Validating generated config files in Ansible

I always forget where it goes, but it's just a validate attribute on ansible.builtin.template and ansible.builtin.copy.

- name: Copy in config file
  ansible.builtin.template:
    src: "knot.conf.j2"
    dest: "/etc/knot/knot.conf"
    owner: "root"
    group: "knot"
    mode: '0640'
    validate: "knotc -v -c '%s' conf-check"
  notify: "knot : restart"

Note that this will get passed the temporary path to the file that Ansible creates before moving it in to place, so you must use %s in the command to check the temporary file. If you don't, you'll get the wonderful bug I caused, where every check always passes and then the service immediately blows up on restart.