From 184a6ac426a0cc5ed1ee9dbb5287affa94464142 Mon Sep 17 00:00:00 2001
From: Matthew Fennell <matthew@fennell.dev>
Date: Sun, 30 Aug 2026 00:36:11 +0100
Subject: Use consistent apt sources across servers

Servers on different providers had different apt sources by default. For
instance - some enabled trixie-backports while others did not. This lack of
consistency could lead to unexpected problems in the future - so ensure all
servers use consistent apt sources now.

Preserve the ability to use use mirrors by making uri a configurable parameter.
Likewise - make debian_version a configurable parameter. While I could set the
distribution to stable, I don't want to risk an upgrade moving onto a new
stable release without it being my explicit choice - a variable allows me to
set the version as trixie as well as upgrade servers incrementally (first in
staging, then transport, then prod).
---
 playbook.yaml | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/playbook.yaml b/playbook.yaml
index 91573fe..ebeefd5 100644
--- a/playbook.yaml
+++ b/playbook.yaml
@@ -216,6 +216,39 @@
      tags:
       - dns
 
+   # This is needed by ansible.builtin.deb822_repository to interact with the
+   # sources lists. In ansible-core 2.20 and above, there is a builtin
+   # install_python_debian parameter that handles that without this extra step,
+   # but we are currently running 2.19.
+   # TODO(debian-forky) use deb822_repository's install_python_debian parameter
+   - name: Ensure python3-debian is installed
+     ansible.builtin.apt:
+      name:
+       - python3-debian
+      state: present
+      update_cache: true
+     become: true
+
+   - name: Ensure debian apt repositories are configured
+     ansible.builtin.deb822_repository:
+      name: debian
+      uris: "{{ debian_uri }}"
+      suites:
+       - "{{ debian_version }}"
+       - "{{ debian_version }}-updates"
+      components: main
+      signed_by: /usr/share/keyrings/debian-archive-keyring.gpg
+     become: true
+
+   - name: Ensure debian-security apt repositories are configured
+     ansible.builtin.deb822_repository:
+      name: debian-security
+      uris: "{{ debian_security_uri }}"
+      suites: "{{ debian_version }}-security"
+      components: main
+      signed_by: /usr/share/keyrings/debian-archive-keyring.gpg
+     become: true
+
    # We specifically use apt instead of the more general package module here,
    # because we want to ensure the cache is updated before we try and install
    # anything. This is needed because, on a freh Debian install on AWS
-- 
cgit v1.2.3