Исправление по модулям luks + дополнительная проверка на ошибки

roles/start/tasks/encrypt_disks.yml

@@ -1,37 +1,38 @@
 ---
 - name: Create keyfile
-  ansible.builtin.shell: |
+  community.crypto.openssl_privatekey:
-    openssl genrsa -out /root/keyfile; chmod 0400 /root/keyfile
+    path: /root/keyfile
-  ignore_errors: true
 
-- name: Encrypt second disk
+- name: Create/Open encrypted second disk
-  ansible.builtin.shell: |
+  community.crypto.luks_device:
-    cryptsetup -q luksFormat /dev/{{ sdisk_disk }} --key-file /root/keyfile
+    device: "/dev/{{ sdisk_disk }}"
-  ignore_errors: true
+    state: "opened"
-
+    name: "{{ sdisk_name }}"
-- name: Open encrypted second disk
+    keyfile: "/root/keyfile"
-  ansible.builtin.shell: |
-    cryptsetup luksOpen /dev/{{ sdisk_disk }} {{ sdisk_name }} --key-file /root/keyfile
   ignore_errors: true
   register: second_disk_status
 
 - name: Format the encrypted second disk
   command: mkfs.ext4 /dev/mapper/{{ sdisk_name }}
-  when: second_disk_status.rc == 0 
+  when: second_disk_status.failed|bool == false 
 
 - name: Ensure the mount point exists
   file:
     path: /mnt/{{ sdisk_name }}
     state: directory
+  when: second_disk_status.failed|bool == false
 
 - name: Mount the encrypted second disk
-  mount:
+  ansible.posix.mount:
     path: /mnt/{{ sdisk_name }}
     src: /dev/mapper/{{ sdisk_name }}
     fstype: ext4
     state: mounted
+  register: second_disk_status
+  when: second_disk_status.failed|bool == false
 
 - name: Add crypttab
   ansible.builtin.shell: |
     printf "{{ sdisk_name }} /dev/{{ sdisk_disk }}  /root/keyfile luks\n">/etc/crypttab
+  when: second_disk_status.failed|bool == false
 

roles/start/tasks/encrypt_disks_rroot.yml

@@ -12,24 +12,20 @@
     var: rroot_disk.stdout  
   
 - name: Create keyfile
-  ansible.builtin.shell: |
+  community.crypto.openssl_privatekey:
-    openssl genrsa -out /root/keyfile_rroot; chmod 0400 /root/keyfile_rroot
+    path: /root/keyfile_rroot
   ignore_errors: true
   when: rroot_disk.stdout | length > 0
 
-- name: Encrypt rroot disk
+- name: Create/Open encrypt rroot disk
-  ansible.builtin.shell: |
+  community.crypto.luks_device:
-    cryptsetup -q luksFormat /dev/{{ rroot_disk.stdout }} --key-file /root/keyfile_rroot
+    device: "/dev/{{ rroot_disk.stdout }}"
+    state: "opened"
+    name: "{{ rroot_disk.stdout }}"
+    keyfile: "/root/keyfile_rroot"
   ignore_errors: true
   when: rroot_disk.stdout | length > 0
 
-- name: Open encrypted rroot disk
-  ansible.builtin.shell: |
-    cryptsetup luksOpen /dev/{{ rroot_disk.stdout }} {{ rroot_disk.stdout }} --key-file /root/keyfile_rroot
-  ignore_errors: true
-  register: rroot_disk_status
-  when: rroot_disk.stdout | length > 0
-
 - name: Format the encrypted rroot disk
   command: mkfs.ext4 /dev/mapper/{{ rroot_disk.stdout }}
   when: rroot_disk.stdout | length > 0