From 296214db55a55b7f47f76e2dcb4ebfb4007278bf Mon Sep 17 00:00:00 2001
From: lilly <li@lly.sh>
Date: Thu, 30 Apr 2026 22:48:56 +0200
Subject: [PATCH 1/6] add role tag to docker_compose role

---
 roles/docker_compose/handlers/main.yaml |  3 +++
 roles/docker_compose/tasks/main.yaml    | 15 +++++++++++++++
 2 files changed, 18 insertions(+)

diff --git a/roles/docker_compose/handlers/main.yaml b/roles/docker_compose/handlers/main.yaml
index 2aff0fe..8885171 100644
--- a/roles/docker_compose/handlers/main.yaml
+++ b/roles/docker_compose/handlers/main.yaml
@@ -1,10 +1,13 @@
+---
 - name: docker compose down
+  tags: [ "docker_compose" ]
   community.docker.docker_compose_v2:
     project_src: /ansible_docker_compose
     state: absent
   become: true
 
 - name: docker compose restart
+  tags: [ "docker_compose" ]
   community.docker.docker_compose_v2:
     project_src: /ansible_docker_compose
     state: restarted
diff --git a/roles/docker_compose/tasks/main.yaml b/roles/docker_compose/tasks/main.yaml
index 3563102..17e65a3 100644
--- a/roles/docker_compose/tasks/main.yaml
+++ b/roles/docker_compose/tasks/main.yaml
@@ -1,4 +1,6 @@
+---
 - name: make sure the `/ansible_docker_compose` directory exists
+  tags: [ "docker_compose" ]
   ansible.builtin.file:
     path: /ansible_docker_compose
     state: directory
@@ -8,6 +10,7 @@
   become: true
 
 - name: deploy the Compose file
+  tags: [ "docker_compose" ]
   ansible.builtin.copy:
     content: "{{ docker_compose__compose_file_content }}"
     dest: /ansible_docker_compose/compose.yaml
@@ -18,6 +21,7 @@
   notify: docker compose down
 
 - name: deploy the .env file
+  tags: [ "docker_compose" ]
   ansible.builtin.copy:
     content: "{{ docker_compose__env_file_content }}"
     dest: /ansible_docker_compose/.env
@@ -29,6 +33,7 @@
   notify: docker compose down
 
 - name: make sure the `/ansible_docker_compose/configs` directory exists
+  tags: [ "docker_compose" ]
   ansible.builtin.file:
     path: /ansible_docker_compose/configs
     state: directory
@@ -38,10 +43,12 @@
   become: true
 
 - name: set `docker_compose__config_files_to_exist` fact initially to an empty list
+  tags: [ "docker_compose" ]
   ansible.builtin.set_fact:
     docker_compose__config_files_to_exist: [ ]
 
 - name: add names from `docker_compose__configuration_files` to `docker_compose__config_files_to_exist` fact
+  tags: [ "docker_compose" ]
   ansible.builtin.set_fact:
     docker_compose__config_files_to_exist: "{{ docker_compose__config_files_to_exist + [ item.name ] }}"  # noqa: jinja[spacing]
   loop: "{{ docker_compose__configuration_files }}"
@@ -49,6 +56,7 @@
     label: "{{ item.name }}"
 
 - name: find configuration files to remove
+  tags: [ "docker_compose" ]
   ansible.builtin.find:
     paths: /ansible_docker_compose/configs/
     recurse: false
@@ -56,6 +64,7 @@
   register: docker_compose__config_files_to_remove
 
 - name: remove all configuration files, which should be removed
+  tags: [ "docker_compose" ]
   ansible.builtin.file:
     path: "{{ item.path }}"
     state: absent
@@ -64,6 +73,7 @@
   notify: docker compose restart
 
 - name: make sure all given configuration files are deployed
+  tags: [ "docker_compose" ]
   ansible.builtin.copy:
     content: "{{ item.content }}"
     dest: "/ansible_docker_compose/configs/{{ item.name }}"
@@ -77,6 +87,7 @@
   notify: docker compose restart
 
 - name: Sync files
+  tags: [ "docker_compose" ]
   ansible.posix.synchronize:
     src: "{{ docker_compose__files }}/"
     dest: "/ansible_docker_compose/files"
@@ -88,9 +99,11 @@
   when: docker_compose__files != ""
 
 - name: Flush handlers to make "docker compose down" and "docker compose restart" handlers run now
+  tags: [ "docker_compose" ]
   ansible.builtin.meta: flush_handlers
 
 - name: docker compose up
+  tags: [ "docker_compose" ]
   community.docker.docker_compose_v2:
     project_src: /ansible_docker_compose
     state: present
@@ -100,12 +113,14 @@
   become: true
 
 - name: Make sure anacron is installed
+  tags: [ "docker_compose" ]
   become: true
   ansible.builtin.package:
     name: anacron
     state: present
 
 - name: ensure automatic update cron job is present
+  tags: [ "docker_compose" ]
   become: true
   ansible.builtin.cron:
     name: 'ansible docker compose auto update'
-- 
2.51.2


From e4722257b91bf126dd47eac181e39fae768e49e2 Mon Sep 17 00:00:00 2001
From: lilly <li@lly.sh>
Date: Thu, 30 Apr 2026 22:56:28 +0200
Subject: [PATCH 2/6] add role tag to certbot role

---
 roles/certbot/tasks/main.yaml                   | 4 ++++
 roles/certbot/tasks/main/cert.yaml              | 7 +++++++
 roles/certbot/tasks/main/certs.yaml             | 4 ++++
 roles/certbot/tasks/main/http_01_cert.yaml      | 4 ++++
 roles/certbot/tasks/main/install.yaml           | 5 +++++
 roles/certbot/tasks/main/new_cert_commands.yaml | 3 +++
 roles/certbot/tasks/main/validate_cert.yaml     | 4 ++++
 7 files changed, 31 insertions(+)

diff --git a/roles/certbot/tasks/main.yaml b/roles/certbot/tasks/main.yaml
index e4749b4..6b14567 100644
--- a/roles/certbot/tasks/main.yaml
+++ b/roles/certbot/tasks/main.yaml
@@ -1,11 +1,15 @@
+---
 - name: ensure certbot installation
+  tags: [ "certbot" ]
   ansible.builtin.import_tasks:
     file: main/install.yaml
 
 - name: ensure new cert commands
+  tags: [ "certbot" ]
   ansible.builtin.import_tasks:
     file: main/new_cert_commands.yaml
 
 - name: ensure certificates
+  tags: [ "certbot" ]
   ansible.builtin.import_tasks:
     file: main/certs.yaml
diff --git a/roles/certbot/tasks/main/cert.yaml b/roles/certbot/tasks/main/cert.yaml
index 61f6d45..c179dee 100644
--- a/roles/certbot/tasks/main/cert.yaml
+++ b/roles/certbot/tasks/main/cert.yaml
@@ -1,4 +1,6 @@
+---
 - name: get expiry date before
+  tags: [ "certbot" ]
   ansible.builtin.command: /usr/bin/openssl x509 -enddate -noout -in /etc/letsencrypt/live/{{ item.commonName }}/fullchain.pem
   ignore_errors: true
   become: true
@@ -6,6 +8,7 @@
   register: certbot__cert_expiry_before
 
 - name: ensure directory for cert configs exists
+  tags: [ "certbot" ]
   ansible.builtin.file:
     path: "/etc/ansible_certbot/cert_configs/"
     state: directory
@@ -15,6 +18,7 @@
   become: true
 
 - name: ensure cert config is stored
+  tags: [ "certbot" ]
   ansible.builtin.copy:
     content: "{{ cert_config_defaults[item.challengeType] | combine(item, recursive=True) | ansible.builtin.to_nice_json }}"
     dest: "/etc/ansible_certbot/cert_configs/{{ item.commonName }}.json"
@@ -30,17 +34,20 @@
 
 # # https://eff-certbot.readthedocs.io/en/stable/using.html#manual
 - name: obtain the certificate using certbot and the manual auth hook
+  tags: [ "certbot" ]
   ansible.builtin.command: /usr/bin/certbot certonly --keep-until-expiring --agree-tos --non-interactive --email "{{ certbot__acme_account_email_address }}" --no-eff-email --manual --preferred-challenge dns --manual-auth-hook "/usr/local/lib/ansible_certbot/manual_auth_scripts/{{ item.challengeType }}.sh" -d "{{ item.commonName }}"
   become: true
   changed_when: false
 
 - name: get expiry date after
+  tags: [ "certbot" ]
   ansible.builtin.command: /usr/bin/openssl x509 -enddate -noout -in /etc/letsencrypt/live/{{ item.commonName }}/fullchain.pem
   become: true
   changed_when: false
   register: certbot__cert_expiry_after
 
 - name: potentially report changed
+  tags: [ "certbot" ]
   ansible.builtin.debug:
     msg: "If this reports changed, then the certificate expiry date and therefore the certificate changed."
   changed_when: certbot__cert_expiry_before.stdout != certbot__cert_expiry_after.stdout
diff --git a/roles/certbot/tasks/main/certs.yaml b/roles/certbot/tasks/main/certs.yaml
index 16271b7..71a42a5 100644
--- a/roles/certbot/tasks/main/certs.yaml
+++ b/roles/certbot/tasks/main/certs.yaml
@@ -1,14 +1,18 @@
+---
 - name: obtain http-01 challenge certificates
+  tags: [ "certbot" ]
   loop: "{{ certbot__certificate_domains }}"
   ansible.builtin.include_tasks:
     file: main/http_01_cert.yaml
 
 - name: validate certs config
+  tags: [ "certbot" ]
   loop: "{{ certbot__certs }}"
   ansible.builtin.include_tasks:
     file: main/validate_cert.yaml
 
 - name: obtain certs
+  tags: [ "certbot" ]
   loop: "{{ certbot__certs }}"
   ansible.builtin.include_tasks:
     file: main/cert.yaml
diff --git a/roles/certbot/tasks/main/http_01_cert.yaml b/roles/certbot/tasks/main/http_01_cert.yaml
index d829fb1..a2fb4b6 100644
--- a/roles/certbot/tasks/main/http_01_cert.yaml
+++ b/roles/certbot/tasks/main/http_01_cert.yaml
@@ -1,4 +1,6 @@
+---
 - name: get expiry date before
+  tags: [ "certbot" ]
   ansible.builtin.command: /usr/bin/openssl x509 -enddate -noout -in /etc/letsencrypt/live/{{ item }}/fullchain.pem
   ignore_errors: true
   become: true
@@ -6,11 +8,13 @@
   register: certbot__cert_expiry_before
 
 - name: obtain the certificate using certbot
+  tags: [ "certbot" ]
   ansible.builtin.command: /usr/bin/certbot certonly --keep-until-expiring --agree-tos --non-interactive --email "{{ certbot__acme_account_email_address }}" --no-eff-email --standalone --http-01-port "{{ certbot__http_01_port }}" -d "{{ item }}"
   become: true
   changed_when: false
 
 - name: get expiry date after
+  tags: [ "certbot" ]
   ansible.builtin.command: /usr/bin/openssl x509 -enddate -noout -in /etc/letsencrypt/live/{{ item }}/fullchain.pem
   become: true
   changed_when: false
diff --git a/roles/certbot/tasks/main/install.yaml b/roles/certbot/tasks/main/install.yaml
index d0fa58d..14c6430 100644
--- a/roles/certbot/tasks/main/install.yaml
+++ b/roles/certbot/tasks/main/install.yaml
@@ -1,4 +1,6 @@
+---
 - name: ensure relevant packages are installed
+  tags: [ "certbot" ]
   ansible.builtin.apt:
     name:
       - openssl
@@ -8,8 +10,10 @@
   become: true
 
 - name: ensure manual auth scripts are deployed
+  tags: [ "certbot" ]
   block:
     - name: ensure manual auth scripts directory exists
+      tags: [ "certbot" ]
       ansible.builtin.file:
         path: "/usr/local/lib/ansible_certbot/manual_auth_scripts"
         state: directory
@@ -19,6 +23,7 @@
       become: true
 
     - name: ensure manual auth scripts are deployed
+      tags: [ "certbot" ]
       ansible.builtin.copy:
         src: "manual_auth_scripts/{{ item }}.sh"
         dest: "/usr/local/lib/ansible_certbot/manual_auth_scripts/{{ item }}.sh"
diff --git a/roles/certbot/tasks/main/new_cert_commands.yaml b/roles/certbot/tasks/main/new_cert_commands.yaml
index 42bc255..70c003b 100644
--- a/roles/certbot/tasks/main/new_cert_commands.yaml
+++ b/roles/certbot/tasks/main/new_cert_commands.yaml
@@ -1,4 +1,6 @@
+---
 - name: ensure existence of renewal deploy hooks directory
+  tags: [ "certbot" ]
   ansible.builtin.file:
     path: /etc/letsencrypt/renewal-hooks/deploy
     state: directory
@@ -8,6 +10,7 @@
   become: true
 
 - name: ensure renewal deploy hook commands
+  tags: [ "certbot" ]
   ansible.builtin.template:
     src: renewal_deploy_hook_commands.sh.j2
     dest: /etc/letsencrypt/renewal-hooks/deploy/ansible_commands.sh
diff --git a/roles/certbot/tasks/main/validate_cert.yaml b/roles/certbot/tasks/main/validate_cert.yaml
index a13b3b9..c8e9dfb 100644
--- a/roles/certbot/tasks/main/validate_cert.yaml
+++ b/roles/certbot/tasks/main/validate_cert.yaml
@@ -1,11 +1,15 @@
+---
 - name: validate dns-01-acme-dns challenge type config
+  tags: [ "certbot" ]
   when: item.challengeType == "dns-01-acme-dns"
   block:
     - name: assert dns_01_acme_dns config exists
+      tags: [ "certbot" ]
       ansible.builtin.assert:
         that: item.dns_01_acme_dns is defined
 
     - name: assert dns_01_acme_dns config is valid
+      tags: [ "certbot" ]
       ansible.builtin.validate_argument_spec:
         argument_spec: "{{ required_data }}"
         provided_arguments:
-- 
2.51.2


From f27a7ee00b7c6fab485a85da36b0c7e6235a917b Mon Sep 17 00:00:00 2001
From: lilly <li@lly.sh>
Date: Thu, 30 Apr 2026 23:01:32 +0200
Subject: [PATCH 3/6] add role tag to base_config role

---
 roles/base_config/tasks/main.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/roles/base_config/tasks/main.yaml b/roles/base_config/tasks/main.yaml
index ab737b7..0837c64 100644
--- a/roles/base_config/tasks/main.yaml
+++ b/roles/base_config/tasks/main.yaml
@@ -1,10 +1,12 @@
 # Ensure the ssh module is disabled, so a cloud-init config change doesn't regenerate the host keys for no reason.
 - name: check if cloud-init config file exists
+  tags: [ "base_config" ]
   ansible.builtin.stat:
     path: /etc/cloud/cloud.cfg
   register: base_config__stat_cloud_cfg
 
 - name: ensure the cloud-init ssh module is disabled
+  tags: [ "base_config" ]
   ansible.builtin.replace:
     path: /etc/cloud/cloud.cfg
     regexp: " - ssh$"
@@ -14,6 +16,7 @@
 
 # Ensure a base set of admin tools is installed.
 - name: ensure a base set of admin tools is installed
+  tags: [ "base_config" ]
   ansible.builtin.apt:
     name:
       - vim
-- 
2.51.2


From 94b3df09816e3e9da84e8f2738540cdc6f6c56a4 Mon Sep 17 00:00:00 2001
From: lilly <li@lly.sh>
Date: Thu, 30 Apr 2026 23:02:49 +0200
Subject: [PATCH 4/6] add role tag to infrastructure_authorized_keys role

---
 roles/infrastructure_authorized_keys/tasks/main.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/roles/infrastructure_authorized_keys/tasks/main.yaml b/roles/infrastructure_authorized_keys/tasks/main.yaml
index 982c7a0..c82ced3 100644
--- a/roles/infrastructure_authorized_keys/tasks/main.yaml
+++ b/roles/infrastructure_authorized_keys/tasks/main.yaml
@@ -1,4 +1,6 @@
+---
 - name: deploy infrastructure authorized keys
+  tags: [ "infrastructure_authorized_keys" ]
   ansible.posix.authorized_key:
     state: present
     user: chaos
-- 
2.51.2


From 9ec04e162f4f6f9433dd8b118b1bf2b01bf0b041 Mon Sep 17 00:00:00 2001
From: lilly <li@lly.sh>
Date: Thu, 30 Apr 2026 23:03:36 +0200
Subject: [PATCH 5/6] add role tag to ansible_pull role

---
 roles/ansible_pull/tasks/main.yaml | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/roles/ansible_pull/tasks/main.yaml b/roles/ansible_pull/tasks/main.yaml
index 61a2635..040d9c2 100644
--- a/roles/ansible_pull/tasks/main.yaml
+++ b/roles/ansible_pull/tasks/main.yaml
@@ -1,6 +1,9 @@
+---
 - name: ensure dependencies are installed
+  tags: [ "ansible_pull" ]
   block:
     - name: ensure apt dependencies are installed
+      tags: [ "ansible_pull" ]
       ansible.builtin.apt:
         name:
           - python3-pip
@@ -10,12 +13,14 @@
       become: true
 
     - name: ensure SOPS is installed
+      tags: [ "ansible_pull" ]
       ansible.builtin.include_role:
         name: community.sops.install
 
 # https://docs.ansible.com/ansible/latest/installation_guide/intro_installation.html#installing-and-upgrading-ansible-with-pip
 # https://www.redhat.com/en/blog/python-venv-ansible
 - name: ensure Ansible installation exists
+  tags: [ "ansible_pull" ]
   ansible.builtin.pip:
     name:
       - ansible
@@ -25,6 +30,7 @@
   become: true
 
 - name: ensure ansible-pull-failure-notify script installation exists
+  tags: [ "ansible_pull" ]
   ansible.builtin.template:
     src: ansible-pull-failure-notify.sh.j2
     dest: /usr/local/sbin/ansible-pull-failure-notify.sh
@@ -34,6 +40,7 @@
   become: true
 
 - name: ensure secrets directory exists
+  tags: [ "ansible_pull" ]
   ansible.builtin.file:
     path: /etc/ansible_pull_secrets
     state: directory
@@ -43,6 +50,7 @@
   become: true
 
 - name: ensure age private key is deployed
+  tags: [ "ansible_pull" ]
   ansible.builtin.copy:
     content: "{{ ansible_pull__age_private_key }}"
     dest: /etc/ansible_pull_secrets/age_private_key
@@ -52,6 +60,7 @@
   become: true
 
 - name: ensure systemd services exists
+  tags: [ "ansible_pull" ]
   ansible.builtin.template:
     src: "{{ item }}.j2"
     dest: "/etc/systemd/system/{{ item }}"
@@ -66,6 +75,7 @@
     - systemd daemon reload
 
 - name: ensure systemd timer exists
+  tags: [ "ansible_pull" ]
   ansible.builtin.template:
     src: ansible-pull.timer.j2
     dest: /etc/systemd/system/ansible-pull.timer
@@ -77,6 +87,7 @@
     - systemd daemon reload
 
 - name: ensure systemd timer is started and enabled
+  tags: [ "ansible_pull" ]
   ansible.builtin.systemd_service:
     name: ansible-pull.timer
     state: started
-- 
2.51.2


From 1d54043b8e88446979ac9e2de895bb12f2072563 Mon Sep 17 00:00:00 2001
From: lilly <li@lly.sh>
Date: Thu, 30 Apr 2026 23:06:19 +0200
Subject: [PATCH 6/6] add role tag to msmtp role

---
 roles/msmtp/tasks/main.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/roles/msmtp/tasks/main.yaml b/roles/msmtp/tasks/main.yaml
index 7689ddc..664ff6d 100644
--- a/roles/msmtp/tasks/main.yaml
+++ b/roles/msmtp/tasks/main.yaml
@@ -1,10 +1,13 @@
+---
 - name: ensure msmtp is installed
+  tags: [ "msmtp" ]
   ansible.builtin.apt:
     name: msmtp
     state: present
   become: true
 
 - name: ensure msmtp config for root user
+  tags: [ "msmtp" ]
   ansible.builtin.template:
     src: msmtprc.j2
     dest: /root/.msmtprc
-- 
2.51.2