diff options
| author | Luke Hoersten <[email protected]> | 2026-08-01 09:53:44 -0500 |
|---|---|---|
| committer | Luke Hoersten <[email protected]> | 2026-08-01 09:53:44 -0500 |
| commit | a457c0932b697fd32febe79c473c7e06dccd355a (patch) | |
| tree | b5ee3640d2d0f6e2d4a19ccef1ecdee3a243bde9 /rpi-base/tasks/main.yaml | |
| parent | 553be3539fcc475ca91ffed17208b730eef7c331 (diff) | |
rpi-base: role-owned netplan replaces wpa_supplicant; auto-upgrades gain -updates and 04:00 reboot
Networking: one 40-net.yaml (eth0 always, wifi via rpi_base_wifi_*) with
cloud-init's 50-cloud-init.yaml deleted after first boot. cloud-init still
renders it on an instance_id bump, and it sorts later, so editing the
card's network-config and bumping meta-data is the headless rescue path.
ssh_deletekeys off so a rescue bump keeps the host keys.
Auto-updates: periodic switches and local policy merged into one
52unattended-upgrades-local; 50unattended-upgrades stays a distro
conffile and debconf's 20auto-upgrades can no longer disable anything.
Diffstat (limited to 'rpi-base/tasks/main.yaml')
| -rw-r--r-- | rpi-base/tasks/main.yaml | 17 |
1 files changed, 11 insertions, 6 deletions
diff --git a/rpi-base/tasks/main.yaml b/rpi-base/tasks/main.yaml index 2a94df5..b7168e3 100644 --- a/rpi-base/tasks/main.yaml +++ b/rpi-base/tasks/main.yaml @@ -13,9 +13,8 @@ become: yes timezone: name="{{rpi_base_timezone}}" -- name: setup wifi - become: yes - template: src="wpa_supplicant.conf.j2" dest="/etc/wpa_supplicant/wpa_supplicant.conf" mode="0600" +- include_tasks: netplan.yaml + when: ansible_distribution == "Ubuntu" - name: update apt package cache become: yes @@ -25,9 +24,12 @@ become: yes apt: name="{{rpi_base_apt_packages}}" state="latest" +# Periodic switches plus local policy in one file; the stock +# 50unattended-upgrades (security-only, no reboot) stays pristine and the +# debconf-owned 20auto-upgrades is left alone (52 sorts later and wins). - name: configure auto upgrades become: yes - copy: src="20auto-upgrades" dest="/etc/apt/apt.conf.d/20auto-upgrades" + copy: src="52unattended-upgrades-local" dest="/etc/apt/apt.conf.d/52unattended-upgrades-local" - name: configure logrotate become: yes @@ -69,9 +71,12 @@ append: yes no_log: true -- name: authorize ssh keys +- name: authorize ssh key become: yes - authorized_key: user="{{item}}" key="https://github.com/{{github_user}}.keys" + authorized_key: + user: "{{item}}" + key: "{{ lookup('file', rpi_base_ssh_public_key_file) }}" + exclusive: yes loop: - "{{admin_user_name}}" - "{{ansible_user}}" |