Trying to understand this ugh

linux/compliance.yaml

@@ -2,6 +2,16 @@
 ## Checks/deploys a Linux system to be managed with Ansible.
 
 - hosts: all
+  gather_facts: yes
   tasks:
+    - name: "Set become method to doas (Alpine)"
+      vars:
+        ansible_become_method: doas
+      when: "ansible_distribution == 'Alpine'"
+    
+    - name: "Set become to true"
+      vars:
+        ansible_become: true
+      
     - name: "Include OS specific tasks"
       ansible.builtin.include_tasks: "compliance_{{ ansible_distribution }}.yaml"

linux/compliance_Alpine.yaml

@@ -1,23 +1,16 @@
 ---
 ## Checks/deploys a Linux system to be managed with Ansible.
 
-gather_facts: yes
-become: yes
-become_method: doas
-tasks:
-  # Gather system groups
 - name: Gather all system groups
   ansible.builtin.getent:
     database: group
     split: ':'
-
 # Add doas package
 - name: Install doas (for Alpine systems).
   ansible.builtin.package:
     name:
       - doas
   state: present
-
 # User account (ansible) configuration
 - name: Add deployment user.
   user:
@@ -29,7 +22,6 @@ tasks:
     groups: wheel
     append: yes
   when: "'wheel' in ansible_facts.getent_group"
-
 # Ansible user SSH pub key
 # This is a really stupid way to do it, but alas.
 # This uses an environment variable named ansiblesvc_key in Semaphore which has the ssh-rsa pubkey.
@@ -45,7 +37,6 @@ tasks:
     dest: /home/ansible/.ssh/authorized_keys
     owner: ansible
     group: ansible
-
 # Add required packages because Debian is lame
 - name: Install standard packages if not already installed.
   # Looking at you LXCs. >.>
@@ -58,7 +49,6 @@ tasks:
       - python3
       - iftop
     state: present
-    
 # Give ansible doas rights with no password required.
 - name: Add doas rights with no password for deployment user (Alpine only)
   lineinfile:
@@ -67,7 +57,6 @@ tasks:
     line: 'permit keepenv nopass :ansible'
     state: present
     validate: 'doas -C %s'
-
 # User account (nhadmin) configuration, for sysadmin use
 - name: Create user nhadmin.
   user:
@@ -75,14 +64,12 @@ tasks:
     state: present
     password: "{{ nhadmin_password | password_hash('sha512') }}"
     shell: /bin/bash
-
 - name: Add nhadmin to wheel group.
   user:
     name: nhadmin
     groups: wheel
     append: yes
   when: "'wheel' in ansible_facts.getent_group"
-
 # Sysadmin user SSH pub key
 # This is a really stupid way to do it, but alas.
 # This uses an environment variable named nhadmin_key in Semaphore which has the ssh-rsa pubkey.
@@ -98,7 +85,6 @@ tasks:
     dest: /home/nhadmin/.ssh/authorized_keys
     owner: nhadmin
     group: nhadmin
-
 # SSH config updating
 - name: Update SSH configuration to disallow root login and disable password authentication.
   lineinfile:
@@ -118,7 +104,6 @@ tasks:
   service:
     name: sshd
     state: restarted
-
 # Delete our network ansible key from the root user.
 - name: Delete our network ansible key (and other keys) from the root user.
   file: