69 lines
2.3 KiB
YAML
69 lines
2.3 KiB
YAML
- name: "Disable Proxmox enterprise repository (requires paid subscription)"
|
|
ansible.builtin.command:
|
|
cmd: mv /etc/apt/sources.list.d/pve-enterprise.list /etc/apt/sources.list.d/pve-enterprise.list.disabled
|
|
removes: /etc/apt/sources.list.d/pve-enterprise.list
|
|
changed_when: false
|
|
|
|
- name: "Check for MariaDB repo file"
|
|
ansible.builtin.stat:
|
|
path: /etc/apt/sources.list.d/mariadb.sources
|
|
register: _mariadb_repo_stat
|
|
|
|
- name: "Read MariaDB repo file (if present)"
|
|
ansible.builtin.slurp:
|
|
path: /etc/apt/sources.list.d/mariadb.sources
|
|
register: _mariadb_repo_content
|
|
when: _mariadb_repo_stat.stat.exists
|
|
|
|
- name: "Remove stale MariaDB 12.2 repo (not available for trixie)"
|
|
ansible.builtin.file:
|
|
path: /etc/apt/sources.list.d/mariadb.sources
|
|
state: absent
|
|
when:
|
|
- _mariadb_repo_content.content is defined
|
|
- "'repo/12.2/debian' in (_mariadb_repo_content.content | b64decode)"
|
|
|
|
- name: "Remove stale linuxfactory.or.kr PPA (ARM Rockchip, unreachable on x86 noble)"
|
|
ansible.builtin.file:
|
|
path: /etc/apt/sources.list.d/ppa-linuxfactory-or-kr.list
|
|
state: absent
|
|
|
|
- name: "Add Signed-By to debian.sources mirror entries"
|
|
ansible.builtin.replace:
|
|
path: /etc/apt/sources.list.d/debian.sources
|
|
regexp: '(URIs: mirror\+file://[^\n]+)\n(Suites:[^\n]+)\n(Components:[^\n]+)'
|
|
replace: '\1\n\2\n\3\nSigned-By: /usr/share/keyrings/debian-archive-keyring.gpg'
|
|
when: ansible_facts['distribution_release'] == 'trixie'
|
|
|
|
- name: "Install updates"
|
|
ansible.builtin.apt:
|
|
name: "*"
|
|
state: latest
|
|
update_cache: true
|
|
cache_valid_time: 3600
|
|
force_apt_get: true
|
|
autoremove: true
|
|
autoclean: true
|
|
|
|
- name: "Secure shared memory"
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/fstab
|
|
state: present
|
|
regexp: '^tmpfs\s+/run/shm\s+'
|
|
line: "tmpfs /run/shm tmpfs defaults,noexec,nosuid 0 0"
|
|
|
|
- name: "Ensure SSH listens on both IPv4 and IPv6"
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: '^#?AddressFamily'
|
|
line: "AddressFamily any"
|
|
state: present
|
|
notify: restart ssh
|
|
|
|
- name: "Comment out GSSAPIAuthentication in ssh_config (removed in OpenSSH 10)"
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/ssh/ssh_config
|
|
regexp: '^(?!\s*#)\s*GSSAPIAuthentication\s'
|
|
line: '#GSSAPIAuthentication yes'
|
|
state: present
|
|
when: ansible_facts['distribution_release'] == 'trixie'
|