From dddfee16bc852fc989b057bd1867f0e85825846d Mon Sep 17 00:00:00 2001
From: Slavi Pantaleev <slavi@devture.com>
Date: Tue, 7 Mar 2023 17:28:10 +0200
Subject: [PATCH] Fix all 300+ ansible-lint-reported errors

---
 .../etherpad-proxy-connect/tasks/main.yml     |  8 +--
 .../tasks/validate_config.yml                 | 16 ++---
 roles/custom/matrix-aux/tasks/main.yml        |  6 +-
 roles/custom/matrix-base/tasks/main.yml       | 24 ++++----
 .../matrix-bot-buscarron/tasks/main.yml       | 18 +++---
 .../custom/matrix-bot-chatgpt/tasks/main.yml  | 21 +++----
 .../custom/matrix-bot-draupnir/tasks/main.yml | 18 +++---
 roles/custom/matrix-bot-go-neb/tasks/main.yml | 18 +++---
 .../custom/matrix-bot-honoroit/tasks/main.yml | 18 +++---
 .../tasks/main.yml                            | 18 +++---
 .../tasks/main.yml                            | 18 +++---
 roles/custom/matrix-bot-maubot/tasks/main.yml | 26 ++++----
 .../custom/matrix-bot-mjolnir/tasks/main.yml  | 18 +++---
 .../matrix-bot-postmoogle/tasks/main.yml      | 18 +++---
 .../tasks/main.yml                            | 18 +++---
 .../tasks/setup_install.yml                   |  5 +-
 .../tasks/main.yml                            | 18 +++---
 .../tasks/setup_install.yml                   | 10 +---
 .../tasks/main.yml                            | 18 +++---
 .../tasks/main.yml                            | 26 ++++----
 .../tasks/main.yml                            | 26 ++++----
 .../tasks/main.yml                            | 18 +++---
 .../tasks/main.yml                            | 18 +++---
 .../tasks/setup_install.yml                   | 10 +++-
 .../matrix-bridge-heisenbridge/tasks/main.yml | 16 ++---
 .../matrix-bridge-hookshot/defaults/main.yml  | 10 ++--
 .../matrix-bridge-hookshot/tasks/main.yml     | 26 ++++----
 .../tasks/setup_install.yml                   |  4 +-
 .../tasks/main.yml                            | 18 +++---
 .../tasks/main.yml                            | 26 ++++----
 .../tasks/setup_install.yml                   |  5 +-
 .../tasks/main.yml                            | 26 ++++----
 .../tasks/setup_install.yml                   |  5 +-
 .../tasks/main.yml                            | 26 ++++----
 .../tasks/setup_install.yml                   |  5 +-
 .../tasks/main.yml                            | 26 ++++----
 .../tasks/main.yml                            | 26 ++++----
 .../tasks/main.yml                            | 18 +++---
 .../tasks/main.yml                            | 26 ++++----
 .../tasks/setup_install.yml                   |  5 +-
 .../tasks/main.yml                            | 26 ++++----
 .../tasks/main.yml                            | 26 ++++----
 .../tasks/setup_install.yml                   | 10 +++-
 .../tasks/main.yml                            | 18 +++---
 .../tasks/main.yml                            | 18 +++---
 .../tasks/setup_install.yml                   |  5 +-
 .../tasks/main.yml                            | 18 +++---
 .../tasks/main.yml                            | 26 ++++----
 .../tasks/setup_install.yml                   |  5 +-
 .../tasks/main.yml                            | 18 +++---
 .../tasks/setup_install.yml                   |  5 +-
 .../tasks/main.yml                            | 26 ++++----
 .../tasks/setup_install.yml                   |  5 +-
 roles/custom/matrix-bridge-sms/tasks/main.yml | 18 +++---
 .../matrix-cactus-comments/tasks/main.yml     | 26 ++++----
 .../custom/matrix-client-cinny/tasks/main.yml | 24 ++++----
 .../matrix-client-element/tasks/main.yml      | 24 ++++----
 .../tasks/setup_install.yml                   |  1 +
 .../matrix-client-hydrogen/tasks/main.yml     | 24 ++++----
 .../custom/matrix-common-after/tasks/main.yml |  6 +-
 roles/custom/matrix-conduit/tasks/main.yml    | 16 ++---
 roles/custom/matrix-corporal/tasks/main.yml   | 24 ++++----
 roles/custom/matrix-coturn/tasks/main.yml     | 18 +++---
 .../matrix-coturn/tasks/setup_install.yml     |  4 +-
 roles/custom/matrix-dendrite/tasks/main.yml   | 30 +++++-----
 .../matrix-dendrite/tasks/setup_install.yml   | 24 ++++----
 roles/custom/matrix-dimension/tasks/main.yml  | 18 +++---
 .../custom/matrix-dynamic-dns/tasks/main.yml  | 18 +++---
 .../custom/matrix-email2matrix/tasks/main.yml | 18 +++---
 roles/custom/matrix-jitsi/tasks/main.yml      | 60 +++++++++----------
 .../util/setup_jitsi_auth_uvs_install.yml     |  5 ++
 .../tasks/main.yml                            | 26 ++++----
 roles/custom/matrix-ma1sd/tasks/main.yml      | 24 ++++----
 .../matrix-ma1sd/tasks/setup_install.yml      |  1 +
 roles/custom/matrix-mailer/tasks/main.yml     | 16 ++---
 .../custom/matrix-nginx-proxy/tasks/main.yml  | 10 ++--
 ...tup_ssl_lets_encrypt_obtain_for_domain.yml |  2 +
 ...etup_ssl_self_signed_obtain_for_domain.yml | 21 ++++---
 .../tasks/main.yml                            | 26 ++++----
 .../tasks/main.yml                            | 20 +++----
 roles/custom/matrix-prometheus/tasks/main.yml | 18 +++---
 .../custom/matrix-rageshake/tasks/install.yml |  1 +
 roles/custom/matrix-rageshake/tasks/main.yml  | 19 +++---
 .../custom/matrix-registration/tasks/main.yml | 38 ++++++------
 .../matrix-sliding-sync/tasks/install.yml     |  1 +
 .../custom/matrix-sliding-sync/tasks/main.yml | 19 +++---
 roles/custom/matrix-sygnal/tasks/main.yml     | 18 +++---
 .../matrix-synapse-admin/tasks/main.yml       | 26 ++++----
 .../tasks/main.yml                            | 16 ++---
 .../tasks/ext/setup_install.yml               | 56 ++++++++---------
 .../tasks/ext/setup_uninstall.yml             | 48 +++++++--------
 roles/custom/matrix-synapse/tasks/main.yml    | 56 ++++++++---------
 .../matrix-synapse/tasks/setup_install.yml    | 26 ++++----
 .../matrix-synapse/tasks/setup_uninstall.yml  | 26 ++++----
 .../tasks/synapse/setup_install.yml           | 33 +++++-----
 .../custom/matrix-user-creator/tasks/main.yml |  8 +--
 .../tasks/main.yml                            | 20 +++----
 .../matrix_playbook_migration/tasks/main.yml  | 18 +++---
 98 files changed, 942 insertions(+), 895 deletions(-)

diff --git a/roles/custom/etherpad-proxy-connect/tasks/main.yml b/roles/custom/etherpad-proxy-connect/tasks/main.yml
index 67bf7d0e3..630ab87f1 100644
--- a/roles/custom/etherpad-proxy-connect/tasks/main.yml
+++ b/roles/custom/etherpad-proxy-connect/tasks/main.yml
@@ -1,12 +1,12 @@
 ---
 
 - when: etherpad_enabled | bool and etherpad_nginx_proxy_dimension_integration_enabled | bool
-  block:
-    - ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
-
-    - ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml"
   tags:
     - install-all
     - setup-all
     - install-nginx-proxy
     - setup-nginx-proxy
+  block:
+    - ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
+
+    - ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml"
diff --git a/roles/custom/etherpad-proxy-connect/tasks/validate_config.yml b/roles/custom/etherpad-proxy-connect/tasks/validate_config.yml
index 2127ce1a4..51a672ee5 100644
--- a/roles/custom/etherpad-proxy-connect/tasks/validate_config.yml
+++ b/roles/custom/etherpad-proxy-connect/tasks/validate_config.yml
@@ -1,30 +1,30 @@
 ---
 
-- when: matrix_playbook_reverse_proxy_type not in ['playbook-managed-nginx', 'other-nginx-non-container']
-  name: Fail if reverse-proxy is not nginx
+- name: Fail if reverse-proxy is not nginx
+  when: matrix_playbook_reverse_proxy_type not in ['playbook-managed-nginx', 'other-nginx-non-container']
   ansible.builtin.fail:
     msg: >
       Etherpad's integration into matrix-nginx-proxy's Dimension server only makes sense if you're using matrix-nginx-proxy.
       `matrix_playbook_reverse_proxy_type` ({{ matrix_playbook_reverse_proxy_type }}) indicates that you're using another reverse-proxy.
       If you're using Traefik, you should configure `etherpad_hostname` and `etherpad_path_prefix` instead.
 
-- when: not matrix_dimension_enabled
-  name: Fail if Dimension not enabled
+- name: Fail if Dimension not enabled
+  when: not matrix_dimension_enabled
   ansible.builtin.fail:
     msg: >
       Etherpad's integration into matrix-nginx-proxy's Dimension server only makes sense if you're using Dimension.
       Looks like Dimension is not enabled in your configuration (judging by `matrix_dimension_enabled`).
       Consider configuring `etherpad_hostname` and `etherpad_path_prefix` instead.
 
-- when: etherpad_hostname != matrix_server_fqn_dimension
-  name: Fail if Etherpad hostname does not match Dimension hostname
+- name: Fail if Etherpad hostname does not match Dimension hostname
+  when: etherpad_hostname != matrix_server_fqn_dimension
   ansible.builtin.fail:
     msg: >
       Etherpad's integration into matrix-nginx-proxy's Dimension server requires that you set `etherpad_hostname` to `matrix_server_fqn_dimension`.
       Consider adding this to your configuration: `{% raw %}etherpad_hostname: "{{ matrix_server_fqn_dimension }}"{% endraw %}`
 
-- when: etherpad_nginx_proxy_dimension_integration_path_prefix == '/'
-  name: Fail if / path prefix used for Etherpad
+- name: Fail if / path prefix used for Etherpad
+  when: etherpad_nginx_proxy_dimension_integration_path_prefix == '/'
   ansible.builtin.fail:
     msg: >
       Etherpad's integration into matrix-nginx-proxy's Dimension server only makes sense if you're using a non-`/` path for Etherpad.
diff --git a/roles/custom/matrix-aux/tasks/main.yml b/roles/custom/matrix-aux/tasks/main.yml
index 57db09653..3ae8d1791 100644
--- a/roles/custom/matrix-aux/tasks/main.yml
+++ b/roles/custom/matrix-aux/tasks/main.yml
@@ -1,9 +1,9 @@
 ---
 
-- block:
-    - ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup.yml"
-  tags:
+- tags:
     - setup-all
     - setup-aux-files
     - install-all
     - install-aux-files
+  block:
+    - ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup.yml"
diff --git a/roles/custom/matrix-base/tasks/main.yml b/roles/custom/matrix-base/tasks/main.yml
index c67e20908..13ef11d5c 100644
--- a/roles/custom/matrix-base/tasks/main.yml
+++ b/roles/custom/matrix-base/tasks/main.yml
@@ -1,30 +1,28 @@
 ---
 
-- block:
-    - ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
-  tags:
+- tags:
     - setup-all
     - install-all
+  block:
+    - ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
 # This needs to always run, because it populates `matrix_user_uid` and `matrix_user_gid`,
 # which are required by many other roles.
-- block:
-    - ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_matrix_user.yml"
-  tags:
+- tags:
     - always
     - setup-system-user
     - common
+  block:
+    - ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_matrix_user.yml"
 
-- block:
-    - ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_matrix_base.yml"
-  tags:
+- tags:
     - setup-all
     - install-all
     - common
+  block:
+    - ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_matrix_base.yml"
 
-- block:
-    - ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_well_known.yml"
-  tags:
+- tags:
     - setup-all
     - setup-ma1sd
     - setup-synapse
@@ -37,3 +35,5 @@
     - install-dendrite
     - install-conduit
     - install-nginx-proxy
+  block:
+    - ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_well_known.yml"
diff --git a/roles/custom/matrix-bot-buscarron/tasks/main.yml b/roles/custom/matrix-bot-buscarron/tasks/main.yml
index b4a58e910..fbf5c96ac 100644
--- a/roles/custom/matrix-bot-buscarron/tasks/main.yml
+++ b/roles/custom/matrix-bot-buscarron/tasks/main.yml
@@ -1,20 +1,20 @@
 ---
 
-- block:
+- tags:
+    - setup-all
+    - setup-bot-buscarron
+    - install-all
+    - install-bot-buscarron
+  block:
     - ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
       when: "run_setup | bool and matrix_bot_buscarron_enabled | bool"
 
     - ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
       when: "run_setup | bool and matrix_bot_buscarron_enabled | bool"
-  tags:
+
+- tags:
     - setup-all
     - setup-bot-buscarron
-    - install-all
-    - install-bot-buscarron
-
-- block:
+  block:
     - ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
       when: "run_setup | bool and not matrix_bot_buscarron_enabled | bool"
-  tags:
-    - setup-all
-    - setup-bot-buscarron
diff --git a/roles/custom/matrix-bot-chatgpt/tasks/main.yml b/roles/custom/matrix-bot-chatgpt/tasks/main.yml
index c5487fb81..1086a62dd 100644
--- a/roles/custom/matrix-bot-chatgpt/tasks/main.yml
+++ b/roles/custom/matrix-bot-chatgpt/tasks/main.yml
@@ -1,20 +1,21 @@
 ---
 
-- block:
-    - when: matrix_bot_chatgpt_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
-
-    - when: matrix_bot_chatgpt_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
+-
   tags:
     - setup-all
     - setup-bot-chatgpt
     - install-all
     - install-bot-chatgpt
+  block:
+    - when: matrix_bot_chatgpt_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
-- block:
-    - when: not matrix_bot_chatgpt_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
+    - when: matrix_bot_chatgpt_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
+
+- tags:
     - setup-all
     - setup-bot-chatgpt
+  block:
+    - when: not matrix_bot_chatgpt_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
diff --git a/roles/custom/matrix-bot-draupnir/tasks/main.yml b/roles/custom/matrix-bot-draupnir/tasks/main.yml
index 686fe298c..66c7cd06e 100644
--- a/roles/custom/matrix-bot-draupnir/tasks/main.yml
+++ b/roles/custom/matrix-bot-draupnir/tasks/main.yml
@@ -1,20 +1,20 @@
 ---
 
-- block:
+- tags:
+    - setup-all
+    - setup-bot-draupnir
+    - install-all
+    - install-bot-draupnir
+  block:
     - when: matrix_bot_draupnir_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_bot_draupnir_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-bot-draupnir
-    - install-all
-    - install-bot-draupnir
-
-- block:
+  block:
     - when: not matrix_bot_draupnir_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-bot-draupnir
diff --git a/roles/custom/matrix-bot-go-neb/tasks/main.yml b/roles/custom/matrix-bot-go-neb/tasks/main.yml
index 3249fc7ba..9367419da 100644
--- a/roles/custom/matrix-bot-go-neb/tasks/main.yml
+++ b/roles/custom/matrix-bot-go-neb/tasks/main.yml
@@ -1,20 +1,20 @@
 ---
 
-- block:
+- tags:
+    - setup-all
+    - setup-bot-go-neb
+    - install-all
+    - install-bot-go-neb
+  block:
     - ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
       when: "run_setup | bool and matrix_bot_go_neb_enabled | bool"
 
     - ansible.builtin.include_tasks: "{{ role_path }}/tasks/install.yml"
       when: "run_setup | bool and matrix_bot_go_neb_enabled | bool"
-  tags:
+
+- tags:
     - setup-all
     - setup-bot-go-neb
-    - install-all
-    - install-bot-go-neb
-
-- block:
+  block:
     - ansible.builtin.include_tasks: "{{ role_path }}/tasks/uninstall.yml"
       when: "run_setup | bool and not matrix_bot_go_neb_enabled | bool"
-  tags:
-    - setup-all
-    - setup-bot-go-neb
diff --git a/roles/custom/matrix-bot-honoroit/tasks/main.yml b/roles/custom/matrix-bot-honoroit/tasks/main.yml
index d4dcbce4b..9b4e29089 100644
--- a/roles/custom/matrix-bot-honoroit/tasks/main.yml
+++ b/roles/custom/matrix-bot-honoroit/tasks/main.yml
@@ -1,20 +1,20 @@
 ---
 
-- block:
+- tags:
+    - setup-all
+    - setup-bot-honoroit
+    - install-all
+    - install-bot-honoroit
+  block:
     - ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
       when: "run_setup | bool and matrix_bot_honoroit_enabled | bool"
 
     - ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
       when: "run_setup | bool and matrix_bot_honoroit_enabled | bool"
-  tags:
+
+- tags:
     - setup-all
     - setup-bot-honoroit
-    - install-all
-    - install-bot-honoroit
-
-- block:
+  block:
     - ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
       when: "run_setup | bool and not matrix_bot_honoroit_enabled | bool"
-  tags:
-    - setup-all
-    - setup-bot-honoroit
diff --git a/roles/custom/matrix-bot-matrix-registration-bot/tasks/main.yml b/roles/custom/matrix-bot-matrix-registration-bot/tasks/main.yml
index 90ee56ccf..83291fb6d 100644
--- a/roles/custom/matrix-bot-matrix-registration-bot/tasks/main.yml
+++ b/roles/custom/matrix-bot-matrix-registration-bot/tasks/main.yml
@@ -1,20 +1,20 @@
 ---
 
-- block:
+- tags:
+    - setup-all
+    - setup-bot-matrix-registration-bot
+    - install-all
+    - install-bot-matrix-registration-bot
+  block:
     - when: matrix_bot_matrix_registration_bot_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_bot_matrix_registration_bot_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-bot-matrix-registration-bot
-    - install-all
-    - install-bot-matrix-registration-bot
-
-- block:
+  block:
     - when: not matrix_bot_matrix_registration_bot_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-bot-matrix-registration-bot
diff --git a/roles/custom/matrix-bot-matrix-reminder-bot/tasks/main.yml b/roles/custom/matrix-bot-matrix-reminder-bot/tasks/main.yml
index 22c014de6..f475afc06 100644
--- a/roles/custom/matrix-bot-matrix-reminder-bot/tasks/main.yml
+++ b/roles/custom/matrix-bot-matrix-reminder-bot/tasks/main.yml
@@ -1,20 +1,20 @@
 ---
 
-- block:
+- tags:
+    - setup-all
+    - setup-bot-matrix-reminder-bot
+    - install-all
+    - install-bot-matrix-reminder-bot
+  block:
     - when: matrix_bot_matrix_reminder_bot_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_bot_matrix_reminder_bot_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-bot-matrix-reminder-bot
-    - install-all
-    - install-bot-matrix-reminder-bot
-
-- block:
+  block:
     - when: not matrix_bot_matrix_reminder_bot_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-bot-matrix-reminder-bot
diff --git a/roles/custom/matrix-bot-maubot/tasks/main.yml b/roles/custom/matrix-bot-maubot/tasks/main.yml
index 95fad19e5..3241795b5 100644
--- a/roles/custom/matrix-bot-maubot/tasks/main.yml
+++ b/roles/custom/matrix-bot-maubot/tasks/main.yml
@@ -1,29 +1,29 @@
 ---
 
-- block:
-    - when: matrix_bot_maubot_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml"
-  tags:
+- tags:
     - setup-all
     - setup-nginx-proxy
     - install-all
     - install-nginx-proxy
+  block:
+    - when: matrix_bot_maubot_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml"
 
-- block:
+- tags:
+    - setup-all
+    - setup-bot-maubot
+    - install-all
+    - install-bot-maubot
+  block:
     - when: matrix_bot_maubot_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_bot_maubot_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-bot-maubot
-    - install-all
-    - install-bot-maubot
-
-- block:
+  block:
     - when: not matrix_bot_maubot_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-bot-maubot
diff --git a/roles/custom/matrix-bot-mjolnir/tasks/main.yml b/roles/custom/matrix-bot-mjolnir/tasks/main.yml
index def5c9f05..03f5ba905 100644
--- a/roles/custom/matrix-bot-mjolnir/tasks/main.yml
+++ b/roles/custom/matrix-bot-mjolnir/tasks/main.yml
@@ -1,20 +1,20 @@
 ---
 
-- block:
+- tags:
+    - setup-all
+    - setup-bot-mjolnir
+    - install-all
+    - install-bot-mjolnir
+  block:
     - when: matrix_bot_mjolnir_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_bot_mjolnir_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-bot-mjolnir
-    - install-all
-    - install-bot-mjolnir
-
-- block:
+  block:
     - when: not matrix_bot_mjolnir_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-bot-mjolnir
diff --git a/roles/custom/matrix-bot-postmoogle/tasks/main.yml b/roles/custom/matrix-bot-postmoogle/tasks/main.yml
index a6bc76a35..b77040392 100644
--- a/roles/custom/matrix-bot-postmoogle/tasks/main.yml
+++ b/roles/custom/matrix-bot-postmoogle/tasks/main.yml
@@ -1,20 +1,20 @@
 ---
 
-- block:
+- tags:
+    - setup-all
+    - setup-bot-postmoogle
+    - install-all
+    - install-bot-postmoogle
+  block:
     - when: matrix_bot_postmoogle_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_bot_postmoogle_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-bot-postmoogle
-    - install-all
-    - install-bot-postmoogle
-
-- block:
+  block:
     - when: not matrix_bot_postmoogle_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-bot-postmoogle
diff --git a/roles/custom/matrix-bridge-appservice-discord/tasks/main.yml b/roles/custom/matrix-bridge-appservice-discord/tasks/main.yml
index 926fe3670..88a772204 100644
--- a/roles/custom/matrix-bridge-appservice-discord/tasks/main.yml
+++ b/roles/custom/matrix-bridge-appservice-discord/tasks/main.yml
@@ -1,20 +1,20 @@
 ---
 
-- block:
+- tags:
+    - setup-all
+    - setup-appservice-discord
+    - install-all
+    - install-appservice-discord
+  block:
     - when: matrix_appservice_discord_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_appservice_discord_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-appservice-discord
-    - install-all
-    - install-appservice-discord
-
-- block:
+  block:
     - when: not matrix_appservice_discord_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-appservice-discord
diff --git a/roles/custom/matrix-bridge-appservice-discord/tasks/setup_install.yml b/roles/custom/matrix-bridge-appservice-discord/tasks/setup_install.yml
index 4a6419edd..632948bcd 100644
--- a/roles/custom/matrix-bridge-appservice-discord/tasks/setup_install.yml
+++ b/roles/custom/matrix-bridge-appservice-discord/tasks/setup_install.yml
@@ -65,7 +65,10 @@
   when: "matrix_appservice_discord_stat_db.stat.exists"
 
 - name: (Data relocation) Move AppService Discord discord.db file to ./data directory
-  ansible.builtin.command: "mv {{ matrix_appservice_discord_base_path }}/{{ item }} {{ matrix_appservice_discord_data_path }}/{{ item }}"
+  ansible.builtin.command:
+    cmd: "mv {{ matrix_appservice_discord_base_path }}/{{ item }} {{ matrix_appservice_discord_data_path }}/{{ item }}"
+    creates: "{{ matrix_appservice_discord_data_path }}/{{ item }}"
+    removes: "{{ matrix_appservice_discord_base_path }}/{{ item }}"
   with_items:
     - discord.db
     - user-store.db
diff --git a/roles/custom/matrix-bridge-appservice-irc/tasks/main.yml b/roles/custom/matrix-bridge-appservice-irc/tasks/main.yml
index 1cc6b35c4..d46698480 100644
--- a/roles/custom/matrix-bridge-appservice-irc/tasks/main.yml
+++ b/roles/custom/matrix-bridge-appservice-irc/tasks/main.yml
@@ -1,20 +1,20 @@
 ---
 
-- block:
+- tags:
+    - setup-all
+    - setup-appservice-irc
+    - install-all
+    - install-appservice-irc
+  block:
     - when: matrix_appservice_irc_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_appservice_irc_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-appservice-irc
-    - install-all
-    - install-appservice-irc
-
-- block:
+  block:
     - when: not matrix_appservice_irc_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-appservice-irc
diff --git a/roles/custom/matrix-bridge-appservice-irc/tasks/setup_install.yml b/roles/custom/matrix-bridge-appservice-irc/tasks/setup_install.yml
index a5fdacded..69a9aa4c8 100644
--- a/roles/custom/matrix-bridge-appservice-irc/tasks/setup_install.yml
+++ b/roles/custom/matrix-bridge-appservice-irc/tasks/setup_install.yml
@@ -108,16 +108,12 @@
     owner: "{{ matrix_user_username }}"
     group: "{{ matrix_user_groupname }}"
 
-- name: Check if Appservice IRC passkey exists
-  ansible.builtin.stat:
-    path: "{{ matrix_appservice_irc_data_path }}/passkey.pem"
-  register: irc_passkey_file
-
 - name: Generate Appservice IRC passkey if it doesn't exist
-  ansible.builtin.shell: "{{ matrix_host_command_openssl }} genpkey -out {{ matrix_appservice_irc_data_path }}/passkey.pem -outform PEM -algorithm RSA -pkeyopt rsa_keygen_bits:2048"
+  ansible.builtin.shell:
+    cmd: "{{ matrix_host_command_openssl }} genpkey -out {{ matrix_appservice_irc_data_path }}/passkey.pem -outform PEM -algorithm RSA -pkeyopt rsa_keygen_bits:2048"
+    creates: "{{ matrix_appservice_irc_data_path }}/passkey.pem"
   become: true
   become_user: "{{ matrix_user_username }}"
-  when: "not irc_passkey_file.stat.exists"
 
 # In the past, we used to generate the passkey.pem file with root, so permissions may not be okay.
 # Fix it.
diff --git a/roles/custom/matrix-bridge-appservice-kakaotalk/tasks/main.yml b/roles/custom/matrix-bridge-appservice-kakaotalk/tasks/main.yml
index 14a30e65b..7a360024e 100644
--- a/roles/custom/matrix-bridge-appservice-kakaotalk/tasks/main.yml
+++ b/roles/custom/matrix-bridge-appservice-kakaotalk/tasks/main.yml
@@ -1,20 +1,20 @@
 ---
 
-- block:
+- tags:
+    - setup-all
+    - setup-appservice-kakaotalk
+    - install-all
+    - install-appservice-kakaotalk
+  block:
     - when: matrix_appservice_kakaotalk_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_appservice_kakaotalk_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-appservice-kakaotalk
-    - install-all
-    - install-appservice-kakaotalk
-
-- block:
+  block:
     - when: not matrix_appservice_kakaotalk_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-appservice-kakaotalk
diff --git a/roles/custom/matrix-bridge-appservice-slack/tasks/main.yml b/roles/custom/matrix-bridge-appservice-slack/tasks/main.yml
index 41e2679ed..6fb8ac7c9 100644
--- a/roles/custom/matrix-bridge-appservice-slack/tasks/main.yml
+++ b/roles/custom/matrix-bridge-appservice-slack/tasks/main.yml
@@ -1,29 +1,29 @@
 ---
 
-- block:
-    - when: matrix_appservice_slack_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml"
-  tags:
+- tags:
     - setup-all
     - setup-nginx-proxy
     - install-all
     - install-nginx-proxy
+  block:
+    - when: matrix_appservice_slack_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml"
 
-- block:
+- tags:
+    - setup-all
+    - setup-appservice-slack
+    - install-all
+    - install-appservice-slack
+  block:
     - when: matrix_appservice_slack_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_appservice_slack_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-appservice-slack
-    - install-all
-    - install-appservice-slack
-
-- block:
+  block:
     - when: not matrix_appservice_slack_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-appservice-slack
diff --git a/roles/custom/matrix-bridge-appservice-webhooks/tasks/main.yml b/roles/custom/matrix-bridge-appservice-webhooks/tasks/main.yml
index ae36cf700..a40d66ddc 100644
--- a/roles/custom/matrix-bridge-appservice-webhooks/tasks/main.yml
+++ b/roles/custom/matrix-bridge-appservice-webhooks/tasks/main.yml
@@ -1,29 +1,29 @@
 ---
 
-- block:
-    - when: matrix_appservice_webhooks_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml"
-  tags:
+- tags:
     - setup-all
     - setup-nginx-proxy
     - install-all
     - install-nginx-proxy
+  block:
+    - when: matrix_appservice_webhooks_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml"
 
-- block:
+- tags:
+    - setup-all
+    - setup-appservice-webhooks
+    - install-all
+    - install-appservice-webhooks
+  block:
     - when: matrix_appservice_webhooks_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_appservice_webhooks_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-appservice-webhooks
-    - install-all
-    - install-appservice-webhooks
-
-- block:
+  block:
     - when: not matrix_appservice_webhooks_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-appservice-webhooks
diff --git a/roles/custom/matrix-bridge-beeper-linkedin/tasks/main.yml b/roles/custom/matrix-bridge-beeper-linkedin/tasks/main.yml
index 502280428..56eb91e52 100644
--- a/roles/custom/matrix-bridge-beeper-linkedin/tasks/main.yml
+++ b/roles/custom/matrix-bridge-beeper-linkedin/tasks/main.yml
@@ -1,20 +1,20 @@
 ---
 
-- block:
+- tags:
+    - setup-all
+    - setup-beeper-linkedin
+    - install-all
+    - install-beeper-linkedin
+  block:
     - when: matrix_beeper_linkedin_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_beeper_linkedin_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-beeper-linkedin
-    - install-all
-    - install-beeper-linkedin
-
-- block:
+  block:
     - when: not matrix_beeper_linkedin_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-beeper-linkedin
diff --git a/roles/custom/matrix-bridge-go-skype-bridge/tasks/main.yml b/roles/custom/matrix-bridge-go-skype-bridge/tasks/main.yml
index 5bf9236b5..7ba914213 100644
--- a/roles/custom/matrix-bridge-go-skype-bridge/tasks/main.yml
+++ b/roles/custom/matrix-bridge-go-skype-bridge/tasks/main.yml
@@ -1,20 +1,20 @@
 ---
 
-- block:
+- tags:
+    - setup-all
+    - setup-go-skype-bridge
+    - install-all
+    - install-go-skype-bridge
+  block:
     - when: matrix_go_skype_bridge_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_go_skype_bridge_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-go-skype-bridge
-    - install-all
-    - install-go-skype-bridge
-
-- block:
+  block:
     - when: not matrix_go_skype_bridge_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-go-skype-bridge
diff --git a/roles/custom/matrix-bridge-go-skype-bridge/tasks/setup_install.yml b/roles/custom/matrix-bridge-go-skype-bridge/tasks/setup_install.yml
index 6146637f5..7d8ccd8dd 100644
--- a/roles/custom/matrix-bridge-go-skype-bridge/tasks/setup_install.yml
+++ b/roles/custom/matrix-bridge-go-skype-bridge/tasks/setup_install.yml
@@ -97,11 +97,17 @@
   when: "matrix_go_skype_bridge_stat_database.stat.exists"
 
 - name: (Data relocation) Move go-skype-bridge database file to ./data directory
-  ansible.builtin.command: "mv {{ matrix_go_skype_bridge_base_path }}/go-skype-bridge.db {{ matrix_go_skype_bridge_data_path }}/go-skype-bridge.db"
+  ansible.builtin.command:
+    cmd: "mv {{ matrix_go_skype_bridge_base_path }}/go-skype-bridge.db {{ matrix_go_skype_bridge_data_path }}/go-skype-bridge.db"
+    creates: "{{ matrix_go_skype_bridge_data_path }}/go-skype-bridge.db"
+    removes: "{{ matrix_go_skype_bridge_base_path }}/go-skype-bridge.db"
   when: "matrix_go_skype_bridge_stat_database.stat.exists"
 
 - name: (Data relocation) Move go-skype-bridge mx-state file to ./data directory
-  ansible.builtin.command: "mv {{ matrix_go_skype_bridge_base_path }}/mx-state.json {{ matrix_go_skype_bridge_data_path }}/mx-state.json"
+  ansible.builtin.command:
+    cmd: "mv {{ matrix_go_skype_bridge_base_path }}/mx-state.json {{ matrix_go_skype_bridge_data_path }}/mx-state.json"
+    creates: "{{ matrix_go_skype_bridge_data_path }}/mx-state.json"
+    removes: "{{ matrix_go_skype_bridge_base_path }}/mx-state.json"
   when: "matrix_go_skype_bridge_stat_mx_state.stat.exists"
 
 - name: Ensure go-skype-bridge config.yaml installed
diff --git a/roles/custom/matrix-bridge-heisenbridge/tasks/main.yml b/roles/custom/matrix-bridge-heisenbridge/tasks/main.yml
index 0d8354cf9..5b92520d1 100644
--- a/roles/custom/matrix-bridge-heisenbridge/tasks/main.yml
+++ b/roles/custom/matrix-bridge-heisenbridge/tasks/main.yml
@@ -1,17 +1,17 @@
 ---
 
-- block:
-    - when: matrix_heisenbridge_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+- tags:
     - setup-all
     - setup-heisenbridge
     - install-all
     - install-heisenbridge
+  block:
+    - when: matrix_heisenbridge_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
 
-- block:
-    - when: not matrix_heisenbridge_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
+- tags:
     - setup-all
     - setup-heisenbridge
+  block:
+    - when: not matrix_heisenbridge_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
diff --git a/roles/custom/matrix-bridge-hookshot/defaults/main.yml b/roles/custom/matrix-bridge-hookshot/defaults/main.yml
index aa4ae45c2..3b65b92a6 100644
--- a/roles/custom/matrix-bridge-hookshot/defaults/main.yml
+++ b/roles/custom/matrix-bridge-hookshot/defaults/main.yml
@@ -122,15 +122,15 @@ matrix_hookshot_jira_oauth_redirect_uri: "{{ matrix_hookshot_urlprefix }}{{ matr
 
 # No need to change these
 matrix_hookshot_generic_enabled: true
-matrix_hookshot_generic_enableHttpGet: false
+matrix_hookshot_generic_enableHttpGet: false  # noqa var-naming
 # Default value of matrix_hookshot_generic_endpoint: "/hookshot/webhooks"
 matrix_hookshot_generic_endpoint: "{{ matrix_hookshot_webhook_endpoint }}"
 # urlprefix gets updated with protocol & port in group_vars/matrix_servers
-matrix_hookshot_generic_urlPrefix: "{{ matrix_hookshot_urlprefix }}{{ matrix_hookshot_generic_endpoint }}"
+matrix_hookshot_generic_urlPrefix: "{{ matrix_hookshot_urlprefix }}{{ matrix_hookshot_generic_endpoint }}"  # noqa var-naming
 # If you're also using matrix-appservice-webhooks, take care that these prefixes don't overlap
-matrix_hookshot_generic_userIdPrefix: '_webhooks_'
-matrix_hookshot_generic_allowJsTransformationFunctions: false
-matrix_hookshot_generic_waitForComplete: false
+matrix_hookshot_generic_userIdPrefix: '_webhooks_'  # noqa var-naming
+matrix_hookshot_generic_allowJsTransformationFunctions: false  # noqa var-naming
+matrix_hookshot_generic_waitForComplete: false  # noqa var-naming
 
 
 matrix_hookshot_feeds_enabled: true
diff --git a/roles/custom/matrix-bridge-hookshot/tasks/main.yml b/roles/custom/matrix-bridge-hookshot/tasks/main.yml
index c7ffc3041..e2fa9936a 100644
--- a/roles/custom/matrix-bridge-hookshot/tasks/main.yml
+++ b/roles/custom/matrix-bridge-hookshot/tasks/main.yml
@@ -1,29 +1,29 @@
 ---
 
-- block:
-    - when: matrix_hookshot_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml"
-  tags:
+- tags:
     - setup-all
     - setup-nginx-proxy
     - install-all
     - install-nginx-proxy
+  block:
+    - when: matrix_hookshot_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml"
 
-- block:
+- tags:
+    - setup-all
+    - setup-hookshot
+    - install-all
+    - install-hookshot
+  block:
     - when: matrix_hookshot_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_hookshot_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-hookshot
-    - install-all
-    - install-hookshot
-
-- block:
+  block:
     - when: not matrix_hookshot_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-hookshot
diff --git a/roles/custom/matrix-bridge-hookshot/tasks/setup_install.yml b/roles/custom/matrix-bridge-hookshot/tasks/setup_install.yml
index e9b277ce4..f0e8c1c62 100644
--- a/roles/custom/matrix-bridge-hookshot/tasks/setup_install.yml
+++ b/roles/custom/matrix-bridge-hookshot/tasks/setup_install.yml
@@ -57,7 +57,9 @@
   register: hookshot_passkey_file
 
 - name: Generate hookshot passkey if it doesn't exist
-  ansible.builtin.shell: "{{ matrix_host_command_openssl }} genpkey -out {{ matrix_hookshot_base_path }}/passkey.pem -outform PEM -algorithm RSA -pkeyopt rsa_keygen_bits:4096"
+  ansible.builtin.shell:
+    cmd: "{{ matrix_host_command_openssl }} genpkey -out {{ matrix_hookshot_base_path }}/passkey.pem -outform PEM -algorithm RSA -pkeyopt rsa_keygen_bits:4096"
+    creates: "{{ matrix_hookshot_base_path }}/passkey.pem"
   become: true
   become_user: "{{ matrix_user_username }}"
   when: "not hookshot_passkey_file.stat.exists"
diff --git a/roles/custom/matrix-bridge-mautrix-discord/tasks/main.yml b/roles/custom/matrix-bridge-mautrix-discord/tasks/main.yml
index cc90f2fae..19698f9f1 100644
--- a/roles/custom/matrix-bridge-mautrix-discord/tasks/main.yml
+++ b/roles/custom/matrix-bridge-mautrix-discord/tasks/main.yml
@@ -1,20 +1,20 @@
 ---
 
-- block:
+- tags:
+    - setup-all
+    - setup-mautrix-discord
+    - install-all
+    - install-mautrix-discord
+  block:
     - when: matrix_mautrix_discord_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_mautrix_discord_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-mautrix-discord
-    - install-all
-    - install-mautrix-discord
-
-- block:
+  block:
     - when: not matrix_mautrix_discord_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-mautrix-discord
diff --git a/roles/custom/matrix-bridge-mautrix-facebook/tasks/main.yml b/roles/custom/matrix-bridge-mautrix-facebook/tasks/main.yml
index fa7cec7dc..110346682 100644
--- a/roles/custom/matrix-bridge-mautrix-facebook/tasks/main.yml
+++ b/roles/custom/matrix-bridge-mautrix-facebook/tasks/main.yml
@@ -1,29 +1,29 @@
 ---
 
-- block:
-    - when: matrix_mautrix_facebook_enabled | bool and matrix_mautrix_facebook_appservice_public_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml"
-  tags:
+- tags:
     - setup-all
     - setup-nginx-proxy
     - install-all
     - install-nginx-proxy
+  block:
+    - when: matrix_mautrix_facebook_enabled | bool and matrix_mautrix_facebook_appservice_public_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml"
 
-- block:
+- tags:
+    - setup-all
+    - setup-mautrix-facebook
+    - install-all
+    - install-mautrix-facebook
+  block:
     - when: matrix_mautrix_facebook_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_mautrix_facebook_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-mautrix-facebook
-    - install-all
-    - install-mautrix-facebook
-
-- block:
+  block:
     - when: not matrix_mautrix_facebook_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-mautrix-facebook
diff --git a/roles/custom/matrix-bridge-mautrix-facebook/tasks/setup_install.yml b/roles/custom/matrix-bridge-mautrix-facebook/tasks/setup_install.yml
index 758a5feda..fac1d1d2b 100644
--- a/roles/custom/matrix-bridge-mautrix-facebook/tasks/setup_install.yml
+++ b/roles/custom/matrix-bridge-mautrix-facebook/tasks/setup_install.yml
@@ -91,7 +91,10 @@
   when: "matrix_mautrix_facebook_stat_database.stat.exists"
 
 - name: (Data relocation) Move mautrix-facebook database file to ./data directory
-  ansible.builtin.command: "mv {{ matrix_mautrix_facebook_base_path }}/mautrix-facebook.db {{ matrix_mautrix_facebook_data_path }}/mautrix-facebook.db"
+  ansible.builtin.command:
+    cmd: "mv {{ matrix_mautrix_facebook_base_path }}/mautrix-facebook.db {{ matrix_mautrix_facebook_data_path }}/mautrix-facebook.db"
+    creates: "{{ matrix_mautrix_facebook_data_path }}/mautrix-facebook.db"
+    removes: "{{ matrix_mautrix_facebook_base_path }}/mautrix-facebook.db"
   when: "matrix_mautrix_facebook_stat_database.stat.exists"
 
 - name: Ensure mautrix-facebook config.yaml installed
diff --git a/roles/custom/matrix-bridge-mautrix-googlechat/tasks/main.yml b/roles/custom/matrix-bridge-mautrix-googlechat/tasks/main.yml
index 917ba7a9d..a23923b50 100644
--- a/roles/custom/matrix-bridge-mautrix-googlechat/tasks/main.yml
+++ b/roles/custom/matrix-bridge-mautrix-googlechat/tasks/main.yml
@@ -1,29 +1,29 @@
 ---
 
-- block:
-    - when: matrix_mautrix_googlechat_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml"
-  tags:
+- tags:
     - setup-all
     - setup-nginx-proxy
     - install-all
     - install-nginx-proxy
+  block:
+    - when: matrix_mautrix_googlechat_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml"
 
-- block:
+- tags:
+    - setup-all
+    - setup-mautrix-googlechat
+    - install-all
+    - install-mautrix-googlechat
+  block:
     - when: matrix_mautrix_googlechat_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_mautrix_googlechat_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-mautrix-googlechat
-    - install-all
-    - install-mautrix-googlechat
-
-- block:
+  block:
     - when: not matrix_mautrix_googlechat_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-mautrix-googlechat
diff --git a/roles/custom/matrix-bridge-mautrix-googlechat/tasks/setup_install.yml b/roles/custom/matrix-bridge-mautrix-googlechat/tasks/setup_install.yml
index c1258471c..c1ae8cf53 100644
--- a/roles/custom/matrix-bridge-mautrix-googlechat/tasks/setup_install.yml
+++ b/roles/custom/matrix-bridge-mautrix-googlechat/tasks/setup_install.yml
@@ -91,7 +91,10 @@
   when: "matrix_mautrix_googlechat_stat_database.stat.exists"
 
 - name: (Data relocation) Move mautrix-googlechat database file to ./data directory
-  ansible.builtin.command: "mv {{ matrix_mautrix_googlechat_base_path }}/mautrix-googlechat.db {{ matrix_mautrix_googlechat_data_path }}/mautrix-googlechat.db"
+  ansible.builtin.command:
+    cmd: "mv {{ matrix_mautrix_googlechat_base_path }}/mautrix-googlechat.db {{ matrix_mautrix_googlechat_data_path }}/mautrix-googlechat.db"
+    creates: "{{ matrix_mautrix_googlechat_data_path }}/mautrix-googlechat.db"
+    removes: "{{ matrix_mautrix_googlechat_base_path }}/mautrix-googlechat.db"
   when: "matrix_mautrix_googlechat_stat_database.stat.exists"
 
 - name: Ensure mautrix-googlechat config.yaml installed
diff --git a/roles/custom/matrix-bridge-mautrix-hangouts/tasks/main.yml b/roles/custom/matrix-bridge-mautrix-hangouts/tasks/main.yml
index e9d8048c7..e7881567e 100644
--- a/roles/custom/matrix-bridge-mautrix-hangouts/tasks/main.yml
+++ b/roles/custom/matrix-bridge-mautrix-hangouts/tasks/main.yml
@@ -1,29 +1,29 @@
 ---
 
-- block:
-    - when: matrix_mautrix_hangouts_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml"
-  tags:
+- tags:
     - setup-all
     - setup-nginx-proxy
     - install-all
     - install-nginx-proxy
+  block:
+    - when: matrix_mautrix_hangouts_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml"
 
-- block:
+- tags:
+    - setup-all
+    - setup-mautrix-hangouts
+    - install-all
+    - install-mautrix-hangouts
+  block:
     - when: matrix_mautrix_hangouts_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_mautrix_hangouts_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-mautrix-hangouts
-    - install-all
-    - install-mautrix-hangouts
-
-- block:
+  block:
     - when: not matrix_mautrix_hangouts_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-mautrix-hangouts
diff --git a/roles/custom/matrix-bridge-mautrix-hangouts/tasks/setup_install.yml b/roles/custom/matrix-bridge-mautrix-hangouts/tasks/setup_install.yml
index f8fdb023d..0fa549941 100644
--- a/roles/custom/matrix-bridge-mautrix-hangouts/tasks/setup_install.yml
+++ b/roles/custom/matrix-bridge-mautrix-hangouts/tasks/setup_install.yml
@@ -91,7 +91,10 @@
   when: "matrix_mautrix_hangouts_stat_database.stat.exists"
 
 - name: (Data relocation) Move mautrix-hangouts database file to ./data directory
-  ansible.builtin.command: "mv {{ matrix_mautrix_hangouts_base_path }}/mautrix-hangouts.db {{ matrix_mautrix_hangouts_data_path }}/mautrix-hangouts.db"
+  ansible.builtin.command:
+    cmd: "mv {{ matrix_mautrix_hangouts_base_path }}/mautrix-hangouts.db {{ matrix_mautrix_hangouts_data_path }}/mautrix-hangouts.db"
+    creates: "{{ matrix_mautrix_hangouts_data_path }}/mautrix-hangouts.db"
+    removes: "{{ matrix_mautrix_hangouts_base_path }}/mautrix-hangouts.db"
   when: "matrix_mautrix_hangouts_stat_database.stat.exists"
 
 - name: Ensure mautrix-hangouts config.yaml installed
diff --git a/roles/custom/matrix-bridge-mautrix-instagram/tasks/main.yml b/roles/custom/matrix-bridge-mautrix-instagram/tasks/main.yml
index 0b3a722df..834dec0cc 100644
--- a/roles/custom/matrix-bridge-mautrix-instagram/tasks/main.yml
+++ b/roles/custom/matrix-bridge-mautrix-instagram/tasks/main.yml
@@ -1,29 +1,29 @@
 ---
 
-- block:
-    - when: matrix_mautrix_instagram_enabled | bool and matrix_mautrix_instagram_metrics_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml"
-  tags:
+- tags:
     - setup-all
     - setup-nginx-proxy
     - install-all
     - install-nginx-proxy
+  block:
+    - when: matrix_mautrix_instagram_enabled | bool and matrix_mautrix_instagram_metrics_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml"
 
-- block:
+- tags:
+    - setup-all
+    - setup-mautrix-instagram
+    - install-all
+    - install-mautrix-instagram
+  block:
     - when: matrix_mautrix_instagram_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_mautrix_instagram_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-mautrix-instagram
-    - install-all
-    - install-mautrix-instagram
-
-- block:
+  block:
     - when: not matrix_mautrix_instagram_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-mautrix-instagram
diff --git a/roles/custom/matrix-bridge-mautrix-signal/tasks/main.yml b/roles/custom/matrix-bridge-mautrix-signal/tasks/main.yml
index 9473344b9..f5d769e5c 100644
--- a/roles/custom/matrix-bridge-mautrix-signal/tasks/main.yml
+++ b/roles/custom/matrix-bridge-mautrix-signal/tasks/main.yml
@@ -1,29 +1,29 @@
 ---
 
-- block:
-    - when: matrix_mautrix_signal_enabled | bool and matrix_mautrix_signal_metrics_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml"
-  tags:
+- tags:
     - setup-all
     - setup-nginx-proxy
     - install-all
     - install-nginx-proxy
+  block:
+    - when: matrix_mautrix_signal_enabled | bool and matrix_mautrix_signal_metrics_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml"
 
-- block:
+- tags:
+    - setup-all
+    - setup-mautrix-signal
+    - install-all
+    - install-mautrix-signal
+  block:
     - when: matrix_mautrix_signal_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_mautrix_signal_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-mautrix-signal
-    - install-all
-    - install-mautrix-signal
-
-- block:
+  block:
     - when: not matrix_mautrix_signal_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-mautrix-signal
diff --git a/roles/custom/matrix-bridge-mautrix-slack/tasks/main.yml b/roles/custom/matrix-bridge-mautrix-slack/tasks/main.yml
index bff905495..b7a2199d7 100644
--- a/roles/custom/matrix-bridge-mautrix-slack/tasks/main.yml
+++ b/roles/custom/matrix-bridge-mautrix-slack/tasks/main.yml
@@ -1,20 +1,20 @@
 ---
 
-- block:
+- tags:
+    - setup-all
+    - setup-mautrix-slack
+    - install-all
+    - install-mautrix-slack
+  block:
     - when: matrix_mautrix_slack_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_mautrix_slack_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-mautrix-slack
-    - install-all
-    - install-mautrix-slack
-
-- block:
+  block:
     - when: not matrix_mautrix_slack_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-mautrix-slack
diff --git a/roles/custom/matrix-bridge-mautrix-telegram/tasks/main.yml b/roles/custom/matrix-bridge-mautrix-telegram/tasks/main.yml
index 3c8e6d044..212848b6a 100644
--- a/roles/custom/matrix-bridge-mautrix-telegram/tasks/main.yml
+++ b/roles/custom/matrix-bridge-mautrix-telegram/tasks/main.yml
@@ -1,29 +1,29 @@
 ---
 
-- block:
-    - when: matrix_mautrix_telegram_enabled | bool and matrix_mautrix_telegram_appservice_public_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml"
-  tags:
+- tags:
     - setup-all
     - setup-nginx-proxy
     - install-all
     - install-nginx-proxy
+  block:
+    - when: matrix_mautrix_telegram_enabled | bool and matrix_mautrix_telegram_appservice_public_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml"
 
-- block:
+- tags:
+    - setup-all
+    - setup-mautrix-telegram
+    - install-all
+    - install-mautrix-telegram
+  block:
     - when: matrix_mautrix_telegram_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_mautrix_telegram_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-mautrix-telegram
-    - install-all
-    - install-mautrix-telegram
-
-- block:
+  block:
     - when: not matrix_mautrix_telegram_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-mautrix-telegram
diff --git a/roles/custom/matrix-bridge-mautrix-telegram/tasks/setup_install.yml b/roles/custom/matrix-bridge-mautrix-telegram/tasks/setup_install.yml
index 383d48275..ddf11d8db 100644
--- a/roles/custom/matrix-bridge-mautrix-telegram/tasks/setup_install.yml
+++ b/roles/custom/matrix-bridge-mautrix-telegram/tasks/setup_install.yml
@@ -116,7 +116,10 @@
   when: "matrix_mautrix_telegram_stat_database.stat.exists"
 
 - name: (Data relocation) Move mautrix-telegram database file to ./data directory
-  ansible.builtin.command: "mv {{ matrix_mautrix_telegram_base_path }}/mautrix-telegram.db {{ matrix_mautrix_telegram_data_path }}/mautrix-telegram.db"
+  ansible.builtin.command:
+    cmd: "mv {{ matrix_mautrix_telegram_base_path }}/mautrix-telegram.db {{ matrix_mautrix_telegram_data_path }}/mautrix-telegram.db"
+    creates: "{{ matrix_mautrix_telegram_data_path }}/mautrix-telegram.db"
+    removes: "{{ matrix_mautrix_telegram_base_path }}/mautrix-telegram.db"
   when: "matrix_mautrix_telegram_stat_database.stat.exists"
 
 - name: Ensure mautrix-telegram config.yaml installed
diff --git a/roles/custom/matrix-bridge-mautrix-twitter/tasks/main.yml b/roles/custom/matrix-bridge-mautrix-twitter/tasks/main.yml
index 9eb444a76..655e52fbc 100644
--- a/roles/custom/matrix-bridge-mautrix-twitter/tasks/main.yml
+++ b/roles/custom/matrix-bridge-mautrix-twitter/tasks/main.yml
@@ -1,29 +1,29 @@
 ---
 
-- block:
-    - when: matrix_mautrix_twitter_enabled | bool and matrix_mautrix_twitter_metrics_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml"
-  tags:
+- tags:
     - setup-all
     - setup-nginx-proxy
     - install-all
     - install-nginx-proxy
+  block:
+    - when: matrix_mautrix_twitter_enabled | bool and matrix_mautrix_twitter_metrics_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml"
 
-- block:
+- tags:
+    - setup-all
+    - setup-mautrix-twitter
+    - install-all
+    - install-mautrix-twitter
+  block:
     - when: matrix_mautrix_twitter_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_mautrix_twitter_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-mautrix-twitter
-    - install-all
-    - install-mautrix-twitter
-
-- block:
+  block:
     - when: not matrix_mautrix_twitter_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-mautrix-twitter
diff --git a/roles/custom/matrix-bridge-mautrix-whatsapp/tasks/main.yml b/roles/custom/matrix-bridge-mautrix-whatsapp/tasks/main.yml
index b49a13003..cb4e8deac 100644
--- a/roles/custom/matrix-bridge-mautrix-whatsapp/tasks/main.yml
+++ b/roles/custom/matrix-bridge-mautrix-whatsapp/tasks/main.yml
@@ -1,29 +1,29 @@
 ---
 
-- block:
-    - when: matrix_mautrix_whatsapp_enabled | bool and matrix_mautrix_whatsapp_metrics_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml"
-  tags:
+- tags:
     - setup-all
     - setup-nginx-proxy
     - install-all
     - install-nginx-proxy
+  block:
+    - when: matrix_mautrix_whatsapp_enabled | bool and matrix_mautrix_whatsapp_metrics_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml"
 
-- block:
+- tags:
+    - setup-all
+    - setup-mautrix-whatsapp
+    - install-all
+    - install-mautrix-whatsapp
+  block:
     - when: matrix_mautrix_whatsapp_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_mautrix_whatsapp_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-mautrix-whatsapp
-    - install-all
-    - install-mautrix-whatsapp
-
-- block:
+  block:
     - when: not matrix_mautrix_whatsapp_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-mautrix-whatsapp
diff --git a/roles/custom/matrix-bridge-mautrix-whatsapp/tasks/setup_install.yml b/roles/custom/matrix-bridge-mautrix-whatsapp/tasks/setup_install.yml
index 1cf883c56..e41fe9c3a 100644
--- a/roles/custom/matrix-bridge-mautrix-whatsapp/tasks/setup_install.yml
+++ b/roles/custom/matrix-bridge-mautrix-whatsapp/tasks/setup_install.yml
@@ -97,11 +97,17 @@
   when: "matrix_mautrix_whatsapp_stat_database.stat.exists"
 
 - name: (Data relocation) Move mautrix-whatsapp database file to ./data directory
-  ansible.builtin.command: "mv {{ matrix_mautrix_whatsapp_base_path }}/mautrix-whatsapp.db {{ matrix_mautrix_whatsapp_data_path }}/mautrix-whatsapp.db"
+  ansible.builtin.command:
+    cmd: "mv {{ matrix_mautrix_whatsapp_base_path }}/mautrix-whatsapp.db {{ matrix_mautrix_whatsapp_data_path }}/mautrix-whatsapp.db"
+    creates: "{{ matrix_mautrix_whatsapp_data_path }}/mautrix-whatsapp.db"
+    removes: "{{ matrix_mautrix_whatsapp_base_path }}/mautrix-whatsapp.db"
   when: "matrix_mautrix_whatsapp_stat_database.stat.exists"
 
 - name: (Data relocation) Move mautrix-whatsapp mx-state file to ./data directory
-  ansible.builtin.command: "mv {{ matrix_mautrix_whatsapp_base_path }}/mx-state.json {{ matrix_mautrix_whatsapp_data_path }}/mx-state.json"
+  ansible.builtin.command:
+    cmd: "mv {{ matrix_mautrix_whatsapp_base_path }}/mx-state.json {{ matrix_mautrix_whatsapp_data_path }}/mx-state.json"
+    creates: "{{ matrix_mautrix_whatsapp_data_path }}/mx-state.json"
+    removes: "{{ matrix_mautrix_whatsapp_base_path }}/mx-state.json"
   when: "matrix_mautrix_whatsapp_stat_mx_state.stat.exists"
 
 - name: Ensure mautrix-whatsapp config.yaml installed
diff --git a/roles/custom/matrix-bridge-mx-puppet-discord/tasks/main.yml b/roles/custom/matrix-bridge-mx-puppet-discord/tasks/main.yml
index c1403dfa3..c0300b513 100644
--- a/roles/custom/matrix-bridge-mx-puppet-discord/tasks/main.yml
+++ b/roles/custom/matrix-bridge-mx-puppet-discord/tasks/main.yml
@@ -1,20 +1,20 @@
 ---
 
-- block:
+- tags:
+    - setup-all
+    - setup-mx-puppet-discord
+    - install-all
+    - install-mx-puppet-discord
+  block:
     - when: matrix_mx_puppet_discord_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_mx_puppet_discord_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-mx-puppet-discord
-    - install-all
-    - install-mx-puppet-discord
-
-- block:
+  block:
     - when: not matrix_mx_puppet_discord_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-mx-puppet-discord
diff --git a/roles/custom/matrix-bridge-mx-puppet-groupme/tasks/main.yml b/roles/custom/matrix-bridge-mx-puppet-groupme/tasks/main.yml
index ab5b0d445..de225e71d 100644
--- a/roles/custom/matrix-bridge-mx-puppet-groupme/tasks/main.yml
+++ b/roles/custom/matrix-bridge-mx-puppet-groupme/tasks/main.yml
@@ -1,20 +1,20 @@
 ---
 
-- block:
+- tags:
+    - setup-all
+    - setup-mx-puppet-groupme
+    - install-all
+    - install-mx-puppet-groupme
+  block:
     - when: matrix_mx_puppet_groupme_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_mx_puppet_groupme_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-mx-puppet-groupme
-    - install-all
-    - install-mx-puppet-groupme
-
-- block:
+  block:
     - when: not matrix_mx_puppet_groupme_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-mx-puppet-groupme
diff --git a/roles/custom/matrix-bridge-mx-puppet-groupme/tasks/setup_install.yml b/roles/custom/matrix-bridge-mx-puppet-groupme/tasks/setup_install.yml
index 9db25e864..0ba1e699f 100644
--- a/roles/custom/matrix-bridge-mx-puppet-groupme/tasks/setup_install.yml
+++ b/roles/custom/matrix-bridge-mx-puppet-groupme/tasks/setup_install.yml
@@ -29,7 +29,10 @@
   when: "matrix_mx_puppet_groupme_stat_database.stat.exists"
 
 - name: (Data relocation) Move mx-puppet-groupme database file to ./data directory
-  ansible.builtin.command: "mv {{ matrix_mx_puppet_groupme_base_path }}/database.db {{ matrix_mx_puppet_groupme_data_path }}/database.db"
+  ansible.builtin.command:
+    cmd: "mv {{ matrix_mx_puppet_groupme_base_path }}/database.db {{ matrix_mx_puppet_groupme_data_path }}/database.db"
+    creates: "{{ matrix_mx_puppet_groupme_data_path }}/database.db"
+    removes: "{{ matrix_mx_puppet_groupme_base_path }}/database.db"
   when: "matrix_mx_puppet_groupme_stat_database.stat.exists"
 
 - ansible.builtin.set_fact:
diff --git a/roles/custom/matrix-bridge-mx-puppet-instagram/tasks/main.yml b/roles/custom/matrix-bridge-mx-puppet-instagram/tasks/main.yml
index 3cf027736..0d46532ce 100644
--- a/roles/custom/matrix-bridge-mx-puppet-instagram/tasks/main.yml
+++ b/roles/custom/matrix-bridge-mx-puppet-instagram/tasks/main.yml
@@ -1,20 +1,20 @@
 ---
 
-- block:
+- tags:
+    - setup-all
+    - setup-mx-puppet-instagram
+    - install-all
+    - install-mx-puppet-instagram
+  block:
     - when: matrix_mx_puppet_instagram_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_mx_puppet_instagram_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-mx-puppet-instagram
-    - install-all
-    - install-mx-puppet-instagram
-
-- block:
+  block:
     - when: not matrix_mx_puppet_instagram_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-mx-puppet-instagram
diff --git a/roles/custom/matrix-bridge-mx-puppet-slack/tasks/main.yml b/roles/custom/matrix-bridge-mx-puppet-slack/tasks/main.yml
index 3d6e722bf..63e074050 100644
--- a/roles/custom/matrix-bridge-mx-puppet-slack/tasks/main.yml
+++ b/roles/custom/matrix-bridge-mx-puppet-slack/tasks/main.yml
@@ -1,29 +1,29 @@
 ---
 
-- block:
-    - when: matrix_mx_puppet_slack_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml"
-  tags:
+- tags:
     - setup-all
     - setup-nginx-proxy
     - install-all
     - install-nginx-proxy
+  block:
+    - when: matrix_mx_puppet_slack_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml"
 
-- block:
+- tags:
+    - setup-all
+    - setup-mx-puppet-slack
+    - install-all
+    - install-mx-puppet-slack
+  block:
     - when: matrix_mx_puppet_slack_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_mx_puppet_slack_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-mx-puppet-slack
-    - install-all
-    - install-mx-puppet-slack
-
-- block:
+  block:
     - when: not matrix_mx_puppet_slack_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-mx-puppet-slack
diff --git a/roles/custom/matrix-bridge-mx-puppet-slack/tasks/setup_install.yml b/roles/custom/matrix-bridge-mx-puppet-slack/tasks/setup_install.yml
index e75d47e57..bba2d25c6 100644
--- a/roles/custom/matrix-bridge-mx-puppet-slack/tasks/setup_install.yml
+++ b/roles/custom/matrix-bridge-mx-puppet-slack/tasks/setup_install.yml
@@ -91,7 +91,10 @@
   when: "matrix_mx_puppet_slack_enabled | bool and matrix_mx_puppet_slack_container_image_self_build"
 
 - name: (Data relocation) Move mx-puppet-slack database file to ./data directory
-  ansible.builtin.command: "mv {{ matrix_mx_puppet_slack_base_path }}/database.db {{ matrix_mx_puppet_slack_data_path }}/database.db"
+  ansible.builtin.command:
+    cmd: "mv {{ matrix_mx_puppet_slack_base_path }}/database.db {{ matrix_mx_puppet_slack_data_path }}/database.db"
+    creates: "{{ matrix_mx_puppet_slack_data_path }}/database.db"
+    removes: "{{ matrix_mx_puppet_slack_base_path }}/database.db"
   when: "matrix_mx_puppet_slack_stat_database.stat.exists"
 
 - name: Ensure mx-puppet-slack config.yaml installed
diff --git a/roles/custom/matrix-bridge-mx-puppet-steam/tasks/main.yml b/roles/custom/matrix-bridge-mx-puppet-steam/tasks/main.yml
index 6eacc6fc8..66d2980d3 100644
--- a/roles/custom/matrix-bridge-mx-puppet-steam/tasks/main.yml
+++ b/roles/custom/matrix-bridge-mx-puppet-steam/tasks/main.yml
@@ -1,20 +1,20 @@
 ---
 
-- block:
+- tags:
+    - setup-all
+    - setup-mx-puppet-steam
+    - install-all
+    - install-mx-puppet-steam
+  block:
     - when: matrix_mx_puppet_steam_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_mx_puppet_steam_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-mx-puppet-steam
-    - install-all
-    - install-mx-puppet-steam
-
-- block:
+  block:
     - when: not matrix_mx_puppet_steam_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-mx-puppet-steam
diff --git a/roles/custom/matrix-bridge-mx-puppet-steam/tasks/setup_install.yml b/roles/custom/matrix-bridge-mx-puppet-steam/tasks/setup_install.yml
index ca2de4480..f2ccea594 100644
--- a/roles/custom/matrix-bridge-mx-puppet-steam/tasks/setup_install.yml
+++ b/roles/custom/matrix-bridge-mx-puppet-steam/tasks/setup_install.yml
@@ -29,7 +29,10 @@
   when: "matrix_mx_puppet_steam_stat_database.stat.exists"
 
 - name: (Data relocation) Move mx-puppet-steam database file to ./data directory
-  ansible.builtin.command: "mv {{ matrix_mx_puppet_steam_base_path }}/database.db {{ matrix_mx_puppet_steam_data_path }}/database.db"
+  ansible.builtin.command:
+    cmd: "mv {{ matrix_mx_puppet_steam_base_path }}/database.db {{ matrix_mx_puppet_steam_data_path }}/database.db"
+    creates: "{{ matrix_mx_puppet_steam_data_path }}/database.db"
+    removes: "{{ matrix_mx_puppet_steam_base_path }}/database.db"
   when: "matrix_mx_puppet_steam_stat_database.stat.exists"
 
 - ansible.builtin.set_fact:
diff --git a/roles/custom/matrix-bridge-mx-puppet-twitter/tasks/main.yml b/roles/custom/matrix-bridge-mx-puppet-twitter/tasks/main.yml
index 85c06f04b..d6d681037 100644
--- a/roles/custom/matrix-bridge-mx-puppet-twitter/tasks/main.yml
+++ b/roles/custom/matrix-bridge-mx-puppet-twitter/tasks/main.yml
@@ -1,29 +1,29 @@
 ---
 
-- block:
-    - when: matrix_mx_puppet_twitter_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml"
-  tags:
+- tags:
     - setup-all
     - setup-nginx-proxy
     - install-all
     - install-nginx-proxy
+  block:
+    - when: matrix_mx_puppet_twitter_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml"
 
-- block:
+- tags:
+    - setup-all
+    - setup-mx-puppet-twitter
+    - install-all
+    - install-mx-puppet-twitter
+  block:
     - when: matrix_mx_puppet_twitter_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_mx_puppet_twitter_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-mx-puppet-twitter
-    - install-all
-    - install-mx-puppet-twitter
-
-- block:
+  block:
     - when: not matrix_mx_puppet_twitter_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-mx-puppet-twitter
diff --git a/roles/custom/matrix-bridge-mx-puppet-twitter/tasks/setup_install.yml b/roles/custom/matrix-bridge-mx-puppet-twitter/tasks/setup_install.yml
index a84502056..9224e9568 100644
--- a/roles/custom/matrix-bridge-mx-puppet-twitter/tasks/setup_install.yml
+++ b/roles/custom/matrix-bridge-mx-puppet-twitter/tasks/setup_install.yml
@@ -29,7 +29,10 @@
   when: "matrix_mx_puppet_twitter_stat_database.stat.exists"
 
 - name: (Data relocation) Move mx-puppet-twitter database file to ./data directory
-  ansible.builtin.command: "mv {{ matrix_mx_puppet_twitter_base_path }}/database.db {{ matrix_mx_puppet_twitter_data_path }}/database.db"
+  ansible.builtin.command:
+    cmd: "mv {{ matrix_mx_puppet_twitter_base_path }}/database.db {{ matrix_mx_puppet_twitter_data_path }}/database.db"
+    creates: "{{ matrix_mx_puppet_twitter_data_path }}/database.db"
+    removes: "{{ matrix_mx_puppet_twitter_base_path }}/database.db"
   when: "matrix_mx_puppet_twitter_stat_database.stat.exists"
 
 - ansible.builtin.set_fact:
diff --git a/roles/custom/matrix-bridge-sms/tasks/main.yml b/roles/custom/matrix-bridge-sms/tasks/main.yml
index f9bd502c7..57d517275 100644
--- a/roles/custom/matrix-bridge-sms/tasks/main.yml
+++ b/roles/custom/matrix-bridge-sms/tasks/main.yml
@@ -1,20 +1,20 @@
 ---
 
-- block:
+- tags:
+    - setup-all
+    - setup-matrix-sms-bridge
+    - install-all
+    - install-matrix-sms-bridge
+  block:
     - when: matrix_sms_bridge_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_sms_bridge_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-matrix-sms-bridge
-    - install-all
-    - install-matrix-sms-bridge
-
-- block:
+  block:
     - when: not matrix_sms_bridge_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-matrix-sms-bridge
diff --git a/roles/custom/matrix-cactus-comments/tasks/main.yml b/roles/custom/matrix-cactus-comments/tasks/main.yml
index c6108e91f..c1a08d328 100644
--- a/roles/custom/matrix-cactus-comments/tasks/main.yml
+++ b/roles/custom/matrix-cactus-comments/tasks/main.yml
@@ -1,29 +1,29 @@
 ---
 
-- block:
-    - when: matrix_cactus_comments_enabled | bool and matrix_cactus_comments_serve_client_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml"
-  tags:
+- tags:
     - setup-all
     - setup-nginx-proxy
     - install-all
     - install-nginx-proxy
+  block:
+    - when: matrix_cactus_comments_enabled | bool and matrix_cactus_comments_serve_client_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml"
 
-- block:
+- tags:
+    - setup-all
+    - setup-cactus-comments
+    - install-all
+    - install-cactus-comments
+  block:
     - when: matrix_cactus_comments_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_cactus_comments_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-cactus-comments
-    - install-all
-    - install-cactus-comments
-
-- block:
+  block:
     - when: not matrix_cactus_comments_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-cactus-comments
diff --git a/roles/custom/matrix-client-cinny/tasks/main.yml b/roles/custom/matrix-client-cinny/tasks/main.yml
index 1e6d47590..40c6514b5 100644
--- a/roles/custom/matrix-client-cinny/tasks/main.yml
+++ b/roles/custom/matrix-client-cinny/tasks/main.yml
@@ -1,26 +1,26 @@
 ---
 
-- block:
+- tags:
+    - setup-all
+    - setup-client-cinny
+    - install-all
+    - install-client-cinny
+  block:
     - when: matrix_client_cinny_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_client_cinny_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-client-cinny
-    - install-all
-    - install-client-cinny
-
-- block:
+  block:
     - when: not matrix_client_cinny_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-client-cinny
 
-- block:
+- tags:
+    - self-check
+  block:
     - when: matrix_client_cinny_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/self_check.yml"
-  tags:
-    - self-check
diff --git a/roles/custom/matrix-client-element/tasks/main.yml b/roles/custom/matrix-client-element/tasks/main.yml
index 89e50ba70..770200678 100644
--- a/roles/custom/matrix-client-element/tasks/main.yml
+++ b/roles/custom/matrix-client-element/tasks/main.yml
@@ -1,6 +1,11 @@
 ---
 
-- block:
+- tags:
+    - setup-all
+    - setup-client-element
+    - install-all
+    - install-client-element
+  block:
     - when: matrix_client_element_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
@@ -9,21 +14,16 @@
 
     - when: matrix_client_element_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-client-element
-    - install-all
-    - install-client-element
-
-- block:
+  block:
     - when: not matrix_client_element_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-client-element
 
-- block:
+- tags:
+    - self-check
+  block:
     - when: matrix_client_element_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/self_check.yml"
-  tags:
-    - self-check
diff --git a/roles/custom/matrix-client-element/tasks/setup_install.yml b/roles/custom/matrix-client-element/tasks/setup_install.yml
index fc0532db6..50d6370f7 100644
--- a/roles/custom/matrix-client-element/tasks/setup_install.yml
+++ b/roles/custom/matrix-client-element/tasks/setup_install.yml
@@ -56,6 +56,7 @@
       --tag={{ matrix_client_element_docker_image }}
       --file={{ matrix_client_element_docker_src_files_path }}/Dockerfile
       {{ matrix_client_element_docker_src_files_path }}
+  changed_when: true
   when: matrix_client_element_container_image_self_build | bool
 
 - name: Ensure Element configuration installed
diff --git a/roles/custom/matrix-client-hydrogen/tasks/main.yml b/roles/custom/matrix-client-hydrogen/tasks/main.yml
index 9bb8bc080..9e7445c0b 100644
--- a/roles/custom/matrix-client-hydrogen/tasks/main.yml
+++ b/roles/custom/matrix-client-hydrogen/tasks/main.yml
@@ -1,26 +1,26 @@
 ---
 
-- block:
+- tags:
+    - setup-all
+    - setup-client-hydrogen
+    - install-all
+    - install-client-hydrogen
+  block:
     - when: matrix_client_hydrogen_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_client_hydrogen_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-client-hydrogen
-    - install-all
-    - install-client-hydrogen
-
-- block:
+  block:
     - when: not matrix_client_hydrogen_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-client-hydrogen
 
-- block:
+- tags:
+    - self-check
+  block:
     - when: matrix_client_hydrogen_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/self_check.yml"
-  tags:
-    - self-check
diff --git a/roles/custom/matrix-common-after/tasks/main.yml b/roles/custom/matrix-common-after/tasks/main.yml
index fe23e467b..5e4dc76b9 100644
--- a/roles/custom/matrix-common-after/tasks/main.yml
+++ b/roles/custom/matrix-common-after/tasks/main.yml
@@ -1,6 +1,6 @@
 ---
 
-- block:
-    - ansible.builtin.include_tasks: "{{ role_path }}/tasks/run_docker_prune.yml"
-  tags:
+- tags:
     - run-docker-prune
+  block:
+    - ansible.builtin.include_tasks: "{{ role_path }}/tasks/run_docker_prune.yml"
diff --git a/roles/custom/matrix-conduit/tasks/main.yml b/roles/custom/matrix-conduit/tasks/main.yml
index d733ac08b..f48e385e0 100644
--- a/roles/custom/matrix-conduit/tasks/main.yml
+++ b/roles/custom/matrix-conduit/tasks/main.yml
@@ -1,17 +1,17 @@
 ---
 
-- block:
-    - when: matrix_conduit_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+- tags:
     - setup-all
     - setup-conduit
     - install-all
     - install-conduit
+  block:
+    - when: matrix_conduit_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
 
-- block:
-    - when: not matrix_conduit_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
+- tags:
     - setup-all
     - setup-conduit
+  block:
+    - when: not matrix_conduit_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
diff --git a/roles/custom/matrix-corporal/tasks/main.yml b/roles/custom/matrix-corporal/tasks/main.yml
index c4c7b7fc1..e8f3b785a 100644
--- a/roles/custom/matrix-corporal/tasks/main.yml
+++ b/roles/custom/matrix-corporal/tasks/main.yml
@@ -1,26 +1,26 @@
 ---
 
-- block:
+- tags:
+    - setup-all
+    - setup-corporal
+    - install-all
+    - install-corporal
+  block:
     - when: matrix_corporal_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_corporal_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-corporal
-    - install-all
-    - install-corporal
-
-- block:
+  block:
     - when: not matrix_corporal_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-corporal
 
-- block:
+- tags:
+    - self-check
+  block:
     - when: matrix_corporal_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/self_check.yml"
-  tags:
-    - self-check
diff --git a/roles/custom/matrix-coturn/tasks/main.yml b/roles/custom/matrix-coturn/tasks/main.yml
index 45ce9fd9e..1b1332fb7 100644
--- a/roles/custom/matrix-coturn/tasks/main.yml
+++ b/roles/custom/matrix-coturn/tasks/main.yml
@@ -1,20 +1,20 @@
 ---
 
-- block:
+- tags:
+    - setup-all
+    - setup-coturn
+    - install-all
+    - install-coturn
+  block:
     - when: matrix_coturn_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_coturn_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-coturn
-    - install-all
-    - install-coturn
-
-- block:
+  block:
     - when: not matrix_coturn_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-coturn
diff --git a/roles/custom/matrix-coturn/tasks/setup_install.yml b/roles/custom/matrix-coturn/tasks/setup_install.yml
index 44325f460..1cb8bd696 100644
--- a/roles/custom/matrix-coturn/tasks/setup_install.yml
+++ b/roles/custom/matrix-coturn/tasks/setup_install.yml
@@ -62,8 +62,8 @@
     owner: "{{ matrix_user_username }}"
     group: "{{ matrix_user_groupname }}"
 
-- when: matrix_coturn_docker_network not in ['', 'host']
-  name: Ensure Coturn network is created in Docker
+- name: Ensure Coturn network is created in Docker
+  when: matrix_coturn_docker_network not in ['', 'host']
   community.docker.docker_network:
     name: "{{ matrix_coturn_docker_network }}"
     driver: bridge
diff --git a/roles/custom/matrix-dendrite/tasks/main.yml b/roles/custom/matrix-dendrite/tasks/main.yml
index 0e88ec510..78d81524c 100644
--- a/roles/custom/matrix-dendrite/tasks/main.yml
+++ b/roles/custom/matrix-dendrite/tasks/main.yml
@@ -1,35 +1,35 @@
 ---
 
-- block:
+- tags:
+    - setup-all
+    - setup-dendrite
+    - install-all
+    - install-dendrite
+  block:
     - when: matrix_dendrite_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_dendrite_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-dendrite
-    - install-all
-    - install-dendrite
-
-- block:
+  block:
     - when: not matrix_dendrite_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-dendrite
 
-- block:
+- tags:
+    - self-check
+  block:
     - when: matrix_dendrite_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/self_check_client_api.yml"
 
     - when: matrix_dendrite_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/self_check_federation_api.yml"
-  tags:
-    - self-check
 
-- block:
+- tags:
+    - register-user
+  block:
     - when: matrix_dendrite_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/register_user.yml"
-  tags:
-    - register-user
diff --git a/roles/custom/matrix-dendrite/tasks/setup_install.yml b/roles/custom/matrix-dendrite/tasks/setup_install.yml
index 3b8cbd9b2..283e8b019 100644
--- a/roles/custom/matrix-dendrite/tasks/setup_install.yml
+++ b/roles/custom/matrix-dendrite/tasks/setup_install.yml
@@ -42,24 +42,20 @@
   delay: "{{ devture_playbook_help_container_retries_delay }}"
   until: result is not failed
 
-- name: Check if a Dendrite signing key exists
-  ansible.builtin.stat:
-    path: "{{ matrix_dendrite_config_dir_path }}/{{ matrix_server_fqn_matrix }}.signing.pem"
-  register: matrix_dendrite_signing_key_stat
-
 # We do this so that the signing key would get generated.
 # We don't use the `docker_container` module, because using it with `cap_drop` requires
 # a very recent version, which is not available for a lot of people yet.
 - name: Generate Dendrite signing key
-  ansible.builtin.command: |
-    docker run
-    --rm
-    --name=matrix-dendrite-config
-    --entrypoint=generate-keys
-    --mount type=bind,src={{ matrix_dendrite_config_dir_path }},dst=/data
-    {{ matrix_dendrite_docker_image }} --private-key=/data/{{ matrix_server_fqn_matrix }}.signing.pem
-    generate
-  when: "not matrix_dendrite_signing_key_stat.stat.exists"
+  ansible.builtin.command:
+    cmd: |
+      docker run
+      --rm
+      --name=matrix-dendrite-config
+      --entrypoint=generate-keys
+      --mount type=bind,src={{ matrix_dendrite_config_dir_path }},dst=/data
+      {{ matrix_dendrite_docker_image }} --private-key=/data/{{ matrix_server_fqn_matrix }}.signing.pem
+      generate
+    creates: "{{ matrix_dendrite_config_dir_path }}/{{ matrix_server_fqn_matrix }}.signing.pem"
 
 - name: Ensure Dendrite server key exists
   ansible.builtin.file:
diff --git a/roles/custom/matrix-dimension/tasks/main.yml b/roles/custom/matrix-dimension/tasks/main.yml
index efd0f8d47..1e949d3f2 100644
--- a/roles/custom/matrix-dimension/tasks/main.yml
+++ b/roles/custom/matrix-dimension/tasks/main.yml
@@ -1,20 +1,20 @@
 ---
 
-- block:
+- tags:
+    - setup-all
+    - setup-dimension
+    - install-all
+    - install-dimension
+  block:
     - when: matrix_dimension_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_dimension_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-dimension
-    - install-all
-    - install-dimension
-
-- block:
+  block:
     - when: not matrix_dimension_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-dimension
diff --git a/roles/custom/matrix-dynamic-dns/tasks/main.yml b/roles/custom/matrix-dynamic-dns/tasks/main.yml
index ae7503b73..8327a84ac 100644
--- a/roles/custom/matrix-dynamic-dns/tasks/main.yml
+++ b/roles/custom/matrix-dynamic-dns/tasks/main.yml
@@ -1,20 +1,20 @@
 ---
 
-- block:
+- tags:
+    - setup-all
+    - setup-dynamic-dns
+    - install-all
+    - install-dynamic-dns
+  block:
     - when: matrix_dynamic_dns_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_dynamic_dns_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-dynamic-dns
-    - install-all
-    - install-dynamic-dns
-
-- block:
+  block:
     - when: not matrix_dynamic_dns_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-dynamic-dns
diff --git a/roles/custom/matrix-email2matrix/tasks/main.yml b/roles/custom/matrix-email2matrix/tasks/main.yml
index 8fac77ce2..acd2c9c1e 100644
--- a/roles/custom/matrix-email2matrix/tasks/main.yml
+++ b/roles/custom/matrix-email2matrix/tasks/main.yml
@@ -1,20 +1,20 @@
 ---
 
-- block:
+- tags:
+    - setup-all
+    - setup-email2matrix
+    - install-all
+    - install-email2matrix
+  block:
     - when: matrix_email2matrix_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_email2matrix_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-email2matrix
-    - install-all
-    - install-email2matrix
-
-- block:
+  block:
     - when: not matrix_email2matrix_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-email2matrix
diff --git a/roles/custom/matrix-jitsi/tasks/main.yml b/roles/custom/matrix-jitsi/tasks/main.yml
index b35c2c347..0ebf3ad62 100644
--- a/roles/custom/matrix-jitsi/tasks/main.yml
+++ b/roles/custom/matrix-jitsi/tasks/main.yml
@@ -1,27 +1,32 @@
 ---
 
-- block:
-    - when: matrix_jitsi_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/init_additional_jvb.yml"
-  tags:
+- tags:
     - setup-additional-jitsi-jvb
     - install-additional-jitsi-jvb
-
-- block:
+  block:
     - when: matrix_jitsi_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/init_additional_jvb.yml"
 
-    - when: matrix_jitsi_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_jitsi_base.yml"
-  tags:
+- tags:
     - setup-all
     - setup-jitsi
     - setup-additional-jitsi-jvb
     - install-all
     - install-jitsi
     - install-additional-jitsi-jvb
+  block:
+    - when: matrix_jitsi_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
-- block:
+    - when: matrix_jitsi_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_jitsi_base.yml"
+
+- tags:
+    - setup-all
+    - setup-jitsi
+    - install-all
+    - install-jitsi
+  block:
     - when: matrix_jitsi_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_jitsi_web_install.yml"
 
@@ -30,13 +35,11 @@
 
     - when: matrix_jitsi_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_jitsi_jicofo_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-jitsi
-    - install-all
-    - install-jitsi
-
-- block:
+  block:
     - when: not matrix_jitsi_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_jitsi_web_uninstall.yml"
 
@@ -45,31 +48,28 @@
 
     - when: not matrix_jitsi_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_jitsi_jicofo_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-jitsi
 
-- block:
-    - when: matrix_jitsi_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_jitsi_jvb_install.yml"
-  tags:
+- tags:
     - setup-all
     - setup-jitsi
     - setup-additional-jitsi-jvb
     - install-all
     - install-jitsi
     - install-additional-jitsi-jvb
+  block:
+    - when: matrix_jitsi_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_jitsi_jvb_install.yml"
 
-- block:
-    - when: not matrix_jitsi_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_jitsi_jvb_uninstall.yml"
-  tags:
+- tags:
     - setup-all
     - setup-jitsi
     - setup-additional-jitsi-jvb
+  block:
+    - when: not matrix_jitsi_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_jitsi_jvb_uninstall.yml"
 
-- block:
+- tags:
+    - self-check
+  block:
     - when: matrix_jitsi_enable_auth | bool and matrix_jitsi_auth_type == 'matrix'
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/self_check_matrix_auth.yml"
-  tags:
-    - self-check
diff --git a/roles/custom/matrix-jitsi/tasks/util/setup_jitsi_auth_uvs_install.yml b/roles/custom/matrix-jitsi/tasks/util/setup_jitsi_auth_uvs_install.yml
index f1d9ff210..4aa67a316 100644
--- a/roles/custom/matrix-jitsi/tasks/util/setup_jitsi_auth_uvs_install.yml
+++ b/roles/custom/matrix-jitsi/tasks/util/setup_jitsi_auth_uvs_install.yml
@@ -5,11 +5,16 @@
     repo: "{{ matrix_jitsi_prosody_auth_matrix_user_verification_repo_location }}"
     dest: "{{ matrix_jitsi_prosody_auth_matrix_user_verification_repo_target }}"
     version: "{{ matrix_jitsi_prosody_auth_matrix_user_verification_repo_version }}"
+  become: true
+  become_user: "{{ matrix_user_username }}"
 
 - name: Install Prosody Auth Matrix User Verification Plugin
   ansible.builtin.copy:
     remote_src: true
     src: "{{ matrix_jitsi_prosody_auth_matrix_user_verification_repo_target }}/{{ item.path }}"
     dest: "{{ matrix_jitsi_prosody_plugins_path }}/{{ item.path }}"
+    mode: 0644
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
   with_items: "{{ matrix_jitsi_prosody_auth_matrix_files }}"
   when: item.when | bool
diff --git a/roles/custom/matrix-ldap-registration-proxy/tasks/main.yml b/roles/custom/matrix-ldap-registration-proxy/tasks/main.yml
index 9309113fe..cc71ae82c 100644
--- a/roles/custom/matrix-ldap-registration-proxy/tasks/main.yml
+++ b/roles/custom/matrix-ldap-registration-proxy/tasks/main.yml
@@ -1,29 +1,29 @@
 ---
 
-- block:
-    - when: matrix_ldap_registration_proxy_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml"
-  tags:
+- tags:
     - setup-all
     - setup-nginx-proxy
     - install-all
     - install-nginx-proxy
+  block:
+    - when: matrix_ldap_registration_proxy_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml"
 
-- block:
+- tags:
+    - setup-all
+    - setup-matrix-ldap-registration-proxy
+    - install-all
+    - install-matrix-ldap-registration-proxy
+  block:
     - when: matrix_ldap_registration_proxy_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_ldap_registration_proxy_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-matrix-ldap-registration-proxy
-    - install-all
-    - install-matrix-ldap-registration-proxy
-
-- block:
+  block:
     - when: not matrix_ldap_registration_proxy_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-matrix-ldap-registration-proxy
diff --git a/roles/custom/matrix-ma1sd/tasks/main.yml b/roles/custom/matrix-ma1sd/tasks/main.yml
index a65cf371e..a9c4ec8b0 100644
--- a/roles/custom/matrix-ma1sd/tasks/main.yml
+++ b/roles/custom/matrix-ma1sd/tasks/main.yml
@@ -1,25 +1,25 @@
 ---
 
-- block:
+- tags:
+    - setup-all
+    - setup-ma1sd
+    - install-all
+    - install-ma1sd
+  block:
     - when: matrix_ma1sd_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_ma1sd_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
-    - setup-all
-    - setup-ma1sd
-    - install-all
-    - install-ma1sd
 
-- block:
+- tags:
+    - setup-ma1sd
+  block:
     - when: not matrix_ma1sd_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-ma1sd
 
-- block:
+- tags:
+    - self-check
+  block:
     - when: matrix_ma1sd_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/self_check.yml"
-  tags:
-    - self-check
diff --git a/roles/custom/matrix-ma1sd/tasks/setup_install.yml b/roles/custom/matrix-ma1sd/tasks/setup_install.yml
index 6fe20342b..5800b45a7 100644
--- a/roles/custom/matrix-ma1sd/tasks/setup_install.yml
+++ b/roles/custom/matrix-ma1sd/tasks/setup_install.yml
@@ -89,6 +89,7 @@
         chdir: "{{ matrix_ma1sd_docker_src_files_path }}"
       environment:
         DOCKER_BUILDKIT: 1
+      changed_when: true
       when: matrix_ma1sd_git_pull_results.changed
 
     - name: Ensure ma1sd Docker image is tagged correctly
diff --git a/roles/custom/matrix-mailer/tasks/main.yml b/roles/custom/matrix-mailer/tasks/main.yml
index b269f63e7..00fa0884e 100644
--- a/roles/custom/matrix-mailer/tasks/main.yml
+++ b/roles/custom/matrix-mailer/tasks/main.yml
@@ -1,17 +1,17 @@
 ---
 
-- block:
-    - when: matrix_mailer_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+- tags:
     - setup-all
     - setup-mailer
     - install-all
     - install-mailer
+  block:
+    - when: matrix_mailer_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
 
-- block:
-    - when: not matrix_mailer_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
+- tags:
     - setup-all
     - setup-mailer
+  block:
+    - when: not matrix_mailer_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
diff --git a/roles/custom/matrix-nginx-proxy/tasks/main.yml b/roles/custom/matrix-nginx-proxy/tasks/main.yml
index 39cec7e53..7a702fb37 100644
--- a/roles/custom/matrix-nginx-proxy/tasks/main.yml
+++ b/roles/custom/matrix-nginx-proxy/tasks/main.yml
@@ -29,13 +29,13 @@
     - install-all
     - install-nginx-proxy
 
-- block:
-    - ansible.builtin.include_tasks: "{{ role_path }}/tasks/self_check_well_known.yml"
-  tags:
+- tags:
     - self-check
+  block:
+    - ansible.builtin.include_tasks: "{{ role_path }}/tasks/self_check_well_known.yml"
 
 - name: Mark matrix-nginx-proxy role as executed
-  ansible.builtin.set_fact:
-    matrix_nginx_proxy_role_executed: true
   tags:
     - always
+  ansible.builtin.set_fact:
+    matrix_nginx_proxy_role_executed: true
diff --git a/roles/custom/matrix-nginx-proxy/tasks/ssl/setup_ssl_lets_encrypt_obtain_for_domain.yml b/roles/custom/matrix-nginx-proxy/tasks/ssl/setup_ssl_lets_encrypt_obtain_for_domain.yml
index b10791a7f..a175b831a 100644
--- a/roles/custom/matrix-nginx-proxy/tasks/ssl/setup_ssl_lets_encrypt_obtain_for_domain.yml
+++ b/roles/custom/matrix-nginx-proxy/tasks/ssl/setup_ssl_lets_encrypt_obtain_for_domain.yml
@@ -51,6 +51,7 @@
     --agree-tos
     --email={{ matrix_ssl_lets_encrypt_support_email }}
     -d {{ domain_name }}
+  changed_when: true
   when: domain_name_needs_cert | bool
   register: result_certbot_direct
   ignore_errors: true
@@ -81,6 +82,7 @@
     --agree-tos
     --email={{ matrix_ssl_lets_encrypt_support_email }}
     -d {{ domain_name }}
+  changed_when: true
   when: "domain_name_needs_cert and result_certbot_direct.failed"
   register: result_certbot_proxy
   ignore_errors: true
diff --git a/roles/custom/matrix-nginx-proxy/tasks/ssl/setup_ssl_self_signed_obtain_for_domain.yml b/roles/custom/matrix-nginx-proxy/tasks/ssl/setup_ssl_self_signed_obtain_for_domain.yml
index d0b254a26..c0f195191 100644
--- a/roles/custom/matrix-nginx-proxy/tasks/ssl/setup_ssl_self_signed_obtain_for_domain.yml
+++ b/roles/custom/matrix-nginx-proxy/tasks/ssl/setup_ssl_self_signed_obtain_for_domain.yml
@@ -28,16 +28,19 @@
 #
 # We'll do it in a more manual way.
 - name: Generate SSL certificate
-  ansible.builtin.command: |
-    openssl req -x509 \
-    -sha256 \
-    -newkey rsa:4096 \
-    -nodes \
-    -subj "/CN={{ domain_name }}" \
-    -keyout {{ matrix_ssl_certificate_cert_key_path }} \
-    -out {{ matrix_ssl_certificate_cert_path }} \
-    -days 3650
   when: "not matrix_ssl_certificate_cert_path_stat_result.stat.exists"
+  ansible.builtin.command:
+    cmd: |
+      openssl req -x509 \
+      -sha256 \
+      -newkey rsa:4096 \
+      -nodes \
+      -subj "/CN={{ domain_name }}" \
+      -keyout {{ matrix_ssl_certificate_cert_key_path }} \
+      -out {{ matrix_ssl_certificate_cert_path }} \
+      -days 3650
+    # Well, this creates 2 files, but Ansible can only check 1.
+    creates: "{{ matrix_ssl_certificate_cert_path }}"
 
 - name: Adjust SSL certificate file ownership
   ansible.builtin.file:
diff --git a/roles/custom/matrix-prometheus-nginxlog-exporter/tasks/main.yml b/roles/custom/matrix-prometheus-nginxlog-exporter/tasks/main.yml
index b205dec36..ad0474604 100644
--- a/roles/custom/matrix-prometheus-nginxlog-exporter/tasks/main.yml
+++ b/roles/custom/matrix-prometheus-nginxlog-exporter/tasks/main.yml
@@ -1,29 +1,29 @@
 ---
 
-- block:
-    - when: matrix_prometheus_nginxlog_exporter_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml"
-  tags:
+- tags:
     - setup-all
     - setup-prometheus-nginxlog-exporter
     - install-all
     - install-prometheus-nginxlog-exporter
+  block:
+    - when: matrix_prometheus_nginxlog_exporter_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml"
 
-- block:
+- tags:
+    - setup-all
+    - setup-prometheus-nginxlog-exporter
+    - install-all
+    - install-prometheus-nginxlog-exporter
+  block:
     - when: matrix_prometheus_nginxlog_exporter_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_prometheus_nginxlog_exporter_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-prometheus-nginxlog-exporter
-    - install-all
-    - install-prometheus-nginxlog-exporter
-
-- block:
+  block:
     - when: not matrix_prometheus_nginxlog_exporter_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-prometheus-nginxlog-exporter
diff --git a/roles/custom/matrix-prometheus-services-proxy-connect/tasks/main.yml b/roles/custom/matrix-prometheus-services-proxy-connect/tasks/main.yml
index e56546889..ea067bdba 100644
--- a/roles/custom/matrix-prometheus-services-proxy-connect/tasks/main.yml
+++ b/roles/custom/matrix-prometheus-services-proxy-connect/tasks/main.yml
@@ -1,28 +1,28 @@
 ---
 
 - name: Fail if matrix-nginx-proxy role executed before matrix-prometheus-services-proxy-connect
+  when: matrix_nginx_proxy_role_executed | default(False) | bool
   ansible.builtin.fail:
     msg: >-
       Trying to append node-exporter's reverse-proxying configuration to matrix-nginx-proxy,
       but it's pointless since the matrix-nginx-proxy role had already executed.
       To fix this, please change the order of roles in your playbook,
       so that the matrix-nginx-proxy role would run after the matrix-prometheus-services-proxy-connect role.
-  when: matrix_nginx_proxy_role_executed | default(False) | bool
 
-- block:
+- tags:
+    - setup-all
+    - setup-nginx-proxy
+    - install-all
+    - install-nginx-proxy
+  block:
     - when: prometheus_node_exporter_enabled | bool and matrix_prometheus_services_proxy_connect_prometheus_node_exporter_metrics_proxying_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/prometheus-node-exporter/inject_into_nginx_proxy.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-nginx-proxy
     - install-all
     - install-nginx-proxy
-
-- block:
+  block:
     - when: prometheus_node_exporter_enabled | bool and matrix_prometheus_services_proxy_connect_prometheus_postgres_exporter_metrics_proxying_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/prometheus-postgres-exporter/inject_into_nginx_proxy.yml"
-  tags:
-    - setup-all
-    - setup-nginx-proxy
-    - install-all
-    - install-nginx-proxy
diff --git a/roles/custom/matrix-prometheus/tasks/main.yml b/roles/custom/matrix-prometheus/tasks/main.yml
index 59371d4d4..bbd820014 100644
--- a/roles/custom/matrix-prometheus/tasks/main.yml
+++ b/roles/custom/matrix-prometheus/tasks/main.yml
@@ -1,20 +1,20 @@
 ---
 
-- block:
+- tags:
+    - setup-all
+    - setup-prometheus
+    - install-all
+    - install-prometheus
+  block:
     - when: matrix_prometheus_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_prometheus_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-prometheus
-    - install-all
-    - install-prometheus
-
-- block:
+  block:
     - when: not matrix_prometheus_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-prometheus
diff --git a/roles/custom/matrix-rageshake/tasks/install.yml b/roles/custom/matrix-rageshake/tasks/install.yml
index f9461680f..a1db9a877 100644
--- a/roles/custom/matrix-rageshake/tasks/install.yml
+++ b/roles/custom/matrix-rageshake/tasks/install.yml
@@ -62,6 +62,7 @@
       --tag={{ matrix_rageshake_container_image }}
       --file={{ matrix_rageshake_container_src_files_path }}/Dockerfile
       {{ matrix_rageshake_container_src_files_path }}
+  changed_when: true
   when: matrix_rageshake_container_image_self_build | bool
 
 - name: Ensure rageshake container network is created
diff --git a/roles/custom/matrix-rageshake/tasks/main.yml b/roles/custom/matrix-rageshake/tasks/main.yml
index c330964a4..a211296d0 100644
--- a/roles/custom/matrix-rageshake/tasks/main.yml
+++ b/roles/custom/matrix-rageshake/tasks/main.yml
@@ -1,19 +1,20 @@
 ---
-- block:
+
+- tags:
+    - setup-all
+    - setup-rageshake
+    - install-all
+    - install-rageshake
+  block:
     - when: matrix_rageshake_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_rageshake_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-rageshake
-    - install-all
-    - install-rageshake
-
-- block:
+  block:
     - when: not matrix_rageshake_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/uninstall.yml"
-  tags:
-    - setup-all
-    - setup-rageshake
diff --git a/roles/custom/matrix-registration/tasks/main.yml b/roles/custom/matrix-registration/tasks/main.yml
index bebcebc0b..64843dee2 100644
--- a/roles/custom/matrix-registration/tasks/main.yml
+++ b/roles/custom/matrix-registration/tasks/main.yml
@@ -1,41 +1,41 @@
 ---
 
-- block:
-    - when: matrix_registration_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml"
-  tags:
+- tags:
     - setup-all
     - setup-nginx-proxy
     - install-all
     - install-nginx-proxy
+  block:
+    - when: matrix_registration_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml"
 
-- block:
+- tags:
+    - setup-all
+    - setup-matrix-registration
+    - install-all
+    - install-matrix-registration
+  block:
     - when: matrix_registration_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_registration_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-matrix-registration
-    - install-all
-    - install-matrix-registration
-
-- block:
+  block:
     - when: not matrix_registration_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-matrix-registration
 
-- block:
+- tags:
+    - generate-matrix-registration-token
+  block:
     - when: matrix_registration_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/generate_token.yml"
-  tags:
-    - generate-matrix-registration-token
 
-- block:
+- tags:
+    - list-matrix-registration-tokens
+  block:
     - when: matrix_registration_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/list_tokens.yml"
-  tags:
-    - list-matrix-registration-tokens
diff --git a/roles/custom/matrix-sliding-sync/tasks/install.yml b/roles/custom/matrix-sliding-sync/tasks/install.yml
index 26717afda..cb41cec06 100644
--- a/roles/custom/matrix-sliding-sync/tasks/install.yml
+++ b/roles/custom/matrix-sliding-sync/tasks/install.yml
@@ -56,6 +56,7 @@
           --tag={{ matrix_sliding_sync_container_image }}
           --file={{ matrix_sliding_sync_container_src_path }}/Dockerfile
           {{ matrix_sliding_sync_container_src_path }}
+      changed_when: true
 
 - name: Ensure matrix-sliding-sync container network is created
   community.general.docker_network:
diff --git a/roles/custom/matrix-sliding-sync/tasks/main.yml b/roles/custom/matrix-sliding-sync/tasks/main.yml
index 71e7391b4..521f16fe7 100644
--- a/roles/custom/matrix-sliding-sync/tasks/main.yml
+++ b/roles/custom/matrix-sliding-sync/tasks/main.yml
@@ -1,19 +1,20 @@
 ---
-- block:
+
+- tags:
+    - setup-all
+    - setup-sliding-sync
+    - install-all
+    - install-sliding-sync
+  block:
     - when: matrix_sliding_sync_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_sliding_sync_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-sliding-sync
-    - install-all
-    - install-sliding-sync
-
-- block:
+  block:
     - when: not matrix_sliding_sync_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/uninstall.yml"
-  tags:
-    - setup-all
-    - setup-sliding-sync
diff --git a/roles/custom/matrix-sygnal/tasks/main.yml b/roles/custom/matrix-sygnal/tasks/main.yml
index ba4cb8768..a586cbd02 100644
--- a/roles/custom/matrix-sygnal/tasks/main.yml
+++ b/roles/custom/matrix-sygnal/tasks/main.yml
@@ -1,20 +1,20 @@
 ---
 
-- block:
+- tags:
+    - setup-all
+    - setup-sygnal
+    - install-all
+    - install-sygnal
+  block:
     - when: matrix_sygnal_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_sygnal_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-sygnal
-    - install-all
-    - install-sygnal
-
-- block:
+  block:
     - when: not matrix_sygnal_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/uninstall.yml"
-  tags:
-    - setup-all
-    - setup-sygnal
diff --git a/roles/custom/matrix-synapse-admin/tasks/main.yml b/roles/custom/matrix-synapse-admin/tasks/main.yml
index f38f1d5e4..da9bdb18c 100644
--- a/roles/custom/matrix-synapse-admin/tasks/main.yml
+++ b/roles/custom/matrix-synapse-admin/tasks/main.yml
@@ -1,29 +1,29 @@
 ---
 
-- block:
-    - when: matrix_synapse_admin_enabled | bool and matrix_synapse_admin_nginx_proxy_integration_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml"
-  tags:
+- tags:
     - setup-all
     - setup-nginx-proxy
     - install-all
     - install-nginx-proxy
+  block:
+    - when: matrix_synapse_admin_enabled | bool and matrix_synapse_admin_nginx_proxy_integration_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml"
 
-- block:
+- tags:
+    - setup-all
+    - setup-synapse-admin
+    - install-all
+    - install-synapse-admin
+  block:
     - when: matrix_synapse_admin_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_synapse_admin_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-synapse-admin
-    - install-all
-    - install-synapse-admin
-
-- block:
+  block:
     - when: not matrix_synapse_admin_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-synapse-admin
diff --git a/roles/custom/matrix-synapse-reverse-proxy-companion/tasks/main.yml b/roles/custom/matrix-synapse-reverse-proxy-companion/tasks/main.yml
index 0dba0b9c7..680602672 100644
--- a/roles/custom/matrix-synapse-reverse-proxy-companion/tasks/main.yml
+++ b/roles/custom/matrix-synapse-reverse-proxy-companion/tasks/main.yml
@@ -1,20 +1,20 @@
 ---
 
-- block:
-    - when: matrix_synapse_reverse_proxy_companion_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+- tags:
     - setup-all
     - setup-synapse-reverse-proxy-companion
     - setup-synapse
     - install-all
     - install-synapse-reverse-proxy-companion
     - install-synapse
+  block:
+    - when: matrix_synapse_reverse_proxy_companion_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
 
-- block:
-    - when: not matrix_synapse_reverse_proxy_companion_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
+- tags:
     - setup-all
     - setup-synapse-reverse-proxy-companion
     - setup-synapse
+  block:
+    - when: not matrix_synapse_reverse_proxy_companion_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
diff --git a/roles/custom/matrix-synapse/tasks/ext/setup_install.yml b/roles/custom/matrix-synapse/tasks/ext/setup_install.yml
index a24138038..0d8879392 100644
--- a/roles/custom/matrix-synapse/tasks/ext/setup_install.yml
+++ b/roles/custom/matrix-synapse/tasks/ext/setup_install.yml
@@ -1,60 +1,60 @@
 ---
 
 # encryption-disabler
-- block:
+- tags:
+    - setup-all
+    - setup-synapse
+  block:
     - when: matrix_synapse_ext_encryption_disabler_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/ext/encryption-disabler/setup_install.yml"
-  tags:
-    - setup-all
-    - setup-synapse
 
 # rest-auth
-- block:
+- tags:
+    - setup-all
+    - setup-synapse
+  block:
     - when: matrix_synapse_ext_password_provider_rest_auth_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/ext/rest-auth/setup_install.yml"
-  tags:
-    - setup-all
-    - setup-synapse
 
 # shared-secret-auth
-- block:
+- tags:
+    - setup-all
+    - setup-synapse
+  block:
     - when: matrix_synapse_ext_password_provider_shared_secret_auth_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/ext/shared-secret-auth/setup_install.yml"
-  tags:
-    - setup-all
-    - setup-synapse
 
 # ldap-auth
-- block:
+- tags:
+    - setup-all
+    - setup-synapse
+  block:
     - when: matrix_synapse_ext_password_provider_ldap_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/ext/ldap-auth/setup_install.yml"
-  tags:
-    - setup-all
-    - setup-synapse
 
 # synapse-simple-antispam
-- block:
+- tags:
+    - setup-all
+    - setup-synapse
+  block:
     - when: matrix_synapse_ext_spam_checker_synapse_simple_antispam_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/ext/synapse-simple-antispam/setup_install.yml"
-  tags:
-    - setup-all
-    - setup-synapse
 
 # mjolnir-antispam
-- block:
-    - when: matrix_synapse_ext_spam_checker_mjolnir_antispam_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/ext/mjolnir-antispam/setup_install.yml"
-  tags:
+- tags:
     - setup-all
     - setup-synapse
+  block:
+    - when: matrix_synapse_ext_spam_checker_mjolnir_antispam_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/ext/mjolnir-antispam/setup_install.yml"
 
 # s3-storage-provider
-- block:
+- tags:
+    - setup-all
+    - setup-synapse
+  block:
     - when: matrix_synapse_ext_synapse_s3_storage_provider_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/ext/s3-storage-provider/validate_config.yml"
 
     - when: matrix_synapse_ext_synapse_s3_storage_provider_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/ext/s3-storage-provider/setup_install.yml"
-  tags:
-    - setup-all
-    - setup-synapse
diff --git a/roles/custom/matrix-synapse/tasks/ext/setup_uninstall.yml b/roles/custom/matrix-synapse/tasks/ext/setup_uninstall.yml
index cca6c1b8a..f584f584d 100644
--- a/roles/custom/matrix-synapse/tasks/ext/setup_uninstall.yml
+++ b/roles/custom/matrix-synapse/tasks/ext/setup_uninstall.yml
@@ -1,52 +1,52 @@
 ---
 
 # encryption-disabler
-- block:
+- tags:
+    - setup-all
+    - setup-synapse
+  block:
     - when: not matrix_synapse_ext_encryption_disabler_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/ext/encryption-disabler/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-synapse
 
 # rest-auth
-- block:
+- tags:
+    - setup-all
+    - setup-synapse
+  block:
     - when: not matrix_synapse_ext_password_provider_rest_auth_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/ext/rest-auth/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-synapse
 
 # shared-secret-auth
-- block:
-    - when: not matrix_synapse_ext_password_provider_shared_secret_auth_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/ext/shared-secret-auth/setup_uninstall.yml"
-  tags:
+- tags:
     - setup-all
     - setup-synapse
+  block:
+    - when: not matrix_synapse_ext_password_provider_shared_secret_auth_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/ext/shared-secret-auth/setup_uninstall.yml"
 
 # ldap-auth has no uninstall tasks
 
 
 # synapse-simple-antispam
-- block:
+- tags:
+    - setup-all
+    - setup-synapse
+  block:
     - when: not matrix_synapse_ext_spam_checker_synapse_simple_antispam_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/ext/synapse-simple-antispam/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-synapse
 
 # mjolnir-antispam
-- block:
+- tags:
+    - setup-all
+    - setup-synapse
+  block:
     - when: not matrix_synapse_ext_spam_checker_mjolnir_antispam_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/ext/mjolnir-antispam/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-synapse
 
 # s3-storage-provider
-- block:
-    - when: not matrix_synapse_ext_synapse_s3_storage_provider_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/ext/s3-storage-provider/setup_uninstall.yml"
-  tags:
+- tags:
     - setup-all
     - setup-synapse
+  block:
+    - when: not matrix_synapse_ext_synapse_s3_storage_provider_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/ext/s3-storage-provider/setup_uninstall.yml"
diff --git a/roles/custom/matrix-synapse/tasks/main.yml b/roles/custom/matrix-synapse/tasks/main.yml
index d00c1808c..88a54afc5 100644
--- a/roles/custom/matrix-synapse/tasks/main.yml
+++ b/roles/custom/matrix-synapse/tasks/main.yml
@@ -1,9 +1,6 @@
 ---
 
-- block:
-    - when: matrix_synapse_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/init.yml"
-  tags:
+- tags:
     - setup-all
     - setup-synapse
     - install-all
@@ -19,55 +16,58 @@
     - stop
     - stop-all
     - stop-group
+  block:
+    - when: matrix_synapse_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/init.yml"
 
-- block:
+- tags:
+    - setup-all
+    - setup-synapse
+    - install-all
+    - install-synapse
+  block:
     - when: matrix_synapse_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_synapse_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-synapse
-    - install-all
-    - install-synapse
-
-- block:
+  block:
     - when: not matrix_synapse_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-synapse
 
-- block:
+- tags:
+    - import-synapse-media-store
+  block:
     - when: matrix_synapse_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/import_media_store.yml"
-  tags:
-    - import-synapse-media-store
 
-- block:
+- tags:
+    - register-user
+  block:
     - when: matrix_synapse_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/register_user.yml"
-  tags:
-    - register-user
 
-- block:
+- tags:
+    - update-user-password
+  block:
     - when: matrix_synapse_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/update_user_password.yml"
-  tags:
-    - update-user-password
 
-- block:
+- tags:
+    - rust-synapse-compress-state
+  block:
     - when: matrix_synapse_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/rust-synapse-compress-state/main.yml"
-  tags:
-    - rust-synapse-compress-state
 
-- block:
+- tags:
+    - self-check
+  block:
     - when: matrix_synapse_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/self_check_client_api.yml"
 
     - when: matrix_synapse_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/self_check_federation_api.yml"
-  tags:
-    - self-check
diff --git a/roles/custom/matrix-synapse/tasks/setup_install.yml b/roles/custom/matrix-synapse/tasks/setup_install.yml
index c8b191ec2..378a0dee5 100644
--- a/roles/custom/matrix-synapse/tasks/setup_install.yml
+++ b/roles/custom/matrix-synapse/tasks/setup_install.yml
@@ -23,33 +23,33 @@
     # trying to chown/chmod it here will cause trouble.
   when: item.when | bool
 
-- block:
+- tags:
+    - setup-all
+    - setup-synapse
+  block:
     - ansible.builtin.include_tasks: "{{ role_path }}/tasks/ext/setup_install.yml"
 
     - ansible.builtin.include_tasks: "{{ role_path }}/tasks/ext/setup_uninstall.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-synapse
-
-- block:
+  block:
     - when: matrix_synapse_workers_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/synapse/workers/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-synapse
-
-- block:
+  block:
     - ansible.builtin.include_tasks: "{{ role_path }}/tasks/synapse/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-synapse
-
-- block:
+  block:
     - when: matrix_s3_media_store_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/goofys/setup_install.yml"
 
     - when: not matrix_s3_media_store_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/goofys/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-synapse
diff --git a/roles/custom/matrix-synapse/tasks/setup_uninstall.yml b/roles/custom/matrix-synapse/tasks/setup_uninstall.yml
index 72b64c879..7ce5e13dd 100644
--- a/roles/custom/matrix-synapse/tasks/setup_uninstall.yml
+++ b/roles/custom/matrix-synapse/tasks/setup_uninstall.yml
@@ -1,27 +1,27 @@
 ---
 
-- block:
-    - ansible.builtin.include_tasks: "{{ role_path }}/tasks/ext/setup_uninstall.yml"
-  tags:
+- tags:
     - setup-all
     - setup-synapse
+  block:
+    - ansible.builtin.include_tasks: "{{ role_path }}/tasks/ext/setup_uninstall.yml"
 
-- block:
+- tags:
+    - setup-all
+    - setup-synapse
+  block:
     - when: not matrix_synapse_workers_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/synapse/workers/setup_uninstall.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-synapse
-
-- block:
+  block:
     - ansible.builtin.include_tasks: "{{ role_path }}/tasks/synapse/setup_uninstall.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-synapse
-
-- block:
+  block:
     - when: not matrix_s3_media_store_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/goofys/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-synapse
diff --git a/roles/custom/matrix-synapse/tasks/synapse/setup_install.yml b/roles/custom/matrix-synapse/tasks/synapse/setup_install.yml
index 4a62d88d9..169be60bf 100644
--- a/roles/custom/matrix-synapse/tasks/synapse/setup_install.yml
+++ b/roles/custom/matrix-synapse/tasks/synapse/setup_install.yml
@@ -48,6 +48,7 @@
           .
       environment:
         DOCKER_BUILDKIT: 1
+      changed_when: true
       when: "matrix_synapse_git_pull_results.changed | bool or matrix_synapse_docker_image_check_result.stdout == ''"
 
 - name: Ensure Synapse Docker image is pulled
@@ -82,11 +83,6 @@
           path: "{{ matrix_synapse_customized_docker_src_files_path }}"
           nocache: "{{ matrix_synapse_docker_image_customized_build_nocache }}"
 
-- name: Check if a Synapse signing key exists
-  ansible.builtin.stat:
-    path: "{{ matrix_synapse_config_dir_path }}/{{ matrix_server_fqn_matrix }}.signing.key"
-  register: matrix_synapse_signing_key_stat
-
 # We do this so that the signing key would get generated.
 #
 # This will also generate a default homeserver.yaml configuration file and a log configuration file.
@@ -95,19 +91,20 @@
 # We don't use the `docker_container` module, because using it with `cap_drop` requires
 # a very recent docker-py version, which is not available for a lot of people yet.
 - name: Generate initial Synapse config and signing key
-  ansible.builtin.command: |
-    docker run
-    --rm
-    --name=matrix-config
-    --user={{ matrix_synapse_uid }}:{{ matrix_synapse_gid }}
-    --cap-drop=ALL
-    --mount type=bind,src={{ matrix_synapse_config_dir_path }},dst=/data
-    -e SYNAPSE_CONFIG_PATH=/data/homeserver.yaml
-    -e SYNAPSE_SERVER_NAME={{ matrix_server_fqn_matrix }}
-    -e SYNAPSE_REPORT_STATS=no
-    {{ matrix_synapse_docker_image }}
-    generate
-  when: "not matrix_synapse_signing_key_stat.stat.exists"
+  ansible.builtin.command:
+    cmd: |
+      docker run
+      --rm
+      --name=matrix-config
+      --user={{ matrix_synapse_uid }}:{{ matrix_synapse_gid }}
+      --cap-drop=ALL
+      --mount type=bind,src={{ matrix_synapse_config_dir_path }},dst=/data
+      -e SYNAPSE_CONFIG_PATH=/data/homeserver.yaml
+      -e SYNAPSE_SERVER_NAME={{ matrix_server_fqn_matrix }}
+      -e SYNAPSE_REPORT_STATS=no
+      {{ matrix_synapse_docker_image }}
+      generate
+    creates: "{{ matrix_synapse_config_dir_path }}/{{ matrix_server_fqn_matrix }}.signing.key"
 
 - name: Ensure Synapse homeserver config installed
   ansible.builtin.copy:
diff --git a/roles/custom/matrix-user-creator/tasks/main.yml b/roles/custom/matrix-user-creator/tasks/main.yml
index 2198b3ebf..ff93a4633 100644
--- a/roles/custom/matrix-user-creator/tasks/main.yml
+++ b/roles/custom/matrix-user-creator/tasks/main.yml
@@ -1,10 +1,10 @@
 ---
 
-- block:
-    - when: matrix_user_creator_users | length > 0
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup.yml"
-  tags:
+- tags:
     # This role intentionally doesn't do work on a `setup-all` tag.
     # If it did, the initial installation (`--tags=setup-all`) would also potentially polute the database with data,
     # which would make importing a database dump problematic.
     - ensure-matrix-users-created
+  block:
+    - when: matrix_user_creator_users | length > 0
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup.yml"
diff --git a/roles/custom/matrix-user-verification-service/tasks/main.yml b/roles/custom/matrix-user-verification-service/tasks/main.yml
index 6eaaaf232..1b65f86a6 100644
--- a/roles/custom/matrix-user-verification-service/tasks/main.yml
+++ b/roles/custom/matrix-user-verification-service/tasks/main.yml
@@ -1,19 +1,19 @@
 ---
 
-- block:
-    - when: run_setup | bool and matrix_user_verification_service_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
-    - when: run_setup | bool and matrix_user_verification_service_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+- tags:
     - setup-all
     - setup-user-verification-service
     - install-all
     - install-user-verification-service
+  block:
+    - when: run_setup | bool and matrix_user_verification_service_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
+    - when: run_setup | bool and matrix_user_verification_service_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
 
-- block:
-    - when: run_setup | bool and not matrix_user_verification_service_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
+- tags:
     - setup-all
     - setup-user-verification-service
+  block:
+    - when: run_setup | bool and not matrix_user_verification_service_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
diff --git a/roles/custom/matrix_playbook_migration/tasks/main.yml b/roles/custom/matrix_playbook_migration/tasks/main.yml
index 4a39e2c74..4dbd3554f 100644
--- a/roles/custom/matrix_playbook_migration/tasks/main.yml
+++ b/roles/custom/matrix_playbook_migration/tasks/main.yml
@@ -1,22 +1,22 @@
 ---
 
-- block:
+- tags:
+    - setup-all
+    - install-all
+  block:
     - ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
-  tags:
-    - setup-all
-    - install-all
 
-- block:
-    - ansible.builtin.include_tasks: "{{ role_path }}/tasks/cleanup_usr_local_bin.yml"
-  tags:
+- tags:
     - setup-all
     - install-all
+  block:
+    - ansible.builtin.include_tasks: "{{ role_path }}/tasks/cleanup_usr_local_bin.yml"
 
 - when: devture_traefik_enabled | bool
-  block:
-    - ansible.builtin.include_tasks: "{{ role_path }}/tasks/devture_traefik_to_matrix_traefik.yml"
   tags:
     - setup-all
     - install-all
     - setup-traefik
     - install-traefik
+  block:
+    - ansible.builtin.include_tasks: "{{ role_path }}/tasks/devture_traefik_to_matrix_traefik.yml"