Graham McIntire
292758900e
- DNS: hi.mcintire.me A/AAAA, git.mcintire.me A/AAAA updated to new host - forgejo role: Docker Compose deployment with SQLite, INSTALL_LOCK, admin user creation - Caddyfile-hi.j2: reverse proxy git.mcintire.me -> localhost:3000 - tailscale role: skip connect when no auth key; dynamic repo suite - debian role: fix Signed-By for debian.sources on trixie - curl added to base Debian packages - support.vntx.net: added to vntx_servers, DNS, host_vars
61 lines
2 KiB
YAML
61 lines
2 KiB
YAML
- name: "Disable Proxmox enterprise repository (requires paid subscription)"
|
|
ansible.builtin.command:
|
|
cmd: mv /etc/apt/sources.list.d/pve-enterprise.list /etc/apt/sources.list.d/pve-enterprise.list.disabled
|
|
removes: /etc/apt/sources.list.d/pve-enterprise.list
|
|
changed_when: false
|
|
|
|
- name: "Check for MariaDB repo file"
|
|
ansible.builtin.stat:
|
|
path: /etc/apt/sources.list.d/mariadb.sources
|
|
register: _mariadb_repo_stat
|
|
|
|
- name: "Read MariaDB repo file (if present)"
|
|
ansible.builtin.slurp:
|
|
path: /etc/apt/sources.list.d/mariadb.sources
|
|
register: _mariadb_repo_content
|
|
when: _mariadb_repo_stat.stat.exists
|
|
|
|
- name: "Remove stale MariaDB 12.2 repo (not available for trixie)"
|
|
ansible.builtin.file:
|
|
path: /etc/apt/sources.list.d/mariadb.sources
|
|
state: absent
|
|
when:
|
|
- _mariadb_repo_content.content is defined
|
|
- "'repo/12.2/debian' in (_mariadb_repo_content.content | b64decode)"
|
|
|
|
- name: "Remove stale linuxfactory.or.kr PPA (ARM Rockchip, unreachable on x86 noble)"
|
|
ansible.builtin.file:
|
|
path: /etc/apt/sources.list.d/ppa-linuxfactory-or-kr.list
|
|
state: absent
|
|
|
|
- name: "Add Signed-By to debian.sources mirror entries"
|
|
ansible.builtin.replace:
|
|
path: /etc/apt/sources.list.d/debian.sources
|
|
regexp: '(URIs: mirror\+file://[^\n]+)\n(Suites:[^\n]+)\n(Components:[^\n]+)'
|
|
replace: '\1\n\2\n\3\nSigned-By: /usr/share/keyrings/debian-archive-keyring.gpg'
|
|
when: ansible_facts['distribution_release'] == 'trixie'
|
|
|
|
- name: "Install updates"
|
|
ansible.builtin.apt:
|
|
name: "*"
|
|
state: latest
|
|
update_cache: true
|
|
cache_valid_time: 3600
|
|
force_apt_get: true
|
|
autoremove: true
|
|
autoclean: true
|
|
|
|
- name: "Secure shared memory"
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/fstab
|
|
state: present
|
|
regexp: '^tmpfs\s+/run/shm\s+'
|
|
line: "tmpfs /run/shm tmpfs defaults,noexec,nosuid 0 0"
|
|
|
|
- name: "Ensure SSH listens on both IPv4 and IPv6"
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: '^#?AddressFamily'
|
|
line: "AddressFamily any"
|
|
state: present
|
|
notify: restart ssh
|