Remove Ubuntu 18.04 support

roles/common/tasks/firewall_Ubuntu.yml

@@ -1,18 +1,7 @@
 ---
 # Ubuntu 20.04 will use nftables directly, with no firewalld.
-# Ubuntu 18.04 will use firewalld with the nftables backend.
-# Ubuntu 16.04 will use firewalld with the iptables backend.
 
 - block:
-  - name: Set Ubuntu firewall packages
-    when: ansible_distribution_version is version('20.04', '<')
-    ansible.builtin.set_fact:
-      ubuntu_firewall_packages:
-        - firewalld
-        - tidy
-        - fail2ban
-        - python3-systemd # for fail2ban systemd backend
-
   - name: Set Ubuntu firewall packages
     when: ansible_distribution_version is version('20.04', '>=')
     ansible.builtin.set_fact:
@@ -54,41 +43,6 @@
       - restart nftables
       - restart fail2ban
 
-  - name: Copy firewalld public zone file
-    when: ansible_distribution_version is version('18.04', '<=')
-    ansible.builtin.template: src=public.xml.j2 dest=/etc/firewalld/zones/public.xml owner=root mode=0600
-
-  - name: Format public.xml firewalld zone file
-    when: ansible_distribution_version is version('18.04', '<=')
-    command: tidy -xml -iq -m -w 0 /etc/firewalld/zones/public.xml
-    notify:
-      - restart firewalld
-      - restart fail2ban
-
-  - name: Copy firewalld ipsets of abusive IPs
-    when: ansible_distribution_version is version('18.04', '<=')
-    ansible.builtin.copy: src={{ item }} dest=/etc/firewalld/ipsets/{{ item }} owner=root group=root mode=0600
-    loop:
-      - abusers-ipv4.xml
-      - abusers-ipv6.xml
-      - spamhaus-ipv4.xml
-      - spamhaus-ipv6.xml
-    notify:
-      - restart firewalld
-      - restart fail2ban
-
-  - name: Copy Spamhaus firewalld update script
-    when: ansible_distribution_version is version('18.04', '<=')
-    ansible.builtin.copy: src=update-spamhaus-lists.sh dest=/usr/local/bin/update-spamhaus-lists.sh mode=0755 owner=root group=root
-
-  - name: Copy Spamhaus firewalld systemd units
-    when: ansible_distribution_version is version('18.04', '<=')
-    ansible.builtin.copy: src={{ item }} dest=/etc/systemd/system/{{ item }} mode=0644 owner=root group=root
-    loop:
-        - update-spamhaus-lists.service
-        - update-spamhaus-lists.timer
-    register: spamhaus_firewalld_systemd_units
-
   - name: Copy nftables update scripts
     when: ansible_distribution_version is version('20.04', '>=')
     ansible.builtin.copy: src={{ item }} dest=/usr/local/bin/{{ item }} mode=0755 owner=root group=root
@@ -110,15 +64,7 @@
   # need to reload to pick up service/timer/environment changes
   - name: Reload systemd daemon
     ansible.builtin.systemd: daemon_reload=true
-    when: spamhaus_firewalld_systemd_units is changed or
-          nftables_systemd_units is changed
-
-  - name: Start and enable Spamhaus firewalld update timer
-    when: ansible_distribution_version is version('18.04', '<=')
-    ansible.builtin.systemd: name=update-spamhaus-lists.timer state=started enabled=true
-    notify:
-      - restart firewalld
-      - restart fail2ban
+    when: nftables_systemd_units is changed
 
   - name: Start and enable nftables update timers
     when: ansible_distribution_version is version('20.04', '>=')

roles/common/tasks/main.yml

@@ -39,12 +39,6 @@
     - reload sysctl
   tags: sysctl
 
-- name: Reconfigure /etc/rc.local
-  when:
-    - ansible_distribution == 'Ubuntu'
-    - ansible_distribution_version is version('19.04', '<=')
-  ansible.builtin.template: src=rc.local_Ubuntu.j2 dest=/etc/rc.local owner=root group=root mode=0755
-
 - name: Set I/O scheduler
   ansible.builtin.template: src=etc/udev/rules.d/60-scheduler.rules.j2 dest=/etc/udev/rules.d/60-scheduler.rules owner=root group=root mode=0644
   tags: udev

roles/common/tasks/packages_Ubuntu.yml

@@ -50,22 +50,6 @@
       when: ansible_distribution_version is version('20.04', '==')
       ignore_errors: true
 
-    - name: Set fact for packages to remove (Ubuntu <= 18.04)
-      ansible.builtin.set_fact:
-        ubuntu_annoying_packages:
-          - whoopsie # security (CIS 4.1)
-          - apport   # security (CIS 4.1)
-          - command-not-found # annoying
-          - command-not-found-data # annoying
-          - python3-commandnotfound # annoying
-          - snapd # annoying (Ubuntu >= 16.04)
-          - lxd # annoying (Ubuntu >= 16.04)
-          - lxd-client # annoying (Ubuntu >= 16.04)
-          - liblxc1 # annoying (Ubuntu >= 16.04)
-          - lxc-common # annoying (Ubuntu >= 16.04)
-          - lxcfs #annoying (Ubuntu >= 16.04)
-      when: ansible_distribution_version is version('18.04', '<=')
-
     - name: Set fact for packages to remove (Ubuntu 20.04)
       ansible.builtin.set_fact:
         ubuntu_annoying_packages: