Add deb822 repository configuration for Debian backports and security updates

roles/common/tasks/apt.yml

@@ -1,4 +1,13 @@
 ---
+- name: (apt.yml) Delete Hetzner files 'hetzner-mirror.list' and 'hetzner-security-updates.list'
+  file:
+    path: "{{ item }}"
+    state: absent
+  with_items:
+    - /etc/apt/sources.list.d/hetzner-mirror.list
+    - /etc/apt/sources.list.d/hetzner-security-updates.list
+  tags:
+    - apt-configuration
 
 - name: (apt.yml) update configuration file - /etc/apt/sources.list
   template:
@@ -9,12 +18,143 @@
     mode: 0644
   register: apt_config_updated
   when:
-    - ansible_facts['distribution'] == "Debian"
     - apt_manage_sources_list|bool
+    - ansible_facts['distribution'] == 'Debian'
     - (ansible_facts['distribution_major_version'] | int) < 13
   tags:
     - apt-configuration
 
+- name: (apt.yml) Ensure Debian archive keyring is present for deb822 Signed-By (Debian >= 13)
+  apt:
+    name: debian-archive-keyring
+    state: present
+  when:
+    - apt_manage_sources_list|bool
+    - ansible_facts['distribution'] == 'Debian'
+    - (ansible_facts['distribution_major_version'] | int) >= 13
+    - apt_deb822_use_signed_by | default(true) | bool
+  tags:
+    - apt-configuration
+
+- name: (apt.yml) backup legacy /etc/apt/sources.list before deb822 migration (Debian >= 13)
+  copy:
+    src: /etc/apt/sources.list
+    dest: /etc/apt/sources.list.before-deb822
+    remote_src: true
+    force: false
+    owner: root
+    group: root
+    mode: "0644"
+  when:
+    - apt_manage_sources_list|bool
+    - ansible_facts['distribution'] == 'Debian'
+    - (ansible_facts['distribution_major_version'] | int) >= 13
+  failed_when:
+    - apt_sources_list_backup.failed
+    - "'No such file or directory' not in (apt_sources_list_backup.msg | default(''))"
+  register: apt_sources_list_backup
+  tags:
+    - apt-configuration
+
+- name: (apt.yml) replace /etc/apt/sources.list with deb822 notice (Debian >= 13)
+  copy:
+    dest: /etc/apt/sources.list
+    content: |
+      # {{ ansible_managed }}
+      #
+      # Verwaltet via Ansible. Repositories liegen in /etc/apt/sources.list.d/*.sources (deb822).
+      # Zielrelease: {{ ansible_facts['distribution_release'] }}
+    owner: root
+    group: root
+    mode: "0644"
+  register: apt_config_updated_sources_list
+  when:
+    - apt_manage_sources_list|bool
+    - ansible_facts['distribution'] == 'Debian'
+    - (ansible_facts['distribution_major_version'] | int) >= 13
+  tags:
+    - apt-configuration
+
+- name: (apt.yml) configure deb822 Debian repository (Debian >= 13)
+  template:
+    src: "etc/apt/deb822/debian.sources.j2"
+    dest: /etc/apt/sources.list.d/debian.sources
+    owner: root
+    group: root
+    mode: "0644"
+  register: apt_config_updated_debian_sources
+  when:
+    - apt_manage_sources_list|bool
+    - ansible_facts['distribution'] == 'Debian'
+    - (ansible_facts['distribution_major_version'] | int) >= 13
+  tags:
+    - apt-configuration
+
+- name: (apt.yml) configure deb822 security repository (Debian >= 13)
+  template:
+    src: "etc/apt/deb822/security.sources.j2"
+    dest: /etc/apt/sources.list.d/security.sources
+    owner: root
+    group: root
+    mode: "0644"
+  register: apt_config_updated_security_sources
+  when:
+    - apt_manage_sources_list|bool
+    - ansible_facts['distribution'] == 'Debian'
+    - (ansible_facts['distribution_major_version'] | int) >= 13
+  tags:
+    - apt-configuration
+
+- name: (apt.yml) configure deb822 backports repository (Debian >= 13)
+  template:
+    src: "etc/apt/deb822/backports.sources.j2"
+    dest: /etc/apt/sources.list.d/backports.sources
+    owner: root
+    group: root
+    mode: "0644"
+  register: apt_config_updated_backports_sources
+  when:
+    - apt_manage_sources_list|bool
+    - ansible_facts['distribution'] == 'Debian'
+    - (ansible_facts['distribution_major_version'] | int) >= 13
+    - apt_backports_enable | default(false) | bool
+  tags:
+    - apt-configuration
+
+# If 'backports' was enabled in a previous run but is now disabled.
+#
+- name: (apt.yml) remove deb822 backports repository when disabled (Debian >= 13)
+  file:
+    path: /etc/apt/sources.list.d/backports.sources
+    state: absent
+  register: apt_config_removed_backports_sources
+  when:
+    - apt_manage_sources_list|bool
+    - ansible_facts['distribution'] == 'Debian'
+    - (ansible_facts['distribution_major_version'] | int) >= 13
+    - not (apt_backports_enable | default(false) | bool)
+  tags:
+    - apt-configuration
+
+# Collect change states from all Debian >=13 deb822 source tasks so apt update
+# can force a fresh cache refresh when repository files changed.
+- name: (apt.yml) aggregate deb822 source changes (Debian >= 13)
+  set_fact:
+    apt_config_updated:
+      changed: >-
+        {{
+          (apt_config_updated_sources_list.changed | default(false))
+          or (apt_config_updated_debian_sources.changed | default(false))
+          or (apt_config_updated_security_sources.changed | default(false))
+          or (apt_config_updated_backports_sources.changed | default(false))
+          or (apt_config_removed_backports_sources.changed | default(false))
+        }}
+  when:
+    - apt_manage_sources_list|bool
+    - ansible_facts['distribution'] == 'Debian'
+    - (ansible_facts['distribution_major_version'] | int) >= 13
+  tags:
+    - apt-configuration
 
 - name: (apt.yml) apt update
   apt:
@@ -30,7 +170,6 @@
     - apt-compiler-pkgs
     - apt-webserver-pkgs
 
-
 - name: (apt.yml) Configure any half-installed packages 'dpkg --configure -a'
   ansible.builtin.command: dpkg --configure -a
   register: _dpkg_configure
@@ -44,7 +183,6 @@
     - apt-compiler-pkgs
     - apt-webserver-pkgs
 
-
 - name: (apt.yml) apt upgrade
   apt:
     upgrade: "{{ apt_upgrade_type }}"
@@ -58,7 +196,6 @@
     - apt-compiler-pkgs
     - apt-webserver-pkgs
 
-
 - name: (apt.yml) Initial install debian packages (stretch)
   apt:
     name: "{{ apt_initial_install_stretch }}"
@@ -70,7 +207,6 @@
   tags:
     - apt-initial-install
 
-
 - name: (apt.yml) Initial install debian packages (buster)
   apt:
     name: "{{ apt_initial_install_buster }}"
@@ -82,7 +218,6 @@
   tags:
     - apt-initial-install
 
-
 - name: (apt.yml) Initial install debian packages (bullseye)
   apt:
     name: "{{ apt_initial_install_bullseye }}"
@@ -94,7 +229,6 @@
   tags:
     - apt-initial-install
 
-
 - name: (apt.yml) Initial install debian packages (bookworm)
   apt:
     name: "{{ apt_initial_install_bookworm }}"
@@ -106,7 +240,6 @@
   tags:
     - apt-initial-install
 
-
 - name: (apt.yml) Initial install debian packages (trixie)
   apt:
     name: "{{ apt_initial_install_trixie }}"
@@ -118,7 +251,6 @@
   tags:
     - apt-initial-install
 
-
 - name: (apt.yml) Initial install ubuntu packages (bionic)
   apt:
     name: "{{ apt_initial_install_bionic }}"
@@ -159,7 +291,6 @@
   tags:
     - apt-initial-install
 
-
 # ---
 # Microcode
 # ---
@@ -178,7 +309,6 @@
     - apt-initial-install
     - apt-microcode
 
-
 - name: (apt.yml) Install CPU microcode (debian buster/bullseye/bookworm/trixie)
   apt:
     name: "{{ microcode_intel_package }}"
@@ -193,7 +323,6 @@
     - apt-initial-install
     - apt-microcode
 
-
 - name: (apt.yml) Install CPU microcode for AMD CPU (debian buster)
   apt:
     name: "{{ microcode_amd_package }}"
@@ -208,7 +337,6 @@
     - apt-initial-install
     - apt-microcode
 
-
 - name: (apt.yml) Install CPU microcode for Intel CPU (ubuntu bionic)
   apt:
     name: "{{ microcode_intel_package }}"
@@ -222,7 +350,6 @@
     - apt-initial-install
     - apt-microcode
 
-
 - name: (apt.yml) Install CPU microcode for AMD CPU (ubuntu bionic)
   apt:
     name: "{{ microcode_amd_package }}"
@@ -237,7 +364,6 @@
     - apt-initial-install
     - apt-microcode
 
-
 - name: (apt.yml) Install CPU microcode for Intel CPU (ubuntu xenial)
   apt:
     name: "{{ microcode_intel_package }}"
@@ -251,7 +377,6 @@
     - apt-initial-install
     - apt-microcode
 
-
 - name: (apt.yml) Install CPU microcode for Intel AMD (ubuntu xenial)
   apt:
     name: "{{ microcode_amd_package }}"
@@ -266,7 +391,6 @@
     - apt-initial-install
     - apt-microcode
 
-
 - name: (apt.yml) Install CPU microcode for Intel CPU (ubuntu jammy/noble)
   apt:
     name: "{{ microcode_intel_package }}"
@@ -280,7 +404,6 @@
     - apt-initial-install
     - apt-microcode
 
-
 - name: (apt.yml) Install CPU microcode for Intel AMD (ubuntu jammy/noble)
   apt:
     name: "{{ microcode_amd_package }}"
@@ -310,7 +433,6 @@
     - apt-initial-install
     - apt-firmware
 
-
 - name: (apt.yml) Install Firmware packages (Debian)
   apt:
     name: "{{ firmware_packages_debian }}"
@@ -322,7 +444,6 @@
     - apt-initial-install
     - apt-firmware
 
-
 - name: (apt.yml) Install non-free Firmware packages (Debian)
   apt:
     name: "{{ firmware_non_free_packages_debian }}"
@@ -335,7 +456,6 @@
     - apt-initial-install
     - apt-firmware
 
-
 # ---
 # unwanted packages
 # ---

roles/common/templates/etc/apt/deb822/backports.sources.j2

@@ -0,0 +1,12 @@
+# {{ ansible_managed }}
+#
+# Managed by Ansible: deb822 definition for the Debian backports repository.
+# It enables deb-src only when apt_src_enable is true and sets Signed-By only
+# when apt_deb822_use_signed_by is enabled.
+Types: {{ 'deb deb-src' if apt_src_enable | default(true) | bool else 'deb' }}
+URIs: {{ apt_debian_mirror }}
+Suites: {{ ansible_facts['distribution_release'] }}-backports
+Components: main contrib non-free non-free-firmware
+{% if apt_deb822_use_signed_by | default(true) | bool %}
+Signed-By: {{ apt_deb822_signed_by_keyring | default('/usr/share/keyrings/debian-archive-keyring.gpg') }}
+{% endif %}

roles/common/templates/etc/apt/deb822/debian.sources.j2

@@ -0,0 +1,10 @@
+# {{ ansible_managed }}
+#
+# Verwaltet via Ansible - Debian Basis & Updates fuer {{ ansible_facts['distribution_release'] }}
+Types: {{ 'deb deb-src' if apt_src_enable | default(true) | bool else 'deb' }}
+URIs: {{ apt_debian_mirror }}
+Suites: {{ ansible_facts['distribution_release'] }} {{ ansible_facts['distribution_release'] }}-updates
+Components: main contrib non-free non-free-firmware
+{% if apt_deb822_use_signed_by | default(true) | bool %}
+Signed-By: {{ apt_deb822_signed_by_keyring | default('/usr/share/keyrings/debian-archive-keyring.gpg') }}
+{% endif %}

roles/common/templates/etc/apt/deb822/security.sources.j2

@@ -0,0 +1,10 @@
+# {{ ansible_managed }}
+#
+# Verwaltet via Ansible - Security fuer {{ ansible_facts['distribution_release'] }}
+Types: {{ 'deb deb-src' if apt_src_enable | default(true) | bool else 'deb' }}
+URIs: http://security.debian.org/debian-security
+Suites: {{ ansible_facts['distribution_release'] }}-security
+Components: main contrib non-free non-free-firmware
+{% if apt_deb822_use_signed_by | default(true) | bool %}
+Signed-By: {{ apt_deb822_signed_by_keyring | default('/usr/share/keyrings/debian-archive-keyring.gpg') }}
+{% endif %}