- name: "Disable Proxmox enterprise repository (requires paid subscription)"
  ansible.builtin.command:
    cmd: mv /etc/apt/sources.list.d/pve-enterprise.list /etc/apt/sources.list.d/pve-enterprise.list.disabled
    removes: /etc/apt/sources.list.d/pve-enterprise.list
  changed_when: false

- name: "Check for MariaDB repo file"
  ansible.builtin.stat:
    path: /etc/apt/sources.list.d/mariadb.sources
  register: _mariadb_repo_stat

- name: "Read MariaDB repo file (if present)"
  ansible.builtin.slurp:
    path: /etc/apt/sources.list.d/mariadb.sources
  register: _mariadb_repo_content
  when: _mariadb_repo_stat.stat.exists

- name: "Remove stale MariaDB 12.2 repo (not available for trixie)"
  ansible.builtin.file:
    path: /etc/apt/sources.list.d/mariadb.sources
    state: absent
  when:
    - _mariadb_repo_content.content is defined
    - "'repo/12.2/debian' in (_mariadb_repo_content.content | b64decode)"

- name: "Remove stale linuxfactory.or.kr PPA (ARM Rockchip, unreachable on x86 noble)"
  ansible.builtin.file:
    path: /etc/apt/sources.list.d/ppa-linuxfactory-or-kr.list
    state: absent

- name: "Add Signed-By to debian.sources mirror entries"
  ansible.builtin.replace:
    path: /etc/apt/sources.list.d/debian.sources
    regexp: '(URIs: mirror\+file://[^\n]+)\n(Suites:[^\n]+)\n(Components:[^\n]+)'
    replace: '\1\n\2\n\3\nSigned-By: /usr/share/keyrings/debian-archive-keyring.gpg'
  when: ansible_facts['distribution_release'] == 'trixie'

- name: "Install updates"
  ansible.builtin.apt:
    name: "*"
    state: latest
    update_cache: true
    cache_valid_time: 3600
    force_apt_get: true
    autoremove: true
    autoclean: true

- name: "Secure shared memory"
  ansible.builtin.lineinfile:
    path: /etc/fstab
    state: present
    regexp: '^tmpfs\s+/run/shm\s+'
    line: "tmpfs /run/shm tmpfs defaults,noexec,nosuid 0 0"

- name: "Ensure SSH listens on both IPv4 and IPv6"
  ansible.builtin.lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^#?AddressFamily'
    line: "AddressFamily any"
    state: present
  notify: restart ssh