ansible/nis
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add deb822 repository configuration for Debian backports and security updates

Browse Source
This commit is contained in:
Christoph
2026-07-14 10:45:17 +02:00
parent 5b66e83dc4
commit 2a50cca686
4 changed files with 182 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
roles/common/tasks/apt.yml
+150 -30
View File
@@ -1,4 +1,13 @@
---
- name: (apt.yml) Delete Hetzner files 'hetzner-mirror.list' and 'hetzner-security-updates.list'
file:
path: "{{ item }}"
state: absent
with_items:
- /etc/apt/sources.list.d/hetzner-mirror.list
- /etc/apt/sources.list.d/hetzner-security-updates.list
tags:
- apt-configuration
- name: (apt.yml) update configuration file - /etc/apt/sources.list
template:
@@ -9,12 +18,143 @@
mode: 0644
register: apt_config_updated
when:
- ansible_facts['distribution'] == "Debian"
- apt_manage_sources_list|bool
- ansible_facts['distribution'] == 'Debian'
- (ansible_facts['distribution_major_version'] | int) < 13
tags:
- apt-configuration
- name: (apt.yml) Ensure Debian archive keyring is present for deb822 Signed-By (Debian >= 13)
apt:
name: debian-archive-keyring
state: present
when:
- apt_manage_sources_list|bool
- ansible_facts['distribution'] == 'Debian'
- (ansible_facts['distribution_major_version'] | int) >= 13
- apt_deb822_use_signed_by | default(true) | bool
tags:
- apt-configuration
- name: (apt.yml) backup legacy /etc/apt/sources.list before deb822 migration (Debian >= 13)
copy:
src: /etc/apt/sources.list
dest: /etc/apt/sources.list.before-deb822
remote_src: true
force: false
owner: root
group: root
mode: "0644"
when:
- apt_manage_sources_list|bool
- ansible_facts['distribution'] == 'Debian'
- (ansible_facts['distribution_major_version'] | int) >= 13
failed_when:
- apt_sources_list_backup.failed
- "'No such file or directory' not in (apt_sources_list_backup.msg | default(''))"
register: apt_sources_list_backup
tags:
- apt-configuration
- name: (apt.yml) replace /etc/apt/sources.list with deb822 notice (Debian >= 13)
copy:
dest: /etc/apt/sources.list
content: |
# {{ ansible_managed }}
#
# Verwaltet via Ansible. Repositories liegen in /etc/apt/sources.list.d/*.sources (deb822).
# Zielrelease: {{ ansible_facts['distribution_release'] }}
owner: root
group: root
mode: "0644"
register: apt_config_updated_sources_list
when:
- apt_manage_sources_list|bool
- ansible_facts['distribution'] == 'Debian'
- (ansible_facts['distribution_major_version'] | int) >= 13
tags:
- apt-configuration
- name: (apt.yml) configure deb822 Debian repository (Debian >= 13)
template:
src: "etc/apt/deb822/debian.sources.j2"
dest: /etc/apt/sources.list.d/debian.sources
owner: root
group: root
mode: "0644"
register: apt_config_updated_debian_sources
when:
- apt_manage_sources_list|bool
- ansible_facts['distribution'] == 'Debian'
- (ansible_facts['distribution_major_version'] | int) >= 13
tags:
- apt-configuration
- name: (apt.yml) configure deb822 security repository (Debian >= 13)
template:
src: "etc/apt/deb822/security.sources.j2"
dest: /etc/apt/sources.list.d/security.sources
owner: root
group: root
mode: "0644"
register: apt_config_updated_security_sources
when:
- apt_manage_sources_list|bool
- ansible_facts['distribution'] == 'Debian'
- (ansible_facts['distribution_major_version'] | int) >= 13
tags:
- apt-configuration
- name: (apt.yml) configure deb822 backports repository (Debian >= 13)
template:
src: "etc/apt/deb822/backports.sources.j2"
dest: /etc/apt/sources.list.d/backports.sources
owner: root
group: root
mode: "0644"
register: apt_config_updated_backports_sources
when:
- apt_manage_sources_list|bool
- ansible_facts['distribution'] == 'Debian'
- (ansible_facts['distribution_major_version'] | int) >= 13
- apt_backports_enable | default(false) | bool
tags:
- apt-configuration
# If 'backports' was enabled in a previous run but is now disabled.
#
- name: (apt.yml) remove deb822 backports repository when disabled (Debian >= 13)
file:
path: /etc/apt/sources.list.d/backports.sources
state: absent
register: apt_config_removed_backports_sources
when:
- apt_manage_sources_list|bool
- ansible_facts['distribution'] == 'Debian'
- (ansible_facts['distribution_major_version'] | int) >= 13
- not (apt_backports_enable | default(false) | bool)
tags:
- apt-configuration
# Collect change states from all Debian >=13 deb822 source tasks so apt update
# can force a fresh cache refresh when repository files changed.
- name: (apt.yml) aggregate deb822 source changes (Debian >= 13)
set_fact:
apt_config_updated:
changed: >-
{{
(apt_config_updated_sources_list.changed | default(false))
or (apt_config_updated_debian_sources.changed | default(false))
or (apt_config_updated_security_sources.changed | default(false))
or (apt_config_updated_backports_sources.changed | default(false))
or (apt_config_removed_backports_sources.changed | default(false))
}}
when:
- apt_manage_sources_list|bool
- ansible_facts['distribution'] == 'Debian'
- (ansible_facts['distribution_major_version'] | int) >= 13
tags:
- apt-configuration
- name: (apt.yml) apt update
apt:
@@ -30,7 +170,6 @@
- apt-compiler-pkgs
- apt-webserver-pkgs
- name: (apt.yml) Configure any half-installed packages 'dpkg --configure -a'
ansible.builtin.command: dpkg --configure -a
register: _dpkg_configure
@@ -44,7 +183,6 @@
- apt-compiler-pkgs
- apt-webserver-pkgs
- name: (apt.yml) apt upgrade
apt:
upgrade: "{{ apt_upgrade_type }}"
@@ -58,7 +196,6 @@
- apt-compiler-pkgs
- apt-webserver-pkgs
- name: (apt.yml) Initial install debian packages (stretch)
apt:
name: "{{ apt_initial_install_stretch }}"
@@ -70,7 +207,6 @@
tags:
- apt-initial-install
- name: (apt.yml) Initial install debian packages (buster)
apt:
name: "{{ apt_initial_install_buster }}"
@@ -82,7 +218,6 @@
tags:
- apt-initial-install
- name: (apt.yml) Initial install debian packages (bullseye)
apt:
name: "{{ apt_initial_install_bullseye }}"
@@ -94,7 +229,6 @@
tags:
- apt-initial-install
- name: (apt.yml) Initial install debian packages (bookworm)
apt:
name: "{{ apt_initial_install_bookworm }}"
@@ -106,7 +240,6 @@
tags:
- apt-initial-install
- name: (apt.yml) Initial install debian packages (trixie)
apt:
name: "{{ apt_initial_install_trixie }}"
@@ -118,7 +251,6 @@
tags:
- apt-initial-install
- name: (apt.yml) Initial install ubuntu packages (bionic)
apt:
name: "{{ apt_initial_install_bionic }}"
@@ -159,7 +291,6 @@
tags:
- apt-initial-install
# ---
# Microcode
# ---
@@ -178,7 +309,6 @@
- apt-initial-install
- apt-microcode
- name: (apt.yml) Install CPU microcode (debian buster/bullseye/bookworm/trixie)
apt:
name: "{{ microcode_intel_package }}"
@@ -193,7 +323,6 @@
- apt-initial-install
- apt-microcode
- name: (apt.yml) Install CPU microcode for AMD CPU (debian buster)
apt:
name: "{{ microcode_amd_package }}"
@@ -208,7 +337,6 @@
- apt-initial-install
- apt-microcode
- name: (apt.yml) Install CPU microcode for Intel CPU (ubuntu bionic)
apt:
name: "{{ microcode_intel_package }}"
@@ -222,7 +350,6 @@
- apt-initial-install
- apt-microcode
- name: (apt.yml) Install CPU microcode for AMD CPU (ubuntu bionic)
apt:
name: "{{ microcode_amd_package }}"
@@ -237,7 +364,6 @@
- apt-initial-install
- apt-microcode
- name: (apt.yml) Install CPU microcode for Intel CPU (ubuntu xenial)
apt:
name: "{{ microcode_intel_package }}"
@@ -251,7 +377,6 @@
- apt-initial-install
- apt-microcode
- name: (apt.yml) Install CPU microcode for Intel AMD (ubuntu xenial)
apt:
name: "{{ microcode_amd_package }}"
@@ -266,7 +391,6 @@
- apt-initial-install
- apt-microcode
- name: (apt.yml) Install CPU microcode for Intel CPU (ubuntu jammy/noble)
apt:
name: "{{ microcode_intel_package }}"
@@ -280,7 +404,6 @@
- apt-initial-install
- apt-microcode
- name: (apt.yml) Install CPU microcode for Intel AMD (ubuntu jammy/noble)
apt:
name: "{{ microcode_amd_package }}"
@@ -301,33 +424,31 @@
- name: (apt.yml) Install Firmware packages (Ubuntu)
apt:
name: "{{ firmware_packages_ubuntu }}"
state: present
default_release: "{{ ansible_facts['distribution_release'] }}"
name: "{{ firmware_packages_ubuntu }}"
state: present
default_release: "{{ ansible_facts['distribution_release'] }}"
when:
- ansible_facts['distribution'] == "Ubuntu"
tags:
- apt-initial-install
- apt-firmware
- name: (apt.yml) Install Firmware packages (Debian)
apt:
name: "{{ firmware_packages_debian }}"
state: present
default_release: "{{ ansible_facts['distribution_release'] }}"
name: "{{ firmware_packages_debian }}"
state: present
default_release: "{{ ansible_facts['distribution_release'] }}"
when:
- ansible_facts['distribution'] == "Debian"
tags:
- apt-initial-install
- apt-firmware
- name: (apt.yml) Install non-free Firmware packages (Debian)
apt:
name: "{{ firmware_non_free_packages_debian }}"
state: present
default_release: "{{ ansible_facts['distribution_release'] }}"
name: "{{ firmware_non_free_packages_debian }}"
state: present
default_release: "{{ ansible_facts['distribution_release'] }}"
when:
- ansible_facts['distribution'] == "Debian"
- apt_debian_contrib_nonfree_enable
@@ -335,7 +456,6 @@
- apt-initial-install
- apt-firmware
# ---
# unwanted packages
# ---