lint: apply a few key-order[task] recommendations

Ordering "when:" before "block:" makes it more readable I suppose.

roles/gitlab_runner/tasks/main.yml

@@ -61,6 +61,7 @@
   systemd: name=gitlab-runner state=started enabled=yes daemon_reload=yes
 
 - name: Setup libvirt-executor
+  when: "'gitlab_vm_runners' in group_names"
   block:
     - name: Install libvirt-executor-update-base-image dependencies
       pacman: name=arch-install-scripts,sequoia-sq state=present
@@ -92,4 +93,3 @@
 
     - name: Enable and start libvirt-executor-update-base-image.timer
       systemd: name=libvirt-executor-update-base-image.timer state=started enabled=yes daemon_reload=yes
-  when: "'gitlab_vm_runners' in group_names"

roles/install_arch/tasks/main.yml

@@ -82,6 +82,9 @@
   changed_when: "chroot_pacman_key_populate.rc == 0"
 
 - name: Install ucode update
+  when:
+    - "'hcloud' not in group_names"
+    - inventory_hostname != 'packer-base-image'
   block:
     - name: Install ucode update for Intel
       set_fact: ucode="intel-ucode"
@@ -90,9 +93,6 @@
     - name: Install ucode update for AMD
       set_fact: ucode="amd-ucode"
       when: "'AuthenticAMD' in ansible_facts['processor']"
-  when:
-    - "'hcloud' not in group_names"
-    - inventory_hostname != 'packer-base-image'
 
 - name: Install arch base from bootstrap chroot
   command: chroot /tmp/root.x86_64 pacstrap /mnt base linux btrfs-progs grub openssh python-requests python-yaml inetutils {{ ucode | default('') }}

roles/keycloak/tasks/main.yml

@@ -27,6 +27,7 @@
   service_facts:
 
 - name: Create an admin user when first starting keycloak
+  when: ansible_facts.services["keycloak.service"]["state"] != "running"
   block:
     - name: Install admin creation drop-in for keycloak.service
       copy: src=create-keycloak-admin.conf dest=/etc/systemd/system/keycloak.service.d/ owner=root group=root mode=0644
@@ -48,7 +49,6 @@
       file: path=/etc/systemd/system/keycloak.service.d/create-keycloak-admin.conf state=absent
       notify:
         - Daemon reload
-  when: ansible_facts.services["keycloak.service"]["state"] != "running"
 
 - name: Open firewall hole
   ansible.posix.firewalld: port={{ item }} permanent=true state=enabled immediate=yes

roles/networking/tasks/main.yml

@@ -1,4 +1,5 @@
 - name: Configure network (static)
+  when: not dhcp | default(false)
   block:
     - name: Install 10-static-ethernet.network
       template: src=10-static-ethernet.network.j2 dest={{ chroot_path }}/etc/systemd/network/10-static-ethernet.network owner=root group=root mode=0644
@@ -13,9 +14,9 @@
       notify:
         - Restart networkd
       when: static_dns | default(true)
-  when: not dhcp | default(false)
 
 - name: Configure network (dhcp)
+  when: dhcp | default(false)
   block:
     - name: Install 10-dhcp-ethernet.network
       template: src=10-dhcp-ethernet.network.j2 dest={{ chroot_path }}/etc/systemd/network/10-dhcp-ethernet.network owner=root group=root mode=0644
@@ -30,7 +31,6 @@
       notify:
         - Restart networkd
       when: static_dns | default(false)
-  when: dhcp | default(false)
 
 - name: Create symlink to resolv.conf
   file: src=/run/systemd/resolve/stub-resolv.conf dest={{ chroot_path }}/etc/resolv.conf state=link force=yes follow=no owner=root group=root