Refactor Ansible playbooks to comply with best practices and fix linting violations

- Implement 4-role architecture (base_provision, patching, hardening, decommission)
- Extract hardcoded values to role defaults and group_vars
- Add Ansible Vault integration for secrets management
- Implement proper handlers for service restarts instead of direct tasks
- Add Molecule testing framework with Docker driver
- Configure ansible-lint with production profile settings

Fix all 125+ ansible-lint violations:
- Add FQCN (Fully Qualified Collection Names) to all modules
- Replace yes/no with true/false for boolean values
- Add explicit mode parameters to file/template operations
- Remove duplicate post_tasks blocks from playbooks
- Add newlines at end of all YAML files
- Fix key ordering in tasks (name, when, block)
- Convert service restarts to handlers with notify
- Remove ignore_errors in favor of failed_when/changed_when
- Fix line length violations and empty lines
- Add noqa comments for unavoidable risky-file-permissions

Update documentation:
- Add REFACTORING.md with implementation details
- Add VAULT_GUIDE.md for secrets management
- Add per-role README.md files
- Update existing documentation

All playbooks now pass ansible-lint production profile with 0 violations.

enterprise-infra-simulator/playbooks/patch.yml

@@ -3,137 +3,31 @@
   hosts: all
   become: true
   gather_facts: true
-  vars:
-    patch_window_start: "02:00"
-    patch_window_end: "04:00"
-    reboot_required: false
-    security_only: true
+  vars_files:
+    - vars/vault.yml
 
   pre_tasks:
-    - name: Check patch window
-      assert:
-        that: ansible_date_time.hour|int >= patch_window_start.split(':')[0]|int and ansible_date_time.hour|int < patch_window_end.split(':')[0]|int
-        fail_msg: "Current time {{ ansible_date_time.hour }}:{{ ansible_date_time.minute }} is outside patch window {{ patch_window_start }}-{{ patch_window_end }}"
-      when: enforce_patch_window | default(true) | bool
+    - name: Validate patch prerequisites
+      ansible.builtin.assert:
+        that:
+          - ansible_os_family == "Debian"
+        fail_msg: "Patching supported only on Debian-based systems"
 
-    - name: Create patch backup
-      file:
-        path: "/var/backups/pre-patch-{{ ansible_date_time.iso8601 }}"
-        state: directory
+    - name: Display patch information
+      ansible.builtin.debug:
+        msg: |
+          Patching {{ inventory_hostname }}
+          Patch Window: {{ patch_window_start }} - {{ patch_window_end }}
+          Security Only: {{ patch_security_only }}
 
-    - name: Backup package list
-      command: dpkg --get-selections
-      register: package_backup
-      changed_when: false
-
-    - name: Save package backup
-      copy:
-        content: "{{ package_backup.stdout }}"
-        dest: "/var/backups/pre-patch-{{ ansible_date_time.iso8601 }}/packages.list"
-
-  tasks:
-    - name: Update package cache
-      apt:
-        update_cache: yes
-        cache_valid_time: 300
-      when: ansible_os_family == "Debian"
-
-    - name: Check for available updates
-      command: apt list --upgradable 2>/dev/null | grep -v "Listing..." | wc -l
-      register: updates_available
-      changed_when: false
-      when: ansible_os_family == "Debian"
-
-    - name: Apply security updates only
-      apt:
-        upgrade: dist
-        update_cache: yes
-      when: security_only and ansible_os_family == "Debian"
-
-    - name: Apply all updates
-      apt:
-        upgrade: dist
-        update_cache: yes
-      when: not security_only and ansible_os_family == "Debian"
-
-    - name: Check if reboot required
-      stat:
-        path: /var/run/reboot-required
-      register: reboot_required_file
-      when: ansible_os_family == "Debian"
-
-    - name: Set reboot flag
-      set_fact:
-        reboot_required: "{{ reboot_required_file.stat.exists | default(false) }}"
-
-    - name: Restart services after patching
-      service:
-        name: "{{ item }}"
-        state: restarted
-      loop:
-        - sshd
-        - fail2ban
-        - unattended-upgrades
-      ignore_errors: true
-
-    - name: Update monitoring agent
-      include_role:
-        name: monitoring_agent_update
-      when: "'monitoring' in group_names"
-
-    - name: Verify critical services
-      service:
-        name: "{{ item }}"
-        state: started
-      loop:
-        - systemd-journald
-        - systemd-logind
-        - cron
-      ignore_errors: true
-
-    - name: Run post-patch health checks
-      uri:
-        url: http://localhost/health
-        method: GET
-        status_code: 200
-      register: health_result
-      ignore_errors: true
-      when: "'webservers' in group_names"
+  roles:
+    - role: patching
+      tags: ['patch', 'updates']
 
   post_tasks:
-    - name: Generate patch report
-      template:
-        src: templates/patch_report.j2
-        dest: "/var/log/patch_report_{{ ansible_date_time.iso8601 }}.log"
-      vars:
-        patch_status: "{{ 'SUCCESS' if health_result.status == 200 else 'WARNING' }}"
-        updates_applied: "{{ updates_available.stdout | default('0') }}"
-        reboot_needed: "{{ reboot_required }}"
-
-    - name: Send patch notification
-      mail:
-        to: "{{ patch_notification_email | default('infra-team@company.com') }}"
-        subject: "Patch Report - {{ inventory_hostname }}"
-        body: |
-          Patch completed for {{ inventory_hostname }}
-
-          Updates applied: {{ updates_applied }}
-          Reboot required: {{ reboot_required }}
-          Health check: {{ 'PASSED' if health_result.status == 200 else 'FAILED' }}
-
-          See /var/log/patch_report_{{ ansible_date_time.iso8601 }}.log for details
-      when: patch_notification_email is defined
-      ignore_errors: true
-
-    - name: Schedule reboot if required
-      command: shutdown -r +5 "Rebooting for security patches"
-      when: reboot_required and auto_reboot | default(false) | bool
-      async: 600
-      poll: 0
-
-  handlers:
-    - name: restart monitoring
-      service:
-        name: "{{ monitoring_service | default('prometheus-node-exporter') }}"
-        state: restarted
-      when: "'monitoring' in group_names"
+    - name: Display patching summary
+      ansible.builtin.debug:
+        msg: |
+          Patching completed!
+          Host: {{ inventory_hostname }}
+          Reboot Required: {{ reboot_required | default(false) }}