fix(proxmox_lxc_provision): use literal module-name keys in module_defaults

The previous commit (d5cf6f6) used 'module_defaults: "{{ _proxmox_module_defaults }}"'
to template the entire defaults dict. Ansible rejects this because
module_defaults keys must be static action/module/group names at parse
time — only values may be templated.

Expose _proxmox_api_args as a flat dict of API parameters in
defaults/main.yml, and in each task file's module_defaults block use
the literal community.proxmox.proxmox and community.proxmox.proxmox_vm_info
keys with templated values pointing at the var.

roles/proxmox_lxc_provision/README.md

@@ -144,26 +144,17 @@ The role includes idempotency checking. If a container with the specified `lxc_v
 
 ### Using Standalone Tasks
 
-When using individual task files via `tasks_from`, you must set `module_defaults` at the play level since the tasks bypass the role's main entry point:
+Individual task files (`stop`, `start`, `delete`, `convert`, etc.) can be invoked via `tasks_from` directly — each task file wraps its work in a block with the role's shared `module_defaults`, so the Proxmox API connection is configured automatically as long as the `proxmox_*` connection variables are in scope (typically from `group_vars/all/`).
 
 ```yaml
 - name: Convert container to a template
   hosts: localhost
-  module_defaults:
-    community.proxmox.proxmox:
-      api_host: "{{ proxmox_api_host }}"
-      api_port: "{{ proxmox_api_port }}"
-      api_user: "{{ proxmox_api_user }}"
-      api_token_id: "{{ proxmox_api_token_id }}"
-      api_token_secret: "{{ proxmox_api_token_secret }}"
-      validate_certs: "{{ proxmox_api_validate_certs }}"
-      node: "{{ proxmox_node }}"
-  vars:
-    lxc_hostname: "{{ lxc_hostname }}"
   tasks:
     - include_role:
         name: proxmox_lxc_provision
         tasks_from: convert
+      vars:
+        lxc_hostname: my-container
 ```
 
 ### Creating an LXC Container and Converting it to a Template
@@ -185,19 +176,10 @@ When using individual task files via `tasks_from`, you must set `module_defaults
 
 - name: Convert the created container to a template
   hosts: localhost
-  module_defaults:
-    community.proxmox.proxmox:
-      api_host: "{{ proxmox_api_host }}"
-      api_port: "{{ proxmox_api_port }}"
-      api_user: "{{ proxmox_api_user }}"
-      api_token_id: "{{ proxmox_api_token_id }}"
-      api_token_secret: "{{ proxmox_api_token_secret }}"
-      validate_certs: "{{ proxmox_api_validate_certs }}"
-      node: "{{ proxmox_node }}"
-  vars:
-    lxc_hostname: "{{ lxc_hostname }}"
   tasks:
     - include_role:
         name: proxmox_lxc_provision
         tasks_from: convert
+      vars:
+        lxc_hostname: "{{ lxc_hostname }}"
 ```

roles/proxmox_lxc_provision/defaults/main.yml

@@ -5,6 +5,17 @@ proxmox_api_validate_certs: false
 # Host to delegate pct commands to (use inventory hostname for become_password to work)
 proxmox_delegate_host: "{{ proxmox_api_host }}"
 
+# Shared Proxmox API args referenced by each task file's module_defaults block.
+# Override the underlying proxmox_* vars (e.g. from group_vars/all/) to customize.
+_proxmox_api_args:
+  api_host: "{{ proxmox_api_host }}"
+  api_port: "{{ proxmox_api_port }}"
+  api_user: "{{ proxmox_api_user }}"
+  api_token_id: "{{ proxmox_api_token_id }}"
+  api_token_secret: "{{ proxmox_api_token_secret }}"
+  validate_certs: "{{ proxmox_api_validate_certs }}"
+  node: "{{ proxmox_node }}"
+
 # LXC defaults
 lxc_template: "local:vztmpl/debian-12-standard_12.12-1_amd64.tar.zst"
 lxc_cores: 4

roles/proxmox_lxc_provision/tasks/check-exists.yml

@@ -1,4 +1,9 @@
 ---
+- name: Check if LXC exists
+  module_defaults:
+    community.proxmox.proxmox: "{{ _proxmox_api_args }}"
+    community.proxmox.proxmox_vm_info: "{{ _proxmox_api_args }}"
+  block:
     - name: Query Proxmox for existing LXCs
       community.proxmox.proxmox_vm_info:
         type: lxc

roles/proxmox_lxc_provision/tasks/clone.yml

@@ -1,4 +1,9 @@
 ---
+- name: Clone LXC container
+  module_defaults:
+    community.proxmox.proxmox: "{{ _proxmox_api_args }}"
+    community.proxmox.proxmox_vm_info: "{{ _proxmox_api_args }}"
+  block:
     - name: Create a full clone of the container
       community.proxmox.proxmox:
         vmid: "{{ lxc_vmid | default(0) }}"

roles/proxmox_lxc_provision/tasks/convert.yml

@@ -1,4 +1,9 @@
 ---
+- name: Convert LXC container to template
+  module_defaults:
+    community.proxmox.proxmox: "{{ _proxmox_api_args }}"
+    community.proxmox.proxmox_vm_info: "{{ _proxmox_api_args }}"
+  block:
     - ansible.builtin.include_tasks: stop.yml
 
     - name: Convert container to template

roles/proxmox_lxc_provision/tasks/create.yml

@@ -1,4 +1,9 @@
 ---
+- name: Create LXC container
+  module_defaults:
+    community.proxmox.proxmox: "{{ _proxmox_api_args }}"
+    community.proxmox.proxmox_vm_info: "{{ _proxmox_api_args }}"
+  block:
     - name: Create an LXC container
       community.proxmox.proxmox:
         vmid: "{{ lxc_vmid | default(omit) }}"

roles/proxmox_lxc_provision/tasks/delete.yml

@@ -1,4 +1,9 @@
 ---
+- name: Delete LXC container
+  module_defaults:
+    community.proxmox.proxmox: "{{ _proxmox_api_args }}"
+    community.proxmox.proxmox_vm_info: "{{ _proxmox_api_args }}"
+  block:
     - ansible.builtin.include_tasks: stop.yml
 
     - name: Delete a container

roles/proxmox_lxc_provision/tasks/main.yml

@@ -1,16 +1,4 @@
 ---
-- name: Proxmox LXC provision
-  module_defaults:
-    community.proxmox.proxmox: &proxmox_defaults
-      api_host: "{{ proxmox_api_host }}"
-      api_port: "{{ proxmox_api_port }}"
-      api_user: "{{ proxmox_api_user }}"
-      api_token_id: "{{ proxmox_api_token_id }}"
-      api_token_secret: "{{ proxmox_api_token_secret }}"
-      validate_certs: "{{ proxmox_api_validate_certs }}"
-      node: "{{ proxmox_node }}"
-    community.proxmox.proxmox_vm_info: *proxmox_defaults
-  block:
 - name: Check if container exists
   ansible.builtin.include_tasks:
     file: check-exists.yml

roles/proxmox_lxc_provision/tasks/post-clone.yml

@@ -4,6 +4,7 @@
     name: root
     password: "{{ lxc_root_password | password_hash('sha512') }}"
     update_password: always
+  become: true
   when: lxc_root_password is defined
 
 - name: Change user password
@@ -11,6 +12,7 @@
     name: "{{ lxc_user_name }}"
     password: "{{ lxc_user_password | password_hash('sha512') }}"
     update_password: always
+  become: true
   when: lxc_user_password is defined
 
 - name: Regenerate SSH host keys
@@ -18,7 +20,7 @@
     name: system_setup
     tasks_from: ssh
   vars:
-    regenerate_ssh_keys: true
+    regenerate_ssh_host_keys: true
 
 - name: Remove previous entry from known hosts
   ansible.builtin.known_hosts:

roles/proxmox_lxc_provision/tasks/start.yml

@@ -1,4 +1,9 @@
 ---
+- name: Start LXC container
+  module_defaults:
+    community.proxmox.proxmox: "{{ _proxmox_api_args }}"
+    community.proxmox.proxmox_vm_info: "{{ _proxmox_api_args }}"
+  block:
     - name: Start the LXC container
       community.proxmox.proxmox:
         vmid: "{{ lxc_result.vmid }}"

roles/proxmox_lxc_provision/tasks/stop.yml

@@ -1,4 +1,9 @@
 ---
+- name: Stop LXC container
+  module_defaults:
+    community.proxmox.proxmox: "{{ _proxmox_api_args }}"
+    community.proxmox.proxmox_vm_info: "{{ _proxmox_api_args }}"
+  block:
     - name: Stop container if it is running
       community.proxmox.proxmox:
         vmid: "{{ lxc_vmid | default(omit) }}"

roles/proxmox_lxc_provision/tasks/update.yml

@@ -1,4 +1,9 @@
 ---
+- name: Update LXC container
+  module_defaults:
+    community.proxmox.proxmox: "{{ _proxmox_api_args }}"
+    community.proxmox.proxmox_vm_info: "{{ _proxmox_api_args }}"
+  block:
     - name: Update an LXC container
       community.proxmox.proxmox:
         vmid: "{{ lxc_vmid }}"

roles/system_setup/tasks/main.yml

@@ -5,10 +5,10 @@
     name: system_maintenance
 
 # Install extra packages
-- include_tasks: extra-packages.yaml
+- include_tasks: extra-packages.yml
 
 # Create a user admin account
-- include_tasks: user.yaml
+- include_tasks: user.yml
 
 # Harden SSH configuration
-- include_tasks: ssh.yaml
+- include_tasks: ssh.yml