run role: standardize inline scipt options

Author: andreashaerter

roles/run/handlers/main.yml

@@ -23,7 +23,9 @@
   #   prints every processed file but reports only when a change is made.
   ansible.builtin.shell:
     cmd: |
-      set -e
+      set -u # fail on unset vars
+      set -o pipefail # fail if any pipe cmd fails
+      set -e # exit on any error (incl. in if/while/tests)
 
       # Set ownership of files and directories: service user and group
       find \

roles/run/tasks/config/default.yml

@@ -19,6 +19,9 @@
   # https://github.com/acmesh-official/acme.sh/wiki/Options-and-Params
   ansible.builtin.shell:
     cmd: |
+      set -u # fail on unset vars
+      set -o pipefail # fail if any pipe cmd fails
+
       __run_acmesh_checksum_before="$({{ __run_acmesh_sha1sum_executable }} '{{ run_acmesh_cfg_config_home }}/account.conf')"
 
       if ! ./acme.sh \

roles/run/tasks/init.yml

@@ -107,6 +107,8 @@
   # - Security concerns are mitigated by strict path usage and input validation.
   ansible.builtin.shell:
     cmd: |
+      set -u # fail on unset vars
+      set -o pipefail # fail if any pipe cmd fails
       __run_acmesh_version_installed=""
       if command -v '{{ run_acmesh_cfg_home }}/acme.sh' > /dev/null 2>&1
       then

roles/run/tasks/setup/install/default.yml

@@ -258,6 +258,8 @@
   # - Security concerns are mitigated by strict path usage and input validation.
   ansible.builtin.shell:
     cmd: |
+      set -u # fail on unset vars
+      set -o pipefail # fail if any pipe cmd fails
       __run_acmesh_version_installed=''
       if command -v '{{ run_acmesh_cfg_home }}/acme.sh' > /dev/null 2>&1
       then