Summary
roles/rdp-server/tasks/service.yml:154 restarts gnome-remote-desktop.service with state: restarted guarded only on distribution and has_gnome. There is no condition on whether any configuration actually changed.
- name: Restart RDP service to apply configuration
ansible.builtin.systemd:
name: gnome-remote-desktop.service
state: restarted
when:
- ansible_facts['distribution'] in ['Fedora', 'Ubuntu']
- has_gnomeImpact
Every --tags rdp-server run restarts the RDP daemon, which disconnects any active RDP session. Anyone administering the host over RDP -- the common case for a remote-desktop role -- loses their session on every run, including a run that changes nothing.
It also means the task reports changed on a fully converged host, so the role can never be idempotent under this tag.
Observed
Confirmed on Ubuntu 26.04, GNOME 50, gnome-remote-desktop 50.2. A --check --diff run against an already-converged host still reports this task as changed.
Suggested fix
Make it a handler notified by the tasks that genuinely require a daemon restart (credentials, TLS certificate, the priority drop-ins), rather than an unconditional task. A --check run would then also stop implying a disconnect that need not happen.
Summary
roles/rdp-server/tasks/service.yml:154restartsgnome-remote-desktop.servicewithstate: restartedguarded only on distribution andhas_gnome. There is no condition on whether any configuration actually changed.Impact
Every
--tags rdp-serverrun restarts the RDP daemon, which disconnects any active RDP session. Anyone administering the host over RDP -- the common case for a remote-desktop role -- loses their session on every run, including a run that changes nothing.It also means the task reports
changedon a fully converged host, so the role can never be idempotent under this tag.Observed
Confirmed on Ubuntu 26.04, GNOME 50,
gnome-remote-desktop50.2. A--check --diffrun against an already-converged host still reports this task aschanged.Suggested fix
Make it a handler notified by the tasks that genuinely require a daemon restart (credentials, TLS certificate, the priority drop-ins), rather than an unconditional task. A
--checkrun would then also stop implying a disconnect that need not happen.