refactor(roles): new variable naming standard

28 files changed, 171 insertions, 206 deletions

diff --git a/roles/acme/defaults/main.yml b/roles/acme/defaults/main.yml
index 81d3b2b..1665d3a 100644
--- a/roles/acme/defaults/main.yml
+++ b/roles/acme/defaults/main.yml
@@ -1,9 +1,9 @@
 ---
 
-acme_configuration_file: /etc/acme-client.conf
-acme_certificates_dir: /etc/ssl
-acme_keys_dir: /etc/ssl/private
+acme__configuration_file: /etc/acme-client.conf
+acme__certificates_dir: /etc/ssl
+acme__keys_dir: /etc/ssl/private
 
-acme_authority_name: letsencrypt
-acme_authority_url: https://acme-v02.api.letsencrypt.org/directory
-acme_authority_key: /etc/acme/letsencrypt-privkey.pem
+acme__authority_name: letsencrypt
+acme__authority_url: https://acme-v02.api.letsencrypt.org/directory
+acme__authority_key: /etc/acme/letsencrypt-privkey.pem
diff --git a/roles/acme/meta/main.yml b/roles/acme/meta/main.yml
index 0458175..f3eccc3 100644
--- a/roles/acme/meta/main.yml
+++ b/roles/acme/meta/main.yml
@@ -5,7 +5,7 @@ argument_specs:
     short_description: acme main entrypoint.
     options:
 
-      acme_rules:
+      acme__rules:
         type: list
         elements: dict
         required: true
@@ -15,37 +15,37 @@ argument_specs:
             required: true
             description: Acme domain name
 
-      acme_authority_name:
+      acme__authority_name:
         type: str
         required: true
         description: Acme authority name
 
-      acme_authority_url:
+      acme__authority_url:
         type: str
         required: true
         description: Acme authority api url
 
-      acme_authority_key:
+      acme__authority_key:
         type: path
         required: true
         description: Acme authority key file
 
-      acme_certificates_dir:
+      acme__certificates_dir:
         type: path
         required: true
         description: Acme certificates directory
 
-      acme_keys_dir:
+      acme__keys_dir:
         type: path
         required: true
         description: Acme keys directory
 
-      acme_configuration_file:
+      acme__configuration_file:
         type: path
         required: true
         description: Acme configuration file
 
-      relayd_connected_hosts:
+      relayd__connected_hosts:
         type: str
         required: true
         description: Group name of hosts for generating certificates
diff --git a/roles/acme/tasks/main.yml b/roles/acme/tasks/main.yml
index 040c176..0435265 100644
--- a/roles/acme/tasks/main.yml
+++ b/roles/acme/tasks/main.yml
@@ -3,7 +3,7 @@
 - name: generate acme-client configuration
   ansible.builtin.template:
     src: acme-client.conf.j2
-    dest: "{{ acme_configuration_file }}"
+    dest: "{{ acme__configuration_file }}"
     owner: 0
     group: 0
     mode: "0644"
@@ -11,20 +11,20 @@
 - name: retrieve enabled domains
   ansible.builtin.shell: |
     set -o pipefail
-    grep "^domain" {{ acme_configuration_file }} | cut -d " " -f 2
-  register: acme_result_subdomains
+    grep "^domain" {{ acme__configuration_file }} | cut -d " " -f 2
+  register: acme__result_subdomains
   changed_when: false
 
 - name: generate acme certificates
   ansible.builtin.command: acme-client -v {{ item }}
-  loop: "{{ acme_result_subdomains.stdout_lines }}"
-  register: acme_result_generation
-  failed_when: acme_result_generation.rc == 1
-  changed_when: acme_result_generation.rc != 2
+  loop: "{{ acme__result_subdomains.stdout_lines }}"
+  register: acme__result_generation
+  failed_when: acme__result_generation.rc == 1
+  changed_when: acme__result_generation.rc != 2
 
 - name: display registered certificates
   ansible.builtin.debug:
-    msg: "{{ acme_result_generation.results | map(attribute='stderr')
+    msg: "{{ acme__result_generation.results | map(attribute='stderr')
       | join('\n') }}"
 
 - name: enable automatic acme certificates update
@@ -33,4 +33,9 @@
     minute: 0
     hour: 6,18
     job: "acme-client -v {{ item }} && rcctl reload relayd"
-  loop: "{{ acme_result_subdomains.stdout_lines }}"
+  loop: "{{ acme__result_subdomains.stdout_lines }}"
+
+- name: restart relayd
+  ansible.builtin.service:
+    name: relayd
+    state: restarted
diff --git a/roles/acme/templates/acme-client.conf.j2 b/roles/acme/templates/acme-client.conf.j2
index 9453cec..00c2f60 100644
--- a/roles/acme/templates/acme-client.conf.j2
+++ b/roles/acme/templates/acme-client.conf.j2
@@ -1,19 +1,19 @@
 # managed by Ansible
 {% import 'macros.j2' as macros with context %}
 
-authority {{ acme_authority_name }} {
-	api url "{{ acme_authority_url }}"
-	account key "{{ acme_authority_key }}"
+authority {{ acme__authority_name }} {
+	api url "{{ acme__authority_url }}"
+	account key "{{ acme__authority_key }}"
 }
 
-{% call(h) macros.loop_valid_hosts(relayd_connected_hosts) -%}
-{% for rule in h.acme_rules %}
+{% call(h) macros.loop_valid_hosts(relayd__connected_hosts) -%}
+{% for rule in h.acme__rules %}
 
 domain {{ rule.domain }} {
-	alternative names { www.{{ rule.domain }} }
-	domain key "{{ acme_keys_dir }}/{{ rule.domain }}.key"
-	domain full chain certificate "{{ acme_certificates_dir }}/{{ rule.domain }}.crt"
-	sign with {{ acme_authority_name }}
+	# alternative names { www.{{ rule.domain }} }
+	domain key "{{ acme__keys_dir }}/{{ rule.domain }}.key"
+	domain full chain certificate "{{ acme__certificates_dir }}/{{ rule.domain }}.crt"
+	sign with {{ acme__authority_name }}
 }
 {% endfor %}
 {%- endcall %}
diff --git a/roles/cgit/meta/main.yml b/roles/cgit/meta/main.yml
index ddd865d..1efbc4b 100644
--- a/roles/cgit/meta/main.yml
+++ b/roles/cgit/meta/main.yml
@@ -2,7 +2,7 @@
 
 dependencies:
   - role: git
-  - role: httpd_pre
+  - role: httpd__pre
 
 argument_specs:
   main:
diff --git a/roles/git/meta/main.yml b/roles/git/meta/main.yml
index 1117027..8877ff2 100644
--- a/roles/git/meta/main.yml
+++ b/roles/git/meta/main.yml
@@ -1,8 +1,8 @@
 ---
 
 dependencies:
-  - role: sshd_keys
-    sshd_keys_users:
+  - role: sshd__keys
+    sshd__keys_users:
       - "{{ git_user }}"
 
 argument_specs:
diff --git a/roles/httpd/defaults/main.yml b/roles/httpd/defaults/main.yml
index f5e0a43..c0f92ed 100644
--- a/roles/httpd/defaults/main.yml
+++ b/roles/httpd/defaults/main.yml
@@ -1,15 +1,6 @@
 ---
 
-httpd_configuration_file: /etc/httpd.conf
-httpd_configuration_dir: /etc/httpd.d
-httpd_chroot_dir: /var/www
-httpd_passwords_dir: "{{ httpd_chroot_dir }}/htpasswd"
-httpd_sites_dir: "{{ httpd_chroot_dir }}/htdocs"
-
-httpd_user: www
-httpd_group: www
-
-httpd_supported_types:
+httpd__supported_types:
   - application/xml xml rss
   - image/gif gif
   - image/jpeg jpeg jpg
diff --git a/roles/httpd/tasks/main.yml b/roles/httpd/tasks/main.yml
index 584ae0b..194f198 100644
--- a/roles/httpd/tasks/main.yml
+++ b/roles/httpd/tasks/main.yml
@@ -1,39 +1,25 @@
 ---
 
-- name: create httpd directory
+- name: create static sites directories
   ansible.builtin.file:
-    path: "{{ httpd_configuration_dir }}"
+    path: "{{ httpd_pre__sites_dir }}/{{ item.domain }}"
     state: directory
-    owner: 0
-    group: 0
-    mode: "0644"
-
-- name: create passwords directory
-  ansible.builtin.file:
-    path: "{{ httpd_passwords_dir }}"
-    state: directory
-    owner: "{{ httpd_user }}"
-    group: "{{ httpd_group }}"
-    mode: "0700"
-
-- name: create sites directory
-  ansible.builtin.file:
-    path: "{{ httpd_sites_dir }}"
-    state: directory
-    owner: 0
-    group: 0
+    owner: "{{ httpd_pre__user }}"
+    group: "{{ httpd_pre__group }}"
     mode: "0755"
+  loop: "{{ httpd__rules }}"
+  when: item.extra.type is defined and item.extra.type == "static"
 
 - name: retrieve all configuration files
   ansible.builtin.find:
-    path: "{{ httpd_configuration_dir }}"
+    path: "{{ httpd_pre__configuration_dir }}"
     patterns: "*.conf"
-  register: httpd_configuration_files
+  register: httpd__configuration_files
 
 - name: generate httpd configuration
   ansible.builtin.template:
     src: httpd.conf.j2
-    dest: "{{ httpd_configuration_file }}"
+    dest: "{{ httpd_pre__configuration_file }}"
     owner: 0
     group: 0
     mode: "0644"
diff --git a/roles/httpd/templates/httpd.conf.j2 b/roles/httpd/templates/httpd.conf.j2
index 49e928d..9225244 100644
--- a/roles/httpd/templates/httpd.conf.j2
+++ b/roles/httpd/templates/httpd.conf.j2
@@ -1,24 +1,38 @@
 # managed by Ansible
 
 types {
-{% for type in httpd_supported_types %}
+{% for type in httpd__supported_types %}
 	{{ type }}
 {% endfor %}
 }
 
-server "acme" {
-	listen on localhost port 8888
+server "default" {
+	listen on * port 8888
+	log style {{ httpd__log_format }}
 
+	# acme tls challenge
 	location "/.well-known/acme-challenge/*" {
 		root "/acme"
 		request strip 2
 	}
 
+	# redirection
 	location * {
 		block return 302 "https://$HTTP_HOST$REQUEST_URI"
 	}
 }
 
-{% for file in httpd_configuration_files.files %}
+{% for item in httpd__rules  %}
+{% if item.extra.type is defined and item.extra.type == "static" %}
+server "{{ item.domain }}" {
+	listen on localhost port {{ item.port }}
+	log style {{ httpd__log_format }}
+	root "{{ httpd_pre__chroot_sites_dir }}/{{ item.domain }}"
+}
+
+{% endif %}
+{% endfor %}
+
+{% for file in httpd__configuration_files.files %}
 include "{{ file.path }}"
 {% endfor %}
diff --git a/roles/pf/defaults/main.yml b/roles/pf/defaults/main.yml
index 90b4c7e..7e8ac41 100644
--- a/roles/pf/defaults/main.yml
+++ b/roles/pf/defaults/main.yml
@@ -1,8 +1,8 @@
 ---
 
-pf_rules: null
+pf__rules: null
 
-pf_configuration_file: /etc/pf.conf
-pf_test_delay: 2
-pf_test_ports:
+pf__configuration_file: /etc/pf.conf
+pf__test_delay: 2
+pf__test_ports:
   - "{{ ansible_port }}"
diff --git a/roles/pf/meta/main.yml b/roles/pf/meta/main.yml
index 8a6aa88..9c02951 100644
--- a/roles/pf/meta/main.yml
+++ b/roles/pf/meta/main.yml
@@ -5,7 +5,7 @@ argument_specs:
     short_description: pf main entrypoint.
     options:
 
-      pf_rules:
+      pf__rules:
         type: list
         elements: dict
         required: true
@@ -25,17 +25,17 @@ argument_specs:
             required: true
             description: Port to be configured
 
-      pf_configuration_file:
+      pf__configuration_file:
         type: path
         required: true
         description: Pf configuration file
 
-      pf_test_delay:
+      pf__test_delay:
         type: int
         required: true
         description: Pf test delay
 
-      pf_test_ports:
+      pf__test_ports:
         type: list
         element: int
         required: true
diff --git a/roles/pf/tasks/main.yml b/roles/pf/tasks/main.yml
index 4fba69e..9737315 100644
--- a/roles/pf/tasks/main.yml
+++ b/roles/pf/tasks/main.yml
@@ -3,35 +3,35 @@
 - name: generate pf configuration
   ansible.builtin.template:
     src: pf.conf.j2
-    dest: "{{ pf_configuration_file }}"
+    dest: "{{ pf__configuration_file }}"
     owner: 0
     group: 0
     mode: "0600"
-  register: pf_result_generate_configuration
+  register: pf__result_generate_configuration
 
 - name: lint pf configuration  # noqa: no-handler
-  ansible.builtin.command: "pfctl -nf {{ pf_configuration_file }}"
-  register: pf_result_lint_configuration
+  ansible.builtin.command: "pfctl -nf {{ pf__configuration_file }}"
+  register: pf__result_lint_configuration
   changed_when:
-    - pf_result_generate_configuration.changed
-    - pf_result_lint_configuration.rc != 0
+    - pf__result_generate_configuration.changed
+    - pf__result_lint_configuration.rc != 0
 
 - name: restart pf  # noqa: no-handler
-  ansible.builtin.command: pfctl -f "{{ pf_configuration_file }}"
-  when: pf_result_generate_configuration.changed
+  ansible.builtin.command: pfctl -f "{{ pf__configuration_file }}"
+  when: pf__result_generate_configuration.changed
 
 - name: test pf rules
   ansible.builtin.wait_for:
     port: "{{ item }}"
-    delay: "{{ pf_test_delay }}"
+    delay: "{{ pf__test_delay }}"
     state: started
-  loop: "{{ pf_test_ports }}"
+  loop: "{{ pf__test_ports }}"
 
 - name: enable pf
   ansible.builtin.command: pfctl -e
-  register: pf_result_enable
+  register: pf__result_enable
   changed_when:
-    - "'already enabled' not in pf_result_enable.stderr"
+    - "'already enabled' not in pf__result_enable.stderr"
   failed_when:
-    - pf_result_enable.rc != 0
-    - "'already enabled' not in pf_result_enable.stderr"
+    - pf__result_enable.rc != 0
+    - "'already enabled' not in pf__result_enable.stderr"
diff --git a/roles/pf/templates/pf.conf.j2 b/roles/pf/templates/pf.conf.j2
index 193c9d2..2f159b4 100644
--- a/roles/pf/templates/pf.conf.j2
+++ b/roles/pf/templates/pf.conf.j2
@@ -11,7 +11,7 @@ block all
 pass in quick on egress proto tcp to port {{ ansible_port }}
 
 # host services
-{% for rule in pf_rules %}
+{% for rule in pf__rules %}
 # {{ rule.name }}
 pass in quick on egress proto {{ rule.protocol }} to port {{ rule.port }}
 {% endfor %}
diff --git a/roles/prerequisites/tasks/main.yml b/roles/prerequisites/tasks/main.yml
index b1f4215..cd241a6 100644
--- a/roles/prerequisites/tasks/main.yml
+++ b/roles/prerequisites/tasks/main.yml
@@ -2,8 +2,8 @@
 
 - name: retrieve python installation
   ansible.builtin.raw: command -v python3
-  register: prerequisites_register_python_present
-  changed_when: prerequisites_register_python_present.rc != 0
+  register: prerequisites__register_python_present
+  changed_when: prerequisites__register_python_present.rc != 0
 
 - name: bruteforce python installation with all packages possiblity
   ansible.builtin.raw: |
@@ -14,4 +14,4 @@
   ignore_errors: true
   failed_when: result.rc not in [0, 1]
   poll: 0
-  when: prerequisites_register_python_present.rc != 0
+  when: prerequisites__register_python_present.rc != 0
diff --git a/roles/relayd/defaults/main.yml b/roles/relayd/defaults/main.yml
index 998ff5c..17d325d 100644
--- a/roles/relayd/defaults/main.yml
+++ b/roles/relayd/defaults/main.yml
@@ -1,19 +1,19 @@
 ---
 
-relayd_rules: {}
+relayd__rules: {}
 
-relayd_configuration_file: /etc/relayd.conf
-relayd_block_msg: aah!
+relayd__configuration_file: /etc/relayd.conf
+relayd__block_msg: aah!
 
-relayd_ssl_certificates_dir: /etc/ssl
-relayd_ssl_keys_dir: /etc/ssl/private
+relayd__ssl_certificates_dir: /etc/ssl
+relayd__ssl_keys_dir: /etc/ssl/private
 
-relayd_tls_ciphers:
+relayd__tls_ciphers:
   - HIGH
   - "!AES128"
   - "!kRSA"
   - "!aNULL"
-relayd_tls_elliptic_curves:
+relayd__tls_elliptic_curves:
   - P-384
   - P-256
   - X25519
diff --git a/roles/relayd/meta/main.yml b/roles/relayd/meta/main.yml
index e2da9c2..64efc3a 100644
--- a/roles/relayd/meta/main.yml
+++ b/roles/relayd/meta/main.yml
@@ -5,7 +5,7 @@ argument_specs:
     short_description: relayd main entrypoint.
     options:
 
-      relayd_rules:
+      relayd__rules:
         type: list
         elements: dict
         required: true
@@ -23,22 +23,22 @@ argument_specs:
             required: true
             description: Port to be configured
 
-      relayd_configuration_file:
+      relayd__configuration_file:
         type: path
         required: true
         description: Relayd configuration file
 
-      relayd_domain_name:
+      relayd__domain_name:
         type: str
         required: true
         description: Relayd domain name
 
-      relayd_connected_hosts:
+      relayd__connected_hosts:
         type: str
         required: true
         description: Group name of hosts that are behind relayd
 
-      relayd_tls_ciphers:
+      relayd__tls_ciphers:
         type: list
         elements: str
         required: true
diff --git a/roles/relayd/tasks/main.yml b/roles/relayd/tasks/main.yml
index 1346675..6485eb2 100644
--- a/roles/relayd/tasks/main.yml
+++ b/roles/relayd/tasks/main.yml
@@ -8,57 +8,57 @@
       -newkey rsa:4096
       -nodes
       -subj "/CN={{ item.domain }}"
-      -keyout {{ relayd_ssl_keys_dir }}/{{ item.domain }}.key
-      -out {{ relayd_ssl_certificates_dir }}/{{ item.domain }}.pem
-    creates: "{{ relayd_ssl_keys_dir }}/{{ item.domain }}.key"
-  loop: "{{ relayd_rules }}"
+      -keyout {{ relayd__ssl_keys_dir }}/{{ item.domain }}.key
+      -out {{ relayd__ssl_certificates_dir }}/{{ item.domain }}.pem
+    creates: "{{ relayd__ssl_keys_dir }}/{{ item.domain }}.key"
+  loop: "{{ relayd__rules }}"
 
 - name: apply restrictive permissions on ssl keys
   ansible.builtin.file:
-    path: "{{ relayd_ssl_keys_dir }}/{{ item.domain }}.key"
+    path: "{{ relayd__ssl_keys_dir }}/{{ item.domain }}.key"
     owner: 0
     group: 0
     mode: "0600"
-  loop: "{{ relayd_rules }}"
+  loop: "{{ relayd__rules }}"
 
 - name: retrieve certificate files
   ansible.builtin.stat:
-    path: "{{ relayd_ssl_certificates_dir }}/{{ item.domain }}.crt"
-  loop: "{{ relayd_rules }}"
-  register: relayd_result_stat_certificates
+    path: "{{ relayd__ssl_certificates_dir }}/{{ item.domain }}.crt"
+  loop: "{{ relayd__rules }}"
+  register: relayd__result_stat_certificates
 
 - name: link pem files to certificate files if required
   ansible.builtin.file:
-    src: "{{ relayd_ssl_certificates_dir }}/{{ item.item.domain }}.pem"
+    src: "{{ relayd__ssl_certificates_dir }}/{{ item.item.domain }}.pem"
     dest: "{{ item.invocation.module_args.path }}"
     owner: 0
     group: 0
     state: link
   when: not item.stat.exists
-  loop: "{{ relayd_result_stat_certificates.results }}"
+  loop: "{{ relayd__result_stat_certificates.results }}"
 
 - name: generate relayd configuration
   ansible.builtin.template:
     src: relayd.conf.j2
-    dest: "{{ relayd_configuration_file }}"
+    dest: "{{ relayd__configuration_file }}"
     owner: 0
     group: 0
     mode: "0640"
-  register: relayd_result_generate_configuration
+  register: relayd__result_generate_configuration
 
 - name: lint relayd configuration
-  ansible.builtin.command: "relayd -nf {{ relayd_configuration_file }}"
-  register: relayd_result_lint_configuration
+  ansible.builtin.command: "relayd -nf {{ relayd__configuration_file }}"
+  register: relayd__result_lint_configuration
   changed_when:
-    - relayd_result_generate_configuration.changed
-    - relayd_result_lint_configuration.rc != 0
+    - relayd__result_generate_configuration.changed
+    - relayd__result_lint_configuration.rc != 0
 
 - name: restart relayd  # noqa: no-handler
   ansible.builtin.service:
     name: relayd
     state: restarted
-  when: relayd_result_generate_configuration.changed
-    or relayd_result_lint_configuration.changed
+  when: relayd__result_generate_configuration.changed
+    or relayd__result_lint_configuration.changed
 
 - name: enable relayd
   ansible.builtin.service:
diff --git a/roles/relayd/templates/relayd.conf.j2 b/roles/relayd/templates/relayd.conf.j2
index 67b9e13..4169251 100644
--- a/roles/relayd/templates/relayd.conf.j2
+++ b/roles/relayd/templates/relayd.conf.j2
@@ -6,11 +6,11 @@ log connection errors
 
 # hosts
 table <local> { 127.0.0.1 }
-{% call(h) macros.loop_valid_hosts(relayd_connected_hosts) -%}
-{% set relayd_rule_ip = "127.0.0.1" if h.inventory_hostname == inventory_hostname else h.__ip.internal %}
-table <{{ h.inventory_hostname }}> { {{ relayd_rule_ip }} }
-{% for rule in h.relayd_rules %}
-table <{{ h.inventory_hostname }}_{{ rule.name }}> { {{ relayd_rule_ip }} }
+{% call(h) macros.loop_valid_hosts(relayd__connected_hosts) -%}
+{% set relayd__rule_ip = "127.0.0.1" if h.inventory_hostname == inventory_hostname else h.__ip.internal %}
+table <{{ h.inventory_hostname }}> { {{ relayd__rule_ip }} }
+{% for rule in h.relayd__rules %}
+table <{{ h.inventory_hostname }}_{{ rule.name }}> { {{ relayd__rule_ip }} }
 {% endfor %}
 {%- endcall %}
 
@@ -18,8 +18,8 @@ table <{{ h.inventory_hostname }}_{{ rule.name }}> { {{ relayd_rule_ip }} }
 
 http protocol "https" {
 	
-	tls ciphers "{{ relayd_tls_ciphers | join(':') }}"
-	tls ecdhe "{{ relayd_tls_elliptic_curves | join(',') }}"
+	tls ciphers "{{ relayd__tls_ciphers | join(':') }}"
+	tls ecdhe "{{ relayd__tls_elliptic_curves | join(',') }}"
 
 	tcp { sack, backlog 128 }
 
@@ -27,19 +27,20 @@ http protocol "https" {
 	match request header append "X-Forwarded-By" value "$SERVER_ADDR:$SERVER_PORT"
 	match request header set "Connection" value "close"
 	match request header set "X-Forwarded-Proto" value "https"
-	match request header set "X-Forwarded-Port" value "443"
+	match request header set "X-Forwarded-For" value "$REMOTE_ADDR"
+	match request header set "X-Forwarded-Port" value "$REMOTE_PORT"
 	match response header set "Content-Security-Policy" value "upgrade-insecure-requests"
 	match response header set "Referrer-Policy" value "no-referrer"
 	match response header set "X-XSS-Protection" value "1; mode=block"
 
-{% call(h) macros.loop_valid_hosts(relayd_connected_hosts) -%}
-{% for rule in h.relayd_rules %}
+{% call(h) macros.loop_valid_hosts(relayd__connected_hosts) -%}
+{% for rule in h.relayd__rules %}
 	tls keypair "{{ rule.domain }}"
 	pass request quick header "Host" value "{{ rule.domain }}" forward to <{{ h.inventory_hostname }}_{{ rule.name }}>
 {% endfor %}
 {%- endcall %}
 
-	block label "{{ relayd_block_msg }}"
+	block label "{{ relayd__block_msg }}"
 	return error
 }
 
@@ -48,8 +49,8 @@ http protocol "http" {
 	# acme
 	pass request quick path "/.well-known/acme-challenge/*" forward to <local>
 
-{% call(h) macros.loop_valid_hosts(relayd_connected_hosts) -%}
-{% for rule in h.relayd_rules %}
+{% call(h) macros.loop_valid_hosts(relayd__connected_hosts) -%}
+{% for rule in h.relayd__rules %}
 	pass request quick header "Host" value "{{ rule.domain }}" forward to <{{ h.inventory_hostname }}_{{ rule.name }}>
 {% endfor %}
 {%- endcall %}
@@ -70,8 +71,8 @@ relay "wwwtls" {
 	listen on egress port 443 tls
 	protocol "https"
 	forward to <local> port 80 check http "/" code 200
-{% call(h) macros.loop_valid_hosts(relayd_connected_hosts) -%}
-{% for rule in h.relayd_rules %}
+{% call(h) macros.loop_valid_hosts(relayd__connected_hosts) -%}
+{% for rule in h.relayd__rules %}
 	forward to <{{ h.inventory_hostname }}_{{ rule.name }}> port {{ rule.port }} check tcp
 {% endfor %}
 {%- endcall %}
diff --git a/roles/sshd/defaults/main.yml b/roles/sshd/defaults/main.yml
index 87933b9..85df472 100644
--- a/roles/sshd/defaults/main.yml
+++ b/roles/sshd/defaults/main.yml
@@ -1,5 +1,5 @@
 ---
 
-sshd_configuration_file: /etc/ssh/sshd_config
-sshd_listen_port: 22
-sshd_enable_x11_forwarding: false
+sshd__configuration_file: /etc/ssh/sshd_config
+sshd__listen_port: 22
+sshd__enable_x11_forwarding: false
diff --git a/roles/sshd/meta/main.yml b/roles/sshd/meta/main.yml
index e0d60ee..7edf5cf 100644
--- a/roles/sshd/meta/main.yml
+++ b/roles/sshd/meta/main.yml
@@ -5,17 +5,17 @@ argument_specs:
     short_description: sshd main entrypoint.
     options:
 
-      sshd_configuration_file:
+      sshd__configuration_file:
         type: path
         required: true
         description: Sshd configuration file
 
-      sshd_listen_port:
+      sshd__listen_port:
         type: int
         required: true
         description: Sshd listen port
 
-      sshd_enable_x11_forwarding:
+      sshd__enable_x11_forwarding:
         type: bool
         required: true
         description: Enable X11 forwarding
diff --git a/roles/sshd/tasks/main.yml b/roles/sshd/tasks/main.yml
index 6a622d2..05221fd 100644
--- a/roles/sshd/tasks/main.yml
+++ b/roles/sshd/tasks/main.yml
@@ -9,22 +9,22 @@
 - name: generate sshd configuration
   ansible.builtin.template:
     src: sshd_config.j2
-    dest: "{{ sshd_configuration_file }}"
+    dest: "{{ sshd__configuration_file }}"
     owner: 0
     group: 0
     mode: "0644"
-  register: sshd_result_generate_configuration
+  register: sshd__result_generate_configuration
 
 - name: lint sshd configuration
-  ansible.builtin.command: "sshd -tf {{ sshd_configuration_file }}"
-  register: sshd_result_lint
+  ansible.builtin.command: "sshd -tf {{ sshd__configuration_file }}"
+  register: sshd__result_lint
   changed_when: false
 
 - name: restart sshd  # noqa: no-handler
   ansible.builtin.service:
     name: sshd
     state: restarted
-  when: sshd_result_generate_configuration.changed
+  when: sshd__result_generate_configuration.changed
 
 - name: enable sshd
   ansible.builtin.service:
@@ -33,6 +33,6 @@
 
 - name: check ssh connection
   ansible.builtin.wait_for:
-    port: "{{ sshd_listen_port }}"
+    port: "{{ sshd__listen_port }}"
     delay: 1
     state: started
diff --git a/roles/sshd/templates/sshd_config.j2 b/roles/sshd/templates/sshd_config.j2
index b8affa8..179738a 100644
--- a/roles/sshd/templates/sshd_config.j2
+++ b/roles/sshd/templates/sshd_config.j2
@@ -1,7 +1,7 @@
 # managed by Ansible
 
 # network
-Port {{ sshd_listen_port }}
+Port {{ sshd__listen_port }}
 
 # security
 PermitRootLogin yes
@@ -13,7 +13,7 @@ AuthorizedKeysFile .ssh/authorized_keys
 PasswordAuthentication no
 PermitEmptyPasswords no
 ClientAliveInterval 180
-X11Forwarding {{ "yes" if sshd_enable_x11_forwarding else "no" }}
+X11Forwarding {{ "yes" if sshd__enable_x11_forwarding else "no" }}
 
 {% if ansible_distribution == "Debian" %}
 Subsystem sftp /usr/lib/openssh/sftp-server
diff --git a/roles/sshd_keys/defaults/main.yml b/roles/sshd_keys/defaults/main.yml
index 1b97a4a..d0b5466 100644
--- a/roles/sshd_keys/defaults/main.yml
+++ b/roles/sshd_keys/defaults/main.yml
@@ -1,13 +1,4 @@
 ---
 
-sshd_keys_users: null
-sshd_keys_dir: files/keys
-sshd_keys_paths: "[
-    {% if sshd_keys_users is none %}
-    '{{ sshd_keys_dir }}',
-    {% else %}
-    {% for user in sshd_keys_users %}
-    '{{ sshd_keys_dir }}/{{ user }}',
-    {% endfor %}
-    {% endif %}
-  ]"
+sshd_keys__users: null
+sshd_keys__dir: null
diff --git a/roles/sshd_keys/meta/main.yml b/roles/sshd_keys/meta/main.yml
index e790d71..ccf16eb 100644
--- a/roles/sshd_keys/meta/main.yml
+++ b/roles/sshd_keys/meta/main.yml
@@ -1,27 +1,17 @@
 ---
 
-dependencies:
-  - role: sshd
-    tags: dependency
-
 argument_specs:
   main:
-    short_description: sshd_keys main entrypoint.
+    short_description: sshd__keys main entrypoint.
     options:
 
-      sshd_keys_users:
+      sshd_keys__users:
         type: list
         elements: str
         required: true
         description: Users to be synced
 
-      sshd_keys_dir:
+      sshd_keys__dir:
         type: path
         required: true
         description: Local directory with public keys
-
-      sshd_keys_paths:
-        type: list
-        elements: path
-        required: true
-        description: Local directory with public keys
diff --git a/roles/sshd_keys/tasks/main.yml b/roles/sshd_keys/tasks/main.yml
index 5d45e34..168f64d 100644
--- a/roles/sshd_keys/tasks/main.yml
+++ b/roles/sshd_keys/tasks/main.yml
@@ -2,34 +2,21 @@
 
 - name: get ssh keys for all users
   ansible.builtin.find:
-    paths: "{{ sshd_keys_paths }}"
+    paths: "{{ sshd__keys_paths }}"
     file_type: link
     recurse: true
   delegate_to: localhost
   run_once: true
-  register: sshd_keys_result_find
+  register: sshd__keys_result_find
 
-- name: set sshd_keys_found_users variable
+- name: set sshd__keys_found_users variable
   ansible.builtin.set_fact:
-    sshd_keys_found_users: "{{ sshd_keys_result_find.files
+    sshd__keys_found_users: "{{ sshd__keys_result_find.files
       | map(attribute='path')
       | map('dirname')
       | map('basename')
       | unique }}"
 
-- name: create groups for users with ssh keys
-  ansible.builtin.group:
-    name: "{{ item }}"
-    state: present
-  loop: "{{ sshd_keys_found_users }}"
-
-- name: create users with ssh keys
-  ansible.builtin.user:
-    name: "{{ item }}"
-    group: "{{ item }}"
-    state: present
-  loop: "{{ sshd_keys_found_users }}"
-
 - name: synchronize ssh keys
   ansible.posix.authorized_key:
     user: "{{ item.path | dirname | basename }}"
@@ -37,5 +24,5 @@
     key: "{{ lookup('file', item.path) }}"
   loop_control:
     label: "{{ item.path }}: {{ item.path | dirname | basename }}"
-  loop: "{{ sshd_keys_result_find.files }}"
+  loop: "{{ sshd__keys_result_find.files }}"
   failed_when: false
diff --git a/roles/update/tasks/main.yml b/roles/update/tasks/main.yml
index 1719611..0c10aa7 100644
--- a/roles/update/tasks/main.yml
+++ b/roles/update/tasks/main.yml
@@ -2,12 +2,12 @@
 
 - name: apply system update
   ansible.builtin.command: syspatch
-  register: update_result_system_update
+  register: update__result_system_update
   failed_when:
-    - update_result_system_update.rc > 0
-    - update_result_system_update.rc != 2
+    - update__result_system_update.rc > 0
+    - update__result_system_update.rc != 2
   changed_when:
-    - update_result_system_update.rc == 0
+    - update__result_system_update.rc == 0
   when: ansible_distribution == "OpenBSD"
 
 - name: apply package update
diff --git a/roles/vmm/meta/main.yml b/roles/vmm/meta/main.yml
index dd93239..4bf5e0a 100644
--- a/roles/vmm/meta/main.yml
+++ b/roles/vmm/meta/main.yml
@@ -1,5 +1,5 @@
 ---
 
 dependencies:
-  - role: httpd_pre
+  - role: httpd__pre
     tags: dependency
diff --git a/roles/vmm/tasks/autoinstall_configuration.yml b/roles/vmm/tasks/autoinstall_configuration.yml
index 4901b61..a131cb3 100644
--- a/roles/vmm/tasks/autoinstall_configuration.yml
+++ b/roles/vmm/tasks/autoinstall_configuration.yml
@@ -40,7 +40,7 @@
   ansible.builtin.template:
     <<: *generation_steps
     src: httpd.conf.j2
-    dest: "{{ httpd_configuration_dir }}/autoinstall.conf"
+    dest: "{{ httpd__configuration_dir }}/autoinstall.conf"
     owner: 0
     group: 0