From a457c0932b697fd32febe79c473c7e06dccd355a Mon Sep 17 00:00:00 2001 From: Luke Hoersten Date: Sat, 1 Aug 2026 09:53:44 -0500 Subject: rpi-base: role-owned netplan replaces wpa_supplicant; auto-upgrades gain -updates and 04:00 reboot Networking: one 40-net.yaml (eth0 always, wifi via rpi_base_wifi_*) with cloud-init's 50-cloud-init.yaml deleted after first boot. cloud-init still renders it on an instance_id bump, and it sorts later, so editing the card's network-config and bumping meta-data is the headless rescue path. ssh_deletekeys off so a rescue bump keeps the host keys. Auto-updates: periodic switches and local policy merged into one 52unattended-upgrades-local; 50unattended-upgrades stays a distro conffile and debconf's 20auto-upgrades can no longer disable anything. --- rpi-base/tasks/main.yaml | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) (limited to 'rpi-base/tasks/main.yaml') diff --git a/rpi-base/tasks/main.yaml b/rpi-base/tasks/main.yaml index 2a94df5..b7168e3 100644 --- a/rpi-base/tasks/main.yaml +++ b/rpi-base/tasks/main.yaml @@ -13,9 +13,8 @@ become: yes timezone: name="{{rpi_base_timezone}}" -- name: setup wifi - become: yes - template: src="wpa_supplicant.conf.j2" dest="/etc/wpa_supplicant/wpa_supplicant.conf" mode="0600" +- include_tasks: netplan.yaml + when: ansible_distribution == "Ubuntu" - name: update apt package cache become: yes @@ -25,9 +24,12 @@ become: yes apt: name="{{rpi_base_apt_packages}}" state="latest" +# Periodic switches plus local policy in one file; the stock +# 50unattended-upgrades (security-only, no reboot) stays pristine and the +# debconf-owned 20auto-upgrades is left alone (52 sorts later and wins). - name: configure auto upgrades become: yes - copy: src="20auto-upgrades" dest="/etc/apt/apt.conf.d/20auto-upgrades" + copy: src="52unattended-upgrades-local" dest="/etc/apt/apt.conf.d/52unattended-upgrades-local" - name: configure logrotate become: yes @@ -69,9 +71,12 @@ append: yes no_log: true -- name: authorize ssh keys +- name: authorize ssh key become: yes - authorized_key: user="{{item}}" key="https://github.com/{{github_user}}.keys" + authorized_key: + user: "{{item}}" + key: "{{ lookup('file', rpi_base_ssh_public_key_file) }}" + exclusive: yes loop: - "{{admin_user_name}}" - "{{ansible_user}}" -- cgit v1.2.3