11 files changed, 56 insertions, 96 deletions
diff --git a/aws-s3-backup/defaults/main.yaml b/aws-s3-backup/defaults/main.yaml
index d17817e..9f59207 100644
--- a/aws-s3-backup/defaults/main.yaml
+++ b/aws-s3-backup/defaults/main.yaml
@@ -1,6 +1,7 @@
 ---
 
 aws_s3_backup_region: "us-east-1"
-aws_s3_backup_pip_packages:
+# apt awscli is v2 (the old pip package was v1); the s3/s3api commands the
+# backup scripts use behave the same. boto3 was dropped: nothing used it.
+aws_s3_backup_apt_packages:
   - "awscli"
-  - "boto3"
diff --git a/aws-s3-backup/tasks/main.yaml b/aws-s3-backup/tasks/main.yaml
index a6f5164..46b6a91 100644
--- a/aws-s3-backup/tasks/main.yaml
+++ b/aws-s3-backup/tasks/main.yaml
@@ -1,8 +1,8 @@
 ---
 
-- name: pip install aws cli packages
+- name: install aws cli
   become: yes
-  pip: name="{{aws_s3_backup_pip_packages}}" break_system_packages="true"
+  apt: name="{{aws_s3_backup_apt_packages}}"
 
 - name: create aws config dir for root
   become: yes
diff --git a/dendrite/build/tasks/main.yaml b/dendrite/build/tasks/main.yaml
index 10f2e12..42d263b 100644
--- a/dendrite/build/tasks/main.yaml
+++ b/dendrite/build/tasks/main.yaml
@@ -9,17 +9,11 @@
     group: "{{ansible_user}}"
     mode: "0755"
 
+# The unversioned package tracks the release default (1.26 on 26.04) and
+# provides /usr/bin/go itself, so no pinned version or hand symlink.
 - name: install golang
   become: yes
-  apt: name="golang-1.21-go"
-
-- name: link go bin
-  become: yes
-  file:
-    src: "/usr/lib/go-1.21/bin/go"
-    dest: "/usr/bin/go"
-    state: "link"
-    mode: "0755"
+  apt: name="golang-go"
 
 - name: unarchive dendrite
   unarchive:
diff --git a/koreader-sync/tasks/main.yaml b/koreader-sync/tasks/main.yaml
index bec8d30..e51d925 100644
--- a/koreader-sync/tasks/main.yaml
+++ b/koreader-sync/tasks/main.yaml
@@ -1,19 +1,14 @@
 ---
 
-- name: add docker apt key
-  become: yes
-  get_url:
-    url: "https://download.docker.com/linux/ubuntu/gpg"
-    dest: "/etc/apt/trusted.gpg.d/docker.asc"
-    mode: "0644"
-
-- name: add docker apt repo
-  become: yes
-  apt_repository: repo="deb [arch=arm64 signed-by=/etc/apt/trusted.gpg.d/docker.asc] https://download.docker.com/linux/ubuntu noble stable"
-
+# 26.04 ships a current docker, so no more docker.com repo. Migrating a
+# host off docker-ce needs cleanup-third-party.yaml first: docker.io cannot
+# install while docker-ce holds the same files.
 - name: install docker apt packages
   become: yes
-  apt: name="docker-ce"
+  apt:
+    name:
+      - "docker.io"
+      - "docker-compose-v2"
 
 - name: add korsync user
   become: yes
diff --git a/miniflux/defaults/main.yaml b/miniflux/defaults/main.yaml
index 17788ef..67fa001 100644
--- a/miniflux/defaults/main.yaml
+++ b/miniflux/defaults/main.yaml
@@ -1,8 +1,4 @@
 ---
 
 miniflux_port: "8555"
-# miniflux_admin_pass: — required, set in host_vars
-miniflux_arch: "arm64"
-# https://github.com/miniflux/miniflux/releases
-miniflux_version: "2.2.18"
-miniflux_url: "https://github.com/miniflux/miniflux/releases/download/{{miniflux_version}}/miniflux-linux-{{miniflux_arch}}"
+# miniflux_admin_pass: required, set in host_vars
diff --git a/miniflux/files/miniflux.service b/miniflux/files/miniflux.service
deleted file mode 100644
index 7a21748..0000000
--- a/miniflux/files/miniflux.service
+++ /dev/null
@@ -1,13 +0,0 @@
-[Unit]
-Description=Miniflux Feed Reader
-After=network.target postgresql.service
-
-[Service]
-Type=simple
-EnvironmentFile=/etc/miniflux.conf
-User=miniflux
-ExecStart=/usr/local/bin/miniflux
-Restart=always
-
-[Install]
-WantedBy=multi-user.target
diff --git a/miniflux/tasks/main.yaml b/miniflux/tasks/main.yaml
index ffa6d0f..333bef9 100644
--- a/miniflux/tasks/main.yaml
+++ b/miniflux/tasks/main.yaml
@@ -1,26 +1,29 @@
 ---
 
-- name: add miniflux user
+# The package's dbconfig-common hook would create its own database; preseed
+# it off since this role manages the db and config itself.
+- name: preseed dbconfig to skip the package db setup
   become: yes
-  user: name="miniflux" shell="/bin/false" system="yes" create_home="no"
+  debconf:
+    name: "miniflux"
+    question: "miniflux/dbconfig-install"
+    vtype: "boolean"
+    value: "false"
 
-- name: download miniflux
+# The package creates the miniflux user and ships the systemd unit, which
+# runs /usr/bin/miniflux -c /etc/miniflux/miniflux.conf as user miniflux.
+- name: install miniflux
   become: yes
-  get_url:
-    url: "{{miniflux_url}}"
-    dest: "/usr/local/bin/miniflux"
-    owner: "root"
-    group: "root"
-    mode: "0600"
+  apt: name="miniflux"
 
 - name: configure miniflux
   become: yes
   template:
     src: "miniflux.conf.j2"
-    dest: "/etc/miniflux.conf"
+    dest: "/etc/miniflux/miniflux.conf"
     owner: "root"
-    group: "root"
-    mode: "0600"
+    group: "miniflux"
+    mode: "0640"
   notify: restart miniflux service
   no_log: true
 
@@ -40,13 +43,6 @@
   changed_when: false
   no_log: true
 
-- name: install systemd service
-  become: yes
-  copy:
-    src: "miniflux.service"
-    dest: "/lib/systemd/system/miniflux.service"
-  notify: restart miniflux service
-
 - name: ensure service is started
   become: yes
   systemd: name="miniflux.service" enabled="yes" state="started"
diff --git a/nostr/build/tasks/main.yaml b/nostr/build/tasks/main.yaml
index 8d7b891..2f2c45f 100644
--- a/nostr/build/tasks/main.yaml
+++ b/nostr/build/tasks/main.yaml
@@ -9,17 +9,11 @@
     group: "{{ansible_user}}"
     mode: "0755"
 
+# The unversioned package tracks the release default (1.26 on 26.04) and
+# provides /usr/bin/go itself, so no pinned version or hand symlink.
 - name: install golang
   become: yes
-  apt: name="golang-1.21-go"
-
-- name: link go bin
-  become: yes
-  file:
-    src: "/usr/lib/go-1.21/bin/go"
-    dest: "/usr/bin/go"
-    state: "link"
-    mode: "0755"
+  apt: name="golang-go"
 
 - name: unarchive nostr relayer
   unarchive:
diff --git a/prometheus/client/tasks/main.yaml b/prometheus/client/tasks/main.yaml
index 707b06a..7e8fb68 100644
--- a/prometheus/client/tasks/main.yaml
+++ b/prometheus/client/tasks/main.yaml
@@ -8,22 +8,35 @@
   become: yes
   systemd: name="prometheus-node-exporter.service" enabled="yes" state="started"
 
+# Optional per-service exporters, both in 26.04 apt (verified: nginx 1.5.1,
+# postgres 0.19.0). Uncomment to deploy.
+
 #   # Nginx
 # - name: check if running nginx
 #   stat: path="/etc/nginx/"
 #   register: stat_nginx_conf
 
-# - name: install prometheus-nginx-exporter
+# - name: install prometheus nginx exporter
 #   become: yes
 #   apt: name="prometheus-nginx-exporter"
 #   when: stat_nginx_conf.stat.exists
 
+# - name: ensure prometheus nginx exporter is started
+#   become: yes
+#   systemd: name="prometheus-nginx-exporter.service" enabled="yes" state="started"
+#   when: stat_nginx_conf.stat.exists
+
 #   # PostgreSQL
 # - name: check if running postgresql
 #   stat: path="/etc/postgresql/"
 #   register: stat_postgresql_conf
 
-# - name: install prometheus-postgresql-exporter
+# - name: install prometheus postgres exporter
 #   become: yes
 #   apt: name="prometheus-postgres-exporter"
 #   when: stat_postgresql_conf.stat.exists
+
+# - name: ensure prometheus postgres exporter is started
+#   become: yes
+#   systemd: name="prometheus-postgres-exporter.service" enabled="yes" state="started"
+#   when: stat_postgresql_conf.stat.exists
diff --git a/rpi-base/tasks/main.yaml b/rpi-base/tasks/main.yaml
index 2e321d2..087d964 100644
--- a/rpi-base/tasks/main.yaml
+++ b/rpi-base/tasks/main.yaml
@@ -9,17 +9,6 @@
   become: yes
   apt: state="absent" name="dphys-swapfile"
 
-- name: add log2ram apt key
-  become: yes
-  get_url:
-    url: "https://azlux.fr/repo.gpg.key"
-    dest: "/etc/apt/trusted.gpg.d/log2ram.asc"
-    mode: "0644"
-
-- name: add log2ram apt repo
-  become: yes
-  apt_repository: repo="deb [signed-by=/etc/apt/trusted.gpg.d/log2ram.asc] https://packages.azlux.fr/debian/ buster main"
-
 - name: set timezone
   become: yes
   timezone: name="{{rpi_base_timezone}}"
diff --git a/scrypted/tasks/main.yaml b/scrypted/tasks/main.yaml
index b8b33b0..2b9e9e3 100644
--- a/scrypted/tasks/main.yaml
+++ b/scrypted/tasks/main.yaml
@@ -1,19 +1,14 @@
 ---
 
-- name: add docker apt key
-  become: yes
-  get_url:
-    url: "https://download.docker.com/linux/ubuntu/gpg"
-    dest: "/etc/apt/trusted.gpg.d/docker.asc"
-    mode: "0644"
-
-- name: add docker apt repo
-  become: yes
-  apt_repository: repo="deb [arch=arm64 signed-by=/etc/apt/trusted.gpg.d/docker.asc] https://download.docker.com/linux/ubuntu noble stable"
-
+# 26.04 ships a current docker, so no more docker.com repo. Migrating a
+# host off docker-ce needs cleanup-third-party.yaml first: docker.io cannot
+# install while docker-ce holds the same files.
 - name: install docker apt packages
   become: yes
-  apt: name="docker-ce" update_cache="yes"
+  apt:
+    name:
+      - "docker.io"
+      - "docker-compose-v2"
 
 - name: add scrypted user
   become: yes