Base: Make the SElinux module compilation reusable

THis moves the SELinux "handler" in roles/base to a global
task file, which allows it to be reused by other roles.

Eventually this should probably be a native Ansible type,
but this is still an improvment.

Signed-off-by: Greg Sutcliffe <fedora@emeraldreverie.org>

roles/base/handlers/main.yml

@@ -34,21 +34,3 @@
   service: name=libvirtd state=reloaded
   ignore_errors: true
   when: ansible_virtualization_role == 'host'
-
-# This could be made more generic eventually ...
-- name: Compile Postfix/Zabbix SELinux module
-  ansible.builtin.shell: |
-    cd /usr/local/share/zabbix
-    checkmodule -M -m -o zabbix_sendmail.mod zabbix_sendmail.te
-    semodule_package -o zabbix_sendmail.pp -m zabbix_sendmail.mod
-  listen: "compile selinux module"
-
-- name: Install Postfix/Zabbix SELinux module
-  ansible.builtin.command: semodule -i /usr/local/share/zabbix/zabbix_sendmail.pp
-  listen: "install selinux module"
-
-- name: Cleanup Postfix/Zabbix SELinux module buildfiles
-  ansible.builtin.file:
-    path: /usr/local/share/zabbix/zabbix_sendmail.mod
-    state: absent
-  listen: "cleanup selinux build files"

roles/base/tasks/postfix-monitoring.yml

@@ -15,17 +15,25 @@
   - postfix
   - zabbix_agent
 
-- name: Copy PostfixZabbix selinux source file
+- name: Copy Postfix Zabbix SELinux module
   ansible.builtin.copy:
     src: postfix/zabbix-selinux.te
     dest: /usr/local/share/zabbix/zabbix_sendmail.te
     owner: root
     group: root
     mode: '0644'
-  notify:
-    - compile selinux module
-    - install selinux module
-    - cleanup selinux build files
+  register: selinux_zabbix_file
+  tags:
+  - selinux
+  - postfix
+  - zabbix_agent
+
+- name: Compile and install SELinux module
+  ansible.builtin.include_tasks: "{{ tasks_path }}/compile-selinux.yml"
+  vars:
+    selinux_module_dir: /usr/local/share/zabbix
+    selinux_module_name: zabbix_sendmail
+  when: selinux_zabbix_file.changed
   tags:
   - selinux
   - postfix

tasks/compile-selinux.yml

@@ -0,0 +1,20 @@
+# In tasks/selinux_module.yml (can be in a common/shared tasks directory)
+- name: Compile SELinux module
+  ansible.builtin.shell: |
+    cd {{ selinux_module_dir }}
+    checkmodule -M -m -o {{ selinux_module_name }}.mod {{ selinux_module_name }}.te
+    semodule_package -o {{ selinux_module_name }}.pp -m {{ selinux_module_name }}.mod
+  tags:
+    - selinux
+
+- name: Install SELinux module
+  ansible.builtin.command: semodule -i {{ selinux_module_dir }}/{{ selinux_module_name }}.pp
+  tags:
+    - selinux
+
+- name: Cleanup SELinux module build files
+  ansible.builtin.file:
+    path: "{{ selinux_module_dir }}/{{ selinux_module_name }}.mod"
+    state: absent
+  tags:
+    - selinux