style: add missing blank lines before bulleted lists in READMEs

markuslf · markuslf · commit 635dcbe1ecb1 · 2026-04-08T09:24:20.000+02:00
diff --git a/README.md b/README.md
@@ -31,19 +31,26 @@ LFOps is a comprehensive Ansible Collection providing 145+ playbooks and 160+ ro
 
 * [Requirements](#requirements)
 * [Installation](#installation)
+
     * [Using ansible-galaxy](#using-ansible-galaxy)
     * [Development Setup](#development-setup)
+
 * [Mitogen](#mitogen)
+
     * [Mitogen with ansible-playbook](#mitogen-with-ansible-playbook)
     * [Mitogen with ansible-navigator](#mitogen-with-ansible-navigator)
     * [Mitogen Compatibility](#mitogen-compatibility)
+
 * [Using ansible-navigator](#using-ansible-navigator)
 * [Usage](#usage)
+
     * [Running a Playbook](#running-a-playbook)
     * [Typical Workflow Example](#typical-workflow-example)
     * [The "all" Playbook](#the-all-playbook)
     * [Skipping Roles in a Playbook](#skipping-roles-in-a-playbook)
+
 * [Configuration](#configuration)
+
     * [Recommended ansible.cfg](#recommended-ansiblecfg)
     * [LFOps-wide Variables](#lfops-wide-variables)
     * [Bitwarden Integration](#bitwarden-integration)
diff --git a/roles/apache_httpd/README.md b/roles/apache_httpd/README.md
@@ -489,6 +489,7 @@ Types of vHosts:
 
 * **app**: A hardened vHost running an application like Nextcloud, Wordpress etc. with the most common options. Can be extended by using the `raw` variable.
 * **localhost**: A hardened, pre-defined VirtualHost just listening on https://localhost, and only accessible from localhost. Due to its naming, it is the first defined vHost. Can be extended by using the `raw` variable. The following URLs are pre-configured and only accessible from localhost:
+
     * `/fpm-ping` - PHP-FPM health check
     * `/fpm-status` - PHP-FPM status page
     * `/monitoring.php` - Linuxfabrik monitoring endpoint
@@ -533,8 +534,11 @@ This role creates a vHost named `localhost` by default. See [defaults/main.yml](
 
 * Restrict allowed [HTTP methods](https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods). Only the explicitly listed ones are allowed; all others return [405 Method Not Allowed](https://en.wikipedia.org/wiki/List_of_HTTP_status_codes). This does not disable TRACE. Always enable GET and OPTIONS at least. For an OPTIONS request, Apache always returns `Allow: GET,POST,OPTIONS,HEAD`, no matter what. We are NOT using [LimitExcept](https://httpd.apache.org/docs/2.4/mod/core.html#limitexcept), because this directive is not allowed in a VirtualHost context. Use `skip_allowed_http_methods` to allow all HTTP methods.
 * Available HTTP methods:
+
     * CONNECT, DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
+
 * Available WebDAV methods:
+
     * COPY, LOCK, MKCOL, MOVE, PROPFIND, PROPPATCH, UNLOCK
 * Type: List.
 * Default: app/localhost/proxy `['GET', 'OPTIONS']`
diff --git a/roles/apache_tomcat/README.md b/roles/apache_tomcat/README.md
@@ -233,6 +233,7 @@ WARN org.hibernate.engine.jdbc.internal.JdbcServicesImpl:169 - HHH000342: Could
 The last packet sent successfully to the server was 0 milliseconds ago. The driver has not received any packets from the server.
 Caused by: org.hibernate.HibernateException: Connection cannot be null when 'hibernate.dialect' not set
 ```
+
 * `chown -R root:tomcat /var/lib/tomcat/webapps/`?
 * Database Credentials correct?
 * Connection string correct? Example: `jdbc:mysql://localhost/linuxfabrik?createDatabaseIfNotExist=true&useEncoding=true&characterEncoding=UTF-8`
diff --git a/roles/elastic_agent_fleet_server/README.md b/roles/elastic_agent_fleet_server/README.md
@@ -73,6 +73,7 @@ EOF
 ```
 
 Copy the generated certificates to the Ansible inventory. The certificates are used for:
+
 * `elastic_agent_fleet_server__elasticsearch_ca` - The CA certificate (same as Elasticsearch CA)
 * `elastic_agent_fleet_server__ssl_cert` - The Fleet Server certificate
 * `elastic_agent_fleet_server__ssl_key` - The Fleet Server private key
diff --git a/roles/elasticsearch/README.md b/roles/elasticsearch/README.md
@@ -72,6 +72,7 @@ Note that a fully unattended cluster setup is not possible with Elasticsearch. T
 The following steps are marked as **manual** or **automated** accordingly.
 
 All cluster nodes must:
+
 * Have the same `elasticsearch__cluster_name__*_var` configured
 * Be able to communicate with each other (configure `elasticsearch__network_host` to be accessible from other nodes, e.g., `0.0.0.0` or a specific IP)
 * Have `elasticsearch__discovery_seed_hosts` set to the list of all cluster nodes from the start
diff --git a/roles/example/README.md b/roles/example/README.md
@@ -92,6 +92,7 @@ example__version: '3.2.1'
 * Type: List of dictionaries.
 * Default: `[]`
 * Subkeys:
+
     * `name`: Mandatory, string. Username.
     * `comment`: Optional, string. User description.
     * `group`: Optional, string. Primary group.
diff --git a/roles/icingadb/README.md b/roles/icingadb/README.md
@@ -10,6 +10,7 @@ When running the `icingadb:migration` tag, the role tries to prepare the configu
 Also have a look at https://icinga.com/docs/icinga-db-web/latest/doc/10-Migration/ for other migration steps.
 
 Notes on high availability / Icinga2 Master clusters:
+
 * Redis: "Each of the master nodes must have the Icinga DB feature enabled and have their own dedicated Redis server set up for it."
 * SQL database: "Icinga DB instances must write to the same database, which of course can be replicated or a cluster."
 * Environment ID: Make sure that `/var/lib/icinga2/icingadb.env` is the same on all master nodes.
diff --git a/roles/mongodb/README.md b/roles/mongodb/README.md
@@ -110,6 +110,7 @@ mongodb__repl_set_skip_init: false
 Important: When setting up a replica set across members, make sure that there is no data being written on any member until all members have joined the replica set. Else you need to [manually prepare the data files](https://www.mongodb.com/docs/manual/tutorial/expand-replica-set/#data-files) on the to-be-added secondary before joining.
 
 To setup a replica set from scratch:
+
 * Choose a name via the `mongodb__conf_replication_repl_set_name__*_var` (needs to be the same for all members).
 * Make sure that the cluster members can reach each other by setting `mongodb__conf_net_bind_ip` accordingly.
 * For production use, also make sure that `mongodb__conf_security_authorization` is enabled and `mongodb__keyfile_content` is set for all members.
diff --git a/roles/nextcloud/README.md b/roles/nextcloud/README.md
@@ -1,6 +1,7 @@
 # Ansible Role linuxfabrik.lfops.nextcloud
 
 This role installs Nextcloud including the tools needed by the most popular business plugins and [notify_push](https://github.com/nextcloud/notify_push). By default, the latest available version is installed. You can choose wether to use
+
 * local block storage (default)
 * S3 object storage backend (by providing `nextcloud__storage_backend_s3`)
 * Swift object storage backend (by providing `nextcloud__storage_backend_swift`)
diff --git a/roles/opensearch/README.md b/roles/opensearch/README.md
@@ -5,10 +5,12 @@ This role installs and configures OpenSearch, either as a single-node instance o
 Note that this role does NOT let you specify a particular OpenSearch version. It simply installs the latest available OpenSearch version from the repos configured in the system. If you want or need to install a specific version, use the `opensearch__version__host_var` / `opensearch__version__group_var` variables.
 
 Supported versions:
+
 * 1.x
 * 2.x
 
 Hints for configuring TLS:
+
 * The admin certificate must not be the same as a node certificate. Using the same certificate results in: `Seems you use a node certificate. This is not permitted, you have to use a client certificate and register it as admin_dn in opensearch.yml`
 * Node certificates must either have `extendedKeyUsage = serverAuth, clientAuth` (`TLS Web Server Authentication`, `TLS Web Client Authentication`, respectively) set, or no `Extended Key Usage` at all. Otherwise `securityadmin.sh` fails with: `ERR: An unexpected SSLHandshakeException occured: Received fatal alert: certificate_unknown`
 
@@ -86,6 +88,7 @@ curl 'https://localhost:9200' --user admin:your-password --insecure
 This role supports creating a multi-node OpenSearch cluster using manual certificate distribution. TLS certificates are generated beforehand and distributed to all nodes via Ansible. The security plugin is configured with the certificate distinguished names of all cluster members.
 
 All cluster nodes must:
+
 * Have the same `opensearch__cluster_name__*_var` configured
 * Be able to communicate with each other (configure `opensearch__network_host` accordingly, e.g., `0.0.0.0` or a specific IP)
 * Have `opensearch__discovery_seed_hosts` set to the list of all cluster nodes from the start
