.yml"
     - "{{ ansible_facts['distribution'] }}_{{ ansible_facts['distribution_release'] }}.yml"
   vars:
-    __docker_vars_file: "{{ role_path }}/vars/{{ item }}"
+    __docker_vars_file: '{{ role_path }}/vars/{{ item }}'
   when: __docker_vars_file is exists
+  ansible.builtin.include_vars: '{{ __docker_vars_file }}'
 
 - name: Configure Docker logging driver
   when: docker_logging_driver is defined and docker_logging_driver != false
@@ -20,7 +20,7 @@
 - name: Install Docker
   become: true
   ansible.builtin.package:
-    name: "{{ docker_package_names }}"
+    name: '{{ docker_package_names }}'
     state: present
 
 # The docker system prune call should be before configuring the service and
@@ -32,19 +32,19 @@
   become: true
   ansible.builtin.systemd_service:
     name: docker.service
-    enabled: "{{ docker_enable_service }}"
+    enabled: '{{ docker_enable_service }}'
     state: "{{ docker_enable_service | ternary('started', 'stopped') }}"
 
 - name: Configure Docker socket
   become: true
   ansible.builtin.systemd_service:
     name: docker.socket
-    enabled: "{{ docker_enable_socket }}"
+    enabled: '{{ docker_enable_socket }}'
     state: "{{ docker_enable_socket | ternary('started', 'stopped') }}"
 
 - name: Add user to Docker group
-  become: true
   when: docker_add_to_group
+  become: true
   ansible.builtin.user:
     append: true
     groups: docker
diff --git a/roles/docker/tasks/prune.yml b/roles/docker/tasks/prune.yml
index e6f1f5d..614813c 100644
--- a/roles/docker/tasks/prune.yml
+++ b/roles/docker/tasks/prune.yml
@@ -3,25 +3,25 @@
     unitname:
       - docker.service
       - docker.socket
-  register: docker_systemd_info
   failed_when:
     docker_systemd_info.msg is defined
-        and "No units match any of the provided patterns" not in docker_systemd_info.msg
+        and 'No units match any of the provided patterns' not in docker_systemd_info.msg
 # ^^^ On fresh installations, systemctl list-units (which is what systemd_info
 # does, it doesn't show the Docker units at all, don't exactly understand why.
+  register: docker_systemd_info
 
 - name: Clean up docker data
-  become: true
   when: |
     docker_systemd_info.units is defined
         and (docker_systemd_info.units['docker.service'].substate == 'running'
             or docker_systemd_info.units['docker.socket'].substate == 'listening'
             or docker_systemd_info.units['docker.socket'].substate == 'running')
+  become: true
   block:
     # Dependencies of the community.docker.docker_prune Ansible module:
     - name: Install module dependencies
       ansible.builtin.package:
-        name: "{{ docker_prune_module_deps }}"
+        name: '{{ docker_prune_module_deps }}'
         state: present
 
     - name: Run docker system prune
diff --git a/roles/etckeeper/handlers/main.yml b/roles/etckeeper/handlers/main.yml
index c67dc02..02ae2fe 100644
--- a/roles/etckeeper/handlers/main.yml
+++ b/roles/etckeeper/handlers/main.yml
@@ -1,10 +1,10 @@
 - name: Commit etckeeper.conf
+  listen: etckeeper_commit_conf
   tensin.infra.etckeeper_commit:
     msg: configure etckeeper
     allowlist: [etckeeper/etckeeper.conf]
-  listen: etckeeper_commit_conf
 
 - name: Commit .gitignore
+  listen: etckeeper_commit_gitignore
   tensin.infra.etckeeper_commit:
     msg: configure ignored files
-  listen: etckeeper_commit_gitignore
diff --git a/roles/etckeeper/tasks/ignore.yml b/roles/etckeeper/tasks/ignore.yml
index 73c5aa1..f5446c0 100644
--- a/roles/etckeeper/tasks/ignore.yml
+++ b/roles/etckeeper/tasks/ignore.yml
@@ -4,22 +4,22 @@
   ansible.builtin.command:
     cmd: git status --porcelain
     chdir: /etc
-  register: etckeeper_git_status
   changed_when: false
+  register: etckeeper_git_status
 
 - name: Fail if there're modifications
+  when: |
+    etckeeper_git_status.stdout_lines | length > 0
   ansible.builtin.fail:
     msg: |
       Unexpected modifications found:
       {{ etckeeper_git_status.stdout }}
-  when: |
-    etckeeper_git_status.stdout_lines | length > 0
 
 - name: Configure ignored path
-  ansible.builtin.include_tasks: ignore_line.yml
   loop: '{{ etckeeper_ignored_paths }}'
   loop_control:
     loop_var: ignore_path
+  ansible.builtin.include_tasks: ignore_line.yml
 
 - name: Commit .gitignore if necessary
   ansible.builtin.meta: flush_handlers
diff --git a/roles/etckeeper/tasks/ignore_line.yml b/roles/etckeeper/tasks/ignore_line.yml
index ceb6a30..06e38b4 100644
--- a/roles/etckeeper/tasks/ignore_line.yml
+++ b/roles/etckeeper/tasks/ignore_line.yml
@@ -6,7 +6,7 @@
     state: present
     owner: root
     group: root
-    mode: '644'
+    mode: '0644'
   notify: etckeeper_commit_gitignore
 
 - name: Remove path from cache
diff --git a/roles/etckeeper/tasks/main.yml b/roles/etckeeper/tasks/main.yml
index b3d46f4..96be796 100644
--- a/roles/etckeeper/tasks/main.yml
+++ b/roles/etckeeper/tasks/main.yml
@@ -11,17 +11,17 @@
     creates: /etc/.git/config
 
 - name: Configure /etc repository
+  loop:
+    - name: user.name
+      value: '{{ etckeeper_git_name }}'
+    - name: user.email
+      value: '{{ etckeeper_git_email }}'
   become: true
   community.general.git_config:
     scope: local
     repo: /etc
     name: '{{ item.name }}'
     value: '{{ item.value }}'
-  loop:
-    - name: user.name
-      value: '{{ etckeeper_git_name }}'
-    - name: user.email
-      value: '{{ etckeeper_git_email }}'
 
 - name: Initial commit
   become: true
@@ -30,6 +30,11 @@
     creates: /etc/.git/index
 
 - name: Configure etckeeper
+  loop:
+    - name: AVOID_DAILY_AUTOCOMMITS
+      value: '1'
+    - name: AVOID_COMMIT_BEFORE_INSTALL
+      value: '1'
   become: true
   community.general.ini_file:
     path: /etc/etckeeper/etckeeper.conf
@@ -37,15 +42,10 @@
     no_extra_spaces: true
     owner: root
     group: root
-    mode: '644'
+    mode: '0644'
     section: null
     option: '{{ item.name }}'
     value: '{{ item.value }}'
-  loop:
-    - name: AVOID_DAILY_AUTOCOMMITS
-      value: '1'
-    - name: AVOID_COMMIT_BEFORE_INSTALL
-      value: '1'
   notify: etckeeper_commit_conf
 
 - name: Configure repository remote
@@ -55,7 +55,7 @@
     - name: Read current remote URL
       # noqa: command-instead-of-module
       ansible.builtin.command:
-        cmd: git config --local remote.{{ etckeeper_remote_name | quote }}.url
+        cmd: 'git config --local remote.{{ etckeeper_remote_name | quote }}.url'
         chdir: /etc
       changed_when: false
       failed_when: false
@@ -63,13 +63,13 @@
 
     - name: Fix remote URL if necessary
       # noqa: command-instead-of-module
+      when: etckeeper_config_result.stdout != etckeeper_remote_url
       ansible.builtin.shell:
         cmd: |
           git remote remove {{ etckeeper_remote_name | quote }} && \
           git remote add -f {{ etckeeper_remote_name | quote }} {{ etckeeper_remote_url | quote }}
         chdir: /etc
       changed_when: true
-      when: etckeeper_config_result.stdout != etckeeper_remote_url
 
     - name: Configure pushes for etckeeper
       community.general.ini_file:
@@ -77,7 +77,7 @@
         no_extra_spaces: true
         owner: root
         group: root
-        mode: '644'
+        mode: '0644'
         section: null
         option: PUSH_REMOTE
         value: '{{ etckeeper_remote_name }}'
diff --git a/roles/file_wait/tasks/check.yml b/roles/file_wait/tasks/check.yml
index 47122b7..1ddd5c2 100644
--- a/roles/file_wait/tasks/check.yml
+++ b/roles/file_wait/tasks/check.yml
@@ -26,4 +26,4 @@
 
     - name: Retry if there're more reboots
       ansible.builtin.include_tasks: check.yml
-      when: (file_wait_reboots_left | int >= 0)
+      when: file_wait_reboots_left | int >= 0
diff --git a/roles/file_wait/tasks/main.yml b/roles/file_wait/tasks/main.yml
index 169f834..8d73140 100644
--- a/roles/file_wait/tasks/main.yml
+++ b/roles/file_wait/tasks/main.yml
@@ -6,6 +6,6 @@
   ansible.builtin.include_tasks: check.yml
 
 - name: Fail unless file exists
+  when: file_wait_check is not defined or file_wait_check is not succeeded or file_wait_check is unreachable
   ansible.builtin.fail:
     msg: 'File is missing: {{ file_wait_path }}'
-  when: file_wait_check is not defined or file_wait_check is not succeeded or file_wait_check is unreachable
diff --git a/roles/firewall/handlers/main.yml b/roles/firewall/handlers/main.yml
index 0a0fcad..4027f45 100644
--- a/roles/firewall/handlers/main.yml
+++ b/roles/firewall/handlers/main.yml
@@ -1,6 +1,6 @@
 - name: Reboot
+  listen: firewall_reboot
   become: true
   ansible.builtin.reboot:
     # 3 minutes is plenty.
     reboot_timeout: 180
-  listen: firewall_reboot
diff --git a/roles/firewall/tasks/main.yml b/roles/firewall/tasks/main.yml
index c3fa6ab..d064cc5 100644
--- a/roles/firewall/tasks/main.yml
+++ b/roles/firewall/tasks/main.yml
@@ -5,18 +5,18 @@
     state: present
 
 - name: Configure rule files
+  loop:
+    - {src: rules.v4.j2, dest: /etc/iptables/rules.v4, tool: iptables}
+    - {src: rules.v6.j2, dest: /etc/iptables/rules.v6, tool: ip6tables}
   become: true
   ansible.builtin.template:
     src: '{{ item.src }}'
     dest: '{{ item.dest }}'
     owner: root
     group: root
-    mode: '640'
+    mode: '0640'
     validate: '/usr/sbin/{{ item.tool }}-restore --test %s'
   notify: firewall_reboot
-  loop:
-    - {src: rules.v4.j2, dest: /etc/iptables/rules.v4, tool: iptables}
-    - {src: rules.v6.j2, dest: /etc/iptables/rules.v6, tool: ip6tables}
 
 - name: Reboot if necessary
   ansible.builtin.meta: flush_handlers
diff --git a/roles/journald/handlers/main.yml b/roles/journald/handlers/main.yml
index 623d9ff..27977bb 100644
--- a/roles/journald/handlers/main.yml
+++ b/roles/journald/handlers/main.yml
@@ -1,6 +1,6 @@
 - name: Restart systemd-journald
+  listen: journald_restart
   become: true
   ansible.builtin.systemd_service:
     name: systemd-journald
     state: restarted
-  listen: journald_restart
diff --git a/roles/journald/tasks/main.yml b/roles/journald/tasks/main.yml
index 38113a5..65ceedb 100644
--- a/roles/journald/tasks/main.yml
+++ b/roles/journald/tasks/main.yml
@@ -7,7 +7,7 @@
     value: '{{ journald_log_level }}'
     owner: root
     group: root
-    mode: '644'
+    mode: '0644'
   notify: journald_restart
 
 - name: Restart systemd-journald if necessary
diff --git a/roles/letsencrypt/tasks/digitalocean.yml b/roles/letsencrypt/tasks/digitalocean.yml
index 30a7a9c..032774f 100644
--- a/roles/letsencrypt/tasks/digitalocean.yml
+++ b/roles/letsencrypt/tasks/digitalocean.yml
@@ -2,22 +2,22 @@
   become: true
   block:
     - name: Prompt for token
+      when: |
+        lookup('env', 'DIGITALOCEAN_TOKEN') | length <= 0
       ansible.builtin.pause:
         prompt: |
           Enter your API token:
         echo: false
       register: letsencrypt_do_token
-      when:
-        - lookup('env', 'DIGITALOCEAN_TOKEN') | length <= 0
 
     - name: Set token as fact
       ansible.builtin.set_fact:
         letsencrypt_do_token: "{{ letsencrypt_do_token.user_input | default(lookup('env', 'DIGITALOCEAN_TOKEN')) }}"
 
     - name: Fail if token is invalid
+      when: letsencrypt_do_token | length == 0
       ansible.builtin.fail:
         msg: 'DigitalOcean token is invalid'
-      when: letsencrypt_do_token | length == 0
 
     - name: Configure certbot.ini
       ansible.builtin.template:
@@ -25,4 +25,4 @@
         dest: '{{ letsencrypt_credentials_ini }}'
         owner: root
         group: root
-        mode: '600'
+        mode: '0600'
diff --git a/roles/letsencrypt/tasks/domain.yml b/roles/letsencrypt/tasks/domain.yml
index 9a9418f..ce31428 100644
--- a/roles/letsencrypt/tasks/domain.yml
+++ b/roles/letsencrypt/tasks/domain.yml
@@ -1,8 +1,8 @@
 - name: Set up certificate for domain
-  become: true
   vars:
     certificate_name: '{{ domain.name | default(domain) }}'
-    certificate_domains: "{{ domain.domains | default([certificate_name]) | unique }}"
+    certificate_domains: '{{ domain.domains | default([certificate_name]) | unique }}'
+  become: true
   block:
     - name: Cache domain list
       ansible.builtin.template:
@@ -10,10 +10,11 @@
         dest: '/etc/letsencrypt/.domains_{{ certificate_name }}.txt'
         owner: root
         group: root
-        mode: '640'
+        mode: '0640'
       register: letsencrypt_domain_list
 
     - name: 'Create certificate: {{ certificate_name }}'
+      when: letsencrypt_domain_list is changed
       ansible.builtin.command: |
         certbot certonly --noninteractive --agree-tos \
             --cert-name {{ certificate_name | quote }} \
@@ -24,4 +25,3 @@
             --dns-digitalocean-credentials {{ letsencrypt_credentials_ini | quote }} \
             --dns-digitalocean-propagation-seconds 30
       changed_when: true
-      when: letsencrypt_domain_list.changed
diff --git a/roles/letsencrypt/tasks/main.yml b/roles/letsencrypt/tasks/main.yml
index 4f12c93..d41e89f 100644
--- a/roles/letsencrypt/tasks/main.yml
+++ b/roles/letsencrypt/tasks/main.yml
@@ -11,7 +11,7 @@
     creates: /etc/letsencrypt
 
 - name: Update certificates
-  ansible.builtin.include_tasks: domain.yml
   loop: '{{ letsencrypt_domains }}'
   loop_control:
     loop_var: domain
+  ansible.builtin.include_tasks: domain.yml
diff --git a/roles/linux_status/handlers/main.yml b/roles/linux_status/handlers/main.yml
index 32448f8..4230ec5 100644
--- a/roles/linux_status/handlers/main.yml
+++ b/roles/linux_status/handlers/main.yml
@@ -1,19 +1,20 @@
 # Don't restart if it's not running.
 - name: Collect service facts
-  ansible.builtin.service_facts:
   listen: linux_status_configured
+  ansible.builtin.service_facts:
 
 - name: Reload systemd daemon
+  listen: linux_status_configured
   become: true
   ansible.builtin.systemd_service:
     daemon_reload: true
-  listen: linux_status_configured
 
 - name: Restart linux-status service
-  become: true
+  listen: linux_status_configured
   when: |
-    'linux-status.service' in ansible_facts.services and ansible_facts.services['linux-status.service'].state == 'running'
+    'linux-status.service' in ansible_facts.services
+    and ansible_facts.services['linux-status.service'].state == 'running'
+  become: true
   ansible.builtin.systemd_service:
     name: linux-status
     state: restarted
-  listen: linux_status_configured
diff --git a/roles/linux_status/tasks/arch.yml b/roles/linux_status/tasks/arch.yml
index b894361..693f6f2 100644
--- a/roles/linux_status/tasks/arch.yml
+++ b/roles/linux_status/tasks/arch.yml
@@ -1,6 +1,6 @@
 - name: Install linux-status
-  ansible.builtin.include_role:
-    name: aur_install
   vars:
     aur_install_packages:
       - linux-status
+  ansible.builtin.include_role:
+    name: aur_install
diff --git a/roles/linux_status/tasks/default.yml b/roles/linux_status/tasks/default.yml
index fc2f83f..6606868 100644
--- a/roles/linux_status/tasks/default.yml
+++ b/roles/linux_status/tasks/default.yml
@@ -1,10 +1,10 @@
 - name: Set up PPA repository
-  ansible.builtin.include_role:
-    name: ppa
   vars:
     ppa_owner: egor-tensin
     ppa_name: linux-status
     ppa_key: ecb69cbafc6d7cd8bd67ec35b1089b3051c9384d
+  ansible.builtin.include_role:
+    name: ppa
 
 - name: Install linux-status
   become: true
diff --git a/roles/linux_status/tasks/power_management.yml b/roles/linux_status/tasks/power_management.yml
index 2288d24..e49fef4 100644
--- a/roles/linux_status/tasks/power_management.yml
+++ b/roles/linux_status/tasks/power_management.yml
@@ -5,25 +5,25 @@
     state: directory
     owner: root
     group: root
-    mode: '755'
+    mode: '0755'
 
 - name: Enable power management
+  when: linux_status_enable_power_management
   become: true
   ansible.builtin.file:
     path: /etc/systemd/system/linux-status.service.d/99-disable_power_management.conf
     state: absent
-  when: linux_status_enable_power_management
   notify: linux_status_configured
 
 - name: Disable power management
+  when: not linux_status_enable_power_management
   become: true
   ansible.builtin.template:
     src: disable_power_management.conf.j2
     dest: /etc/systemd/system/linux-status.service.d/99-disable_power_management.conf
     owner: root
     group: root
-    mode: '644'
-  when: not linux_status_enable_power_management
+    mode: '0644'
   notify: linux_status_configured
 
 - name: Restart systemd service if necessary
diff --git a/roles/my_dotfiles/tasks/main.yml b/roles/my_dotfiles/tasks/main.yml
index ff3ff0d..c8f7e03 100644
--- a/roles/my_dotfiles/tasks/main.yml
+++ b/roles/my_dotfiles/tasks/main.yml
@@ -7,8 +7,8 @@
   register: my_dotfiles_repo
 
 - name: Run setup.sh
+  when: my_dotfiles_repo is changed
   ansible.builtin.command: ./scripts/setup.sh
   args:
     chdir: '{{ my_dotfiles_dir }}'
   changed_when: true
-  when: my_dotfiles_repo.changed
diff --git a/roles/my_workspace/tasks/main.yml b/roles/my_workspace/tasks/main.yml
index 0a64f5a..3cf90c8 100644
--- a/roles/my_workspace/tasks/main.yml
+++ b/roles/my_workspace/tasks/main.yml
@@ -5,7 +5,7 @@
     state: directory
     owner: '{{ ansible_user }}'
     group: '{{ ansible_user }}'
-    mode: '750'
+    mode: '0750'
 
 - name: Install dependencies
   become: true
@@ -14,7 +14,7 @@
     state: present
 
 - name: Update projects
-  ansible.builtin.include_tasks: project.yml
   loop: '{{ my_workspace_projects }}'
   loop_control:
     loop_var: project
+  ansible.builtin.include_tasks: project.yml
diff --git a/roles/my_workspace/tasks/project.yml b/roles/my_workspace/tasks/project.yml
index 3f36455..9e95671 100644
--- a/roles/my_workspace/tasks/project.yml
+++ b/roles/my_workspace/tasks/project.yml
@@ -14,16 +14,16 @@
         accept_hostkey: true
 
     - name: Configure git repository
-      community.general.git_config:
-        scope: local
-        repo: '{{ project_dir }}'
-        name: '{{ item.name }}'
-        value: '{{ item.value }}'
       loop:
         - name: user.name
           value: '{{ my_workspace_git_name }}'
         - name: user.email
           value: '{{ my_workspace_git_email }}'
+      community.general.git_config:
+        scope: local
+        repo: '{{ project_dir }}'
+        name: '{{ item.name }}'
+        value: '{{ item.value }}'
 
     - name: Check for Makefile
       ansible.builtin.stat:
@@ -44,22 +44,22 @@
       register: my_workspace_compose_file
 
     - name: Run make
+      when: my_workspace_makefile.stat.readable
       become: true
       community.general.make:
         chdir: '{{ project_dir }}'
-      when: my_workspace_makefile.stat.readable
 
     - name: Run docker-compose
+      when: not my_workspace_makefile.stat.readable and my_workspace_compose_file.stat.readable
       become: true
       community.docker.docker_compose_v2:
         project_src: '{{ project_dir }}'
         pull: always
         build: always
         remove_orphans: true
-      when: not my_workspace_makefile.stat.readable and my_workspace_compose_file.stat.readable
 
     - name: Fail if both files are unreadable
+      when: not (my_workspace_makefile.stat.readable or my_workspace_compose_file.stat.readable)
       ansible.builtin.fail:
         msg: |
           Don't know how to run project in {{ project_dir }}
-      when: not (my_workspace_makefile.stat.readable or my_workspace_compose_file.stat.readable)
diff --git a/roles/nfs/tasks/main.yml b/roles/nfs/tasks/main.yml
index a563a11..4ec48be 100644
--- a/roles/nfs/tasks/main.yml
+++ b/roles/nfs/tasks/main.yml
@@ -22,11 +22,11 @@
     dest: /etc/exports
     owner: root
     group: root
-    mode: '644'
+    mode: '0644'
   register: nfs_exports_conf
 
 - name: Reload NFS mounts
-  become: true
   when: nfs_exports_conf is changed
+  become: true
   ansible.builtin.command: /usr/sbin/exportfs -arv
   changed_when: true
diff --git a/roles/pacman/tasks/main.yml b/roles/pacman/tasks/main.yml
index 873ce12..e0fec22 100644
--- a/roles/pacman/tasks/main.yml
+++ b/roles/pacman/tasks/main.yml
@@ -12,12 +12,12 @@
   community.general.pacman:
     update_cache: true
     upgrade: true
-  register: pacman_result
   # According to
   #     https://docs.ansible.com/projects/ansible/latest/collections/community/general/pacman_module.html
   # this module now reports 'changed' even if only the cache was updated, with
   # no upgrades; this is the workaround.
   changed_when: pacman_result.packages is defined and (pacman_result.packages | length > 0)
+  register: pacman_result
 
 - name: Post-upgrade
   when: pacman_result is changed
@@ -34,23 +34,23 @@
 
 - name: Get list of unneeded dependencies
   ansible.builtin.command: pacman -Qqdt
-  register: pacman_result
   changed_when: false
   failed_when: |
     pacman_result.rc != 0
     and not (pacman_result.rc == 1 and (pacman_result.stdout_lines | length == 0))
+  register: pacman_result
 
 - name: Remove unneeded dependencies
+  when: pacman_result.stdout_lines | length > 0
   become: true
   community.general.pacman:
     name: '{{ pacman_result.stdout_lines }}'
     state: absent
     extra_args: --recursive
     remove_nosave: true
-  when: pacman_result.stdout_lines | length > 0
   register: pacman_result
 
 - name: Show removed packages
+  when: pacman_result.packages is defined
   ansible.builtin.debug:
     var: pacman_result.packages | sort
-  when: pacman_result.packages is defined
diff --git a/roles/pacman_install/tasks/main.yml b/roles/pacman_install/tasks/main.yml
index aece99b..05220d8 100644
--- a/roles/pacman_install/tasks/main.yml
+++ b/roles/pacman_install/tasks/main.yml
@@ -8,6 +8,6 @@
   register: pacman_install_result
 
 - name: Show installed packages
+  when: pacman_install_result.packages is defined and (pacman_install_result.packages | length > 0)
   ansible.builtin.debug:
     var: pacman_install_result.packages | sort
-  when: pacman_install_result.packages is defined and (pacman_install_result.packages | length > 0)
diff --git a/roles/ppa/tasks/main.yml b/roles/ppa/tasks/main.yml
index 002d0f1..52ac245 100644
--- a/roles/ppa/tasks/main.yml
+++ b/roles/ppa/tasks/main.yml
@@ -5,17 +5,15 @@
       - distribution_release
 
 - name: Set platform-specific variables
-  ansible.builtin.include_vars: "{{ __ppa_vars_file }}"
   loop:
     - "{{ ansible_facts['distribution'] }}.yml"
     - "{{ ansible_facts['distribution'] }}_{{ ansible_facts['distribution_release'] }}.yml"
   vars:
-    __ppa_vars_file: "{{ role_path }}/vars/{{ item }}"
+    __ppa_vars_file: '{{ role_path }}/vars/{{ item }}'
   when: __ppa_vars_file is exists
+  ansible.builtin.include_vars: '{{ __ppa_vars_file }}'
 
 - name: Set up PPA repository
-  ansible.builtin.include_role:
-    name: apt_repo
   vars:
     apt_repo_name: '{{ ppa_name }}'
     apt_repo_key_url: 'https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x{{ ppa_key }}'
@@ -23,3 +21,5 @@
     apt_repo_codename: '{{ ppa_distro }}'
     # All PPA repositories are Ubuntu repositories, even though they might be used on Debian:
     apt_repo_append_distro: false
+  ansible.builtin.include_role:
+    name: apt_repo
diff --git a/roles/router/tasks/main.yml b/roles/router/tasks/main.yml
index ff77a40..e3e1b2b 100644
--- a/roles/router/tasks/main.yml
+++ b/roles/router/tasks/main.yml
@@ -1,11 +1,11 @@
 - name: Enable traffic forwarding
+  loop:
+    - net.ipv4.ip_forward
+    - net.ipv4.conf.all.forwarding
+    - net.ipv6.conf.all.forwarding
   become: true
   ansible.posix.sysctl:
     name: '{{ item }}'
     value: 1
     reload: true
     sysctl_file: '{{ router_sysctl_file }}'
-  loop:
-    - net.ipv4.ip_forward
-    - net.ipv4.conf.all.forwarding
-    - net.ipv6.conf.all.forwarding
diff --git a/roles/samba/handlers/main.yml b/roles/samba/handlers/main.yml
index ad3d245..6f33e25 100644
--- a/roles/samba/handlers/main.yml
+++ b/roles/samba/handlers/main.yml
@@ -1,13 +1,14 @@
 # Don't restart if it's not running.
 - name: Collect service facts
-  ansible.builtin.service_facts:
   listen: samba_configured
+  ansible.builtin.service_facts:
 
 - name: Restart Samba service
-  become: true
+  listen: samba_configured
   when: |
-    'smbd.service' in ansible_facts.services and ansible_facts.services['smbd.service'].state == 'running'
+    'smbd.service' in ansible_facts.services
+    and ansible_facts.services['smbd.service'].state == 'running'
+  become: true
   ansible.builtin.systemd_service:
     name: smbd
     state: restarted
-  listen: samba_configured
diff --git a/roles/samba/tasks/main.yml b/roles/samba/tasks/main.yml
index 97aff98..19e2070 100644
--- a/roles/samba/tasks/main.yml
+++ b/roles/samba/tasks/main.yml
@@ -11,7 +11,7 @@
     state: directory
     owner: root
     group: root
-    mode: '755'
+    mode: '0755'
 
 - name: Format smb.conf
   become: true
@@ -20,7 +20,7 @@
     dest: /etc/samba/smb.conf
     owner: root
     group: root
-    mode: '644'
+    mode: '0644'
     validate: '/usr/bin/testparm --suppress-prompt %s'
   notify: samba_configured
 
diff --git a/roles/sshd/tasks/main.yml b/roles/sshd/tasks/main.yml
index 751f379..db151f5 100644
--- a/roles/sshd/tasks/main.yml
+++ b/roles/sshd/tasks/main.yml
@@ -5,13 +5,13 @@
       - distribution_release
 
 - name: Set platform-specific variables
-  ansible.builtin.include_vars: "{{ __sshd_vars_file }}"
   loop:
     - "{{ ansible_facts['distribution'] }}.yml"
     - "{{ ansible_facts['distribution'] }}_{{ ansible_facts['distribution_release'] }}.yml"
   vars:
-    __sshd_vars_file: "{{ role_path }}/vars/{{ item }}"
+    __sshd_vars_file: '{{ role_path }}/vars/{{ item }}'
   when: __sshd_vars_file is exists
+  ansible.builtin.include_vars: '{{ __sshd_vars_file }}'
 
 - name: Configure sshd
   become: true
@@ -20,13 +20,13 @@
     dest: /etc/ssh/sshd_config
     owner: root
     group: root
-    mode: '644'
+    mode: '0644'
     validate: /usr/sbin/sshd -t -f %s
   register: sshd_conf
 
 - name: Restart sshd
-  become: true
   when: sshd_conf is changed
+  become: true
   ansible.builtin.systemd_service:
     name: '{{ __sshd_service_name }}'
     state: restarted
diff --git a/roles/sudo/tasks/main.yml b/roles/sudo/tasks/main.yml
index 7bdd157..dbd1fd6 100644
--- a/roles/sudo/tasks/main.yml
+++ b/roles/sudo/tasks/main.yml
@@ -20,5 +20,5 @@
     dest: '/etc/sudoers.d/{{ sudo_user }}'
     owner: root
     group: root
-    mode: '440'
+    mode: '0440'
     validate: 'visudo -cf %s'
diff --git a/roles/systemd_depend_iface/handlers/main.yml b/roles/systemd_depend_iface/handlers/main.yml
index 1449130..5c9e7b6 100644
--- a/roles/systemd_depend_iface/handlers/main.yml
+++ b/roles/systemd_depend_iface/handlers/main.yml
@@ -1,5 +1,5 @@
 - name: Reload systemd daemon
+  listen: systemd_depend_iface_reload
   become: true
   ansible.builtin.systemd_service:
     daemon_reload: true
-  listen: systemd_depend_iface_reload
diff --git a/roles/systemd_depend_iface/tasks/main.yml b/roles/systemd_depend_iface/tasks/main.yml
index d99a445..fd335e0 100644
--- a/roles/systemd_depend_iface/tasks/main.yml
+++ b/roles/systemd_depend_iface/tasks/main.yml
@@ -1,27 +1,23 @@
 - name: Create override directory
+  loop: '{{ systemd_depend_iface_services }}'
   become: true
   ansible.builtin.file:
-    path: '/etc/systemd/system/{{ service }}.service.d'
+    path: '/etc/systemd/system/{{ item }}.service.d'
     state: directory
     owner: root
     group: root
-    mode: '755'
-  loop: '{{ systemd_depend_iface_services }}'
-  loop_control:
-    loop_var: service
+    mode: '0755'
 
 - name: Create service override
+  loop: '{{ systemd_depend_iface_services }}'
   become: true
   ansible.builtin.template:
     src: override.conf.j2
-    dest: '/etc/systemd/system/{{ service }}.service.d/depend_iface_{{ systemd_depend_iface_name }}.conf'
+    dest: '/etc/systemd/system/{{ item }}.service.d/depend_iface_{{ systemd_depend_iface_name }}.conf'
     owner: root
     group: root
-    mode: '644'
+    mode: '0644'
   notify: systemd_depend_iface_reload
-  loop: '{{ systemd_depend_iface_services }}'
-  loop_control:
-    loop_var: service
 
 - name: Reload systemd services if necessary
   ansible.builtin.meta: flush_handlers
diff --git a/roles/systemd_depend_mount/handlers/main.yml b/roles/systemd_depend_mount/handlers/main.yml
index b59b5a5..86af947 100644
--- a/roles/systemd_depend_mount/handlers/main.yml
+++ b/roles/systemd_depend_mount/handlers/main.yml
@@ -1,5 +1,5 @@
 - name: Reload systemd daemon
+  listen: systemd_depend_mount_reload
   become: true
   ansible.builtin.systemd_service:
     daemon_reload: true
-  listen: systemd_depend_mount_reload
diff --git a/roles/systemd_depend_mount/tasks/main.yml b/roles/systemd_depend_mount/tasks/main.yml
index 32b83d6..94637c9 100644
--- a/roles/systemd_depend_mount/tasks/main.yml
+++ b/roles/systemd_depend_mount/tasks/main.yml
@@ -1,27 +1,23 @@
 - name: Create override directory
+  loop: '{{ systemd_depend_mount_services }}'
   become: true
   ansible.builtin.file:
-    path: '/etc/systemd/system/{{ service }}.service.d'
+    path: '/etc/systemd/system/{{ item }}.service.d'
     state: directory
     owner: root
     group: root
-    mode: '755'
-  loop: '{{ systemd_depend_mount_services }}'
-  loop_control:
-    loop_var: service
+    mode: '0755'
 
 - name: Create service override
+  loop: '{{ systemd_depend_mount_services }}'
   become: true
   ansible.builtin.template:
     src: override.conf.j2
-    dest: '/etc/systemd/system/{{ service }}.service.d/depend_mount_{{ systemd_depend_mount_dir | regex_replace("/", "_") }}.conf'
+    dest: '/etc/systemd/system/{{ item }}.service.d/depend_mount_{{ systemd_depend_mount_dir | regex_replace("/", "_") }}.conf'
     owner: root
     group: root
-    mode: '644'
+    mode: '0644'
   notify: systemd_depend_mount_reload
-  loop: '{{ systemd_depend_mount_services }}'
-  loop_control:
-    loop_var: service
 
 - name: Reload systemd services if necessary
   ansible.builtin.meta: flush_handlers
diff --git a/roles/wireguard/handlers/main.yml b/roles/wireguard/handlers/main.yml
index 390e740..4c9b831 100644
--- a/roles/wireguard/handlers/main.yml
+++ b/roles/wireguard/handlers/main.yml
@@ -1,5 +1,5 @@
 - name: Reload systemd daemon
+  listen: wireguard_reload
   become: true
   ansible.builtin.systemd_service:
     daemon_reload: true
-  listen: wireguard_reload
diff --git a/roles/wireguard/tasks/NetworkManager.yml b/roles/wireguard/tasks/NetworkManager.yml
index 6259fec..612a112 100644
--- a/roles/wireguard/tasks/NetworkManager.yml
+++ b/roles/wireguard/tasks/NetworkManager.yml
@@ -5,46 +5,42 @@
     dest: '/etc/NetworkManager/system-connections/{{ wireguard_name }}.nmconnection'
     owner: root
     group: root
-    mode: '600'
+    mode: '0600'
   register: wireguard_config
 
 - name: Reload NetworkManager connections
+  when: wireguard_config is changed
   become: true
   ansible.builtin.command: nmcli connection reload
-  when: wireguard_config.changed
   changed_when: true
 
 - name: Set up service dependencies for the interface
-  ansible.builtin.include_role:
-    name: systemd_depend_iface
   vars:
     systemd_depend_iface_name: '{{ wireguard_name }}'
     systemd_depend_iface_services: '{{ wireguard_dependent_services }}'
+  ansible.builtin.include_role:
+    name: systemd_depend_iface
 
 - name: Create override directory for services
+  loop: '{{ wireguard_dependent_services }}'
   become: true
   ansible.builtin.file:
-    path: '/etc/systemd/system/{{ service }}.service.d'
+    path: '/etc/systemd/system/{{ item }}.service.d'
     state: directory
     owner: root
     group: root
-    mode: '755'
-  loop: '{{ wireguard_dependent_services }}'
-  loop_control:
-    loop_var: service
+    mode: '0755'
 
 - name: Set up service dependencies for wg-quick
+  loop: '{{ wireguard_dependent_services }}'
   become: true
   ansible.builtin.template:
     src: depend_service_NetworkManager.conf.j2
-    dest: '/etc/systemd/system/{{ service }}.service.d/depend_service_NetworkManager.conf'
+    dest: '/etc/systemd/system/{{ item }}.service.d/depend_service_NetworkManager.conf'
     owner: root
     group: root
-    mode: '644'
+    mode: '0644'
   notify: wireguard_reload
-  loop: '{{ wireguard_dependent_services }}'
-  loop_control:
-    loop_var: service
 
 - name: Reload systemd services if necessary
   ansible.builtin.meta: flush_handlers
diff --git a/roles/wireguard/tasks/main.yml b/roles/wireguard/tasks/main.yml
index cc0121a..4d0ac57 100644
--- a/roles/wireguard/tasks/main.yml
+++ b/roles/wireguard/tasks/main.yml
@@ -1,9 +1,9 @@
 - name: Validate backend
+  when: |
+    wireguard_backend not in ['wg-quick', 'NetworkManager']
   ansible.builtin.fail:
     msg: |
       Unknown Wireguard backend: {{ wireguard_backend }}
-  when: |
-    wireguard_backend not in ['wg-quick', 'NetworkManager']
 
 - name: 'Set up using backend {{ wireguard_backend }}'
   ansible.builtin.include_tasks: '{{ wireguard_backend }}.yml'
diff --git a/roles/wireguard/tasks/wg-quick.yml b/roles/wireguard/tasks/wg-quick.yml
index c7f9a24..e5909ee 100644
--- a/roles/wireguard/tasks/wg-quick.yml
+++ b/roles/wireguard/tasks/wg-quick.yml
@@ -11,54 +11,50 @@
     dest: '/etc/wireguard/{{ wireguard_name }}.conf'
     owner: root
     group: root
-    mode: '600'
+    mode: '0600'
   register: wireguard_config
 
 - name: Enable wg-quick service
+  when: wireguard_config is changed
   become: true
   ansible.builtin.systemd_service:
     name: 'wg-quick@{{ wireguard_name }}'
     enabled: '{{ wireguard_autoconnect }}'
-  when: wireguard_config.changed
 
 - name: Restart wg-quick service
+  when: wireguard_config is changed and wireguard_autoconnect
   become: true
   ansible.builtin.systemd_service:
     name: 'wg-quick@{{ wireguard_name }}'
     state: restarted
-  when: wireguard_config.changed and wireguard_autoconnect
 
 - name: Set up service dependencies for the interface
-  ansible.builtin.include_role:
-    name: systemd_depend_iface
   vars:
     systemd_depend_iface_name: '{{ wireguard_name }}'
     systemd_depend_iface_services: '{{ wireguard_dependent_services }}'
+  ansible.builtin.include_role:
+    name: systemd_depend_iface
 
 - name: Create override directory for services
+  loop: '{{ wireguard_dependent_services }}'
   become: true
   ansible.builtin.file:
-    path: '/etc/systemd/system/{{ service }}.service.d'
+    path: '/etc/systemd/system/{{ item }}.service.d'
     state: directory
     owner: root
     group: root
-    mode: '755'
-  loop: '{{ wireguard_dependent_services }}'
-  loop_control:
-    loop_var: service
+    mode: '0755'
 
 - name: Set up service dependencies for wg-quick
+  loop: '{{ wireguard_dependent_services }}'
   become: true
   ansible.builtin.template:
     src: depend_service_wg-quick.conf.j2
-    dest: '/etc/systemd/system/{{ service }}.service.d/depend_service_wg-quick@{{ wireguard_name }}.conf'
+    dest: '/etc/systemd/system/{{ item }}.service.d/depend_service_wg-quick@{{ wireguard_name }}.conf'
     owner: root
     group: root
-    mode: '644'
+    mode: '0644'
   notify: wireguard_reload
-  loop: '{{ wireguard_dependent_services }}'
-  loop_control:
-    loop_var: service
 
 - name: Reload systemd services if necessary
   ansible.builtin.meta: flush_handlers
diff --git a/roles/yay/tasks/main.yml b/roles/yay/tasks/main.yml
index cc3729a..0676320 100644
--- a/roles/yay/tasks/main.yml
+++ b/roles/yay/tasks/main.yml
@@ -31,5 +31,5 @@
       always:
         - name: Clean up
           ansible.builtin.file:
-            path: '${{ yay_dir.path }}'
+            path: '{{ yay_dir.path }}'
             state: absent