- name: "Disable Proxmox enterprise repository (requires paid subscription)"
  ansible.builtin.command:
    cmd: mv /etc/apt/sources.list.d/pve-enterprise.list /etc/apt/sources.list.d/pve-enterprise.list.disabled
    removes: /etc/apt/sources.list.d/pve-enterprise.list
  changed_when: false

- name: "Check for MariaDB repo file"
  ansible.builtin.stat:
    path: /etc/apt/sources.list.d/mariadb.sources
  register: _mariadb_repo_stat

- name: "Read MariaDB repo file (if present)"
  ansible.builtin.slurp:
    path: /etc/apt/sources.list.d/mariadb.sources
  register: _mariadb_repo_content
  when: _mariadb_repo_stat.stat.exists

- name: "Remove stale MariaDB 12.2 repo (not available for trixie)"
  ansible.builtin.file:
    path: /etc/apt/sources.list.d/mariadb.sources
    state: absent
  when:
    - _mariadb_repo_content.content is defined
    - "'repo/12.2/debian' in (_mariadb_repo_content.content | b64decode)"

- name: "Install updates"
  ansible.builtin.apt:
    name: "*"
    state: latest
    update_cache: true
    cache_valid_time: 3600
    force_apt_get: true
    autoremove: true
    autoclean: true

- name: "Secure shared memory"
  ansible.builtin.lineinfile:
    path: /etc/fstab
    state: present
    regexp: '^tmpfs\s+/run/shm\s+'
    line: "tmpfs /run/shm tmpfs defaults,noexec,nosuid 0 0"