From ffc1a6a8a533468fca7476d46418af0efaf1c6cd Mon Sep 17 00:00:00 2001
From: DerLinkman <derlinkman@gmail.com>
Date: Fri, 20 Feb 2026 22:19:57 +0100
Subject: [PATCH] update state

---
 bootstrap.yml                                 |  0
 roles/bootstrap/tasks/create-admin-user.yml   | 15 ++++++++++++
 roles/bootstrap/tasks/install-sudo.yml        |  6 +++++
 roles/os-updates/defaults/main.yml            |  4 ++--
 .../os-updates/tasks/update_major_version.yml | 14 +++++++++--
 roles/os-updates/tasks/update_mirrors.yml     |  4 ++++
 roles/os-updates/tasks/upgrade_packages.yml   |  6 ++++-
 roles/os-updates/templates/sources.list.j2    | 23 +++++++++++++++----
 8 files changed, 63 insertions(+), 9 deletions(-)
 create mode 100644 bootstrap.yml
 create mode 100644 roles/bootstrap/tasks/create-admin-user.yml
 create mode 100644 roles/bootstrap/tasks/install-sudo.yml

diff --git a/bootstrap.yml b/bootstrap.yml
new file mode 100644
index 0000000..e69de29
diff --git a/roles/bootstrap/tasks/create-admin-user.yml b/roles/bootstrap/tasks/create-admin-user.yml
new file mode 100644
index 0000000..3b83165
--- /dev/null
+++ b/roles/bootstrap/tasks/create-admin-user.yml
@@ -0,0 +1,15 @@
+---
+- name: Create admin user
+  user:
+    name: admin
+    groups: sudo
+    shell: /bin/bash
+    createhome: yes
+    state: present
+
+- name: Set sudo privileges for admin user
+  lineinfile:
+    path: /etc/sudoers.d/10-admin
+    line: "admin ALL=(ALL) NOPASSWD:ALL"
+    validate: 'visudo -cf %s'
+    state: present
\ No newline at end of file
diff --git a/roles/bootstrap/tasks/install-sudo.yml b/roles/bootstrap/tasks/install-sudo.yml
new file mode 100644
index 0000000..4011a9b
--- /dev/null
+++ b/roles/bootstrap/tasks/install-sudo.yml
@@ -0,0 +1,6 @@
+---
+- name: Install sudo
+  apt:
+    name: sudo
+    state: present
+  become: yes
\ No newline at end of file
diff --git a/roles/os-updates/defaults/main.yml b/roles/os-updates/defaults/main.yml
index d0d03c2..e697faa 100644
--- a/roles/os-updates/defaults/main.yml
+++ b/roles/os-updates/defaults/main.yml
@@ -3,7 +3,7 @@ os_update_auto_upgrade: true
 os_also_update_mirror: false
 os_update_mirrors:
   # Role needs two mirros to use for the sources.list.j2 Template
-  - "http://mirror.tinc.gmbh/debian" # Enter a main mirror here (not security)
-  - "http://mirror.tinc.gmbh/debian-security" # Enter a security mirror here
+  - "http://deb.debian.org/debian" # Enter a main mirror here (not security)
+  - "http://security.debian.org/debian-security" # Enter a security mirror here
 os_update_major_version: false # Can either be true or false | To toggle if systems need to be upgraded to newer codename
 os_update_version_codename: "{{ ansible_distribution_release }}" # KEEP UNTOUCHED!! | Used for jinja2 Template fill in as it determines the current codename of system where ansible is run on
\ No newline at end of file
diff --git a/roles/os-updates/tasks/update_major_version.yml b/roles/os-updates/tasks/update_major_version.yml
index 0378f21..03343e8 100644
--- a/roles/os-updates/tasks/update_major_version.yml
+++ b/roles/os-updates/tasks/update_major_version.yml
@@ -13,13 +13,23 @@
   vars:
     os_update_version_codename: "{{ new_version_codename }}" # Variable gets passed by main.yml task
 
-- name: Update additional repositories in /etc/apt/sources.list.d
+- name: Update additional repositories in /etc/apt/sources.list.d (deb822 format)
+  replace:
+    path: "{{ item }}"
+    regexp: '^(Suites:.*\s)({{ os_update_version_codename }})(\s|$)'
+    replace: '\1{{ new_version_codename }}\3'
+  loop: "{{ lookup('ansible.builtin.fileglob', '/etc/apt/sources.list.d/*.sources') }}"
+  when: item | file
+  ignore_errors: true
+
+- name: Update additional repositories in /etc/apt/sources.list.d (old format fallback)
   lineinfile:
     path: "{{ item }}"
     regexp: '^(deb .* )({{ os_update_version_codename }})'
-    line: '\1{{ new_version_codename }}'
+    replace: '\1{{ new_version_codename }}'
   loop: "{{ lookup('ansible.builtin.fileglob', '/etc/apt/sources.list.d/*.list') }}"
   when: item | file
+  ignore_errors: true
 
 - name: Update apt cache
   apt:
diff --git a/roles/os-updates/tasks/update_mirrors.yml b/roles/os-updates/tasks/update_mirrors.yml
index b2e18e3..bdedd13 100644
--- a/roles/os-updates/tasks/update_mirrors.yml
+++ b/roles/os-updates/tasks/update_mirrors.yml
@@ -5,6 +5,10 @@
     remote_src: yes
     force: yes
 
+- name: Remove existing debian.sources file from LXC image
+  file:
+    path: /etc/apt/sources.list.d/debian.sources
+    state: absent
 
 - name: Update sources.list with new mirrors
   template:
diff --git a/roles/os-updates/tasks/upgrade_packages.yml b/roles/os-updates/tasks/upgrade_packages.yml
index 5bf3956..67516cf 100644
--- a/roles/os-updates/tasks/upgrade_packages.yml
+++ b/roles/os-updates/tasks/upgrade_packages.yml
@@ -9,6 +9,7 @@
   shell: |
     dpkg -l | grep -E '^ii' | grep 'linux-image-[0-9]' | awk '{print $2}' | sort | tail -n 1
   register: latest_kernel
+  when: ansible_virtualization_type != 'lxc'
 
 - name: Check if running kernel matches the latest installed kernel
   shell: |
@@ -16,8 +17,11 @@
   register: kernel_match
   changed_when: false
   ignore_errors: true
+  when: ansible_virtualization_type != 'lxc'
 
 - name: Mark reboot required if a new kernel is installed
   set_fact:
     reboot_required: "yes"
-  when: kernel_match.stdout == "0"
\ No newline at end of file
+  when: 
+    - ansible_virtualization_type != 'lxc'
+    - kernel_match.stdout == "0"
\ No newline at end of file
diff --git a/roles/os-updates/templates/sources.list.j2 b/roles/os-updates/templates/sources.list.j2
index eda8338..4db3da0 100644
--- a/roles/os-updates/templates/sources.list.j2
+++ b/roles/os-updates/templates/sources.list.j2
@@ -1,5 +1,20 @@
 # {{ ansible_managed }}
-deb {{ os_update_mirrors[0] }} {{ os_update_version_codename }} main contrib non-free non-free-firmware
-deb {{ os_update_mirrors[0] }} {{ os_update_version_codename }}-updates main contrib non-free non-free-firmware
-deb {{ os_update_mirrors[0] }} {{ os_update_version_codename }}-backports main contrib non-free non-free-firmware
-deb {{ os_update_mirrors[1] }} {{ os_update_version_codename }}-security main contrib non-free non-free-firmware
\ No newline at end of file
+Types: deb
+URIs: {{ os_update_mirrors[0] }}
+Suites: {{ os_update_version_codename }}
+Components: main contrib non-free non-free-firmware
+
+Types: deb
+URIs: {{ os_update_mirrors[0] }}
+Suites: {{ os_update_version_codename }}-updates
+Components: main contrib non-free non-free-firmware
+
+Types: deb
+URIs: {{ os_update_mirrors[0] }}
+Suites: {{ os_update_version_codename }}-backports
+Components: main contrib non-free non-free-firmware
+
+Types: deb
+URIs: {{ os_update_mirrors[1] }}
+Suites: {{ os_update_version_codename }}-security
+Components: main contrib non-free non-free-firmware
\ No newline at end of file