---
# zz-compare-sysctl.yaml
- name: Check sysctl values against /proc/sys
  hosts: all
  gather_facts: false            # <- truthy fix
  vars:
    required:
      vm.dirty_ratio: 30
      vm.dirty_background_ratio: 10
      vm.swappiness: 1
      vm.force_cgroup_v2_swappiness: 1
      net.core.somaxconn: 4096
      net.ipv6.ip_nonlocal_bind: 1

  tasks:
    - name: Slurp current value from /proc/sys
      ansible.builtin.slurp:
        src: "/proc/sys/{{ item.key | replace('.', '/') }}"
      register: proc_vals
      loop: "{{ required | dict2items }}"

    - name: Build dictionary of live values
      ansible.builtin.set_fact:
        live: "{{ live | default({}) | combine({item.item.key: (item.content | b64decode).strip()}) }}"
      loop: "{{ proc_vals.results }}"

    - name: Show mismatches (if any)
      ansible.builtin.debug:
        msg: "{{ item.key }}  live={{ live[item.key] }}  required={{ item.value }}"
      loop: "{{ required | dict2items }}"
      when: live[item.key] != item.value | string
      register: mismatches

    - name: Mark play CHANGED when any value differs
      ansible.builtin.debug:
        msg: One or more sysctl values differ
      changed_when: true
      when: mismatches.results | selectattr('msg', 'defined') | length > 0