ipv4 only work

roles/ipv4_only/handlers/main.yml

@@ -0,0 +1,5 @@
+# code: language=ansible
+
+- name: Reboot
+  ansible.builtin.reboot:
+    reboot_timeout: 180

roles/ipv4_only/tasks/main.yml

@@ -0,0 +1,32 @@
+# code: language=ansible
+
+- name: Disable ipv6 (all)
+  ansible.posix.sysctl:
+    name: "{{ item }}"
+    reload: true
+    state: present
+    sysctl_set: true
+    value: 1
+  loop:
+    - net.ipv6.conf.all.disable_ipv6
+    - net.ipv6.conf.default.disable_ipv6
+    - net.ipv6.conf.lo.disable_ipv6
+  notify:
+    - Reboot
+
+- name: Remove IPv6 localhost entries from /etc/hosts
+  when:
+    - (ipv4_only | default(false))
+  ansible.builtin.lineinfile:
+    path: /etc/hosts
+    line: "{{ item }}"
+    state: absent
+  loop:
+    - '::1 localhost ip6-localhost ip6-loopback'
+    - 'ff02::1 ip6-allnodes'
+    - 'ff02::2 ip6-allrouters'
+  notify:
+    - Reboot
+
+- name: Flush handlers to trigger reboot if required
+  ansible.builtin.meta: flush_handlers

roles/ipv4_only/vars/main.yml

@@ -0,0 +1 @@
+# code: language=ansible

roles/sudoers/tasks/main.yml

@@ -46,7 +46,7 @@
     name: "{{ sudoers_user }}"
     state: present
 
-- name: Add sudoers entries
+- name: Add main root sudoers entry
   community.general.sudoers:
     commands:
       - ALL
@@ -54,19 +54,28 @@
       - '!fqdn' # Ensures using shortname only when assessing hostname in sudo rule
     group: sudo
     host: "{{ inventory_hostname_short }}"
-    name: sudo_{{ item.name }}
-    nopassword: "{{ item.nopassword }}"
-    runas: "{{ item.name }}"
+    name: sudo_root
+    nopassword: false
+    runas: root
     state: present
     sudoers_path: "/etc/sudoers.d"
     validation: required
-  loop:
-    - name: root
-      nopassword: false
-    - name: "{{ unprivileged_user }}"
-      nopassword: true
-  loop_control:
-    label: "{{ item.name }}"
+
+- name: Add become unpriviligeed users sudoers entries
+  community.general.sudoers:
+    commands:
+      - ALL
+    defaults:
+      - '!fqdn' # Ensures using shortname only when assessing hostname in sudo rule
+    group: sudo
+    host: "{{ inventory_hostname_short }}"
+    name: sudo_{{ item }}
+    nopassword: true
+    runas: "{{ item }}"
+    state: present
+    sudoers_path: "/etc/sudoers.d"
+    validation: required
+  loop: "{{ unprivileged_users }}"
 
 - name: Remove default sudoers file
   ansible.builtin.file: