Fix some ansible-lint complaints.

roles/ldap/tasks/setup.yml

@@ -3,7 +3,7 @@
 - name: preseed ldap domain
   debconf:
     name: slapd
-    question:  slapd/domain
+    question: slapd/domain
     value: "{{ ansible_domain }}"
     vtype: string
 
@@ -24,7 +24,9 @@
   no_log: true
 
 - name: dump admin password
-  shell: echo -n "{{ ldap_admin_pwd }}" > "{{ ldap_admin_pwd_file }}" ; chmod 0600 "{{ ldap_admin_pwd_file }}"
+  shell:
+    cmd: echo -n "{{ ldap_admin_pwd }}" > "{{ ldap_admin_pwd_file }}" ; chmod 0600 "{{ ldap_admin_pwd_file }}"
+    creates: "{{ ldap_admin_pwd_file }}"
   no_log: true
 
 - name: install packages for LDAP
@@ -35,37 +37,35 @@
       - ldapvi
       - python3-ldap
       - ssl-cert
-    state: latest
+    state: latest # noqa package-latest
 
 - name: add openldap to the ssl-cert group
   user:
     name: openldap
     groups: ssl-cert
-    append: yes
-  register: ssl_cert_group
-
-- name: restart slapd
-  systemd: name=slapd state=restarted
-  when: ssl_cert_group.changed
+    append: true
+  notify: restart slapd
 
 - name: make initial slapd configuration available
   copy:
     src: slapd-config.ldif
     dest: /etc/ldap/slapd.d/
+    mode: 0644
 
 - name: make slapd TLS configuration available
   template:
     src: slapd-TLS.ldif
     dest: /etc/ldap/slapd.d/
+    mode: 0644
 
 - name: activate ppolicy schema
-  command: ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/ppolicy.ldif
+  command: ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/ppolicy.ldif # noqa no-changed-when
 
 - name: initialize slapd if it has just been installed
-  command: ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/slapd.d/slapd-config.ldif
+  command: ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/slapd.d/slapd-config.ldif # noqa no-changed-when
 
 - name: configure LDAP TLS
-  command: ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/ldap/slapd.d/slapd-TLS.ldif
+  command: ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/ldap/slapd.d/slapd-TLS.ldif # noqa no-changed-when
 
 - name: add URI to ldap.conf
   lineinfile:
@@ -83,7 +83,7 @@
   replace:
     path: /etc/ldap/ldap.conf
     regexp: "^(TLS_CACERT\\s+/etc/ssl/certs/ca-certificates.crt)$"
-    replace: '#\1\nTLS_CACERT\t{{ TLSCertificateFile }}'
+    replace: '#\1\nTLS_CACERT\t{{ certpub }}'
 
 - name: enable pam-mkhomedir
   command: pam-auth-update --enable mkhomedir