---
- name: systemd journald.conf
  become: 'yes'
  ansible.builtin.template:
    src: journald.conf.j2
    dest: /etc/systemd/journald.conf
    backup: 'yes'
    mode: 0644
    owner: root
    group: root
  notify:
    - reload systemd

- name: logrotate.conf
  become: 'yes'
  ansible.builtin.template:
    src: logrotate.conf.j2
    dest: /etc/logrotate.conf
    backup: 'yes'
    mode: 0644
    owner: root
    group: root

- name: cron.daily logrotate
  become: 'yes'
  ansible.builtin.lineinfile:
    line: "/usr/sbin/logrotate /etc/logrotate.conf"
    dest: /etc/cron.daily/logrotate
    mode: 0750
    state: present
    create: 'yes'

- name: stat rsyslog.conf
  become: 'yes'
  ansible.builtin.stat:
    path: /etc/rsyslog.conf
  register: rsyslogconf

- name: get rsyslog.conf FileCreateMode
  become: 'yes'
  environment:
    PATH: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
  ansible.builtin.shell: grep "^$FileCreateMode" /etc/rsyslog.conf
  register: rsyslog_filecreatemode
  changed_when: false
  when: rsyslogconf.stat.exists

- name: set rsyslog.conf FileCreateMode
  become: 'yes'
  ansible.builtin.lineinfile:
    regexp: '^\$FileCreateMode'
    line: '$FileCreateMode 0600'
    dest: /etc/rsyslog.conf
    mode: 0640
    state: present
    create: 'no'
  when: rsyslogconf.stat.exists and rsyslog_filecreatemode.stdout.find('FileCreateMode') != -1

- name: set rsyslog.d FileCreateMode
  become: 'yes'
  ansible.builtin.lineinfile:
    regexp: '^\$FileCreateMode'
    line: '$FileCreateMode 0600'
    dest: /etc/rsyslog.d/99-filecreatemode.conf
    mode: 0644
    state: present
    create: 'yes'
...