From 951b4df43ee3d3f407bc87933ba22d20aaf796d8 Mon Sep 17 00:00:00 2001
From: lilly <li@lly.sh>
Date: Thu, 30 Apr 2026 22:48:56 +0200
Subject: [PATCH 01/12] add role tag to docker_compose role

---
 roles/docker_compose/handlers/main.yaml |  6 ++--
 roles/docker_compose/tasks/main.yaml    | 42 ++++++++++++++++---------
 2 files changed, 32 insertions(+), 16 deletions(-)

diff --git a/roles/docker_compose/handlers/main.yaml b/roles/docker_compose/handlers/main.yaml
index 2aff0fe..736743f 100644
--- a/roles/docker_compose/handlers/main.yaml
+++ b/roles/docker_compose/handlers/main.yaml
@@ -1,10 +1,12 @@
-- name: docker compose down
+- tags: ["docker_compose"]
+  name: docker compose down
   community.docker.docker_compose_v2:
     project_src: /ansible_docker_compose
     state: absent
   become: true
 
-- name: docker compose restart
+- tags: ["docker_compose"]
+  name: docker compose restart
   community.docker.docker_compose_v2:
     project_src: /ansible_docker_compose
     state: restarted
diff --git a/roles/docker_compose/tasks/main.yaml b/roles/docker_compose/tasks/main.yaml
index 3563102..b7b260d 100644
--- a/roles/docker_compose/tasks/main.yaml
+++ b/roles/docker_compose/tasks/main.yaml
@@ -1,4 +1,5 @@
-- name: make sure the `/ansible_docker_compose` directory exists
+- tags: ["docker_compose"]
+  name: make sure the `/ansible_docker_compose` directory exists
   ansible.builtin.file:
     path: /ansible_docker_compose
     state: directory
@@ -7,7 +8,8 @@
     group: root
   become: true
 
-- name: deploy the Compose file
+- tags: ["docker_compose"]
+  name: deploy the Compose file
   ansible.builtin.copy:
     content: "{{ docker_compose__compose_file_content }}"
     dest: /ansible_docker_compose/compose.yaml
@@ -17,7 +19,8 @@
   become: true
   notify: docker compose down
 
-- name: deploy the .env file
+- tags: ["docker_compose"]
+  name: deploy the .env file
   ansible.builtin.copy:
     content: "{{ docker_compose__env_file_content }}"
     dest: /ansible_docker_compose/.env
@@ -28,7 +31,8 @@
   when: docker_compose__env_file_content is defined
   notify: docker compose down
 
-- name: make sure the `/ansible_docker_compose/configs` directory exists
+- tags: ["docker_compose"]
+  name: make sure the `/ansible_docker_compose/configs` directory exists
   ansible.builtin.file:
     path: /ansible_docker_compose/configs
     state: directory
@@ -37,25 +41,29 @@
     group: root
   become: true
 
-- name: set `docker_compose__config_files_to_exist` fact initially to an empty list
+- tags: ["docker_compose"]
+  name: set `docker_compose__config_files_to_exist` fact initially to an empty list
   ansible.builtin.set_fact:
     docker_compose__config_files_to_exist: [ ]
 
-- name: add names from `docker_compose__configuration_files` to `docker_compose__config_files_to_exist` fact
+- tags: ["docker_compose"]
+  name: add names from `docker_compose__configuration_files` to `docker_compose__config_files_to_exist` fact
   ansible.builtin.set_fact:
     docker_compose__config_files_to_exist: "{{ docker_compose__config_files_to_exist + [ item.name ] }}"  # noqa: jinja[spacing]
   loop: "{{ docker_compose__configuration_files }}"
   loop_control:
     label: "{{ item.name }}"
 
-- name: find configuration files to remove
+- tags: ["docker_compose"]
+  name: find configuration files to remove
   ansible.builtin.find:
     paths: /ansible_docker_compose/configs/
     recurse: false
     excludes: "{{ docker_compose__config_files_to_exist }}"
   register: docker_compose__config_files_to_remove
 
-- name: remove all configuration files, which should be removed
+- tags: ["docker_compose"]
+  name: remove all configuration files, which should be removed
   ansible.builtin.file:
     path: "{{ item.path }}"
     state: absent
@@ -63,7 +71,8 @@
   loop: "{{ docker_compose__config_files_to_remove.files }}"
   notify: docker compose restart
 
-- name: make sure all given configuration files are deployed
+- tags: ["docker_compose"]
+  name: make sure all given configuration files are deployed
   ansible.builtin.copy:
     content: "{{ item.content }}"
     dest: "/ansible_docker_compose/configs/{{ item.name }}"
@@ -76,7 +85,8 @@
     label: "{{ item.name }}"
   notify: docker compose restart
 
-- name: Sync files
+- tags: ["docker_compose"]
+  name: Sync files
   ansible.posix.synchronize:
     src: "{{ docker_compose__files }}/"
     dest: "/ansible_docker_compose/files"
@@ -87,10 +97,12 @@
   notify: docker compose restart
   when: docker_compose__files != ""
 
-- name: Flush handlers to make "docker compose down" and "docker compose restart" handlers run now
+- tags: ["docker_compose"]
+  name: Flush handlers to make "docker compose down" and "docker compose restart" handlers run now
   ansible.builtin.meta: flush_handlers
 
-- name: docker compose up
+- tags: ["docker_compose"]
+  name: docker compose up
   community.docker.docker_compose_v2:
     project_src: /ansible_docker_compose
     state: present
@@ -99,13 +111,15 @@
     remove_orphans: true
   become: true
 
-- name: Make sure anacron is installed
+- tags: ["docker_compose"]
+  name: Make sure anacron is installed
   become: true
   ansible.builtin.package:
     name: anacron
     state: present
 
-- name: ensure automatic update cron job is present
+- tags: ["docker_compose"]
+  name: ensure automatic update cron job is present
   become: true
   ansible.builtin.cron:
     name: 'ansible docker compose auto update'

From e08d18f48bdeec463a44f5cc7d283efe60711df3 Mon Sep 17 00:00:00 2001
From: lilly <li@lly.sh>
Date: Thu, 30 Apr 2026 22:56:28 +0200
Subject: [PATCH 02/12] add role tag to certbot role

---
 roles/certbot/tasks/main.yaml                  |  9 ++++++---
 roles/certbot/tasks/main/cert.yaml             | 18 ++++++++++++------
 roles/certbot/tasks/main/certs.yaml            |  9 ++++++---
 roles/certbot/tasks/main/http_01_cert.yaml     |  9 ++++++---
 roles/certbot/tasks/main/install.yaml          | 12 ++++++++----
 .../certbot/tasks/main/new_cert_commands.yaml  |  6 ++++--
 roles/certbot/tasks/main/validate_cert.yaml    |  9 ++++++---
 7 files changed, 48 insertions(+), 24 deletions(-)

diff --git a/roles/certbot/tasks/main.yaml b/roles/certbot/tasks/main.yaml
index e4749b4..95bc69e 100644
--- a/roles/certbot/tasks/main.yaml
+++ b/roles/certbot/tasks/main.yaml
@@ -1,11 +1,14 @@
-- name: ensure certbot installation
+- tags: ["certbot"]
+  name: ensure certbot installation
   ansible.builtin.import_tasks:
     file: main/install.yaml
 
-- name: ensure new cert commands
+- tags: ["certbot"]
+  name: ensure new cert commands
   ansible.builtin.import_tasks:
     file: main/new_cert_commands.yaml
 
-- name: ensure certificates
+- tags: ["certbot"]
+  name: ensure certificates
   ansible.builtin.import_tasks:
     file: main/certs.yaml
diff --git a/roles/certbot/tasks/main/cert.yaml b/roles/certbot/tasks/main/cert.yaml
index 61f6d45..0c21300 100644
--- a/roles/certbot/tasks/main/cert.yaml
+++ b/roles/certbot/tasks/main/cert.yaml
@@ -1,11 +1,13 @@
-- name: get expiry date before
+- tags: ["certbot", "certbot-cert"]
+  name: get expiry date before
   ansible.builtin.command: /usr/bin/openssl x509 -enddate -noout -in /etc/letsencrypt/live/{{ item.commonName }}/fullchain.pem
   ignore_errors: true
   become: true
   changed_when: false
   register: certbot__cert_expiry_before
 
-- name: ensure directory for cert configs exists
+- tags: ["certbot", "certbot-cert"]
+  name: ensure directory for cert configs exists
   ansible.builtin.file:
     path: "/etc/ansible_certbot/cert_configs/"
     state: directory
@@ -14,7 +16,8 @@
     mode: "0750"
   become: true
 
-- name: ensure cert config is stored
+- tags: ["certbot", "certbot-cert"]
+  name: ensure cert config is stored
   ansible.builtin.copy:
     content: "{{ cert_config_defaults[item.challengeType] | combine(item, recursive=True) | ansible.builtin.to_nice_json }}"
     dest: "/etc/ansible_certbot/cert_configs/{{ item.commonName }}.json"
@@ -29,18 +32,21 @@
           serverUrl: "https://acmedns.hamburg.ccc.de"
 
 # # https://eff-certbot.readthedocs.io/en/stable/using.html#manual
-- name: obtain the certificate using certbot and the manual auth hook
+- tags: ["certbot", "certbot-cert"]
+  name: obtain the certificate using certbot and the manual auth hook
   ansible.builtin.command: /usr/bin/certbot certonly --keep-until-expiring --agree-tos --non-interactive --email "{{ certbot__acme_account_email_address }}" --no-eff-email --manual --preferred-challenge dns --manual-auth-hook "/usr/local/lib/ansible_certbot/manual_auth_scripts/{{ item.challengeType }}.sh" -d "{{ item.commonName }}"
   become: true
   changed_when: false
 
-- name: get expiry date after
+- tags: ["certbot", "certbot-cert"]
+  name: get expiry date after
   ansible.builtin.command: /usr/bin/openssl x509 -enddate -noout -in /etc/letsencrypt/live/{{ item.commonName }}/fullchain.pem
   become: true
   changed_when: false
   register: certbot__cert_expiry_after
 
-- name: potentially report changed
+- tags: ["certbot", "certbot-cert"]
+  name: potentially report changed
   ansible.builtin.debug:
     msg: "If this reports changed, then the certificate expiry date and therefore the certificate changed."
   changed_when: certbot__cert_expiry_before.stdout != certbot__cert_expiry_after.stdout
diff --git a/roles/certbot/tasks/main/certs.yaml b/roles/certbot/tasks/main/certs.yaml
index 16271b7..ebb0d67 100644
--- a/roles/certbot/tasks/main/certs.yaml
+++ b/roles/certbot/tasks/main/certs.yaml
@@ -1,14 +1,17 @@
-- name: obtain http-01 challenge certificates
+- tags: ["certbot", "certbot-cert"]
+  name: obtain http-01 challenge certificates
   loop: "{{ certbot__certificate_domains }}"
   ansible.builtin.include_tasks:
     file: main/http_01_cert.yaml
 
-- name: validate certs config
+- tags: ["certbot", "certbot-cert"]
+  name: validate certs config
   loop: "{{ certbot__certs }}"
   ansible.builtin.include_tasks:
     file: main/validate_cert.yaml
 
-- name: obtain certs
+- tags: ["certbot", "certbot-cert"]
+  name: obtain certs
   loop: "{{ certbot__certs }}"
   ansible.builtin.include_tasks:
     file: main/cert.yaml
diff --git a/roles/certbot/tasks/main/http_01_cert.yaml b/roles/certbot/tasks/main/http_01_cert.yaml
index d829fb1..bf60062 100644
--- a/roles/certbot/tasks/main/http_01_cert.yaml
+++ b/roles/certbot/tasks/main/http_01_cert.yaml
@@ -1,16 +1,19 @@
-- name: get expiry date before
+- tags: ["certbot", "certbot-http-01-cert"]
+  name: get expiry date before
   ansible.builtin.command: /usr/bin/openssl x509 -enddate -noout -in /etc/letsencrypt/live/{{ item }}/fullchain.pem
   ignore_errors: true
   become: true
   changed_when: false
   register: certbot__cert_expiry_before
 
-- name: obtain the certificate using certbot
+- tags: ["certbot", "certbot-http-01-cert"]
+  name: obtain the certificate using certbot
   ansible.builtin.command: /usr/bin/certbot certonly --keep-until-expiring --agree-tos --non-interactive --email "{{ certbot__acme_account_email_address }}" --no-eff-email --standalone --http-01-port "{{ certbot__http_01_port }}" -d "{{ item }}"
   become: true
   changed_when: false
 
-- name: get expiry date after
+- tags: ["certbot", "certbot-http-01-cert"]
+  name: get expiry date after
   ansible.builtin.command: /usr/bin/openssl x509 -enddate -noout -in /etc/letsencrypt/live/{{ item }}/fullchain.pem
   become: true
   changed_when: false
diff --git a/roles/certbot/tasks/main/install.yaml b/roles/certbot/tasks/main/install.yaml
index d0fa58d..0dd9fa9 100644
--- a/roles/certbot/tasks/main/install.yaml
+++ b/roles/certbot/tasks/main/install.yaml
@@ -1,4 +1,5 @@
-- name: ensure relevant packages are installed
+- tags: ["certbot", "certbot-install"]
+  name: ensure relevant packages are installed
   ansible.builtin.apt:
     name:
       - openssl
@@ -7,9 +8,11 @@
     state: present
   become: true
 
-- name: ensure manual auth scripts are deployed
+- tags: ["certbot", "certbot-install"]
+  name: ensure manual auth scripts are deployed
   block:
-    - name: ensure manual auth scripts directory exists
+    - tags: ["certbot", "certbot-install"]
+      name: ensure manual auth scripts directory exists
       ansible.builtin.file:
         path: "/usr/local/lib/ansible_certbot/manual_auth_scripts"
         state: directory
@@ -18,7 +21,8 @@
         mode: "0755"
       become: true
 
-    - name: ensure manual auth scripts are deployed
+    - tags: ["certbot", "certbot-install"]
+      name: ensure manual auth scripts are deployed
       ansible.builtin.copy:
         src: "manual_auth_scripts/{{ item }}.sh"
         dest: "/usr/local/lib/ansible_certbot/manual_auth_scripts/{{ item }}.sh"
diff --git a/roles/certbot/tasks/main/new_cert_commands.yaml b/roles/certbot/tasks/main/new_cert_commands.yaml
index 42bc255..cb710c5 100644
--- a/roles/certbot/tasks/main/new_cert_commands.yaml
+++ b/roles/certbot/tasks/main/new_cert_commands.yaml
@@ -1,4 +1,5 @@
-- name: ensure existence of renewal deploy hooks directory
+- tags: ["certbot", "certbot-new_cert_commands"]
+  name: ensure existence of renewal deploy hooks directory
   ansible.builtin.file:
     path: /etc/letsencrypt/renewal-hooks/deploy
     state: directory
@@ -7,7 +8,8 @@
     mode: "0755"
   become: true
 
-- name: ensure renewal deploy hook commands
+- tags: ["certbot", "certbot-new_cert_commands"]
+  name: ensure renewal deploy hook commands
   ansible.builtin.template:
     src: renewal_deploy_hook_commands.sh.j2
     dest: /etc/letsencrypt/renewal-hooks/deploy/ansible_commands.sh
diff --git a/roles/certbot/tasks/main/validate_cert.yaml b/roles/certbot/tasks/main/validate_cert.yaml
index a13b3b9..36b6c4e 100644
--- a/roles/certbot/tasks/main/validate_cert.yaml
+++ b/roles/certbot/tasks/main/validate_cert.yaml
@@ -1,11 +1,14 @@
-- name: validate dns-01-acme-dns challenge type config
+- tags: ["certbot", "certbot-validate_cert"]
+  name: validate dns-01-acme-dns challenge type config
   when: item.challengeType == "dns-01-acme-dns"
   block:
-    - name: assert dns_01_acme_dns config exists
+    - tags: ["certbot", "certbot-validate_cert"]
+      name: assert dns_01_acme_dns config exists
       ansible.builtin.assert:
         that: item.dns_01_acme_dns is defined
 
-    - name: assert dns_01_acme_dns config is valid
+    - tags: ["certbot", "certbot-validate_cert"]
+      name: assert dns_01_acme_dns config is valid
       ansible.builtin.validate_argument_spec:
         argument_spec: "{{ required_data }}"
         provided_arguments:

From 80d5bb49c334193adb9006fce1347268c794f062 Mon Sep 17 00:00:00 2001
From: lilly <li@lly.sh>
Date: Thu, 30 Apr 2026 23:01:32 +0200
Subject: [PATCH 03/12] add role tag to base_config role

---
 roles/base_config/tasks/main.yaml | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/roles/base_config/tasks/main.yaml b/roles/base_config/tasks/main.yaml
index ab737b7..8d06303 100644
--- a/roles/base_config/tasks/main.yaml
+++ b/roles/base_config/tasks/main.yaml
@@ -1,10 +1,12 @@
 # Ensure the ssh module is disabled, so a cloud-init config change doesn't regenerate the host keys for no reason.
-- name: check if cloud-init config file exists
+- tags: ["base_config"]
+  name: check if cloud-init config file exists
   ansible.builtin.stat:
     path: /etc/cloud/cloud.cfg
   register: base_config__stat_cloud_cfg
 
-- name: ensure the cloud-init ssh module is disabled
+- tags: ["base_config"]
+  name: ensure the cloud-init ssh module is disabled
   ansible.builtin.replace:
     path: /etc/cloud/cloud.cfg
     regexp: " - ssh$"
@@ -13,7 +15,8 @@
   when: base_config__stat_cloud_cfg.stat.exists
 
 # Ensure a base set of admin tools is installed.
-- name: ensure a base set of admin tools is installed
+- tags: ["base_config"]
+  name: ensure a base set of admin tools is installed
   ansible.builtin.apt:
     name:
       - vim

From 5661cc1cff88b7edbc55d3221732238672b86a3e Mon Sep 17 00:00:00 2001
From: lilly <li@lly.sh>
Date: Thu, 30 Apr 2026 23:02:49 +0200
Subject: [PATCH 04/12] add role tag to infrastructure_authorized_keys role

---
 roles/infrastructure_authorized_keys/tasks/main.yaml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/roles/infrastructure_authorized_keys/tasks/main.yaml b/roles/infrastructure_authorized_keys/tasks/main.yaml
index 982c7a0..8ed1603 100644
--- a/roles/infrastructure_authorized_keys/tasks/main.yaml
+++ b/roles/infrastructure_authorized_keys/tasks/main.yaml
@@ -1,4 +1,5 @@
-- name: deploy infrastructure authorized keys
+- tags: ["infrastructure_authorized_keys"]
+  name: deploy infrastructure authorized keys
   ansible.posix.authorized_key:
     state: present
     user: chaos

From 47e82488418d4d26a7355adb52681495606f922b Mon Sep 17 00:00:00 2001
From: lilly <li@lly.sh>
Date: Thu, 30 Apr 2026 23:03:36 +0200
Subject: [PATCH 05/12] add role tag to ansible_pull role

---
 roles/ansible_pull/tasks/main.yaml | 30 ++++++++++++++++++++----------
 1 file changed, 20 insertions(+), 10 deletions(-)

diff --git a/roles/ansible_pull/tasks/main.yaml b/roles/ansible_pull/tasks/main.yaml
index 61a2635..92c8a50 100644
--- a/roles/ansible_pull/tasks/main.yaml
+++ b/roles/ansible_pull/tasks/main.yaml
@@ -1,6 +1,8 @@
-- name: ensure dependencies are installed
+- tags: ["ansible_pull"]
+  name: ensure dependencies are installed
   block:
-    - name: ensure apt dependencies are installed
+    - tags: ["ansible_pull"]
+      name: ensure apt dependencies are installed
       ansible.builtin.apt:
         name:
           - python3-pip
@@ -9,13 +11,15 @@
         state: present
       become: true
 
-    - name: ensure SOPS is installed
+    - tags: ["ansible_pull"]
+      name: ensure SOPS is installed
       ansible.builtin.include_role:
         name: community.sops.install
 
 # https://docs.ansible.com/ansible/latest/installation_guide/intro_installation.html#installing-and-upgrading-ansible-with-pip
 # https://www.redhat.com/en/blog/python-venv-ansible
-- name: ensure Ansible installation exists
+- tags: ["ansible_pull"]
+  name: ensure Ansible installation exists
   ansible.builtin.pip:
     name:
       - ansible
@@ -24,7 +28,8 @@
     virtualenv: /usr/local/lib/ansible_pull_venv
   become: true
 
-- name: ensure ansible-pull-failure-notify script installation exists
+- tags: ["ansible_pull"]
+  name: ensure ansible-pull-failure-notify script installation exists
   ansible.builtin.template:
     src: ansible-pull-failure-notify.sh.j2
     dest: /usr/local/sbin/ansible-pull-failure-notify.sh
@@ -33,7 +38,8 @@
     mode: "0755"
   become: true
 
-- name: ensure secrets directory exists
+- tags: ["ansible_pull"]
+  name: ensure secrets directory exists
   ansible.builtin.file:
     path: /etc/ansible_pull_secrets
     state: directory
@@ -42,7 +48,8 @@
     group: "{{ ansible_pull__user }}"
   become: true
 
-- name: ensure age private key is deployed
+- tags: ["ansible_pull"]
+  name: ensure age private key is deployed
   ansible.builtin.copy:
     content: "{{ ansible_pull__age_private_key }}"
     dest: /etc/ansible_pull_secrets/age_private_key
@@ -51,7 +58,8 @@
     group: "{{ ansible_pull__user }}"
   become: true
 
-- name: ensure systemd services exists
+- tags: ["ansible_pull"]
+  name: ensure systemd services exists
   ansible.builtin.template:
     src: "{{ item }}.j2"
     dest: "/etc/systemd/system/{{ item }}"
@@ -65,7 +73,8 @@
   notify:
     - systemd daemon reload
 
-- name: ensure systemd timer exists
+- tags: ["ansible_pull"]
+  name: ensure systemd timer exists
   ansible.builtin.template:
     src: ansible-pull.timer.j2
     dest: /etc/systemd/system/ansible-pull.timer
@@ -76,7 +85,8 @@
   notify:
     - systemd daemon reload
 
-- name: ensure systemd timer is started and enabled
+- tags: ["ansible_pull"]
+  name: ensure systemd timer is started and enabled
   ansible.builtin.systemd_service:
     name: ansible-pull.timer
     state: started

From 9aeedc3e78b85cc110e459f0ae67274e957030e8 Mon Sep 17 00:00:00 2001
From: lilly <li@lly.sh>
Date: Thu, 30 Apr 2026 23:06:19 +0200
Subject: [PATCH 06/12] add role tag to msmtp role

---
 roles/msmtp/tasks/main.yaml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/roles/msmtp/tasks/main.yaml b/roles/msmtp/tasks/main.yaml
index 7689ddc..b50f33e 100644
--- a/roles/msmtp/tasks/main.yaml
+++ b/roles/msmtp/tasks/main.yaml
@@ -1,10 +1,12 @@
-- name: ensure msmtp is installed
+- tags: ["msmtp"]
+  name: ensure msmtp is installed
   ansible.builtin.apt:
     name: msmtp
     state: present
   become: true
 
-- name: ensure msmtp config for root user
+- tags: ["msmtp"]
+  name: ensure msmtp config for root user
   ansible.builtin.template:
     src: msmtprc.j2
     dest: /root/.msmtprc

From 447e87961bf683b761a7a053f2337f1aed4ae08b Mon Sep 17 00:00:00 2001
From: lilly <li@lly.sh>
Date: Thu, 30 Apr 2026 22:48:56 +0200
Subject: [PATCH 07/12] add role tag to docker_compose role

---
 roles/docker_compose/handlers/main.yaml |  7 ++--
 roles/docker_compose/tasks/main.yaml    | 43 +++++++++++++++++--------
 2 files changed, 34 insertions(+), 16 deletions(-)

diff --git a/roles/docker_compose/handlers/main.yaml b/roles/docker_compose/handlers/main.yaml
index 2aff0fe..a4abcba 100644
--- a/roles/docker_compose/handlers/main.yaml
+++ b/roles/docker_compose/handlers/main.yaml
@@ -1,10 +1,13 @@
-- name: docker compose down
+---
+- tags: ["docker_compose"]
+  name: docker compose down
   community.docker.docker_compose_v2:
     project_src: /ansible_docker_compose
     state: absent
   become: true
 
-- name: docker compose restart
+- tags: ["docker_compose"]
+  name: docker compose restart
   community.docker.docker_compose_v2:
     project_src: /ansible_docker_compose
     state: restarted
diff --git a/roles/docker_compose/tasks/main.yaml b/roles/docker_compose/tasks/main.yaml
index 3563102..a3952e8 100644
--- a/roles/docker_compose/tasks/main.yaml
+++ b/roles/docker_compose/tasks/main.yaml
@@ -1,4 +1,6 @@
-- name: make sure the `/ansible_docker_compose` directory exists
+---
+- tags: ["docker_compose"]
+  name: make sure the `/ansible_docker_compose` directory exists
   ansible.builtin.file:
     path: /ansible_docker_compose
     state: directory
@@ -7,7 +9,8 @@
     group: root
   become: true
 
-- name: deploy the Compose file
+- tags: ["docker_compose"]
+  name: deploy the Compose file
   ansible.builtin.copy:
     content: "{{ docker_compose__compose_file_content }}"
     dest: /ansible_docker_compose/compose.yaml
@@ -17,7 +20,8 @@
   become: true
   notify: docker compose down
 
-- name: deploy the .env file
+- tags: ["docker_compose"]
+  name: deploy the .env file
   ansible.builtin.copy:
     content: "{{ docker_compose__env_file_content }}"
     dest: /ansible_docker_compose/.env
@@ -28,7 +32,8 @@
   when: docker_compose__env_file_content is defined
   notify: docker compose down
 
-- name: make sure the `/ansible_docker_compose/configs` directory exists
+- tags: ["docker_compose"]
+  name: make sure the `/ansible_docker_compose/configs` directory exists
   ansible.builtin.file:
     path: /ansible_docker_compose/configs
     state: directory
@@ -37,25 +42,29 @@
     group: root
   become: true
 
-- name: set `docker_compose__config_files_to_exist` fact initially to an empty list
+- tags: ["docker_compose"]
+  name: set `docker_compose__config_files_to_exist` fact initially to an empty list
   ansible.builtin.set_fact:
     docker_compose__config_files_to_exist: [ ]
 
-- name: add names from `docker_compose__configuration_files` to `docker_compose__config_files_to_exist` fact
+- tags: ["docker_compose"]
+  name: add names from `docker_compose__configuration_files` to `docker_compose__config_files_to_exist` fact
   ansible.builtin.set_fact:
     docker_compose__config_files_to_exist: "{{ docker_compose__config_files_to_exist + [ item.name ] }}"  # noqa: jinja[spacing]
   loop: "{{ docker_compose__configuration_files }}"
   loop_control:
     label: "{{ item.name }}"
 
-- name: find configuration files to remove
+- tags: ["docker_compose"]
+  name: find configuration files to remove
   ansible.builtin.find:
     paths: /ansible_docker_compose/configs/
     recurse: false
     excludes: "{{ docker_compose__config_files_to_exist }}"
   register: docker_compose__config_files_to_remove
 
-- name: remove all configuration files, which should be removed
+- tags: ["docker_compose"]
+  name: remove all configuration files, which should be removed
   ansible.builtin.file:
     path: "{{ item.path }}"
     state: absent
@@ -63,7 +72,8 @@
   loop: "{{ docker_compose__config_files_to_remove.files }}"
   notify: docker compose restart
 
-- name: make sure all given configuration files are deployed
+- tags: ["docker_compose"]
+  name: make sure all given configuration files are deployed
   ansible.builtin.copy:
     content: "{{ item.content }}"
     dest: "/ansible_docker_compose/configs/{{ item.name }}"
@@ -76,7 +86,8 @@
     label: "{{ item.name }}"
   notify: docker compose restart
 
-- name: Sync files
+- tags: ["docker_compose"]
+  name: Sync files
   ansible.posix.synchronize:
     src: "{{ docker_compose__files }}/"
     dest: "/ansible_docker_compose/files"
@@ -87,10 +98,12 @@
   notify: docker compose restart
   when: docker_compose__files != ""
 
-- name: Flush handlers to make "docker compose down" and "docker compose restart" handlers run now
+- tags: ["docker_compose"]
+  name: Flush handlers to make "docker compose down" and "docker compose restart" handlers run now
   ansible.builtin.meta: flush_handlers
 
-- name: docker compose up
+- tags: ["docker_compose"]
+  name: docker compose up
   community.docker.docker_compose_v2:
     project_src: /ansible_docker_compose
     state: present
@@ -99,13 +112,15 @@
     remove_orphans: true
   become: true
 
-- name: Make sure anacron is installed
+- tags: ["docker_compose"]
+  name: Make sure anacron is installed
   become: true
   ansible.builtin.package:
     name: anacron
     state: present
 
-- name: ensure automatic update cron job is present
+- tags: ["docker_compose"]
+  name: ensure automatic update cron job is present
   become: true
   ansible.builtin.cron:
     name: 'ansible docker compose auto update'

From 20b24f6df73585f1dc529ce9b1edd01c40ec1522 Mon Sep 17 00:00:00 2001
From: lilly <li@lly.sh>
Date: Thu, 30 Apr 2026 22:56:28 +0200
Subject: [PATCH 08/12] add role tag to certbot role

---
 roles/certbot/tasks/main.yaml                 | 10 +++++++---
 roles/certbot/tasks/main/cert.yaml            | 19 +++++++++++++------
 roles/certbot/tasks/main/certs.yaml           | 10 +++++++---
 roles/certbot/tasks/main/http_01_cert.yaml    | 10 +++++++---
 roles/certbot/tasks/main/install.yaml         | 13 +++++++++----
 .../certbot/tasks/main/new_cert_commands.yaml |  7 +++++--
 roles/certbot/tasks/main/validate_cert.yaml   | 10 +++++++---
 7 files changed, 55 insertions(+), 24 deletions(-)

diff --git a/roles/certbot/tasks/main.yaml b/roles/certbot/tasks/main.yaml
index e4749b4..55b4127 100644
--- a/roles/certbot/tasks/main.yaml
+++ b/roles/certbot/tasks/main.yaml
@@ -1,11 +1,15 @@
-- name: ensure certbot installation
+---
+- tags: ["certbot"]
+  name: ensure certbot installation
   ansible.builtin.import_tasks:
     file: main/install.yaml
 
-- name: ensure new cert commands
+- tags: ["certbot"]
+  name: ensure new cert commands
   ansible.builtin.import_tasks:
     file: main/new_cert_commands.yaml
 
-- name: ensure certificates
+- tags: ["certbot"]
+  name: ensure certificates
   ansible.builtin.import_tasks:
     file: main/certs.yaml
diff --git a/roles/certbot/tasks/main/cert.yaml b/roles/certbot/tasks/main/cert.yaml
index 61f6d45..609d405 100644
--- a/roles/certbot/tasks/main/cert.yaml
+++ b/roles/certbot/tasks/main/cert.yaml
@@ -1,11 +1,14 @@
-- name: get expiry date before
+---
+- tags: ["certbot", "certbot-cert"]
+  name: get expiry date before
   ansible.builtin.command: /usr/bin/openssl x509 -enddate -noout -in /etc/letsencrypt/live/{{ item.commonName }}/fullchain.pem
   ignore_errors: true
   become: true
   changed_when: false
   register: certbot__cert_expiry_before
 
-- name: ensure directory for cert configs exists
+- tags: ["certbot", "certbot-cert"]
+  name: ensure directory for cert configs exists
   ansible.builtin.file:
     path: "/etc/ansible_certbot/cert_configs/"
     state: directory
@@ -14,7 +17,8 @@
     mode: "0750"
   become: true
 
-- name: ensure cert config is stored
+- tags: ["certbot", "certbot-cert"]
+  name: ensure cert config is stored
   ansible.builtin.copy:
     content: "{{ cert_config_defaults[item.challengeType] | combine(item, recursive=True) | ansible.builtin.to_nice_json }}"
     dest: "/etc/ansible_certbot/cert_configs/{{ item.commonName }}.json"
@@ -29,18 +33,21 @@
           serverUrl: "https://acmedns.hamburg.ccc.de"
 
 # # https://eff-certbot.readthedocs.io/en/stable/using.html#manual
-- name: obtain the certificate using certbot and the manual auth hook
+- tags: ["certbot", "certbot-cert"]
+  name: obtain the certificate using certbot and the manual auth hook
   ansible.builtin.command: /usr/bin/certbot certonly --keep-until-expiring --agree-tos --non-interactive --email "{{ certbot__acme_account_email_address }}" --no-eff-email --manual --preferred-challenge dns --manual-auth-hook "/usr/local/lib/ansible_certbot/manual_auth_scripts/{{ item.challengeType }}.sh" -d "{{ item.commonName }}"
   become: true
   changed_when: false
 
-- name: get expiry date after
+- tags: ["certbot", "certbot-cert"]
+  name: get expiry date after
   ansible.builtin.command: /usr/bin/openssl x509 -enddate -noout -in /etc/letsencrypt/live/{{ item.commonName }}/fullchain.pem
   become: true
   changed_when: false
   register: certbot__cert_expiry_after
 
-- name: potentially report changed
+- tags: ["certbot", "certbot-cert"]
+  name: potentially report changed
   ansible.builtin.debug:
     msg: "If this reports changed, then the certificate expiry date and therefore the certificate changed."
   changed_when: certbot__cert_expiry_before.stdout != certbot__cert_expiry_after.stdout
diff --git a/roles/certbot/tasks/main/certs.yaml b/roles/certbot/tasks/main/certs.yaml
index 16271b7..7fe83c6 100644
--- a/roles/certbot/tasks/main/certs.yaml
+++ b/roles/certbot/tasks/main/certs.yaml
@@ -1,14 +1,18 @@
-- name: obtain http-01 challenge certificates
+---
+- tags: ["certbot", "certbot-cert"]
+  name: obtain http-01 challenge certificates
   loop: "{{ certbot__certificate_domains }}"
   ansible.builtin.include_tasks:
     file: main/http_01_cert.yaml
 
-- name: validate certs config
+- tags: ["certbot", "certbot-cert"]
+  name: validate certs config
   loop: "{{ certbot__certs }}"
   ansible.builtin.include_tasks:
     file: main/validate_cert.yaml
 
-- name: obtain certs
+- tags: ["certbot", "certbot-cert"]
+  name: obtain certs
   loop: "{{ certbot__certs }}"
   ansible.builtin.include_tasks:
     file: main/cert.yaml
diff --git a/roles/certbot/tasks/main/http_01_cert.yaml b/roles/certbot/tasks/main/http_01_cert.yaml
index d829fb1..1ea7447 100644
--- a/roles/certbot/tasks/main/http_01_cert.yaml
+++ b/roles/certbot/tasks/main/http_01_cert.yaml
@@ -1,16 +1,20 @@
-- name: get expiry date before
+---
+- tags: ["certbot", "certbot-http-01-cert"]
+  name: get expiry date before
   ansible.builtin.command: /usr/bin/openssl x509 -enddate -noout -in /etc/letsencrypt/live/{{ item }}/fullchain.pem
   ignore_errors: true
   become: true
   changed_when: false
   register: certbot__cert_expiry_before
 
-- name: obtain the certificate using certbot
+- tags: ["certbot", "certbot-http-01-cert"]
+  name: obtain the certificate using certbot
   ansible.builtin.command: /usr/bin/certbot certonly --keep-until-expiring --agree-tos --non-interactive --email "{{ certbot__acme_account_email_address }}" --no-eff-email --standalone --http-01-port "{{ certbot__http_01_port }}" -d "{{ item }}"
   become: true
   changed_when: false
 
-- name: get expiry date after
+- tags: ["certbot", "certbot-http-01-cert"]
+  name: get expiry date after
   ansible.builtin.command: /usr/bin/openssl x509 -enddate -noout -in /etc/letsencrypt/live/{{ item }}/fullchain.pem
   become: true
   changed_when: false
diff --git a/roles/certbot/tasks/main/install.yaml b/roles/certbot/tasks/main/install.yaml
index d0fa58d..d02a989 100644
--- a/roles/certbot/tasks/main/install.yaml
+++ b/roles/certbot/tasks/main/install.yaml
@@ -1,4 +1,6 @@
-- name: ensure relevant packages are installed
+---
+- tags: ["certbot", "certbot-install"]
+  name: ensure relevant packages are installed
   ansible.builtin.apt:
     name:
       - openssl
@@ -7,9 +9,11 @@
     state: present
   become: true
 
-- name: ensure manual auth scripts are deployed
+- tags: ["certbot", "certbot-install"]
+  name: ensure manual auth scripts are deployed
   block:
-    - name: ensure manual auth scripts directory exists
+    - tags: ["certbot", "certbot-install"]
+      name: ensure manual auth scripts directory exists
       ansible.builtin.file:
         path: "/usr/local/lib/ansible_certbot/manual_auth_scripts"
         state: directory
@@ -18,7 +22,8 @@
         mode: "0755"
       become: true
 
-    - name: ensure manual auth scripts are deployed
+    - tags: ["certbot", "certbot-install"]
+      name: ensure manual auth scripts are deployed
       ansible.builtin.copy:
         src: "manual_auth_scripts/{{ item }}.sh"
         dest: "/usr/local/lib/ansible_certbot/manual_auth_scripts/{{ item }}.sh"
diff --git a/roles/certbot/tasks/main/new_cert_commands.yaml b/roles/certbot/tasks/main/new_cert_commands.yaml
index 42bc255..18f4993 100644
--- a/roles/certbot/tasks/main/new_cert_commands.yaml
+++ b/roles/certbot/tasks/main/new_cert_commands.yaml
@@ -1,4 +1,6 @@
-- name: ensure existence of renewal deploy hooks directory
+---
+- tags: ["certbot", "certbot-new_cert_commands"]
+  name: ensure existence of renewal deploy hooks directory
   ansible.builtin.file:
     path: /etc/letsencrypt/renewal-hooks/deploy
     state: directory
@@ -7,7 +9,8 @@
     mode: "0755"
   become: true
 
-- name: ensure renewal deploy hook commands
+- tags: ["certbot", "certbot-new_cert_commands"]
+  name: ensure renewal deploy hook commands
   ansible.builtin.template:
     src: renewal_deploy_hook_commands.sh.j2
     dest: /etc/letsencrypt/renewal-hooks/deploy/ansible_commands.sh
diff --git a/roles/certbot/tasks/main/validate_cert.yaml b/roles/certbot/tasks/main/validate_cert.yaml
index a13b3b9..cdf08f5 100644
--- a/roles/certbot/tasks/main/validate_cert.yaml
+++ b/roles/certbot/tasks/main/validate_cert.yaml
@@ -1,11 +1,15 @@
-- name: validate dns-01-acme-dns challenge type config
+---
+- tags: ["certbot", "certbot-validate_cert"]
+  name: validate dns-01-acme-dns challenge type config
   when: item.challengeType == "dns-01-acme-dns"
   block:
-    - name: assert dns_01_acme_dns config exists
+    - tags: ["certbot", "certbot-validate_cert"]
+      name: assert dns_01_acme_dns config exists
       ansible.builtin.assert:
         that: item.dns_01_acme_dns is defined
 
-    - name: assert dns_01_acme_dns config is valid
+    - tags: ["certbot", "certbot-validate_cert"]
+      name: assert dns_01_acme_dns config is valid
       ansible.builtin.validate_argument_spec:
         argument_spec: "{{ required_data }}"
         provided_arguments:

From c5951647cf390963fe07fb6deae79708c801378f Mon Sep 17 00:00:00 2001
From: lilly <li@lly.sh>
Date: Thu, 30 Apr 2026 23:01:32 +0200
Subject: [PATCH 09/12] add role tag to base_config role

---
 roles/base_config/tasks/main.yaml | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/roles/base_config/tasks/main.yaml b/roles/base_config/tasks/main.yaml
index ab737b7..8d06303 100644
--- a/roles/base_config/tasks/main.yaml
+++ b/roles/base_config/tasks/main.yaml
@@ -1,10 +1,12 @@
 # Ensure the ssh module is disabled, so a cloud-init config change doesn't regenerate the host keys for no reason.
-- name: check if cloud-init config file exists
+- tags: ["base_config"]
+  name: check if cloud-init config file exists
   ansible.builtin.stat:
     path: /etc/cloud/cloud.cfg
   register: base_config__stat_cloud_cfg
 
-- name: ensure the cloud-init ssh module is disabled
+- tags: ["base_config"]
+  name: ensure the cloud-init ssh module is disabled
   ansible.builtin.replace:
     path: /etc/cloud/cloud.cfg
     regexp: " - ssh$"
@@ -13,7 +15,8 @@
   when: base_config__stat_cloud_cfg.stat.exists
 
 # Ensure a base set of admin tools is installed.
-- name: ensure a base set of admin tools is installed
+- tags: ["base_config"]
+  name: ensure a base set of admin tools is installed
   ansible.builtin.apt:
     name:
       - vim

From 1f339db3121b17d7742955c7ead47c7efbda2e04 Mon Sep 17 00:00:00 2001
From: lilly <li@lly.sh>
Date: Thu, 30 Apr 2026 23:02:49 +0200
Subject: [PATCH 10/12] add role tag to infrastructure_authorized_keys role

---
 roles/infrastructure_authorized_keys/tasks/main.yaml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/roles/infrastructure_authorized_keys/tasks/main.yaml b/roles/infrastructure_authorized_keys/tasks/main.yaml
index 982c7a0..5c6ef1c 100644
--- a/roles/infrastructure_authorized_keys/tasks/main.yaml
+++ b/roles/infrastructure_authorized_keys/tasks/main.yaml
@@ -1,4 +1,6 @@
-- name: deploy infrastructure authorized keys
+---
+- tags: ["infrastructure_authorized_keys"]
+  name: deploy infrastructure authorized keys
   ansible.posix.authorized_key:
     state: present
     user: chaos

From 4f2d0ad75be7d5bc1a987dd182062a029b2b0e6f Mon Sep 17 00:00:00 2001
From: lilly <li@lly.sh>
Date: Thu, 30 Apr 2026 23:03:36 +0200
Subject: [PATCH 11/12] add role tag to ansible_pull role

---
 roles/ansible_pull/tasks/main.yaml | 31 ++++++++++++++++++++----------
 1 file changed, 21 insertions(+), 10 deletions(-)

diff --git a/roles/ansible_pull/tasks/main.yaml b/roles/ansible_pull/tasks/main.yaml
index 61a2635..e7c614b 100644
--- a/roles/ansible_pull/tasks/main.yaml
+++ b/roles/ansible_pull/tasks/main.yaml
@@ -1,6 +1,9 @@
-- name: ensure dependencies are installed
+---
+- tags: ["ansible_pull"]
+  name: ensure dependencies are installed
   block:
-    - name: ensure apt dependencies are installed
+    - tags: ["ansible_pull"]
+      name: ensure apt dependencies are installed
       ansible.builtin.apt:
         name:
           - python3-pip
@@ -9,13 +12,15 @@
         state: present
       become: true
 
-    - name: ensure SOPS is installed
+    - tags: ["ansible_pull"]
+      name: ensure SOPS is installed
       ansible.builtin.include_role:
         name: community.sops.install
 
 # https://docs.ansible.com/ansible/latest/installation_guide/intro_installation.html#installing-and-upgrading-ansible-with-pip
 # https://www.redhat.com/en/blog/python-venv-ansible
-- name: ensure Ansible installation exists
+- tags: ["ansible_pull"]
+  name: ensure Ansible installation exists
   ansible.builtin.pip:
     name:
       - ansible
@@ -24,7 +29,8 @@
     virtualenv: /usr/local/lib/ansible_pull_venv
   become: true
 
-- name: ensure ansible-pull-failure-notify script installation exists
+- tags: ["ansible_pull"]
+  name: ensure ansible-pull-failure-notify script installation exists
   ansible.builtin.template:
     src: ansible-pull-failure-notify.sh.j2
     dest: /usr/local/sbin/ansible-pull-failure-notify.sh
@@ -33,7 +39,8 @@
     mode: "0755"
   become: true
 
-- name: ensure secrets directory exists
+- tags: ["ansible_pull"]
+  name: ensure secrets directory exists
   ansible.builtin.file:
     path: /etc/ansible_pull_secrets
     state: directory
@@ -42,7 +49,8 @@
     group: "{{ ansible_pull__user }}"
   become: true
 
-- name: ensure age private key is deployed
+- tags: ["ansible_pull"]
+  name: ensure age private key is deployed
   ansible.builtin.copy:
     content: "{{ ansible_pull__age_private_key }}"
     dest: /etc/ansible_pull_secrets/age_private_key
@@ -51,7 +59,8 @@
     group: "{{ ansible_pull__user }}"
   become: true
 
-- name: ensure systemd services exists
+- tags: ["ansible_pull"]
+  name: ensure systemd services exists
   ansible.builtin.template:
     src: "{{ item }}.j2"
     dest: "/etc/systemd/system/{{ item }}"
@@ -65,7 +74,8 @@
   notify:
     - systemd daemon reload
 
-- name: ensure systemd timer exists
+- tags: ["ansible_pull"]
+  name: ensure systemd timer exists
   ansible.builtin.template:
     src: ansible-pull.timer.j2
     dest: /etc/systemd/system/ansible-pull.timer
@@ -76,7 +86,8 @@
   notify:
     - systemd daemon reload
 
-- name: ensure systemd timer is started and enabled
+- tags: ["ansible_pull"]
+  name: ensure systemd timer is started and enabled
   ansible.builtin.systemd_service:
     name: ansible-pull.timer
     state: started

From 5787a9d792d69b6d60d298928f0ec426738c3176 Mon Sep 17 00:00:00 2001
From: lilly <li@lly.sh>
Date: Thu, 30 Apr 2026 23:06:19 +0200
Subject: [PATCH 12/12] add role tag to msmtp role

---
 roles/msmtp/tasks/main.yaml | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/roles/msmtp/tasks/main.yaml b/roles/msmtp/tasks/main.yaml
index 7689ddc..655f391 100644
--- a/roles/msmtp/tasks/main.yaml
+++ b/roles/msmtp/tasks/main.yaml
@@ -1,10 +1,13 @@
-- name: ensure msmtp is installed
+---
+- tags: ["msmtp"]
+  name: ensure msmtp is installed
   ansible.builtin.apt:
     name: msmtp
     state: present
   become: true
 
-- name: ensure msmtp config for root user
+- tags: ["msmtp"]
+  name: ensure msmtp config for root user
   ansible.builtin.template:
     src: msmtprc.j2
     dest: /root/.msmtprc