diff options
| author | Matthew Fennell <matthew@fennell.dev> | 2026-08-30 00:36:11 +0100 |
|---|---|---|
| committer | Matthew Fennell <matthew@fennell.dev> | 2026-08-30 00:36:11 +0100 |
| commit | 184a6ac426a0cc5ed1ee9dbb5287affa94464142 (patch) | |
| tree | 5caeda7e89bd998c41b9b9acb0c5d0c9c17f91d9 | |
| parent | 8b1ba2a7d9f0509253e37e5832c4bc74b44d009d (diff) | |
Use consistent apt sources across servers
Servers on different providers had different apt sources by default. For
instance - some enabled trixie-backports while others did not. This lack of
consistency could lead to unexpected problems in the future - so ensure all
servers use consistent apt sources now.
Preserve the ability to use use mirrors by making uri a configurable parameter.
Likewise - make debian_version a configurable parameter. While I could set the
distribution to stable, I don't want to risk an upgrade moving onto a new
stable release without it being my explicit choice - a variable allows me to
set the version as trixie as well as upgrade servers incrementally (first in
staging, then transport, then prod).
| -rw-r--r-- | playbook.yaml | 33 |
1 files changed, 33 insertions, 0 deletions
diff --git a/playbook.yaml b/playbook.yaml index 91573fe..ebeefd5 100644 --- a/playbook.yaml +++ b/playbook.yaml @@ -216,6 +216,39 @@ tags: - dns + # This is needed by ansible.builtin.deb822_repository to interact with the + # sources lists. In ansible-core 2.20 and above, there is a builtin + # install_python_debian parameter that handles that without this extra step, + # but we are currently running 2.19. + # TODO(debian-forky) use deb822_repository's install_python_debian parameter + - name: Ensure python3-debian is installed + ansible.builtin.apt: + name: + - python3-debian + state: present + update_cache: true + become: true + + - name: Ensure debian apt repositories are configured + ansible.builtin.deb822_repository: + name: debian + uris: "{{ debian_uri }}" + suites: + - "{{ debian_version }}" + - "{{ debian_version }}-updates" + components: main + signed_by: /usr/share/keyrings/debian-archive-keyring.gpg + become: true + + - name: Ensure debian-security apt repositories are configured + ansible.builtin.deb822_repository: + name: debian-security + uris: "{{ debian_security_uri }}" + suites: "{{ debian_version }}-security" + components: main + signed_by: /usr/share/keyrings/debian-archive-keyring.gpg + become: true + # We specifically use apt instead of the more general package module here, # because we want to ensure the cache is updated before we try and install # anything. This is needed because, on a freh Debian install on AWS |