From a457c0932b697fd32febe79c473c7e06dccd355a Mon Sep 17 00:00:00 2001
From: Luke Hoersten <luke@hoersten.org>
Date: Sat, 1 Aug 2026 09:53:44 -0500
Subject: rpi-base: role-owned netplan replaces wpa_supplicant; auto-upgrades
 gain -updates and 04:00 reboot

Networking: one 40-net.yaml (eth0 always, wifi via rpi_base_wifi_*) with
cloud-init's 50-cloud-init.yaml deleted after first boot. cloud-init still
renders it on an instance_id bump, and it sorts later, so editing the
card's network-config and bumping meta-data is the headless rescue path.
ssh_deletekeys off so a rescue bump keeps the host keys.

Auto-updates: periodic switches and local policy merged into one
52unattended-upgrades-local; 50unattended-upgrades stays a distro
conffile and debconf's 20auto-upgrades can no longer disable anything.
---
 rpi-base/tasks/main.yaml    | 17 +++++++++++------
 rpi-base/tasks/netplan.yaml | 25 +++++++++++++++++++++++++
 2 files changed, 36 insertions(+), 6 deletions(-)
 create mode 100644 rpi-base/tasks/netplan.yaml

(limited to 'rpi-base/tasks')

diff --git a/rpi-base/tasks/main.yaml b/rpi-base/tasks/main.yaml
index 2a94df5..b7168e3 100644
--- a/rpi-base/tasks/main.yaml
+++ b/rpi-base/tasks/main.yaml
@@ -13,9 +13,8 @@
   become: yes
   timezone: name="{{rpi_base_timezone}}"
 
-- name: setup wifi
-  become: yes
-  template: src="wpa_supplicant.conf.j2" dest="/etc/wpa_supplicant/wpa_supplicant.conf" mode="0600"
+- include_tasks: netplan.yaml
+  when: ansible_distribution == "Ubuntu"
 
 - name: update apt package cache
   become: yes
@@ -25,9 +24,12 @@
   become: yes
   apt: name="{{rpi_base_apt_packages}}" state="latest"
 
+# Periodic switches plus local policy in one file; the stock
+# 50unattended-upgrades (security-only, no reboot) stays pristine and the
+# debconf-owned 20auto-upgrades is left alone (52 sorts later and wins).
 - name: configure auto upgrades
   become: yes
-  copy: src="20auto-upgrades" dest="/etc/apt/apt.conf.d/20auto-upgrades"
+  copy: src="52unattended-upgrades-local" dest="/etc/apt/apt.conf.d/52unattended-upgrades-local"
 
 - name: configure logrotate
   become: yes
@@ -69,9 +71,12 @@
     append: yes
   no_log: true
 
-- name: authorize ssh keys
+- name: authorize ssh key
   become: yes
-  authorized_key: user="{{item}}" key="https://github.com/{{github_user}}.keys"
+  authorized_key:
+    user: "{{item}}"
+    key: "{{ lookup('file', rpi_base_ssh_public_key_file) }}"
+    exclusive: yes
   loop:
     - "{{admin_user_name}}"
     - "{{ansible_user}}"
diff --git a/rpi-base/tasks/netplan.yaml b/rpi-base/tasks/netplan.yaml
new file mode 100644
index 0000000..eda0e69
--- /dev/null
+++ b/rpi-base/tasks/netplan.yaml
@@ -0,0 +1,25 @@
+---
+
+# One role-owned netplan file replaces cloud-init's render: eth0 always,
+# wifi when enabled. cloud-init only re-renders on a new instance_id, so
+# the deletion below sticks across reboots.
+#
+# RESCUE a dark pi: on the card's FAT partition, edit network-config (a
+# phone hotspot entry works) and bump instance_id in meta-data, then
+# boot. The re-rendered 50-cloud-init.yaml sorts after 40-net.yaml and
+# overrides it; the next playbook run deletes it again.
+- name: install netplan config
+  become: yes
+  template: src="40-net.yaml.j2" dest="/etc/netplan/40-net.yaml" mode="0600"
+  notify: apply netplan
+
+- name: remove the cloud-init netplan config
+  become: yes
+  file: path="/etc/netplan/50-cloud-init.yaml" state="absent"
+  notify: apply netplan
+
+# A rescue instance_id bump re-runs cloud-init's ssh module, which by
+# default deletes and regenerates the host keys; keep them.
+- name: keep ssh host keys on cloud-init re-runs
+  become: yes
+  copy: src="10-rpi-base.cfg" dest="/etc/cloud/cloud.cfg.d/10-rpi-base.cfg"
-- 
cgit v1.2.3