commited current state

roles/os-updates/defaults/main.yml

@@ -5,5 +5,9 @@ os_update_mirrors:
   # Role needs two mirros to use for the sources.list.j2 Template
   - "http://deb.debian.org/debian" # Enter a main mirror here (not security)
   - "http://security.debian.org/debian-security" # Enter a security mirror here
-os_update_major_version: false # Can either be true or false | To toggle if systems need to be upgraded to newer codename
-os_update_version_codename: "{{ ansible_distribution_release }}" # KEEP UNTOUCHED!! | Used for jinja2 Template fill in as it determines the current codename of system where ansible is run on
+os_update_version_codename: "{{ ansible_distribution_release }}" # KEEP UNTOUCHED!! | Used for jinja2 Template fill in as it determines the current codename of system where ansible is run on
+os_update_debian_codenames:
+  # Only these suites are considered Debian codenames and will be rewritten in sources.list.d
+  - trixie
+  - bookworm
+  - bullseye

roles/os-updates/handlers/main.yml

@@ -8,4 +8,4 @@
   async: 1
   poll: 0
   ignore_errors: true
-  when: reboot_required.stdout == "yes"
+  when: reboot_required == "yes"

roles/os-updates/tasks/main.yml

@@ -3,10 +3,5 @@
   include_tasks: update_mirrors.yml
   ignore_errors: true
 
-- name: Upgrade to new major version if enabled
-  when: os_update_major_version
-  include_tasks: update_major_version.yml
-  ignore_errors: true
-
 - name: Upgrade all packages
   include_tasks: upgrade_packages.yml

roles/os-updates/tasks/update_major_version.yml

@@ -1,44 +0,0 @@
-- name: Backup existing sources in /etc/apt
-  copy:
-    src: "{{ item }}"
-    dest: "{{ item }}.bak"
-    remote_src: yes
-  loop: "{{ lookup('ansible.builtin.fileglob', '/etc/apt/sources.list.d/*.list') + ['/etc/apt/sources.list'] }}"
-  when: item | file
-
-- name: Update sources.list for new major version
-  template:
-    src: sources.list.j2
-    dest: /etc/apt/sources.list
-  vars:
-    os_update_version_codename: "{{ new_version_codename }}" # Variable gets passed by main.yml task
-
-- name: Update additional repositories in /etc/apt/sources.list.d (deb822 format)
-  replace:
-    path: "{{ item }}"
-    regexp: '^(Suites:.*\s)({{ os_update_version_codename }})(\s|$)'
-    replace: '\1{{ new_version_codename }}\3'
-  loop: "{{ lookup('ansible.builtin.fileglob', '/etc/apt/sources.list.d/*.sources') }}"
-  when: item | file
-  ignore_errors: true
-
-- name: Update additional repositories in /etc/apt/sources.list.d (old format fallback)
-  lineinfile:
-    path: "{{ item }}"
-    regexp: '^(deb .* )({{ os_update_version_codename }})'
-    replace: '\1{{ new_version_codename }}'
-  loop: "{{ lookup('ansible.builtin.fileglob', '/etc/apt/sources.list.d/*.list') }}"
-  when: item | file
-  ignore_errors: true
-
-- name: Update apt cache
-  apt:
-    update_cache: yes
-
-- name: Perform distribution upgrade
-  apt:
-    upgrade: yes
-    allow_unauthenticated: yes
-  notify:
-    - Reboot system
-    - apt cleanup

roles/os-updates/tasks/update_mirrors.yml

@@ -1,20 +1,66 @@
+- name: Run last dist upgrade before changing codename
+  apt:
+    update_cache: yes
+    upgrade: dist
+  when: ansible_facts['distribution_release'] != os_update_version_codename
+
 - name: Backup existing sources.list
   copy:
     src: /etc/apt/sources.list
     dest: /etc/apt/sources.list.bak
     remote_src: yes
     force: yes
+  ignore_errors: true
+  when: ansible_facts['distribution_version'] is version('13', '<=') # Only apply under Debian 13 and newer
 
-- name: Remove existing debian.sources file from LXC image
+- name: Remove existing sources.list to avoid conflicts with new deb822 format
   file:
-    path: /etc/apt/sources.list.d/debian.sources
+    path: /etc/apt/sources.list
     state: absent
+  when: ansible_facts['distribution_version'] is version('13', '>=') # Only apply for Debian 13 and newer
 
-- name: Update sources.list with new mirrors
+- name: Update sources.list.d with new mirrors
+  template:
+    src: sources.list-deb822.j2
+    dest: /etc/apt/sources.list.d/debian.sources
+  when: ansible_facts['distribution_version'] is version('13', '>=') # Only apply for Debian 13 and newer
+  register: cache_update_needed
+
+- name: Update sources.list with new mirrors for older Debian versions
   template:
     src: sources.list.j2
     dest: /etc/apt/sources.list
+  when: ansible_facts['distribution_version'] is version('13', '<') # Only apply for Debian versions older than 13
+  register: cache_update_needed
+
+- name: Find sources list fragments
+  find:
+    paths: /etc/apt/sources.list.d
+    patterns: "*.list,*.sources"
+    file_type: file
+  register: apt_sources_list_fragments
+
+- name: Align suite codenames in sources.list.d for .list files
+  replace:
+    path: "{{ item.path }}"
+    backup: yes
+    regexp: '^(deb(?:-src)?\s+(?:\[[^\]]+\]\s+)?\S+\s+)({{ os_update_debian_codenames | join("|") }})(-[^\s]+)?(\s+.+)$'
+    replace: '\1{{ os_update_version_codename }}\3\4'
+  loop: "{{ apt_sources_list_fragments.files }}"
+  when: (item.path | regex_search('\.list$')) is not none
+  register: cache_update_needed
+
+- name: Align suite codenames in sources.list.d for .sources files
+  replace:
+    path: "{{ item.path }}"
+    backup: yes
+    regexp: '^(Suites:\s+)({{ os_update_debian_codenames | join("|") }})(-[^\s]+)?(.*)$'
+    replace: '\1{{ os_update_version_codename }}\3\4'
+  loop: "{{ apt_sources_list_fragments.files }}"
+  when: (item.path | regex_search('\.sources$')) is not none
+  register: cache_update_needed
 
 - name: Update apt cache
   apt:
-    update_cache: yes
+    update_cache: yes
+  when: cache_update_needed is changed

roles/os-updates/tasks/upgrade_packages.yml

@@ -16,12 +16,15 @@
     echo "{{ latest_kernel.stdout }}" | grep -c $(uname -r)
   register: kernel_match
   changed_when: false
-  ignore_errors: true
-  when: ansible_virtualization_type != 'lxc'
+  failed_when: false
+  when: ansible_facts['virtualization_type'] != 'lxc'
 
 - name: Mark reboot required if a new kernel is installed
   set_fact:
     reboot_required: "yes"
+  changed_when: true
+  notify:
+    - Reboot system
   when: 
-    - ansible_virtualization_type != 'lxc'
-    - kernel_match.stdout == "0"
+    - ansible_facts['virtualization_type'] != 'lxc'
+    - (kernel_match.stdout | int) == 0

roles/os-updates/templates/sources.list-deb822.j2

@@ -0,0 +1,26 @@
+# {{ ansible_managed }}
+# Package sources for Debian {{ os_update_version_codename }}. This file is generated by Ansible using the os-updates role.
+# Using deb822 format for sources.list as it is the new standard in Debian 13 and newer. This file is placed in /etc/apt/sources.list.d/debian.sources to avoid conflicts with older sources.list files and to allow coexistence during transition.
+Types: deb
+URIs: {{ os_update_mirrors[0] }}
+Suites: {{ os_update_version_codename }}
+Components: main contrib non-free non-free-firmware
+Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
+
+Types: deb
+URIs: {{ os_update_mirrors[0] }}
+Suites: {{ os_update_version_codename }}-updates
+Components: main contrib non-free non-free-firmware
+Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
+
+Types: deb
+URIs: {{ os_update_mirrors[0] }}
+Suites: {{ os_update_version_codename }}-backports
+Components: main contrib non-free non-free-firmware
+Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
+
+Types: deb
+URIs: {{ os_update_mirrors[1] }}
+Suites: {{ os_update_version_codename }}-security
+Components: main contrib non-free non-free-firmware
+Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg

roles/os-updates/templates/sources.list.j2

@@ -1,20 +1,8 @@
-# {{ ansible_managed }}
-Types: deb
-URIs: {{ os_update_mirrors[0] }}
-Suites: {{ os_update_version_codename }}
-Components: main contrib non-free non-free-firmware
+# {{ ansible_managed }} | This file is managed by Ansible. Do not edit it manually.
+# Package sources for Debian {{ os_update_version_codename }}. This file is generated by Ansible using the os-updates role.
 
-Types: deb
-URIs: {{ os_update_mirrors[0] }}
-Suites: {{ os_update_version_codename }}-updates
-Components: main contrib non-free non-free-firmware
+deb {{ os_update_mirrors[0] }} {{ os_update_version_codename }} main contrib non-free non-free-firmware
+deb {{ os_update_mirrors[0] }} {{ os_update_version_codename }}-updates main contrib non-free non-free-firmware
+deb {{ os_update_mirrors[0] }} {{ os_update_version_codename }}-backports main contrib non-free non-free-firmware
 
-Types: deb
-URIs: {{ os_update_mirrors[0] }}
-Suites: {{ os_update_version_codename }}-backports
-Components: main contrib non-free non-free-firmware
-
-Types: deb
-URIs: {{ os_update_mirrors[1] }}
-Suites: {{ os_update_version_codename }}-security
-Components: main contrib non-free non-free-firmware
+deb {{ os_update_mirrors[1] }} {{ os_update_version_codename }}-security main contrib non-free non-free-firmware