YDA-7297: update legacy fact name format

The legacy fact name format (e.g. "ansible_os_family") will be removed
in Ansible v2.24.0. Replace it with the regular bracket format
(e.g. ansible_facts["os_family"]) to remain compatible with newer
Ansible versions.

The fallbacks to the FQDN facts for yoda_fqdn are there so we have
a fallback in case the playbook is run with --tags

Author: stsnel

roles/acme_certificates/defaults/main.yml

@@ -19,6 +19,6 @@ openssl_o: 'Utrecht University'
 openssl_c: 'NL'
 openssl_locality_name: 'Utrecht'
 
-certificate_domain: "{{ ansible_fqdn }}"
+certificate_domain: "{{ yoda_fqdn | default(ansible_facts['fqdn']) }}"
 
 acme_certificates_email_contact: l.r.westerhof@uu.nl

roles/acme_certificates/tasks/main.yml

@@ -2,7 +2,7 @@
 # copyright Utrecht University
 
 - name: Include OS-specific variables
-  ansible.builtin.include_vars: "{{ ansible_os_family }}.yml"
+  ansible.builtin.include_vars: "{{ ansible_facts['os_family'] }}.yml"
 
 
 - name: Ensure Certbot for Let's Encrypt is installed

roles/anubis/tasks/install-redhat.yml

@@ -2,7 +2,7 @@
 # copyright Utrecht University
 
 - name: Include OS-specific variables
-  ansible.builtin.include_vars: "{{ ansible_os_family }}.yml"
+  ansible.builtin.include_vars: "{{ ansible_facts['os_family'] }}.yml"
 
 
 - name: Download Anubis package

roles/anubis/tasks/install-ubuntu.yml

@@ -2,7 +2,7 @@
 # copyright Utrecht University
 
 - name: Include OS-specific variables
-  ansible.builtin.include_vars: "{{ ansible_os_family }}.yml"
+  ansible.builtin.include_vars: "{{ ansible_facts['os_family'] }}.yml"
 
 
 - name: Download Anubis package

roles/anubis/tasks/setup-anubis.yml

@@ -2,17 +2,17 @@
 # copyright Utrecht University
 
 - name: Include OS-specific variables
-  ansible.builtin.include_vars: "{{ ansible_os_family }}.yml"
+  ansible.builtin.include_vars: "{{ ansible_facts['os_family'] }}.yml"
 
 
 - name: Install Anubis (EL)
   ansible.builtin.import_tasks: install-redhat.yml
-  when: ansible_os_family == 'RedHat'
+  when: ansible_facts['os_family'] == 'RedHat'
 
 
 - name: Install Anubis (Ubuntu)
   ansible.builtin.import_tasks: install-ubuntu.yml
-  when: ansible_os_family == 'Debian'
+  when: ansible_facts['os_family'] == 'Debian'
 
 
 - name: Ensure Anubis env file is present for DavRods
@@ -69,15 +69,15 @@
     - "proxy_http"
     - "rewrite"
     - "substitute"
-  when: ansible_os_family == 'Debian'
+  when: ansible_facts['os_family'] == 'Debian'
 
 
 - name: Allow Anubis to make network connections
   ansible.posix.seboolean:
     name: httpd_can_network_connect
     state: true
     persistent: true
-  when: ansible_os_family == 'RedHat' and ansible_selinux.status == "enabled"
+  when: ansible_facts['os_family'] == 'RedHat' and ansible_facts['selinux']['status'] == "enabled"
 
 
 - name: Allow Anubis to listen on ports for DavRods
@@ -89,7 +89,7 @@
   notify: Restart Anubis (davrods)
   when:
     - inventory_hostname in groups.get('portals', []) or inventory_hostname in groups.get('davrods', [])
-    - ansible_os_family == 'RedHat' and ansible_selinux.status == "enabled"
+    - ansible_facts['os_family'] == 'RedHat' and ansible_facts['selinux']['status'] == "enabled"
     - yoda_davrods_anonymous_enabled is not defined or yoda_davrods_anonymous_enabled
 
 
@@ -102,7 +102,7 @@
   notify: Restart Anubis (landingpages)
   when:
     - inventory_hostname in groups.get('publics', [])
-    - ansible_os_family == 'RedHat' and ansible_selinux.status == "enabled"
+    - ansible_facts['os_family'] == 'RedHat' and ansible_facts['selinux']['status'] == "enabled"
 
 
 - name: Ensure Anubis is running and enabled for Davrods

roles/apache/tasks/main-tasks.yml

@@ -2,7 +2,7 @@
 # copyright Utrecht University
 
 - name: Include OS-specific variables
-  ansible.builtin.include_vars: "{{ ansible_os_family }}.yml"
+  ansible.builtin.include_vars: "{{ ansible_facts['os_family'] }}.yml"
 
 
 - name: Ensure Apache webserver is installed
@@ -18,7 +18,7 @@
   ansible.builtin.package:
     name: mod_ssl
     state: present
-  when: ansible_os_family == 'RedHat'
+  when: ansible_facts['os_family'] == 'RedHat'
 
 
 - name: Allow public to ports for Apache in firewall
@@ -55,15 +55,15 @@
     dest: /etc/apache2/conf-available/other-vhosts-access-log.conf
     mode: '0644'
   notify: Restart Apache webserver
-  when: ansible_os_family == 'Debian'
+  when: ansible_facts['os_family'] == 'Debian'
 
 
 - name: Copy Apache ports configuration file (Ubuntu)
   ansible.builtin.copy:
     src: ports.conf.noble
     dest: /etc/apache2/ports.conf
     mode: '0600'
-  when: ansible_os_family == 'Debian'
+  when: ansible_facts['os_family'] == 'Debian'
 
 
 - name: Copy Apache security configuration file (Ubuntu)
@@ -74,7 +74,7 @@
     group: root
     mode: '0644'
   notify: Restart Apache webserver
-  when: ansible_os_family == 'Debian'
+  when: ansible_facts['os_family'] == 'Debian'
 
 
 - name: Copy bad bots blocklist
@@ -92,7 +92,7 @@
     dest: "/etc/apache2/conf-enabled/bad_bots.conf"
     state: link
   notify: Restart Apache webserver
-  when: ansible_os_family == 'Debian' and not ansible_check_mode
+  when: ansible_facts['os_family'] == 'Debian' and not ansible_check_mode
 
 
 - name: Ensure autoindex.conf is absent
@@ -102,7 +102,7 @@
   notify: Restart Apache webserver
   with_items:
     - /etc/httpd/conf.d/autoindex.conf
-  when: ansible_os_family == 'RedHat'
+  when: ansible_facts['os_family'] == 'RedHat'
 
 
 - name: Ensure unused Apache configurations are removed
@@ -114,7 +114,7 @@
     - /etc/httpd/conf.modules.d/00-lua.conf
     - /etc/httpd/conf.modules.d/01-cgi.conf
     - /etc/httpd/conf.modules.d/15-php.conf
-  when: ansible_os_family == 'RedHat'
+  when: ansible_facts['os_family'] == 'RedHat'
 
 
 - name: Ensure Apache modules used by Yoda are enabled (Ubuntu)
@@ -127,7 +127,7 @@
     - headers
     - ssl
     - socache_shmcb
-  when: ansible_os_family == 'Debian'
+  when: ansible_facts['os_family'] == 'Debian'
 
 
 - name: Ensure Apache global SSL configuration is loaded (Ubuntu)
@@ -136,7 +136,7 @@
     dest: "/etc/apache2/mods-enabled/ssl.conf"
     state: link
   notify: Restart Apache webserver
-  when: ansible_os_family == 'Debian'
+  when: ansible_facts['os_family'] == 'Debian'
 
 
 - name: Configure Apache apparmor profile
@@ -147,7 +147,7 @@
     group: root
     mode: '0644'
   register: apache_apparmor
-  when: ansible_os_family == 'Debian'
+  when: ansible_facts['os_family'] == 'Debian'
 
 
 - name: Put Apache in AppArmor enforce mode
@@ -156,7 +156,7 @@
     apparmor_parser -r /etc/apparmor.d/usr.sbin.apache2
   notify: Restart Apache webserver
   changed_when: true
-  when: ansible_os_family == 'Debian' and apache_apparmor.changed
+  when: ansible_facts['os_family'] == 'Debian' and apache_apparmor.changed
 
 
 - name: Ensure Apache service is configured

roles/apache_wsgi/tasks/main-tasks.yml

@@ -4,15 +4,15 @@
 - name: Install Mod-WSGI for Python (Ubuntu)
   ansible.builtin.apt:
     name: libapache2-mod-wsgi-py3
-  when: ansible_os_family == 'Debian'
+  when: ansible_facts['os_family'] == 'Debian'
 
 
 - name: Install Mod-WSGI for Python (EL)
   ansible.builtin.pip:
     name:
       - mod-wsgi==5.0.2
     executable: /usr/bin/pip3.12
-  when: ansible_os_family == 'RedHat'
+  when: ansible_facts['os_family'] == 'RedHat'
 
 
 - name: Configure WSGI module in Apache
@@ -23,15 +23,15 @@
     group: root
     mode: '0644'
   notify: Restart Apache webserver
-  when: ansible_os_family == 'RedHat'
+  when: ansible_facts['os_family'] == 'RedHat'
 
 
 - name: Remove old WSGI configurations in Apache
   ansible.builtin.file:
     path: '{{ item }}'
     state: absent
   notify: Restart Apache webserver
-  when: ansible_os_family == 'RedHat'
+  when: ansible_facts['os_family'] == 'RedHat'
   with_items:
     - /etc/httpd/conf.modules.d/10-wsgi.conf
     - /etc/httpd/conf.modules.d/10-wsgi-python3.conf
@@ -45,7 +45,7 @@
     group: root
     mode: '0644'
   register: python_selinux
-  when: ansible_os_family == 'RedHat'
+  when: ansible_facts['os_family'] == 'RedHat'
 
 
 # Running as task instead of handler in order to prevent ordering issues
@@ -54,4 +54,4 @@
   ansible.builtin.command:
     cmd: semodule -i /root/my-httpd.pp
   changed_when: false
-  when: ansible_os_family == 'RedHat' and not ansible_check_mode and python_selinux.changed
+  when: ansible_facts['os_family'] == 'RedHat' and not ansible_check_mode and python_selinux.changed

roles/certificates/defaults/main.yml

@@ -17,4 +17,4 @@ openssl_o: 'Utrecht University'
 openssl_c: 'NL'
 openssl_locality_name: 'Utrecht'
 
-certificate_domain: "{{ ansible_fqdn }}"
+certificate_domain: "{{ yoda_fqdn | default(ansible_facts['fqdn']) }}"

roles/certificates/tasks/main-tasks.yml

@@ -2,7 +2,7 @@
 # copyright Utrecht University
 
 - name: Include OS-specific variables
-  ansible.builtin.include_vars: "{{ ansible_os_family }}.yml"
+  ansible.builtin.include_vars: "{{ ansible_facts['os_family'] }}.yml"
 
 
 - name: Ensure dependencies for Ansible OpenSSL module are present

roles/common/tasks/basics-redhat.yml

@@ -9,7 +9,7 @@
       - python3-policycoreutils
       - python3-dnf-plugin-versionlock
     state: present
-  when: ansible_distribution_major_version == "9"
+  when: ansible_facts['distribution_major_version'] == "9"
 
 
 - name: Ensure basics (vim, bind-utils, etc.) are installed