diff --git a/.yamllint b/.yamllint
index 1a2efd9ea..3ac156d9a 100644
--- a/.yamllint
+++ b/.yamllint
@@ -14,7 +14,9 @@ rules:
   empty-lines:
     max: 1
     max-end: 2
-  indentation: disable
+  indentation:
+    level: error
+    indent-sequences: consistent
   new-line-at-end-of-file: disable
   line-length: disable
   truthy: false
diff --git a/playbooks/tox/pre-molecule.yaml b/playbooks/tox/pre-molecule.yaml
index b103291aa..bca2f7f73 100644
--- a/playbooks/tox/pre-molecule.yaml
+++ b/playbooks/tox/pre-molecule.yaml
@@ -1,27 +1,26 @@
 - hosts: all
   vars:
     tox_molecule_packages: "{{ _tox_molecule_packages | default([]) }}"
-  tasks:
-  - name: Gather variables for each operating system
-    include_vars: "{{ item }}"
-    with_first_found:
-      - skip: true
-        files:
-          - "molecule-vars/{{ ansible_distribution | lower }}-{{ ansible_distribution_version | lower }}.yaml"
-          - "molecule-vars/{{ ansible_distribution | lower }}-{{ ansible_distribution_major_version | lower }}.yaml"
-          - "molecule-vars/{{ ansible_os_family | lower }}-{{ ansible_distribution_major_version | lower }}.yaml"
-          - "molecule-vars/{{ ansible_distribution | lower }}.yaml"
-          - "molecule-vars/{{ ansible_os_family | lower }}-{{ ansible_distribution_version.split('.')[0] }}.yaml"
-          - "molecule-vars/{{ ansible_os_family | lower }}.yaml"
-    tags:
-      - always
-
-  - name: Install packages needed by molecule
-    become: true
-    package:
-      name: "{{ tox_molecule_packages }}"
-    when:
-      - (tox_molecule_packages | length) > 0
-
   roles:
     - role: ensure-docker
+  tasks:
+    - name: Gather variables for each operating system
+      include_vars: "{{ item }}"
+      with_first_found:
+        - skip: true
+          files:
+            - "molecule-vars/{{ ansible_distribution | lower }}-{{ ansible_distribution_version | lower }}.yaml"
+            - "molecule-vars/{{ ansible_distribution | lower }}-{{ ansible_distribution_major_version | lower }}.yaml"
+            - "molecule-vars/{{ ansible_os_family | lower }}-{{ ansible_distribution_major_version | lower }}.yaml"
+            - "molecule-vars/{{ ansible_distribution | lower }}.yaml"
+            - "molecule-vars/{{ ansible_os_family | lower }}-{{ ansible_distribution_version.split('.')[0] }}.yaml"
+            - "molecule-vars/{{ ansible_os_family | lower }}.yaml"
+      tags:
+        - always
+
+    - name: Install packages needed by molecule
+      become: true
+      package:
+        name: "{{ tox_molecule_packages }}"
+      when:
+        - (tox_molecule_packages | length) > 0
diff --git a/roles/ara-report/tasks/main.yaml b/roles/ara-report/tasks/main.yaml
index eea684422..8e5742d27 100644
--- a/roles/ara-report/tasks/main.yaml
+++ b/roles/ara-report/tasks/main.yaml
@@ -66,8 +66,8 @@
         data:
           zuul:
             artifacts:
-               - name: ARA report
-                 url: "{{ ara_report_path }}"
+              - name: ARA report
+                url: "{{ ara_report_path }}"
   rescue:
     - name: HTML generation rescue
       debug:
@@ -93,5 +93,5 @@
         data:
           zuul:
             artifacts:
-               - name: ARA report
-                 url: "{{ ara_report_path }}"
+              - name: ARA report
+                url: "{{ ara_report_path }}"
diff --git a/roles/build-docker-image/tasks/main.yaml b/roles/build-docker-image/tasks/main.yaml
index dfd091c1e..d64a949af 100644
--- a/roles/build-docker-image/tasks/main.yaml
+++ b/roles/build-docker-image/tasks/main.yaml
@@ -65,7 +65,7 @@
     - name: Assert buildset registry is defined for buildx
       assert:
         that:
-           - buildset_registry is defined
+          - buildset_registry is defined
         fail_msg: "Building multi-arch images requires a buildset registry"
 
     - name: Set up buildx builders
diff --git a/roles/configure-mirrors/tasks/mirror/Suse.yaml b/roles/configure-mirrors/tasks/mirror/Suse.yaml
index 19252d52c..df6e400bf 100644
--- a/roles/configure-mirrors/tasks/mirror/Suse.yaml
+++ b/roles/configure-mirrors/tasks/mirror/Suse.yaml
@@ -1,11 +1,11 @@
 - name: set zypper base package repository (openSUSE Leap)
   set_fact:
-      opensuse_repo_baseurl: "{{ package_mirror }}/distribution/leap/$releasever/repo/oss/"
+    opensuse_repo_baseurl: "{{ package_mirror }}/distribution/leap/$releasever/repo/oss/"
   when: ansible_distribution is not search("Tumbleweed")
 
 - name: set zypper base package repository (openSUSE Tumbleweed)
   set_fact:
-      opensuse_repo_baseurl: "{{ package_mirror }}/tumbleweed/repo/oss/"
+    opensuse_repo_baseurl: "{{ package_mirror }}/tumbleweed/repo/oss/"
   when: ansible_distribution is search("Tumbleweed")
 
 - name: Install Suse repository files
diff --git a/roles/fetch-subunit-output/tasks/find-subunit-html.yaml b/roles/fetch-subunit-output/tasks/find-subunit-html.yaml
index 8fd36df2c..e2de203b3 100644
--- a/roles/fetch-subunit-output/tasks/find-subunit-html.yaml
+++ b/roles/fetch-subunit-output/tasks/find-subunit-html.yaml
@@ -8,7 +8,7 @@
     - find_subunit2html_output.rc == 0
     - find_subunit2html_output.stdout_lines
   set_fact:
-   subunit_html_command: "{{ find_subunit2html_output.stdout_lines[0] }}"
+    subunit_html_command: "{{ find_subunit2html_output.stdout_lines[0] }}"
 
 - name: Emit a debug line so we can search logstash for fallback hits
   debug:
diff --git a/roles/persistent-firewall/tasks/main.yaml b/roles/persistent-firewall/tasks/main.yaml
index 26d1354e9..c01201582 100644
--- a/roles/persistent-firewall/tasks/main.yaml
+++ b/roles/persistent-firewall/tasks/main.yaml
@@ -6,7 +6,7 @@
   failed_when: false
   register: iptables_rules
   tags:
-   - skip_ansible_lint
+    - skip_ansible_lint
 
 - name: List current ipv6 rules
   become: yes
@@ -16,7 +16,7 @@
   failed_when: false
   register: ip6tables_rules
   tags:
-   - skip_ansible_lint
+    - skip_ansible_lint
 
 - name: Configure persistent iptables rules
   include: "{{ zj_distro_os }}"
diff --git a/roles/stage-output/tasks/main.yaml b/roles/stage-output/tasks/main.yaml
index 8a8f6a1c5..5bd2df061 100644
--- a/roles/stage-output/tasks/main.yaml
+++ b/roles/stage-output/tasks/main.yaml
@@ -96,7 +96,7 @@
   args:
     chdir: "{{ stage_dir }}/logs"
   tags:
-   - skip_ansible_lint
+    - skip_ansible_lint
 
 - block:
     - name: Discover log files for compression
@@ -119,6 +119,6 @@
       loop_control:
         loop_var: zj_log_file
       tags:
-       - skip_ansible_lint
+        - skip_ansible_lint
   when:
     - stage_compress_logs
diff --git a/test-playbooks/base-roles/fetch-subunit-output.yaml b/test-playbooks/base-roles/fetch-subunit-output.yaml
index 26fea931a..0f1665420 100644
--- a/test-playbooks/base-roles/fetch-subunit-output.yaml
+++ b/test-playbooks/base-roles/fetch-subunit-output.yaml
@@ -16,11 +16,11 @@
     # to cover the find-*.sh scripts in the role a bit more.
     - name: Install stestr and subunit-output
       pip:
-         name:
-           - stestr>=2.0.0,<2.6.0
-           - python-subunit
-         virtualenv: "{{ zuul_work_dir }}/.tox/utests/"
-         virtualenv_command: '{{ ensure_pip_virtualenv_command }}'
+        name:
+          - stestr>=2.0.0,<2.6.0
+          - python-subunit
+        virtualenv: "{{ zuul_work_dir }}/.tox/utests/"
+        virtualenv_command: '{{ ensure_pip_virtualenv_command }}'
 
     - name: Ensure that the test directories exists
       file:
diff --git a/zuul.d/python-jobs.yaml b/zuul.d/python-jobs.yaml
index c868fe524..d78b0e926 100644
--- a/zuul.d/python-jobs.yaml
+++ b/zuul.d/python-jobs.yaml
@@ -125,11 +125,11 @@
       bindep_profile: compile doc
     run: playbooks/tox/run.yaml
     pre-run:
-        - playbooks/tox-docs/pre.yaml
-        - playbooks/tox/pre.yaml
+      - playbooks/tox-docs/pre.yaml
+      - playbooks/tox/pre.yaml
     post-run:
-        - playbooks/tox/docs-post.yaml
-        - playbooks/tox/post.yaml
+      - playbooks/tox/docs-post.yaml
+      - playbooks/tox/post.yaml
     success-url: docs/
 
 - job: