Add extrepo tasks for managing external repositories in Debian

.devcontainer/devcontainer.json

@@ -0,0 +1,16 @@
+{
+    "name": "Ansible Development",
+    "image": "mcr.microsoft.com/devcontainers/python:3.12",
+    "features": {
+        "ghcr.io/devcontainers/features/ansible:1": {}
+    },
+    "customizations": {
+        "vscode": {
+            "extensions": [
+                "redhat.ansible",
+                "ms-python.python"
+            ]
+        }
+    },
+    "postCreateCommand": "pip install ansible-lint"
+}

.vscode/settings.json

@@ -5,5 +5,14 @@
       "envManager": "ms-python.python:venv",
       "packageManager": "ms-python.python:pip"
     }
-  ]
+  ],
+  "python.defaultInterpreterPath": "${workspaceFolder}/.venv/bin/python",
+  "python.pythonPath": "${workspaceFolder}/.venv/bin/python", // legacy fallback for older Python extension versions
+  // Keep these Ansible executable paths absolute: parts of the extension use them verbatim.
+  "ansible.ansiblePath": "/home/chris/devel/git/git.oopen.de/ansible/oopen-server/.venv/bin/ansible", // legacy fallback for older Ansible extension versions
+  "ansible.ansibleLintPath": "/home/chris/devel/git/git.oopen.de/ansible/oopen-server/.venv/bin/ansible-lint", // legacy fallback for older Ansible extension versions
+  "ansible.ansible.path": "/home/chris/devel/git/git.oopen.de/ansible/oopen-server/.venv/bin/ansible",
+  "ansible.python.interpreterPath": "${workspaceFolder}/.venv/bin/python3",
+  "ansible.validation.lint.path": "/home/chris/devel/git/git.oopen.de/ansible/oopen-server/.venv/bin/ansible-lint",
+  "ansible.ansibleNavigator.path": "/home/chris/devel/git/git.oopen.de/ansible/oopen-server/.venv/bin/ansible-navigator"
 }

.vscode/settings.json.bak.20260327-152321

@@ -0,0 +1,18 @@
+{
+  "python-envs.pythonProjects": [
+    {
+      "path": ".",
+      "envManager": "ms-python.python:venv",
+      "packageManager": "ms-python.python:pip"
+    }
+  ],
+  "python.defaultInterpreterPath": "${workspaceFolder}/.venv/bin/python",
+  "python.pythonPath": "${workspaceFolder}/.venv/bin/python", // legacy fallback for older Python extension versions
+  // Keep these Ansible executable paths absolute: parts of the extension use them verbatim.
+  "ansible.ansiblePath": "/home/chris/devel/git/git.oopen.de/ansible/oopen-server/.venv/bin/ansible", // legacy fallback for older Ansible extension versions
+  "ansible.ansibleLintPath": "/home/chris/devel/git/git.oopen.de/ansible/oopen-server/.venv/bin/ansible-lint", // legacy fallback for older Ansible extension versions
+  "ansible.ansible.path": "/home/chris/devel/git/git.oopen.de/ansible/oopen-server/.venv/bin/ansible",
+  "ansible.python.interpreterPath": "${workspaceFolder}/.venv/bin/python3",
+  "ansible.validation.lint.path": "/home/chris/devel/git/git.oopen.de/ansible/oopen-server/.venv/bin/ansible-lint",
+  "ansible.ansibleNavigator.path": "/home/chris/devel/git/git.oopen.de/ansible/oopen-server/.venv/bin/ansible-navigator"
+}

roles/common/tasks/apache2.yml

@@ -1,5 +1,4 @@
 ---
-
 # ---
 # Apache2  Server
 # ---
@@ -7,31 +6,29 @@
 - name: Populate service facts
   ansible.builtin.service_facts:
 
-#- name: Print service facts
-#  ansible.builtin.debug:
-#    var: ansible_facts.services
-#  when: 
-#    - ansible_facts['services']['apache2.service']['name'] | default('not-found') != 'not-found'
-
+# - name: Print service facts
+#   ansible.builtin.debug:
+#     var: ansible_facts.services
+#   when:
+#     - ansible_facts['services']['apache2.service']['name'] | default('not-found') != 'not-found'
 
 - name: (apache2.yml) Ensure directory '/etc/systemd/system/apache2.service.d' is present
-  file:
+  ansible.builtin.file:
     path: /etc/systemd/system/apache2.service.d
     state: directory
     owner: root
     group: root
-    mode: '0755'
+    mode: "0755"
   when:
     - ansible_facts['services']['apache2.service']['name'] | default('not-found') != 'not-found'
 
-
 - name: (apache2.yml) Ensure file '/etc/systemd/system/apache2.service.d/limits.conf' exists
-  copy:
-    src: 'etc/systemd/system/apache2.service.d/limits.conf'
-    dest: '/etc/systemd/system/apache2.service.d/limits.conf'
+  ansible.builtin.copy:
+    src: "etc/systemd/system/apache2.service.d/limits.conf"
+    dest: "/etc/systemd/system/apache2.service.d/limits.conf"
     owner: root
     group: root
-    mode: '0644'
+    mode: "0644"
   notify: "Restart apache2"
   when:
     - ansible_facts['services']['apache2.service']['name'] | default('not-found') != 'not-found'

roles/common/tasks/cron.yml

@@ -1,5 +1,82 @@
 ---
 
+- name: (cron.yml) Define candidate paths for root crontab PATH
+  ansible.builtin.set_fact:
+    cron_root_path_candidates:
+      - /root/bin/admin-stuff
+      - /root/bin
+      - /usr/local/apache2/bin
+      - /usr/local/php/bin
+      - /usr/local/sbin
+      - /usr/local/bin
+      - /usr/sbin
+      - /usr/bin
+      - /sbin
+      - /bin
+  tags:
+    - user_crontab
+
+- name: (cron.yml) Check candidate paths for root crontab PATH
+  ansible.builtin.stat:
+    path: "{{ item }}"
+  loop: "{{ cron_root_path_candidates }}"
+  register: cron_root_path_stats
+  tags:
+    - user_crontab
+
+- name: (cron.yml) Build validated root crontab PATH
+  ansible.builtin.set_fact:
+    cron_root_path: >-
+      {{
+        cron_root_path_stats.results
+        | selectattr('stat.exists')
+        | map(attribute='stat.path')
+        | join(':')
+      }}
+  tags:
+    - user_crontab
+
+- name: (cron.yml) Check if root crontab already exists
+  ansible.builtin.stat:
+    path: /var/spool/cron/crontabs/root
+  register: root_crontab_file
+  tags:
+    - user_crontab
+
+- name: (cron.yml) Initialize root crontab with default header and env vars
+  ansible.builtin.copy:
+    dest: /var/spool/cron/crontabs/root
+    owner: root
+    group: crontab
+    mode: '0600'
+    content: |
+      # Edit this file to introduce tasks to be run by cron.
+      #
+      # Each task to run has to be defined through a single line
+      # indicating with different fields when the task will be run
+      # and what command to run for the task
+      #
+      # To define the time you can provide concrete values for
+      # minute (m), hour (h), day of month (dom), month (mon),
+      # and day of week (dow) or use '*' in these fields (for 'any').
+      #
+      # Notice that tasks will be started based on the cron's system
+      # daemon's notion of time and timezones.
+      #
+      # Output of the crontab jobs (including errors) is sent through
+      # email to the user the crontab file belongs to (unless redirected).
+      #
+      # For example, you can run a backup of all your user accounts
+      # at 5 a.m every week with:
+      # 0 5 * * 1 tar -zcf /var/backups/home.tgz /home/
+      #
+      PATH={{ cron_root_path }}
+      SHELL=/bin/bash
+  when:
+    - not root_crontab_file.stat.exists
+  tags:
+    - user_crontab
+
 - name: (cron.yml) Set env entries in user crontabs
   cron:
     name: '{{ item.name }}'

roles/common/tasks/extrepo.yml

@@ -0,0 +1,26 @@
+---
+
+- name: (extrepo.yml) Install extrepo package
+  ansible.builtin.apt:
+    name: extrepo
+    state: present
+  tags:
+    - extrepo
+
+- name: (extrepo.yml) Enable contrib policy in /etc/extrepo/config.yaml
+  ansible.builtin.lineinfile:
+    path: /etc/extrepo/config.yaml
+    regexp: '^(#\s*)?-\s*contrib$'
+    insertafter: '^- main$'
+    line: '- contrib'
+  tags:
+    - extrepo
+
+- name: (extrepo.yml) Enable non-free policy in /etc/extrepo/config.yaml
+  ansible.builtin.lineinfile:
+    path: /etc/extrepo/config.yaml
+    regexp: '^(#\s*)?-\s*non-free$'
+    insertafter: '^- contrib$'
+    line: '- non-free'
+  tags:
+    - extrepo

roles/common/tasks/main.yml

@@ -1,8 +1,7 @@
 ---
-
 - import_tasks: show.yml
   tags:
-   - show
+    - show
 
 # tags supported inside basic.yml
 #
@@ -13,7 +12,6 @@
   tags:
     - basic
 
-
 # tags supported inside apt.yml
 #
 #   apt-update
@@ -34,6 +32,15 @@
     - ansible_facts['distribution'] == "Debian"
   tags: apt
 
+# tags supported inside extrepo.yml
+#
+#   extrepo
+- import_tasks: extrepo.yml
+  when:
+    - ansible_facts['distribution'] == "Debian"
+    - (ansible_facts['distribution_major_version'] | int) >= 12
+  tags:
+    - extrepo
 
 # tags supported inside apt-gateway.yml:
 #
@@ -44,7 +51,6 @@
     - apt
     - apt-gateway-server
 
-
 #
 #    yum-update
 #    yum-base-install
@@ -55,7 +61,6 @@
     - ansible_facts.distribution == "CentOS" or ansible_facts.distribution == "Fedora"
   tags: yum
 
-
 # tags supportetd inside caching-nameserver.yml
 #
 # apt-caching-nameserver
@@ -65,7 +70,6 @@
   when: groups['caching_nameserver']|string is search(inventory_hostname)
   tags: caching-nameserver
 
-
 # tags supported inside systemd-resolved.yml
 #
 #    systemd-resolved
@@ -77,17 +81,15 @@
     - ansible_facts['distribution_major_version'] > "11"
     - systemd_resolved is defined and systemd_resolved|bool
 
-
-
 - import_tasks: tor.yml
   when:
     - inventory_hostname in groups['mail_server']
     - ansible_facts['distribution'] == "Debian"
-  tags: 
+  tags:
     - tor-service
 
 - import_tasks: cron.yml
-  tags: 
+  tags:
     - cron
 
 # tags supported inside shell.yml
@@ -99,10 +101,9 @@
   when:
     - ansible_facts['distribution'] == "Debian"
   tags:
-     - shell-config
-     - vim-config
-     - zsh-config
-
+    - shell-config
+    - vim-config
+    - zsh-config
 
 # tags supported inside users.yml:
 #
@@ -115,21 +116,19 @@
 #   root-defaut-ssh-keypair
 #   insert_root_ssh_public_key
 - import_tasks: users.yml
-  tags: 
+  tags:
     - users
 
-
 # tags supported inside users-systemfiles.yml:
 #
 #   bash
 #   profile
 #   vim
 - import_tasks: users-systemfiles.yml
-  tags: 
+  tags:
     - users
     - users-systemfiles
 
-
 # tags supported inside webadmin-user.yml:
 #
 #   users-exists
@@ -140,19 +139,17 @@
 #   insert_webadmin_ssh_public_key
 - import_tasks: webadmin-user.yml
   when: groups['webadmin']|string is search(inventory_hostname)
-  tags: 
+  tags:
     - users
     - users-systemfiles
     - webadmin
 
-
 # tags supported inside sshd.yml
 #
 #    sshd-config
 - import_tasks: sshd.yml
   tags: sshd
 
-
 # tags supported inside sudoers.yml:
 #
 #   sudoers-remove
@@ -161,11 +158,9 @@
 - import_tasks: sudoers.yml
   tags: sudoers
 
-
 - import_tasks: motd.yml
   tags: motd
 
-
 # tags supported inside ntp.yml:
 #
 #    ntp-server
@@ -175,7 +170,6 @@
   when:
     - "'lxc_guest' not in group_names"
 
-
 # tags supportetd inside git.yml
 #
 #   git-firewall-repository
@@ -198,7 +192,6 @@
 - import_tasks: git.yml
   tags: git
 
-
 # tags supported inside nfs.yml:
 #
 #    nfs-server
@@ -207,7 +200,6 @@
   tags:
     - nfs
 
-
 # tags supported inside x2go-server.yml:
 #
 #    x2go-server
@@ -216,7 +208,6 @@
   tags:
     - x2go
 
-
 # tags supported inside copy_files.yml:
 #
 #   copy-files
@@ -233,7 +224,6 @@
   tags:
     - symlink-files
 
-
 # tags supported inside config_files_mailsystem_scripts.yml:
 #
 - import_tasks: config_files_mailsystem_scripts.yml
@@ -276,9 +266,9 @@
     - remove-samba-user
 
 - import_tasks: redis-server.yml
-  when: inventory_hostname in groups['nextcloud_server'] or 
-        inventory_hostname in groups['apache2_webserver'] or
-        inventory_hostname in groups['nginx_webserver']
+  when: inventory_hostname in groups['nextcloud_server'] or
+    inventory_hostname in groups['apache2_webserver'] or
+    inventory_hostname in groups['nginx_webserver']
   tags:
     - redis-server
 
@@ -299,10 +289,8 @@
   tags:
     - services
 
-
 - import_tasks: systemd-services_redhat_based_OS.yml
   when:
     - ansible_facts.os_family == "RedHat"
   tags:
     - services
-