535 lines
16 KiB
YAML
535 lines
16 KiB
YAML
---
|
|
- name: (apt.yml) Delete Hetzner files 'hetzner-mirror.list' and 'hetzner-security-updates.list'
|
|
file:
|
|
path: "{{ item }}"
|
|
state: absent
|
|
with_items:
|
|
- /etc/apt/sources.list.d/hetzner-mirror.list
|
|
- /etc/apt/sources.list.d/hetzner-security-updates.list
|
|
tags:
|
|
- apt-configuration
|
|
|
|
- name: (apt.yml) update configuration file - /etc/apt/sources.list
|
|
ansible.builtin.template:
|
|
src: "etc/apt/sources.list.{{ ansible_facts['distribution'] }}.j2"
|
|
dest: /etc/apt/sources.list
|
|
owner: root
|
|
group: root
|
|
mode: 0644
|
|
register: apt_config_updated
|
|
when:
|
|
- apt_manage_sources_list|bool
|
|
- ansible_facts['distribution'] == 'Debian'
|
|
- (ansible_facts['distribution_major_version'] | int) < 13
|
|
tags:
|
|
- apt-configuration
|
|
|
|
- name: (apt.yml) Ensure Debian archive keyring is present for deb822 Signed-By (Debian >= 13)
|
|
apt:
|
|
name: debian-archive-keyring
|
|
state: present
|
|
when:
|
|
- apt_manage_sources_list|bool
|
|
- ansible_facts['distribution'] == 'Debian'
|
|
- (ansible_facts['distribution_major_version'] | int) >= 13
|
|
- apt_deb822_use_signed_by | default(true) | bool
|
|
tags:
|
|
- apt-configuration
|
|
|
|
- name: (apt.yml) backup legacy /etc/apt/sources.list before deb822 migration (Debian >= 13)
|
|
copy:
|
|
src: /etc/apt/sources.list
|
|
dest: /etc/apt/sources.list.before-deb822
|
|
remote_src: true
|
|
force: false
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
when:
|
|
- apt_manage_sources_list|bool
|
|
- ansible_facts['distribution'] == 'Debian'
|
|
- (ansible_facts['distribution_major_version'] | int) >= 13
|
|
failed_when:
|
|
- apt_sources_list_backup.failed
|
|
- "'No such file or directory' not in (apt_sources_list_backup.msg | default(''))"
|
|
register: apt_sources_list_backup
|
|
tags:
|
|
- apt-configuration
|
|
|
|
- name: (apt.yml) replace /etc/apt/sources.list with deb822 notice (Debian >= 13)
|
|
copy:
|
|
dest: /etc/apt/sources.list
|
|
content: |
|
|
# {{ ansible_managed }}
|
|
#
|
|
# Verwaltet via Ansible. Repositories liegen in /etc/apt/sources.list.d/*.sources (deb822).
|
|
# Zielrelease: {{ ansible_facts['distribution_release'] }}
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
register: apt_config_updated_sources_list
|
|
when:
|
|
- apt_manage_sources_list|bool
|
|
- ansible_facts['distribution'] == 'Debian'
|
|
- (ansible_facts['distribution_major_version'] | int) >= 13
|
|
tags:
|
|
- apt-configuration
|
|
|
|
- name: (apt.yml) configure deb822 Debian repository (Debian >= 13)
|
|
ansible.builtin.template:
|
|
src: "etc/apt/deb822/debian.sources.j2"
|
|
dest: /etc/apt/sources.list.d/debian.sources
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
register: apt_config_updated_debian_sources
|
|
when:
|
|
- apt_manage_sources_list|bool
|
|
- ansible_facts['distribution'] == 'Debian'
|
|
- (ansible_facts['distribution_major_version'] | int) >= 13
|
|
tags:
|
|
- apt-configuration
|
|
|
|
- name: (apt.yml) configure deb822 security repository (Debian >= 13)
|
|
ansible.builtin.template:
|
|
src: "etc/apt/deb822/security.sources.j2"
|
|
dest: /etc/apt/sources.list.d/security.sources
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
register: apt_config_updated_security_sources
|
|
when:
|
|
- apt_manage_sources_list|bool
|
|
- ansible_facts['distribution'] == 'Debian'
|
|
- (ansible_facts['distribution_major_version'] | int) >= 13
|
|
tags:
|
|
- apt-configuration
|
|
|
|
- name: (apt.yml) configure deb822 backports repository (Debian >= 13)
|
|
ansible.builtin.template:
|
|
src: "etc/apt/deb822/backports.sources.j2"
|
|
dest: /etc/apt/sources.list.d/backports.sources
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
register: apt_config_updated_backports_sources
|
|
when:
|
|
- apt_manage_sources_list|bool
|
|
- ansible_facts['distribution'] == 'Debian'
|
|
- (ansible_facts['distribution_major_version'] | int) >= 13
|
|
- apt_backports_enable | default(false) | bool
|
|
tags:
|
|
- apt-configuration
|
|
|
|
# If 'backports' was enabled in a previous run but is now disabled.
|
|
#
|
|
- name: (apt.yml) remove deb822 backports repository when disabled (Debian >= 13)
|
|
file:
|
|
path: /etc/apt/sources.list.d/backports.sources
|
|
state: absent
|
|
register: apt_config_removed_backports_sources
|
|
when:
|
|
- apt_manage_sources_list|bool
|
|
- ansible_facts['distribution'] == 'Debian'
|
|
- (ansible_facts['distribution_major_version'] | int) >= 13
|
|
- not (apt_backports_enable | default(false) | bool)
|
|
tags:
|
|
- apt-configuration
|
|
|
|
# Collect change states from all Debian >=13 deb822 source tasks so apt update
|
|
# can force a fresh cache refresh when repository files changed.
|
|
- name: (apt.yml) aggregate deb822 source changes (Debian >= 13)
|
|
set_fact:
|
|
apt_config_updated:
|
|
changed: >-
|
|
{{
|
|
(apt_config_updated_sources_list.changed | default(false))
|
|
or (apt_config_updated_debian_sources.changed | default(false))
|
|
or (apt_config_updated_security_sources.changed | default(false))
|
|
or (apt_config_updated_backports_sources.changed | default(false))
|
|
or (apt_config_removed_backports_sources.changed | default(false))
|
|
}}
|
|
when:
|
|
- apt_manage_sources_list|bool
|
|
- ansible_facts['distribution'] == 'Debian'
|
|
- (ansible_facts['distribution_major_version'] | int) >= 13
|
|
tags:
|
|
- apt-configuration
|
|
|
|
- name: (apt.yml) apt update
|
|
apt:
|
|
update_cache: true
|
|
cache_valid_time: "{{ 0 if apt_config_updated is defined and apt_config_updated.changed else apt_update_cache_valid_time }}"
|
|
when: apt_update|bool
|
|
tags:
|
|
- apt-update
|
|
- apt-upgrade
|
|
- apt-dpkg-configure
|
|
- apt-initial-install
|
|
- apt-microcode
|
|
- apt-compiler-pkgs
|
|
- apt-webserver-pkgs
|
|
|
|
- name: (apt.yml) Configure any half-installed packages 'dpkg --configure -a'
|
|
ansible.builtin.command: dpkg --configure -a
|
|
register: _dpkg_configure
|
|
changed_when: (_dpkg_configure.stdout | default('')) | length > 0
|
|
failed_when: _dpkg_configure.rc != 0
|
|
when: apt_dpkg_configure|bool
|
|
tags:
|
|
- apt-dpkg-configure
|
|
- apt-initial-install
|
|
- apt-microcode
|
|
- apt-compiler-pkgs
|
|
- apt-webserver-pkgs
|
|
|
|
- name: (apt.yml) apt upgrade
|
|
apt:
|
|
upgrade: "{{ apt_upgrade_type }}"
|
|
update_cache: true
|
|
dpkg_options: "{{ apt_upgrade_dpkg_options | join(',') }}"
|
|
when: apt_upgrade|bool
|
|
tags:
|
|
- apt-upgrade
|
|
- apt-initial-install
|
|
- apt-microcode
|
|
- apt-compiler-pkgs
|
|
- apt-webserver-pkgs
|
|
|
|
- name: (apt.yml) Initial install debian packages (stretch)
|
|
apt:
|
|
name: "{{ apt_initial_install_stretch }}"
|
|
state: "{{ apt_install_state }}"
|
|
when:
|
|
- apt_initial_install_stretch is defined and apt_initial_install_stretch|length > 0
|
|
- ansible_facts['distribution'] == "Debian"
|
|
- ansible_facts['distribution_major_version'] == "9"
|
|
tags:
|
|
- apt-initial-install
|
|
|
|
- name: (apt.yml) Initial install debian packages (buster)
|
|
apt:
|
|
name: "{{ apt_initial_install_buster }}"
|
|
state: "{{ apt_install_state }}"
|
|
when:
|
|
- apt_initial_install_buster is defined and apt_initial_install_buster|length > 0
|
|
- ansible_facts['distribution'] == "Debian"
|
|
- ansible_facts['distribution_major_version'] == "10"
|
|
tags:
|
|
- apt-initial-install
|
|
|
|
- name: (apt.yml) Initial install debian packages (bullseye)
|
|
apt:
|
|
name: "{{ apt_initial_install_bullseye }}"
|
|
state: "{{ apt_install_state }}"
|
|
when:
|
|
- apt_initial_install_bullseye is defined and apt_initial_install_bullseye|length > 0
|
|
- ansible_facts['distribution'] == "Debian"
|
|
- ansible_facts['distribution_major_version'] == "11"
|
|
tags:
|
|
- apt-initial-install
|
|
|
|
- name: (apt.yml) Initial install debian packages (bookworm)
|
|
apt:
|
|
name: "{{ apt_initial_install_bookworm }}"
|
|
state: "{{ apt_install_state }}"
|
|
when:
|
|
- apt_initial_install_bookworm is defined and apt_initial_install_bookworm|length > 0
|
|
- ansible_facts['distribution'] == "Debian"
|
|
- ansible_facts['distribution_major_version'] == "12"
|
|
tags:
|
|
- apt-initial-install
|
|
|
|
- name: (apt.yml) Initial install debian packages (trixie)
|
|
apt:
|
|
name: "{{ apt_initial_install_trixie }}"
|
|
state: "{{ apt_install_state }}"
|
|
when:
|
|
- apt_initial_install_trixie is defined and apt_initial_install_trixie|length > 0
|
|
- ansible_facts['distribution'] == "Debian"
|
|
- ansible_facts['distribution_major_version'] == "13"
|
|
tags:
|
|
- apt-initial-install
|
|
|
|
- name: (apt.yml) Initial install ubuntu packages (bionic)
|
|
apt:
|
|
name: "{{ apt_initial_install_bionic }}"
|
|
state: "{{ apt_install_state }}"
|
|
when:
|
|
- ansible_facts['distribution'] == "Ubuntu"
|
|
- ansible_facts['distribution_release'] == "bionic"
|
|
tags:
|
|
- apt-initial-install
|
|
|
|
- name: (apt.yml) Initial install ubuntu packages (xenial)
|
|
apt:
|
|
name: "{{ apt_initial_install_xenial }}"
|
|
state: "{{ apt_install_state }}"
|
|
when:
|
|
- ansible_facts['distribution'] == "Ubuntu"
|
|
- ansible_facts['distribution_release'] == "xenial"
|
|
tags:
|
|
- apt-initial-install
|
|
|
|
- name: (apt.yml) Initial install ubuntu packages (jammy)
|
|
apt:
|
|
name: "{{ apt_initial_install_jammy }}"
|
|
state: "{{ apt_install_state }}"
|
|
when:
|
|
- ansible_facts['distribution'] == "Ubuntu"
|
|
- ansible_facts['distribution_release'] == "jammy"
|
|
tags:
|
|
- apt-initial-install
|
|
|
|
- name: (apt.yml) Initial install ubuntu packages (noble)
|
|
apt:
|
|
name: "{{ apt_initial_install_noble }}"
|
|
state: "{{ apt_install_state }}"
|
|
when:
|
|
- ansible_facts['distribution'] == "Ubuntu"
|
|
- ansible_facts['distribution_release'] == "noble"
|
|
tags:
|
|
- apt-initial-install
|
|
|
|
# ---
|
|
# Microcode
|
|
# ---
|
|
|
|
- name: (apt.yml) Ensure we have CPU microcode from backports for Intel CPU (debian stretch)
|
|
apt:
|
|
name: "{{ microcode_intel_package }}"
|
|
state: present
|
|
default_release: "{{ ansible_facts['distribution_release'] }}-backports"
|
|
when:
|
|
- apt_backports_enable
|
|
- ansible_facts['distribution'] == "Debian"
|
|
- ansible_facts['distribution_major_version'] == "9"
|
|
- ansible_facts['processor']|string is search("Intel")
|
|
tags:
|
|
- apt-initial-install
|
|
- apt-microcode
|
|
|
|
- name: (apt.yml) Install CPU microcode (debian buster/bullseye/bookworm/trixie)
|
|
apt:
|
|
name: "{{ microcode_intel_package }}"
|
|
state: present
|
|
default_release: "{{ ansible_facts['distribution_release'] }}"
|
|
when:
|
|
- apt_debian_contrib_nonfree_enable
|
|
- ansible_facts['distribution'] == "Debian"
|
|
- ansible_facts['distribution_major_version'] == "10" or ansible_facts['distribution_major_version'] == "11"or ansible_facts['distribution_major_version'] == "12" or ansible_facts['distribution_major_version'] == "13"
|
|
- ansible_facts['processor']|string is search("Intel")
|
|
tags:
|
|
- apt-initial-install
|
|
- apt-microcode
|
|
|
|
- name: (apt.yml) Install CPU microcode for AMD CPU (debian buster)
|
|
apt:
|
|
name: "{{ microcode_amd_package }}"
|
|
state: present
|
|
default_release: "{{ ansible_facts['distribution_release'] }}"
|
|
when:
|
|
- apt_debian_contrib_nonfree_enable
|
|
- ansible_facts['distribution'] == "Debian"
|
|
- ansible_facts['distribution_major_version'] == "10"
|
|
- ansible_facts['processor']|string is search("AMD")
|
|
tags:
|
|
- apt-initial-install
|
|
- apt-microcode
|
|
|
|
- name: (apt.yml) Install CPU microcode for Intel CPU (ubuntu bionic)
|
|
apt:
|
|
name: "{{ microcode_intel_package }}"
|
|
state: present
|
|
default_release: "{{ ansible_facts['distribution_release'] }}"
|
|
when:
|
|
- ansible_facts['distribution'] == "Ubuntu"
|
|
- ansible_facts['distribution_release'] == "bionic"
|
|
- ansible_facts['processor']|string is search("Intel")
|
|
tags:
|
|
- apt-initial-install
|
|
- apt-microcode
|
|
|
|
- name: (apt.yml) Install CPU microcode for AMD CPU (ubuntu bionic)
|
|
apt:
|
|
name: "{{ microcode_amd_package }}"
|
|
state: present
|
|
default_release: "{{ ansible_facts['distribution_release'] }}"
|
|
when:
|
|
- apt_debian_contrib_nonfree_enable
|
|
- ansible_facts['distribution'] == "Ubuntu"
|
|
- ansible_facts['distribution_release'] == "bionic"
|
|
- ansible_facts['processor']|string is search("AMD")
|
|
tags:
|
|
- apt-initial-install
|
|
- apt-microcode
|
|
|
|
- name: (apt.yml) Install CPU microcode for Intel CPU (ubuntu xenial)
|
|
apt:
|
|
name: "{{ microcode_intel_package }}"
|
|
state: present
|
|
default_release: "{{ ansible_facts['distribution_release'] }}"
|
|
when:
|
|
- ansible_facts['distribution'] == "Ubuntu"
|
|
- ansible_facts['distribution_release'] == "xenial"
|
|
- ansible_facts['processor']|string is search("Intel")
|
|
tags:
|
|
- apt-initial-install
|
|
- apt-microcode
|
|
|
|
- name: (apt.yml) Install CPU microcode for Intel AMD (ubuntu xenial)
|
|
apt:
|
|
name: "{{ microcode_amd_package }}"
|
|
state: present
|
|
default_release: "{{ ansible_facts['distribution_release'] }}"
|
|
when:
|
|
- apt_debian_contrib_nonfree_enable
|
|
- ansible_facts['distribution'] == "Ubuntu"
|
|
- ansible_facts['distribution_release'] == "xenial"
|
|
- ansible_facts['processor']|string is search("AMD")
|
|
tags:
|
|
- apt-initial-install
|
|
- apt-microcode
|
|
|
|
- name: (apt.yml) Install CPU microcode for Intel CPU (ubuntu jammy/noble)
|
|
apt:
|
|
name: "{{ microcode_intel_package }}"
|
|
state: present
|
|
default_release: "{{ ansible_facts['distribution_release'] }}"
|
|
when:
|
|
- ansible_facts['distribution'] == "Ubuntu"
|
|
- ansible_facts['distribution_release'] == "jammy" or ansible_facts['distribution_release'] == "noble"
|
|
- ansible_facts['processor']|string is search("Intel")
|
|
tags:
|
|
- apt-initial-install
|
|
- apt-microcode
|
|
|
|
- name: (apt.yml) Install CPU microcode for Intel AMD (ubuntu jammy/noble)
|
|
apt:
|
|
name: "{{ microcode_amd_package }}"
|
|
state: present
|
|
default_release: "{{ ansible_facts['distribution_release'] }}"
|
|
when:
|
|
- apt_debian_contrib_nonfree_enable
|
|
- ansible_facts['distribution'] == "Ubuntu"
|
|
- ansible_facts['distribution_release'] == "jammy" or ansible_facts['distribution_release'] == "noble"
|
|
- ansible_facts['processor']|string is search("AMD")
|
|
tags:
|
|
- apt-initial-install
|
|
- apt-microcode
|
|
|
|
# ---
|
|
# Firmware
|
|
# ---
|
|
|
|
- name: (apt.yml) Install Firmware packages (Ubuntu)
|
|
apt:
|
|
name: "{{ firmware_packages_ubuntu }}"
|
|
state: present
|
|
default_release: "{{ ansible_facts['distribution_release'] }}"
|
|
when:
|
|
- ansible_facts['distribution'] == "Ubuntu"
|
|
tags:
|
|
- apt-initial-install
|
|
- apt-firmware
|
|
|
|
- name: (apt.yml) Install Firmware packages (Debian)
|
|
apt:
|
|
name: "{{ firmware_packages_debian }}"
|
|
state: present
|
|
default_release: "{{ ansible_facts['distribution_release'] }}"
|
|
when:
|
|
- ansible_facts['distribution'] == "Debian"
|
|
tags:
|
|
- apt-initial-install
|
|
- apt-firmware
|
|
|
|
- name: (apt.yml) Install non-free Firmware packages (Debian)
|
|
apt:
|
|
name: "{{ firmware_non_free_packages_debian }}"
|
|
state: present
|
|
default_release: "{{ ansible_facts['distribution_release'] }}"
|
|
when:
|
|
- ansible_facts['distribution'] == "Debian"
|
|
- apt_debian_contrib_nonfree_enable
|
|
tags:
|
|
- apt-initial-install
|
|
- apt-firmware
|
|
|
|
# ---
|
|
# unwanted packages
|
|
# ---
|
|
|
|
- name: (apt.yml) Remove unwanted packages
|
|
apt:
|
|
name: "{{ apt_remove }}"
|
|
state: absent
|
|
purge: "{{ apt_remove_purge }}"
|
|
tags:
|
|
- apt-remove
|
|
|
|
- name: (apt.yml) Remove unwanted packages Ubuntu bionic
|
|
apt:
|
|
name: "{{ apt_remove_bionic }}"
|
|
state: absent
|
|
purge: "{{ apt_remove_purge }}"
|
|
when:
|
|
- ansible_facts['distribution'] == "Ubuntu"
|
|
- ansible_facts['distribution_release'] == "bionic"
|
|
tags:
|
|
- apt-remove
|
|
|
|
- name: (apt.yml) Remove unwanted packages Ubuntu xenial
|
|
apt:
|
|
name: "{{ apt_remove_xenial }}"
|
|
state: absent
|
|
purge: "{{ apt_remove_purge }}"
|
|
when:
|
|
- ansible_facts['distribution'] == "Ubuntu"
|
|
- ansible_facts['distribution_release'] == "xenial"
|
|
tags:
|
|
- apt-remove
|
|
|
|
- name: (apt.yml) Remove unwanted packages Ubuntu jammy
|
|
apt:
|
|
name: "{{ apt_remove_jammy }}"
|
|
state: absent
|
|
purge: "{{ apt_remove_purge }}"
|
|
when:
|
|
- ansible_facts['distribution'] == "Ubuntu"
|
|
- ansible_facts['distribution_release'] == "jammy"
|
|
tags:
|
|
- apt-remove
|
|
|
|
- name: (apt.yml) Remove unwanted packages Ubuntu noble
|
|
apt:
|
|
name: "{{ apt_remove_noble }}"
|
|
state: absent
|
|
purge: "{{ apt_remove_purge }}"
|
|
when:
|
|
- ansible_facts['distribution'] == "Ubuntu"
|
|
- ansible_facts['distribution_release'] == "noble"
|
|
tags:
|
|
- apt-remove
|
|
|
|
- name: (apt.yml) autoremove
|
|
apt:
|
|
autoremove: true
|
|
dpkg_options: "{{ apt_upgrade_dpkg_options | join(',') }}"
|
|
when: apt_autoremove|bool
|
|
tags:
|
|
- apt-autoremove
|
|
- apt-initial-install
|
|
- apt-microcode
|
|
|
|
- name: (apt.yml) clean
|
|
command: apt-get -y clean
|
|
#args:
|
|
# warn: false
|
|
changed_when: false
|
|
when: apt_clean|bool
|
|
tags:
|
|
- apt-clean
|
|
- apt-initial-install
|
|
- apt-microcode
|