This is pretty badly done. Dear freddiearch, it&#x27;s ok if you know that it&#x27;s low-quality and no real effort has gone into it (as you yourself have said), but then please don&#x27;t post it on HN and waste everyone elses time.<p>Notes&#x2F;suggestions, in the interest of helping you get better at Ansible. I hope you find them helpful:<p>* It leaves your Apache bound on all interfaces, exposing where your files are really hosted. Security fail. (And because of the port conflict I doubt it even works in its current state.)<p>* It doesn&#x27;t even work, due to the double &quot;command&quot; in &quot;add keys&quot;. Only the second one will actually be run. (It&#x27;s obvious you never tested on a fresh system. Learn about Vagrant next. It also has super-easy ansible integration. That fits the scenario really well too. Wouldn&#x27;t that be awesome? &quot;vagrant up&quot; from any machine, wait a minute, and you have an .onion server in the Tor network?)<p>* Please spend 10 minutes and read the module list at <a href="https:&#x2F;&#x2F;docs.ansible.com&#x2F;ansible&#x2F;modules_by_category.html" rel="nofollow">https:&#x2F;&#x2F;docs.ansible.com&#x2F;ansible&#x2F;modules_by_category.html</a> completely and use them. If you have to use &quot;command&quot; tasks (seldom the case), at least implement &quot;changed_when&quot; and think about if you need &quot;when&quot; and &quot;failed_when&quot;. Also consider --check mode. You used command in cases where you could have used: apt, apt_repository, apt_key, service,<p>* Use the long key id in the --recv command too. The short will work even when there are conflicts, but it&#x27;ll leave the additional (probably malicious) key in your local keyring, which may or may not confuse you later.<p>* The apparmor restart should be done in a handler, conditionally the config actually being changed. It also should use the &quot;service&quot; task.<p>* &#x2F;home isn&#x27;t the right place. Read the Filesystem Hierarchy Standard. Put the directory somwhere under &#x2F;var or &#x2F;srv.<p>* Add some blank lines for readability.<p>* As it is, your play isn&#x27;t really reusable and not modular at all. It&#x27;s ok since your intention clearly was just to show how easy it was to get Tor running. But if you want you could still turn it into a role.<p>* &quot;state=directory owner=debian-tor mode=0700 recurse=yes&quot; isn&#x27;t really a good idea; it&#x27;ll make all files executable too.<p>Getting automation right (whether via ansible, puppet, or whatever) requires careful attention to detail.