logic changed

roles/bastionhost/tasks/system_setup/aide_update.yml

@@ -0,0 +1,19 @@
+---
+- name: system setup | aide | run aide --update to check for legitimate changes
+  tags: aide,hardening,system
+  command: aide --config /etc/aide/aide.conf --update
+  register: aide_update_result
+  changed_when: "'new database written to' in aide_update_result.stdout"
+  async: 1800 # Allow up to 30 minutes for update
+  poll: 15
+
+- name: system setup | aide | activate updated database
+  tags: aide,hardening,system
+  copy:
+    src: /var/lib/aide/aide.db.new
+    dest: /var/lib/aide/aide.db
+    remote_src: true
+    owner: root
+    group: root
+    mode: '0600'
+  when: aide_update_result.changed

roles/bastionhost/tasks/system_setup/package_hardening.yml

@@ -23,7 +23,7 @@
       - fortune-mod
     state: absent
     purge: true # Also removes configuration files
-  notify: Update_aide_database
+  register: deb_packages_removed
   when: ansible_os_family == "Debian"
 
 - name: system setup | package hardening | remove unnecessary packages (RedHat family)
@@ -40,5 +40,10 @@
       - avahi
       - sudo
     state: absent
-  notify: Update_aide_database
-  when: ansible_os_family == "RedHat"
+  register: rh_packages_removed
+  when: ansible_os_family == "RedHat"
+
+- name: Set fact if packages were removed
+  set_fact:
+    aide_db_needs_update: true
+  when: (deb_packages_removed is defined and deb_packages_removed.changed) or (rh_packages_removed is defined and rh_packages_removed.changed)