Merge branch 'unstable' into stable

CHANGELOG.md

@@ -21,6 +21,24 @@ The **patch** part changes is incremented if multiple releases happen the same m
 
 ### Security
 
+## [23.04] 2023-04-23
+
+### Added
+
+* graylog: new role
+* lxc-php: add support for PHP 8.2 container
+
+### Changed
+
+* Use FQCN (Fully Qualified Collection Name)
+* apt: with Debian 12, backports are installed but disabled by default
+* openvpn: updated the README file
+* pgbouncer: add handler to restart the service
+
+### Fixed
+
+* generate-ldif: Support for Debian 12
+
 ## [23.03.1] 2023-03-16
 
 ### Added

amavis/handlers/main.yml

@@ -1,5 +1,5 @@
 ---
 - name: restart amavis
-  service:
+  ansible.builtin.service:
     name: amavis
     state: restarted

amavis/tasks/main.yml

@@ -1,6 +1,6 @@
 ---
 - name: install Amavis
-  apt:
+  ansible.builtin.apt:
     name:
       - postgrey
       - amavisd-new
@@ -9,7 +9,7 @@
   - amavis
 
 - name: configure Amavis
-  template:
+  ansible.builtin.template:
     src: amavis.conf.j2
     dest: /etc/amavis/conf.d/49-evolinux-defaults
     mode: "0644"

amazon-ec2/amazon-ec2-evolinux.yml

@@ -9,10 +9,10 @@
     aws_region: ca-central-1
 
   tasks:
-    - include_role:
+    - ansible.builtin.include_role:
         name: evolix/amazon-ec2
         tasks_from: setup.yml
-    - include_role:
+    - ansible.builtin.include_role:
         name: evolix/amazon-ec2
         tasks_from: create-instance.yml
 
@@ -51,7 +51,7 @@
   - mysql
 
   post_tasks:
-  - include_role:
+  - ansible.builtin.include_role:
       name: evolix/etc-git
       tasks_from: commit.yml
     vars:

amazon-ec2/tasks/create-instance.yml

@@ -1,7 +1,7 @@
 ---
 
 - name: Launch new instance(s)
-  ec2:
+  amazon.aws.ec2:
     state: present
     aws_access_key: "{{ aws_access_key }}"
     aws_secret_key: "{{ aws_secret_key }}"
@@ -16,19 +16,19 @@
   register: ec2
 
 - name: Add newly created instance(s) to inventory
-  add_host:
+  ansible.builtin.add_host:
     hostname: "{{ item.public_dns_name }}"
     groupname: launched-instances
     ansible_user: admin
     ansible_ssh_common_args: "-o StrictHostKeyChecking=no"
   loop: "{{ ec2.instances }}"
 
-- debug:
+- ansible.builtin.debug:
     msg: "Your newly created instance is reachable at: {{ item.public_dns_name }}"
   loop: "{{ ec2.instances }}"
 
 - name: Wait for SSH to come up on all instances (give up after 2m)
-  wait_for:
+  ansible.builtin.wait_for:
     state: started
     host: "{{ item.public_dns_name }}"
     port: 22

amazon-ec2/tasks/post-install.yml

@@ -1,5 +1,5 @@
 ---
 - name: Remove admin user
-  user:
+  ansible.builtin.user:
     name: admin
     state: absent

amazon-ec2/tasks/setup.yml

@@ -1,7 +1,7 @@
 ---
 
 - name: Create default security group
-  ec2_group:
+  amazon.aws.ec2_group:
     name: "{{ ec2_security_group.name }}"
     state: present
     aws_access_key: "{{ aws_access_key }}"
@@ -12,7 +12,7 @@
     rules_egress: "{{ ec2_security_group.rules_egress }}"
 
 - name: Create key pair
-  ec2_key:
+  amazon.aws.ec2_key:
     name: "{{ ec2_keyname }}"
     state: present
     aws_access_key: "{{ aws_access_key }}"

apache/handlers/main.yml

@@ -1,15 +1,15 @@
 ---
 - name: restart apache
-  service:
+  ansible.builtin.service:
     name: apache2
     state: restarted
 
 - name: reload apache
-  service:
+  ansible.builtin.service:
     name: apache2
     state: reloaded
 
 - name: restart munin-node
-  service:
+  ansible.builtin.service:
     name: munin-node
     state: restarted

apache/tasks/auth.yml

@@ -1,7 +1,7 @@
 ---
 
 - name: Init ipaddr_whitelist.conf file
-  copy:
+  ansible.builtin.copy:
     src: ipaddr_whitelist.conf
     dest: /etc/apache2/ipaddr_whitelist.conf
     owner: root
@@ -12,10 +12,10 @@
     - apache
 
 - name: Load IP whitelist task
-  include: ip_whitelist.yml
+  ansible.builtin.import_tasks: ip_whitelist.yml
 
 - name: include private IP whitelist for server-status
-  lineinfile:
+  ansible.builtin.lineinfile:
     dest: /etc/apache2/mods-available/status.conf
     line: "        include /etc/apache2/ipaddr_whitelist.conf"
     insertafter: 'SetHandler server-status'
@@ -24,7 +24,7 @@
     - apache
 
 - name: Copy private_htpasswd
-  copy:
+  ansible.builtin.copy:
     src: private_htpasswd
     dest: /etc/apache2/private_htpasswd
     owner: root
@@ -36,7 +36,7 @@
     - apache
 
 - name: add user:pwd to private htpasswd
-  lineinfile:
+  ansible.builtin.lineinfile:
     dest: /etc/apache2/private_htpasswd
     line: "{{ item }}"
     state: present
@@ -46,7 +46,7 @@
     - apache
 
 - name: remove user:pwd from private htpasswd
-  lineinfile:
+  ansible.builtin.lineinfile:
     dest: /etc/apache2/private_htpasswd
     line: "{{ item }}"
     state: absent

apache/tasks/ip_whitelist.yml

@@ -1,7 +1,7 @@
 ---
 
 - name: add IP addresses to private IP whitelist
-  lineinfile:
+  ansible.builtin.lineinfile:
     dest: /etc/apache2/ipaddr_whitelist.conf
     line: "Require ip {{ item }}"
     state: present
@@ -12,7 +12,7 @@
     - ips
 
 - name: remove IP addresses from private IP whitelist
-  lineinfile:
+  ansible.builtin.lineinfile:
     dest: /etc/apache2/ipaddr_whitelist.conf
     line: "Require ip {{ item }}"
     state: absent

apache/tasks/log2mail.yml

@@ -1,14 +1,14 @@
 ---
 
 - name: log2mail is installed
-  apt:
+  ansible.builtin.apt:
     name: log2mail
     state: present
   tags:
     - apache
 
 - name: Add log2mail config for Apache segfaults
-  template:
+  ansible.builtin.template:
     src: log2mail-apache.j2
     dest: "/etc/log2mail/config/apache"
     owner: log2mail

apache/tasks/main.yml

@@ -1,7 +1,7 @@
 ---
 
 - name: packages are installed (Debian 9 or later)
-  apt:
+  ansible.builtin.apt:
     name:
       - apache2
       - libapache2-mod-evasive
@@ -14,7 +14,7 @@
   when: ansible_distribution_major_version is version('9', '>=')
 
 - name: itk package is installed if required (Debian 9 or later)
-  apt:
+  ansible.builtin.apt:
     name:
       - libapache2-mpm-itk
     state: present
@@ -26,7 +26,7 @@
     - apache_mpm == "itk"
 
 - name: packages are installed (jessie)
-  apt:
+  ansible.builtin.apt:
     name:
       - apache2-mpm-itk
       - libapache2-mod-evasive
@@ -39,7 +39,7 @@
   when: ansible_distribution_release == "jessie"
 
 - name: basic modules are enabled
-  apache2_module:
+  community.general.apache2_module:
     name: '{{ item }}'
     state: present
   loop:
@@ -55,7 +55,7 @@
     - apache
 
 - name: basic modules are enabled
-  apache2_module:
+  community.general.apache2_module:
     name: '{{ item }}'
     state: present
   loop:
@@ -67,7 +67,7 @@
 
 
 - name: Copy Apache defaults config file
-  copy:
+  ansible.builtin.copy:
     src: evolinux-defaults.conf
     dest: "/etc/apache2/conf-available/z-evolinux-defaults.conf"
     owner: root
@@ -79,7 +79,7 @@
   - apache
 
 - name: Copy Apache custom config file
-  copy:
+  ansible.builtin.copy:
     src: evolinux-custom.conf
     dest: "/etc/apache2/conf-available/zzz-evolinux-custom.conf"
     owner: root
@@ -91,7 +91,7 @@
   - apache
 
 - name: disable status.conf
-  file:
+  ansible.builtin.file:
     dest: /etc/apache2/mods-enabled/status.conf
     state: absent
   notify: reload apache
@@ -99,7 +99,8 @@
     - apache
 
 - name: Ensure Apache config files are enabled
-  command: "a2enconf {{ item }}"
+  ansible.builtin.command:
+    cmd: "a2enconf {{ item }}"
   register: command_result
   changed_when: "'Enabling' in command_result.stderr"
   loop:
@@ -109,12 +110,12 @@
   tags:
     - apache
 
-- include: auth.yml
+- ansible.builtin.include: auth.yml
   tags:
   - apache
 
 - name: default vhost is installed
-  template:
+  ansible.builtin.template:
     src: evolinux-default.conf.j2
     dest: /etc/apache2/sites-available/000-evolinux-default.conf
     mode: "0640"
@@ -124,7 +125,7 @@
     - apache
 
 - name: default vhost is enabled
-  file:
+  ansible.builtin.file:
     src: /etc/apache2/sites-available/000-evolinux-default.conf
     dest: /etc/apache2/sites-enabled/000-default.conf
     state: link
@@ -134,12 +135,13 @@
   tags:
     - apache
 
-- include: server_status.yml
+- ansible.builtin.include: server_status.yml
   tags:
     - apache
 
 - name: is umask already present?
-  command: "grep -E '^umask ' /etc/apache2/envvars"
+  ansible.builtin.command:
+    cmd: "grep -E '^umask ' /etc/apache2/envvars"
   failed_when: False
   changed_when: False
   register: envvar_grep_umask
@@ -148,7 +150,7 @@
     - apache
 
 - name: Add a mark in envvars for umask
-  blockinfile:
+  ansible.builtin.blockinfile:
     dest: /etc/apache2/envvars
     marker: "## {mark} ANSIBLE MANAGED BLOCK"
     block: |
@@ -159,13 +161,13 @@
   tags:
     - apache
 
-- include_role:
+- ansible.builtin.include_role:
     name: evolix/remount-usr
   tags:
     - apache
 
 - name: /usr/share/scripts exists
-  file:
+  ansible.builtin.file:
     dest: /usr/share/scripts
     mode: "0700"
     owner: root
@@ -175,7 +177,7 @@
     - apache
 
 - name: "Install save_apache_status.sh"
-  copy:
+  ansible.builtin.copy:
     src: save_apache_status.sh
     dest: /usr/share/scripts/save_apache_status.sh
     mode: "0755"
@@ -184,7 +186,7 @@
     - apache
 
 - name: "logrotate: {{ apache_logrotate_frequency }}"
-  replace:
+  ansible.builtin.replace:
     dest: /etc/logrotate.d/apache2
     regexp: "(daily|weekly|monthly)"
     replace: "{{ apache_logrotate_frequency }}"
@@ -192,19 +194,19 @@
     - apache
 
 - name: "logrotate: rotate {{ apache_logrotate_rotate }}"
-  replace:
+  ansible.builtin.replace:
     dest: /etc/logrotate.d/apache2
     regexp: '^(\s+rotate) \d+$'
     replace: '\1 {{ apache_logrotate_rotate }}'
   tags:
     - apache
 
-- include: log2mail.yml
+- ansible.builtin.include: log2mail.yml
   when: apache_log2mail_include
   tags:
     - apache
 
-- include: munin.yml
+- ansible.builtin.include: munin.yml
   when: apache_munin_include | bool
   tags:
     - apache

apache/tasks/munin.yml

@@ -1,7 +1,7 @@
 ---
 
 - name: "Install munin-node and core plugins packages"
-  apt:
+  ansible.builtin.apt:
     name:
       - munin-node
       - munin-plugins-core
@@ -11,7 +11,7 @@
     - munin
 
 - name: "Enable Munin plugins"
-  file:
+  ansible.builtin.file:
     src: "/usr/share/munin/plugins/{{ item }}"
     dest: "/etc/munin/plugins/{{ item }}"
     state: link
@@ -25,7 +25,7 @@
     - munin
 
 - name: "Install fcgi packages for Munin graphs"
-  apt:
+  ansible.builtin.apt:
     name:
       - libapache2-mod-fcgid
       - libcgi-fast-perl
@@ -36,7 +36,8 @@
     - munin
 
 - name: "Enable libapache2-mod-fcgid"
-  command: a2enmod fcgid
+  ansible.builtin.command:
+    cmd: a2enmod fcgid
   register: cmd_enable_fcgid
   changed_when: "'Module fcgid already enabled' not in cmd_enable_fcgid.stdout"
   notify: restart apache
@@ -45,7 +46,7 @@
     - munin
 
 - name: "Apache has access to /var/log/munin/"
-  file:
+  ansible.builtin.file:
     path: /var/log/munin/
     group: www-data
   tags:

apache/tasks/server_status.yml

@@ -1,7 +1,7 @@
 ---
 
 - name: server status dirname exists
-  file:
+  ansible.builtin.file:
     dest: "{{ apache_serverstatus_suffix_file | dirname }}"
     mode: "0700"
     owner: root
@@ -9,7 +9,7 @@
     state: directory
 
 - name: set apache serverstatus suffix if provided
-  copy:
+  ansible.builtin.copy:
     dest: "{{ apache_serverstatus_suffix_file }}"
     # The last character "\u000A" is a line feed (LF), it's better to keep it
     content: "{{ apache_serverstatus_suffix }}\u000A"
@@ -17,51 +17,53 @@
   when: apache_serverstatus_suffix | length > 0
 
 - name: generate random string for server-status suffix
-  shell: "apg -a 1 -M N -n 1 > {{ apache_serverstatus_suffix_file }}"
+  ansible.builtin.shell:
+    cmd: "apg -a 1 -M N -n 1 > {{ apache_serverstatus_suffix_file }}"
   args:
     creates: "{{ apache_serverstatus_suffix_file }}"
 
 - name: read apache server status suffix
-  command: "tail -n 1 {{ apache_serverstatus_suffix_file }}"
+  ansible.builtin.command:
+    cmd: "tail -n 1 {{ apache_serverstatus_suffix_file }}"
   changed_when: False
   check_mode: no
   register: new_apache_serverstatus_suffix
 
 - name: overwrite apache_serverstatus_suffix
-  set_fact:
+  ansible.builtin.set_fact:
     apache_serverstatus_suffix: "{{ new_apache_serverstatus_suffix.stdout }}"
 
-- debug:
+- ansible.builtin.debug:
     var: apache_serverstatus_suffix
     verbosity: 1
 
 - name: replace server-status suffix in default site index
-  replace:
+  ansible.builtin.replace:
     dest: /var/www/index.html
     regexp: '__SERVERSTATUS_SUFFIX__'
     replace: "{{ apache_serverstatus_suffix }}"
 
 - name: add server-status suffix in default site index if missing
-  replace:
+  ansible.builtin.replace:
     dest: /var/www/index.html
     regexp: '"/server-status-?"'
     replace: '"/server-status-{{ apache_serverstatus_suffix }}"'
 
 - name: add server-status suffix in default VHost
-  replace:
+  ansible.builtin.replace:
     dest: /etc/apache2/sites-available/000-evolinux-default.conf
     regexp: '<Location /server-status-?>'
     replace: '<Location /server-status-{{ apache_serverstatus_suffix }}>'
   notify: reload apache
 
 - name: Munin configuration has a section for apache
-  lineinfile:
+  ansible.builtin.lineinfile:
     dest: /etc/munin/plugin-conf.d/munin-node
     line: "[apache_*]"
     create: no
 
 - name: apache-status URL is configured for Munin
-  lineinfile:
+  ansible.builtin.lineinfile:
     dest: /etc/munin/plugin-conf.d/munin-node
     line: "env.url http://{{ apache_serverstatus_host }}/server-status-{{ apache_serverstatus_suffix }}?auto"
     regexp: 'env.url http://[^\\/]+/server-status'
@@ -70,7 +72,7 @@
   notify: restart munin-node
 
 - name: add mailgraph URL in index.html
-  lineinfile:
+  ansible.builtin.lineinfile:
     dest: /var/www/index.html
     state: present
     line: '            <li><a href="/mailgraph">Stats Mail</a></li>'

apt/defaults/main.yml

@@ -8,6 +8,8 @@ apt_upgrade: False
 apt_install_basics: True
 apt_basics_components: "main"
 
+# With Debian 12+ and the deb822 format of source files
+# backports are always installed but enabled according to `apt_install_backports`
 apt_install_backports: False
 apt_backports_components: "main"
 

apt/files/bookworm_backports_preferences

@@ -0,0 +1,3 @@
+Package: *
+Pin: release a=bookworm-backports
+Pin-Priority: 50

apt/files/deb822-migration.py

@@ -3,20 +3,36 @@
 import re
 import sys
 import os
+import select
+import apt
+import apt_pkg
 
-if len(sys.argv) > 1:
+# Order matters !
-    src_file = sys.argv[1]
+destinations = {
-else:
+    "debian-security": "security.sources",
-    print("You must provide a source file as first argument", file=sys.stderr)
+    ".*-backports": "backports.sources",
-    sys.exit(1)
+    ".debian.org": "system.sources",
+    "mirror.evolix.org": "system.sources",
+    "pub.evolix.net": "evolix_public_old.sources",
+    "pub.evolix.org": "evolix_public.sources",
+    "artifacts.elastic.co": "elastic.sources",
+    "download.docker.com": "docker.sources",
+    "downloads.linux.hpe.com": "hp.sources",
+    "pkg.jenkins-ci.org": "jenkins.sources",
+    "packages.sury.org": "sury.sources",
+    "repo.mongodb.org": "mongodb.sources",
+    "apt.newrelic.com": "newrelic.sources",
+    "deb.nodesource.com": "nodesource.sources",
+    "dl.yarnpkg.com": "yarn.sources",
+    "apt.postgresql.org": "postgresql.sources",
+    "packages.microsoft.com/repos/vscode": "microsoft-vscode.sources",
+    "packages.microsoft.com/repos/ms-teams": "microsoft-teams.sources",
+    "updates.signal.org": "signal.sources",
+    "downloads.1password.com/linux/debian": "1password.sources",
+    "download.virtualbox.org": "virtualbox.sources"
+}
 
-if not os.access(src_file, os.R_OK):
+sources_parts = apt_pkg.config.find_dir('Dir::Etc::sourceparts')
-    print(src_file, "is not readable", file=sys.stderr)
-    sys.exit(2)
-
-pattern = re.compile('^(?P<type>deb|deb-src) +(?P<options>\[.+\] ?)*(?P<uri>\w+:\/\/\S+) +(?P<suite>\S+)(?: +(?P<components>.*))?$')
-
-sources = {}
 
 def split_options(raw):
     table = str.maketrans({
@@ -27,25 +43,44 @@ def split_options(raw):
 
     return options
 
-with open(src_file,'r') as file:
+def auto_destination(uri):
-    for line in file:
+    basename = uri
-        matches = re.match(pattern, line)
+    basename = re.sub('\[[^\]]+\]', '', basename)
-        if matches is not None:
+    basename = re.sub('\w+://', '', basename)
-            # print(matches.groupdict())
+    basename = '_'.join(re.sub('[^a-zA-Z0-9]', ' ', basename).split())
-            uri = matches['uri']
+    return '%s.sources' % basename
 
+
+def destination(matches):
+    for search_str in destinations.keys():
+        search_pattern = re.compile(f'{search_str}(/|\s|$)')
+        if re.search(search_pattern, matches['uri']) or re.search(search_pattern, matches["suite"]):
+            return destinations[search_str]
+    # fallback if nothing matches
+    return auto_destination(matches['uri'])
+
+def prepare_sources(lines):
+    sources = {}
+    pattern = re.compile('^(?: *(?P<type>deb|deb-src)) +(?P<options>\[.+\] ?)*(?P<uri>\w+:\/\/\S+) +(?P<suite>\S+)(?: +(?P<components>.*))?$')
+
+    for line in lines:
+        matches = re.match(pattern, line)
+
+        if matches is not None:
+            dest = destination(matches)
             options = {}
+
             if matches.group('options'):
                 for option in split_options(matches['options']):
                     if "=" in option:
                         key, value = option.split("=")
                         options[key] = value
 
-            if uri in sources:
+            if dest in sources:
-                sources[uri]["Types"].add(matches["type"])
+                sources[dest]["Types"].add(matches["type"])
-                sources[uri]["URIs"] = matches["uri"]
+                sources[dest]["URIs"] = matches["uri"]
-                sources[uri]["Suites"].add(matches["suite"])
+                sources[dest]["Suites"].add(matches["suite"])
-                sources[uri]["Components"].update(matches["components"].split(' '))
+                sources[dest]["Components"].update(matches["components"].split(' '))
             else:
                 source = {
                     "Types": {matches['type']},
@@ -83,14 +118,35 @@ with open(src_file,'r') as file:
                     else:
                         source["Targets"] = {options["target"]}
 
-                sources[uri] = source
+                sources[dest] = source
+    return sources
 
-for i, (uri, source) in enumerate(sources.items()):
+def save_sources(sources, output_dir):
-    if i > 0:
+    # print(output_dir)
-        print("")
+    # print(sources)
-    for key, value in source.items():
+    for dest, source in sources.items():
-        if isinstance(value, str):
+        source_path = output_dir + dest
-            print("{}: {}".format(key, value) )
+
-        else:
+        with open(source_path, 'w') as file:
-            print("{}: {}".format(key, ' '.join(value)) )
+            for key, value in source.items():
-    i += 1
+                if isinstance(value, str):
+                    file.write("{}: {}\n".format(key, value))
+                else:
+                    file.write("{}: {}\n".format(key, ' '.join(value)))
+
+def main():
+    if select.select([sys.stdin, ], [], [], 0.0)[0]:
+        sources = prepare_sources(sys.stdin)
+    # elif len(sys.argv) > 1:
+    #     sources = prepare_sources([sys.argv[1]])
+    else:
+        print("You must provide source lines to stdin", file=sys.stderr)
+        sys.exit(1)
+
+    output_dir = apt_pkg.config.find_dir('Dir::Etc::sourceparts')
+    save_sources(sources, output_dir)
+
+if __name__ == "__main__":
+    main()
+
+sys.exit(0)

apt/files/deb822-migration.sh

@@ -10,39 +10,40 @@ if [ ! -x "${deb822_migrate_script}" ]; then
     exit 1
 fi
 
-dest_dir="/etc/apt/sources.list.d"
+sources_from_file() {
-rc=0
+    grep --extended-regexp "^\s*(deb|deb-src) " $1
-
-migrate_file() {
-    legacy_file=$1
-    deb822_file=$2
-
-    if [ -f "${legacy_file}" ]; then
-        if [ -f "${deb822_file}" ]; then
-            >&2 echo "ERROR: '${deb822_file}' already exists"
-            rc=2
-        else
-            ${deb822_migrate_script} "${legacy_file}" > "${deb822_file}"
-            if [ $? -eq 0 ] && [ -f "${deb822_file}" ]; then
-                mv "${legacy_file}" "${legacy_file}.bak"
-                echo "Migrated ${legacy_file} to ${deb822_file} and renamed to ${legacy_file}.bak"
-            else
-                >&2 echo "ERROR: failed to convert '${legacy_file}' to '${deb822_file}'"
-                rc=2
-            fi
-        fi
-    else
-        >&2 echo "ERROR: '${legacy_file}' not found"
-        rc=2
-    fi
 }
 
-migrate_file "/etc/apt/sources.list" "${dest_dir}/system.sources"
+rc=0
+count=0
 
-# shellcheck disable=SC2044
+if [ -f /etc/apt/sources.list ]; then
-for legacy_file in $(find /etc/apt/sources.list.d -mindepth 1 -maxdepth 1 -type f -name '*.list'); do
+    sources_from_file /etc/apt/sources.list | ${deb822_migrate_script} 
-    deb822_file=$(basename "${legacy_file}" .list)
+    python_rc=$?
-    migrate_file "${legacy_file}" "${dest_dir}/${deb822_file}.sources"
+
+    if [ ${python_rc} -eq 0 ]; then
+        mv /etc/apt/sources.list /etc/apt/sources.list.bak
+        echo "OK: /etc/apt/sources.list"
+        count=$(( count + 1 ))
+    else
+        >&2 echo "ERROR: failed migration for /etc/apt/sources.list"
+        rc=1
+    fi
+fi
+
+for file in $(find /etc/apt/sources.list.d -mindepth 1 -maxdepth 1 -type f -name '*.list'); do
+    sources_from_file "${file}" | ${deb822_migrate_script}
+    python_rc=$?
+
+    if [ ${python_rc} -eq 0 ]; then
+        mv "${file}" "${file}.bak"
+        echo "OK: ${file}"
+        count=$(( count + 1 ))
+    else
+        >&2 echo "ERROR: failed migration for ${file}"
+        rc=1
+    fi
 done
 
+echo "${count} file(s) migrated"
 exit ${rc}

apt/tasks/backports.deb822.yml

@@ -0,0 +1,28 @@
+---
+
+- name: Backports deb822 sources list is installed
+  ansible.builtin.template:
+    src: '{{ ansible_distribution_release }}_backports.sources.j2'
+    dest: /etc/apt/sources.list.d/backports.sources
+    force: yes
+    mode: "0640"
+  register: apt_backports_sources
+  tags:
+    - apt
+
+- name: Backports configuration
+  ansible.builtin.copy:
+    src: '{{ ansible_distribution_release }}_backports_preferences'
+    dest: /etc/apt/preferences.d/0-backports-defaults
+    force: yes
+    mode: "0640"
+  register: apt_backports_config
+  tags:
+    - apt
+
+- name: Apt update
+  ansible.builtin.apt:
+    update_cache: yes
+  when: apt_backports_sources is changed or apt_backports_config is changed
+  tags:
+    - apt

apt/tasks/backports.oneline.yml

@@ -0,0 +1,45 @@
+---
+- name: No backports config in default sources.list
+  ansible.builtin.lineinfile:
+    dest: /etc/apt/sources.list
+    regexp: "backports"
+    state: absent
+  tags:
+    - apt
+
+- name: Backports sources list is installed
+  ansible.builtin.template:
+    src: '{{ ansible_distribution_release }}_backports.list.j2'
+    dest: /etc/apt/sources.list.d/backports.list
+    force: yes
+    mode: "0640"
+  register: apt_backports_list
+  tags:
+    - apt
+
+- name: Backports configuration
+  ansible.builtin.copy:
+    src: '{{ ansible_distribution_release }}_backports_preferences'
+    dest: /etc/apt/preferences.d/0-backports-defaults
+    force: yes
+    mode: "0640"
+  register: apt_backports_config
+  tags:
+    - apt
+
+- name: Archived backport are accepted (jessie)
+  ansible.builtin.lineinfile:
+    dest: '/etc/apt/apt.conf.d/99no-check-valid-until'
+    line: 'Acquire::Check-Valid-Until no;'
+    create: yes
+    state: present
+  tags:
+    - apt
+  when: ansible_distribution_release == "jessie"
+
+- name: Apt update
+  ansible.builtin.apt:
+    update_cache: yes
+  tags:
+    - apt
+  when: apt_backports_list is changed or apt_backports_config is changed

apt/tasks/backports.yml

@@ -1,45 +1,13 @@
 ---
-- name: No backports config in default sources.list
-  lineinfile:
-    dest: /etc/apt/sources.list
-    regexp: "backports"
-    state: absent
-  tags:
-    - apt
 
-- name: Backports sources list is installed
+# Backward compatibility task file
-  template:
-    src: '{{ ansible_distribution_release }}_backports.list.j2'
-    dest: /etc/apt/sources.list.d/backports.list
-    force: yes
-    mode: "0640"
-  register: apt_backports_list
-  tags:
-    - apt
 
-- name: Backports configuration
+- name: Install backports repositories (Debian <12)
-  copy:
+  ansible.builtin.import_tasks: backports.oneline.yml
-    src: '{{ ansible_distribution_release }}_backports_preferences'
+  when:
-    dest: /etc/apt/preferences.d/0-backports-defaults
+    - ansible_distribution_major_version is version('12', '<')
-    force: yes
-    mode: "0640"
-  register: apt_backports_config
-  tags:
-    - apt
 
-- name: Archived backport are accepted (jessie)
+- name: Install backports repositories (Debian >=12)
-  lineinfile:
+  ansible.builtin.import_tasks: backports.deb822.yml
-    dest: '/etc/apt/apt.conf.d/99no-check-valid-until'
+  when:
-    line: 'Acquire::Check-Valid-Until no;'
+    - ansible_distribution_major_version is version('12', '>=')
-    create: yes
-    state: present
-  when: ansible_distribution_release == "jessie"
-  tags:
-    - apt
-
-- name: Apt update
-  apt:
-    update_cache: yes
-  when: apt_backports_list is changed or apt_backports_config is changed
-  tags:
-    - apt

apt/tasks/basics.deb822.yml

@@ -0,0 +1,45 @@
+---
+
+- name: Change basics repositories
+  ansible.builtin.template:
+    src: "{{ ansible_distribution_release }}_basics.sources.j2"
+    dest: /etc/apt/sources.list.d/system.sources
+    mode: "0644"
+    force: yes
+  register: apt_basic_sources
+  tags:
+    - apt
+
+- name: Change security repositories
+  ansible.builtin.template:
+    src: "{{ ansible_distribution_release }}_security.sources.j2"
+    dest: /etc/apt/sources.list.d/security.sources
+    mode: "0644"
+    force: yes
+  register: apt_security_sources
+  tags:
+    - apt
+
+- name: Find one-line APT sources
+  ansible.builtin.find:
+    paths: /etc/apt
+    patterns: '*.list'
+  register: list_files
+
+- name: Disable one-line-formatted sources
+  ansible.builtin.command:
+    cmd: "mv --verbose {{ item.path }} {{ item.path }}.bak"
+  environment:
+    LC_ALL: C
+  loop: "{{ list_files.files }}"
+  register: rename_cmd
+  changed_when: "'renamed' in rename_cmd.stdout"
+  tags:
+    - apt
+
+- name: Apt update
+  ansible.builtin.apt:
+    update_cache: yes
+  tags:
+    - apt
+  when: apt_basic_list is changed or apt_security_sources is changed

apt/tasks/basics.oneline.yml

@@ -0,0 +1,18 @@
+---
+
+- name: Change basics repositories
+  ansible.builtin.template:
+    src: "{{ ansible_distribution_release }}_basics.list.j2"
+    dest: /etc/apt/sources.list
+    mode: "0644"
+    force: yes
+  register: apt_basic_list
+  tags:
+    - apt
+
+- name: Apt update
+  ansible.builtin.apt:
+    update_cache: yes
+  tags:
+    - apt
+  when: apt_basic_list is changed

apt/tasks/basics.yml

@@ -1,33 +1,13 @@
 ---
 
-- name: Change basics repositories
+# Backward compatibility task file
-  template:
-    src: "{{ ansible_distribution_release }}_basics.list.j2"
-    dest: /etc/apt/sources.list
-    mode: "0644"
-    force: yes
-  register: apt_basic_list
-  tags:
-    - apt
 
-- name: Clean GANDI sources.list.d/debian-security.list
+- name: Install basics repositories (Debian <12)
-  file:
+  ansible.builtin.import_tasks: basics.oneline.yml
-    path: '{{ item }}'
+  when:
-    state: absent
+    - ansible_distribution_major_version is version('12', '<')
-  loop:
-    - /etc/apt/sources.list.d/debian-security.list
-    - /etc/apt/sources.list.d/debian-jessie.list
-    - /etc/apt/sources.list.d/debian-stretch.list
-    - /etc/apt/sources.list.d/debian-buster.list
-    - /etc/apt/sources.list.d/debian-bullseye.list
-    - /etc/apt/sources.list.d/debian-update.list
-  when: apt_clean_gandi_sourceslist | bool
-  tags:
-    - apt
 
-- name: Apt update
+- name: Install basics repositories (Debian >=12)
-  apt:
+  ansible.builtin.import_tasks: basics.deb822.yml
-    update_cache: yes
+  when:
-  when: apt_basic_list is changed
+    - ansible_distribution_major_version is version('12', '>=')
-  tags:
-    - apt

apt/tasks/config.yml

@@ -1,7 +1,7 @@
 ---
 
 - name: Evolinux config for APT
-  lineinfile:
+  ansible.builtin.lineinfile:
     dest: /etc/apt/apt.conf.d/z-evolinux.conf
     line: "{{ item.line }}"
     regexp: "{{ item.regexp }}"
@@ -12,12 +12,12 @@
     - { line: "APT::Install-Recommends \"false\";", regexp: 'APT::Install-Recommends' }
     - { line: "APT::Install-Suggests \"false\";",   regexp: 'APT::Install-Suggests' }
     - { line: "APT::Periodic::Enable \"0\";",   regexp: 'APT::Periodic::Enable' }
-  when: apt_evolinux_config | bool
   tags:
     - apt
+  when: apt_evolinux_config | bool
 
 - name: DPkg invoke hooks
-  lineinfile:
+  ansible.builtin.lineinfile:
     dest: /etc/apt/apt.conf.d/z-evolinux.conf
     line: "{{ item }}"
     create: yes
@@ -28,14 +28,14 @@
     - "DPkg::Pre-Invoke { \"df /usr | grep -q /usr && mount -oremount,rw /usr || true\"; };"
     - "DPkg::Post-Invoke { \"df /tmp | grep -q /tmp && mount -oremount /tmp || true\"; };"
     - "DPkg::Post-Invoke { \"df /usr | grep -q /usr && mount -oremount /usr || true\"; };"
-  when: apt_hooks | bool
   tags:
     - apt
+  when: apt_hooks | bool
 
 - name: Remove Aptitude
-  apt:
+  ansible.builtin.apt:
     name: aptitude
     state: absent
-  when: apt_remove_aptitude | bool
   tags:
     - apt
+  when: apt_remove_aptitude | bool

apt/tasks/evolix_public.deb822.yml

@@ -0,0 +1,45 @@
+---
+
+- name: Look for legacy apt keyring
+  ansible.builtin.stat:
+    path: /etc/apt/trusted.gpg
+  register: _trusted_gpg_keyring
+  tags:
+    - apt
+
+- name: Evolix embedded GPG key is absent
+  ansible.builtin.apt_key:
+    id: "B8612B5D"
+    keyring: /etc/apt/trusted.gpg
+    state: absent
+  tags:
+    - apt
+  when: _trusted_gpg_keyring.stat.exists
+
+- name: Add Evolix GPG key
+  ansible.builtin.copy:
+    src: pub_evolix.asc
+    dest: "{{ apt_keyring_dir }}/pub_evolix.asc"
+    force: yes
+    mode: "0644"
+    owner: root
+    group: root
+  tags:
+    - apt
+
+- name: Evolix public list is installed
+  ansible.builtin.template:
+    src: evolix_public.sources.j2
+    dest: /etc/apt/sources.list.d/evolix_public.sources
+    force: yes
+    mode: "0640"
+  register: apt_evolix_public
+  tags:
+    - apt
+
+- name: Apt update
+  ansible.builtin.apt:
+    update_cache: yes
+  tags:
+    - apt
+  when: apt_evolix_public is changed

apt/tasks/evolix_public.oneline.yml

@@ -0,0 +1,45 @@
+---
+
+- name: Look for legacy apt keyring
+  ansible.builtin.stat:
+    path: /etc/apt/trusted.gpg
+  register: _trusted_gpg_keyring
+  tags:
+    - apt
+
+- name: Evolix embedded GPG key is absent
+  ansible.builtin.apt_key:
+    id: "B8612B5D"
+    keyring: /etc/apt/trusted.gpg
+    state: absent
+  tags:
+    - apt
+  when: _trusted_gpg_keyring.stat.exists
+
+- name: Add Evolix GPG key
+  ansible.builtin.copy:
+    src: pub_evolix.asc
+    dest: "{{ apt_keyring_dir }}/pub_evolix.asc"
+    force: yes
+    mode: "0644"
+    owner: root
+    group: root
+  tags:
+    - apt
+
+- name: Evolix public list is installed
+  ansible.builtin.template:
+    src: evolix_public.list.j2
+    dest: /etc/apt/sources.list.d/evolix_public.list
+    force: yes
+    mode: "0640"
+  register: apt_evolix_public
+  tags:
+    - apt
+
+- name: Apt update
+  ansible.builtin.apt:
+    update_cache: yes
+  tags:
+    - apt
+  when: apt_evolix_public is changed

apt/tasks/evolix_public.yml

@@ -1,45 +1,13 @@
 ---
 
-- name: Look for legacy apt keyring
+# Backward compatibility task file
-  stat:
-    path: /etc/apt/trusted.gpg
-  register: _trusted_gpg_keyring
-  tags:
-    - apt
 
-- name: Evolix embedded GPG key is absent
+- name: Install Evolix Public repositories (Debian <12)
-  apt_key:
+  ansible.builtin.import_tasks: evolix_public.oneline.yml
-    id: "B8612B5D"
+  when:
-    keyring: /etc/apt/trusted.gpg
+    - ansible_distribution_major_version is version('12', '<')
-    state: absent
-  when: _trusted_gpg_keyring.stat.exists
-  tags:
-    - apt
 
-- name: Add Evolix GPG key
+- name: Install Evolix Public repositories (Debian >=12)
-  copy:
+  ansible.builtin.import_tasks: evolix_public.deb822.yml
-    src: pub_evolix.asc
+  when:
-    dest: "{{ apt_keyring_dir }}/pub_evolix.asc"
+    - ansible_distribution_major_version is version('12', '>=')
-    force: yes
-    mode: "0644"
-    owner: root
-    group: root
-  tags:
-    - apt
-
-- name: Evolix public list is installed
-  template:
-    src: evolix_public.list.j2
-    dest: /etc/apt/sources.list.d/evolix_public.list
-    force: yes
-    mode: "0640"
-  register: apt_evolix_public
-  tags:
-    - apt
-
-- name: Apt update
-  apt:
-    update_cache: yes
-  when: apt_evolix_public is changed
-  tags:
-    - apt

apt/tasks/hold_packages.yml

@@ -1,11 +1,11 @@
 ---
 
-- include_role:
+- ansible.builtin.include_role:
     name: evolix/remount-usr
 
 - name: "hold packages (apt)"
-  shell: "set -o pipefail && (dpkg -l {{ item }} 2>/dev/null | grep -q -E '^(i|h)i') && ((apt-mark showhold | grep --quiet {{ item }}) || apt-mark hold {{ item }})"
+  ansible.builtin.shell:
-  args:
+    cmd: "set -o pipefail && (dpkg -l {{ item }} 2>/dev/null | grep -q -E '^(i|h)i') && ((apt-mark showhold | grep --quiet {{ item }}) || apt-mark hold {{ item }})"
     executable: /bin/bash
   check_mode: no
   register: apt_mark
@@ -18,7 +18,7 @@
     - apt
 
 - name: "/etc/evolinux is present"
-  file:
+  ansible.builtin.file:
     dest: /etc/evolinux
     mode: "0700"
     state: directory
@@ -26,7 +26,7 @@
     - apt
 
 - name: "hold packages (config)"
-  lineinfile:
+  ansible.builtin.lineinfile:
     dest: /etc/evolinux/apt_hold_packages.cf
     line: "{{ item }}"
     create: True
@@ -36,8 +36,8 @@
     - apt
 
 - name: "unhold packages (apt)"
-  shell: "set -o pipefail && (dpkg -l {{ item }} 2>/dev/null | grep -q -E '^(i|h)i') && ((apt-mark showhold | grep --quiet {{ item }}) && apt-mark unhold {{ item }})"
+  ansible.builtin.shell:
-  args:
+    cmd: "set -o pipefail && (dpkg -l {{ item }} 2>/dev/null | grep -q -E '^(i|h)i') && ((apt-mark showhold | grep --quiet {{ item }}) && apt-mark unhold {{ item }})"
     executable: /bin/bash
   check_mode: no
   register: apt_mark
@@ -48,7 +48,7 @@
     - apt
 
 - name: "unhold packages (config)"
-  lineinfile:
+  ansible.builtin.lineinfile:
     dest: /etc/evolinux/apt_hold_packages.cf
     line: "{{ item }}"
     create: True
@@ -58,7 +58,7 @@
     - apt
 
 - name: /usr/share/scripts exists
-  file:
+  ansible.builtin.file:
     dest: /usr/share/scripts
     mode: "0700"
     owner: root
@@ -68,7 +68,7 @@
     - apt
 
 - name: Check scripts is installed
-  copy:
+  ansible.builtin.copy:
     src: check_held_packages.sh
     dest: /usr/share/scripts/check_held_packages.sh
     force: yes
@@ -77,7 +77,8 @@
     - apt
 
 - name: Check if Cron is installed
-  shell: "dpkg --list 'cron' 2>/dev/null | grep -q -E '^(i|h)i'"
+  ansible.builtin.shell:
+    cmd: "dpkg --list 'cron' 2>/dev/null | grep -q -E '^(i|h)i'"
   register: is_cron
   changed_when: False
   failed_when: False
@@ -86,7 +87,7 @@
     - apt
 
 - name: Check for held packages (script)
-  cron:
+  ansible.builtin.cron:
     cron_file: apt-hold-packages
     name: check_held_packages
     job: "/usr/share/scripts/check_held_packages.sh"
@@ -97,6 +98,6 @@
     day: "{{ apt_check_hold_cron_day }}"
     month: "{{ apt_check_hold_cron_month }}"
     state: "present"
-  when: is_cron.rc == 0
   tags:
     - apt
+  when: is_cron.rc == 0

apt/tasks/main.yml

@@ -1,52 +1,116 @@
 ---
 
 - name: "Compatibility check"
-  fail:
+  ansible.builtin.assert:
-    msg: only compatible with Debian >= 8
+    that:
-  when:
+      - ansible_distribution == "Debian"
-    - ansible_distribution != "Debian" or ansible_distribution_major_version is version('8', '<')
+      - ansible_distribution_major_version is version('8', '>=')
+    msg: Only compatible with Debian >= 8
+  tags:
+    - apt
+
+- name: "apt-transport-https is installed for https repositories (before Buster)"
+  ansible.builtin.apt:
+    name:
+      - apt-transport-https
+  tags:
+    - apt
+  when: ansible_distribution_major_version is version('10', '<')
+
+- name: "certificates are installed for https repositories"
+  ansible.builtin.apt:
+    name:
+      - ca-certificates
   tags:
     - apt
 
 - name: Custom configuration
-  include: config.yml
+  ansible.builtin.import_tasks: config.yml
   when: apt_config | bool
   tags:
     - apt
 
-- name: Install basics repositories
+- name: Install basics repositories (Debian <12)
-  include: basics.yml
+  ansible.builtin.import_tasks: basics.oneline.yml
-  when: apt_install_basics | bool
   tags:
     - apt
+  when:
+    - apt_install_basics | bool
+    - ansible_distribution_major_version is version('12', '<')
 
-- name: Install APT Backports repository
+- name: Install basics repositories (Debian >=12)
-  include: backports.yml
+  ansible.builtin.import_tasks: basics.deb822.yml
-  when: apt_install_backports | bool
   tags:
     - apt
+  when:
+    - apt_install_basics | bool
+    - ansible_distribution_major_version is version('12', '>=')
 
-- name: Install Evolix Public APT repository
+- name: Install backports repositories (Debian <12)
-  include: evolix_public.yml
+  ansible.builtin.import_tasks: backports.oneline.yml
-  when: apt_install_evolix_public | bool
   tags:
     - apt
+  when:
+    - apt_install_backports | bool
+    - ansible_distribution_major_version is version('12', '<')
+
+# With Debian 12+ and the deb822 format of source files
+# backports are always installed but enabled according to `apt_install_backports`
+- name: Install backports repositories (Debian >=12)
+  ansible.builtin.import_tasks: backports.deb822.yml
+  tags:
+    - apt
+  when:
+    - ansible_distribution_major_version is version('12', '>=')
+
+
+- name: Install Evolix Public repositories (Debian <12)
+  ansible.builtin.import_tasks: evolix_public.oneline.yml
+  tags:
+    - apt
+  when:
+    - apt_install_evolix_public | bool
+    - ansible_distribution_major_version is version('12', '<')
+
+- name: Install Evolix Public repositories (Debian >=12)
+  ansible.builtin.import_tasks: evolix_public.deb822.yml
+  tags:
+    - apt
+  when:
+    - apt_install_evolix_public | bool
+    - ansible_distribution_major_version is version('12', '>=')
+
+- name: Clean GANDI sources
+  ansible.builtin.file:
+    path: '{{ item }}'
+    state: absent
+  loop:
+    - /etc/apt/sources.list.d/debian-security.list
+    - /etc/apt/sources.list.d/debian-jessie.list
+    - /etc/apt/sources.list.d/debian-stretch.list
+    - /etc/apt/sources.list.d/debian-buster.list
+    - /etc/apt/sources.list.d/debian-bullseye.list
+    - /etc/apt/sources.list.d/debian-update.list
+  tags:
+    - apt
+  when: apt_clean_gandi_sourceslist | bool
+
 
 - name: Install check for packages marked hold
-  include: hold_packages.yml
+  ansible.builtin.import_tasks: hold_packages.yml
   when: apt_install_hold_packages | bool
   tags:
     - apt
 
 - name: Updating APT cache
-  apt:
+  ansible.builtin.apt:
     update_cache: yes
   changed_when: False
   tags:
     - apt
 
 - name: Upgrading system
-  apt:
+  ansible.builtin.apt:
     upgrade: dist
   when: apt_upgrade | bool
   tags:

apt/tasks/migrate-to-deb822.yml

@@ -1,9 +1,9 @@
 ---
-- include_role:
+- ansible.builtin.include_role:
     name: evolix/remount-usr
 
 - name: /usr/share/scripts exists
-  file:
+  ansible.builtin.file:
     dest: /usr/share/scripts
     mode: "0700"
     owner: root
@@ -13,7 +13,7 @@
     - apt
 
 - name: Migration scripts are installed
-  copy:
+  ansible.builtin.copy:
     src: "{{ item  }}"
     dest: "/usr/share/scripts/{{ item  }}"
     force: yes
@@ -25,7 +25,8 @@
     - apt
 
 - name: Exec migration script
-  command: /usr/share/scripts/deb822-migration.sh
+  ansible.builtin.command:
+    cmd: /usr/share/scripts/deb822-migration.sh
   ignore_errors: yes
   tags:
     - apt

apt/tasks/move-apt-keyring.yml

@@ -1,18 +1,18 @@
 ---
 
 - name: New APT keyrings directory is present
-  file:
+  ansible.builtin.file:
     path: /etc/apt/keyrings
     state: directory
     mode: "0755"
     owner: root
     group: root
 
-- include_role:
+- ansible.builtin.include_role:
     name: evolix/remount-usr
 
 - name: /usr/share/scripts exists
-  file:
+  ansible.builtin.file:
     dest: /usr/share/scripts
     mode: "0700"
     owner: root
@@ -22,7 +22,7 @@
     - apt
 
 - name: migration script is present
-  copy:
+  ansible.builtin.copy:
     src: move-apt-keyrings.sh
     dest: /usr/share/scripts/move-apt-keyrings.sh
     mode: "0755"
@@ -30,7 +30,8 @@
     group: root
 
 - name: Move repository signing key
-  command: "/usr/share/scripts/move-apt-keyrings.sh \"{{ item.repository_pattern }}\" \"{{ item.key }}\""
+  ansible.builtin.command:
+    cmd: "/usr/share/scripts/move-apt-keyrings.sh \"{{ item.repository_pattern }}\" \"{{ item.key }}\""
   loop:
     - { repository_pattern: "http://pub.evolix.net/", key: "reg.asc" }
     - { repository_pattern: "http://pub.evolix.org/evolix", key: "pub_evolix.asc" }
@@ -48,5 +49,5 @@
   register: _cmd
 
 - name: Debug command
-  debug:
+  ansible.builtin.debug:
     var: _cmd

apt/templates/bookworm_backports.sources.j2

@@ -0,0 +1,7 @@
+# {{ ansible_managed }}
+
+Types: deb
+URIs: http://mirror.evolix.org/debian
+Suites: bullseye-backports
+Components: {{ apt_backports_components | mandatory }}
+Enabled: {{ apt_install_backports | bool | ternary('yes', 'no') }}

apt/templates/bookworm_basics.list.j2

@@ -1,5 +0,0 @@
-# {{ ansible_managed }}
-
-deb http://mirror.evolix.org/debian bookworm {{ apt_basics_components | mandatory }}
-deb http://mirror.evolix.org/debian/ bookworm-updates {{ apt_basics_components | mandatory }} 
-deb http://security.debian.org/debian-security bookworm-security {{ apt_basics_components | mandatory }}

apt/templates/bookworm_basics.sources.j2

@@ -0,0 +1,7 @@
+# {{ ansible_managed }}
+
+Types: deb
+URIs: http://mirror.evolix.org/debian
+Suites: bookworm bookworm-updates
+Components: {{ apt_basics_components | mandatory }} 
+Enabled: yes

apt/templates/bookworm_security.sources.j2

@@ -0,0 +1,7 @@
+# {{ ansible_managed }}
+
+Types: deb
+URIs: https://security.debian.org/debian-security
+Suites: bookworm-security
+Components: {{ apt_basics_components | mandatory }} 
+Enabled: yes

apt/templates/evolix_public.sources.j2

@@ -0,0 +1,8 @@
+# {{ ansible_managed }}
+
+Types:deb
+URIs: http://pub.evolix.org/evolix
+Suites: {{ ansible_distribution_release }}
+Components: main
+Signed-by: {{ apt_keyring_dir }}/pub_evolix.asc
+Enabled: yes

bind/handlers/main.yml

@@ -1,21 +1,21 @@
 ---
 - name: reload systemd
-  systemd:
+  ansible.builtin.systemd:
     daemon-reload: yes
 
 
 - name: restart apparmor
-  systemd:
+  ansible.builtin.systemd:
     name: apparmor
     state: restarted
 
 - name: restart bind
-  systemd:
+  ansible.builtin.systemd:
     name: bind9
     state: restarted
 
 - name: restart munin-node
-  systemd:
+  ansible.builtin.systemd:
     name: munin-node
     state: restarted
 

bind/tasks/authoritative.yml

@@ -1,7 +1,7 @@
 ---
 
 - name: Set bind configuration for authoritative server
-  template:
+  ansible.builtin.template:
     src: named.conf.options_authoritative.j2
     dest: /etc/bind/named.conf.options
     owner: bind

bind/tasks/main.yml

@@ -1,6 +1,6 @@
 # Until chroot-bind.sh is migrated to ansible, we hardcode the chroot paths.
 - name: set chroot variables
-  set_fact:
+  ansible.builtin.set_fact:
     bind_log_file: /var/log/bind.log
     bind_query_file: /var/log/bind_queries.log
     bind_cache_dir: /var/cache/bind
@@ -9,14 +9,15 @@
   when: bind_chroot_set | bool
 
 - name: Check AppArmor
-  shell: systemctl is-active apparmor || systemctl is-enabled apparmor
+  ansible.builtin.shell:
+    cmd: systemctl is-active apparmor || systemctl is-enabled apparmor
   failed_when: False
   changed_when: False
   check_mode: no
   register: check_apparmor
 
 - name: configure apparmor
-  template:
+  ansible.builtin.template:
     src: apparmor.usr.sbin.named.j2
     dest: /etc/apparmor.d/usr.sbin.named
     owner: root
@@ -27,20 +28,20 @@
   when: check_apparmor.rc == 0
 
 - name: package are installed
-  apt:
+  ansible.builtin.apt:
     name:
       - bind9
       - dnstop
     state: present
 
-- include: authoritative.yml
+- ansible.builtin.include: authoritative.yml
   when: bind_authoritative_server | bool
 
-- include: recursive.yml
+- ansible.builtin.include: recursive.yml
   when: bind_recursive_server | bool
 
 - name: Create systemd service for Debian 8 (Jessie)
-  template:
+  ansible.builtin.template:
     src: bind9.service.jessie.j2
     dest: "{{ bind_systemd_service_path }}"
     owner: root
@@ -53,7 +54,7 @@
   when: ansible_distribution_release == "jessie"
 
 - name: "touch {{ bind_log_file }} if non chroot"
-  file:
+  ansible.builtin.file:
     path: "{{ bind_log_file }}"
     owner: bind
     group: adm
@@ -62,7 +63,7 @@
   when: not (bind_chroot_set | bool)
 
 - name: "touch {{ bind_query_file }} if non chroot"
-  file:
+  ansible.builtin.file:
     path: "{{ bind_query_file }}"
     owner: bind
     group: adm
@@ -71,7 +72,7 @@
   when: not (bind_chroot_set | bool)
 
 - name: send chroot-bind.sh in /root
-  copy:
+  ansible.builtin.copy:
     src: chroot-bind.sh
     dest: /root/chroot-bind.sh
     mode: "0700"
@@ -81,19 +82,20 @@
   when: bind_chroot_set | bool
 
 - name: exec chroot-bind.sh
-  command: "/root/chroot-bind.sh"
+  ansible.builtin.command:
+    cmd: "/root/chroot-bind.sh"
   register: chrootbind_run
   changed_when: False
   when: bind_chroot_set | bool
 
-- debug:
+- ansible.builtin.debug:
     var: chrootbind_run.stdout_lines
   when:
     - bind_chroot_set | bool
     - chrootbind_run.stdout | length > 0
 
 - name: Modify OPTIONS in /etc/default/bind9 for chroot
-  replace:
+  ansible.builtin.replace:
     dest: /etc/default/bind9
     regexp: '^OPTIONS=.*'
     replace: 'OPTIONS="-u bind -t {{ bind_chroot_path }}"'
@@ -101,7 +103,7 @@
   when: bind_chroot_set | bool
 
 - name: logrotate for bind
-  template:
+  ansible.builtin.template:
     src: logrotate_bind.j2
     dest: /etc/logrotate.d/bind9
     owner: root
@@ -110,4 +112,4 @@
     force: yes
   notify: restart bind
 
-- include: munin.yml
+- ansible.builtin.include: munin.yml

bind/tasks/munin.yml

@@ -1,7 +1,7 @@
 ---
 
 - name: is Munin present ?
-  stat:
+  ansible.builtin.stat:
     path: /etc/munin/plugin-conf.d/munin-node
   check_mode: no
   register: munin_node_plugins_config
@@ -10,7 +10,7 @@
     - munin
 
 - name: Enable munin plugins for authoritative server
-  file:
+  ansible.builtin.file:
     src: "/usr/share/munin/plugins/{{ item }}"
     dest: "/etc/munin/plugins/{{ item }}"
     state: link
@@ -18,31 +18,31 @@
     - bind9
     - bind9_rndc
   notify: restart munin-node
-  when:
-    - bind_authoritative_server | bool
-    - munin_node_plugins_config.stat.exists
   tags:
     - bind
     - munin
+  when:
+    - bind_authoritative_server | bool
+    - munin_node_plugins_config.stat.exists
 
 - name: Enable munin plugins for recursive server
-  file:
+  ansible.builtin.file:
     src: "/usr/share/munin/plugins/{{ item }}"
     dest: "/etc/munin/plugins/{{ item }}"
     state: link
   loop:
     - bind9
   notify: restart munin-node
+  tags:
+    - bind
+    - munin
   when:
     - bind_recursive_server | bool
     - bind_query_file_enabled | bool
     - munin_node_plugins_config.stat.exists
-  tags:
-    - bind
-    - munin
 
 - name: Add munin plugin configuration
-  template:
+  ansible.builtin.template:
     src: munin-env_bind9.j2
     dest: /etc/munin/plugin-conf.d/bind9
     owner: root
@@ -50,7 +50,7 @@
     mode: "0644"
     force: yes
   notify: restart munin-node
-  when: munin_node_plugins_config.stat.exists
   tags:
     - bind
     - munin
+  when: munin_node_plugins_config.stat.exists

bind/tasks/recursive.yml

@@ -2,7 +2,7 @@
 
 
 - name: Set bind configuration for recursive server
-  template:
+  ansible.builtin.template:
     src: named.conf.options_recursive.j2
     dest: /etc/bind/named.conf.options
     owner: bind
@@ -12,7 +12,7 @@
   notify: restart bind
 
 - name: enable zones.rfc1918 for recursive server
-  lineinfile:
+  ansible.builtin.lineinfile:
     dest: /etc/bind/named.conf.local
     line: 'include "/etc/bind/zones.rfc1918";'
     regexp: "zones.rfc1918"

bookworm-detect/tasks/main.yml

@@ -1,11 +1,11 @@
 ---
 
-- debug:
+- ansible.builtin.debug:
     var: ansible_lsb
 
 # Force facts until Debian 12 is released because Ansible is dumb
-- set_fact:
+- ansible.builtin.set_fact:
     ansible_distribution_major_version: 12
     ansible_distribution: "Debian"
     ansible_distribution_release: "bookworm"
-  when: "ansible_lsb.codename == 'bookworm'"
+  when: "'bookworm' in ansible_lsb.codename or 'bookworm' in ansible_lsb.description"

bullseye-detect/tasks/main.yml

@@ -1,7 +1,7 @@
 ---
 
 # Force facts until Debian 11 is released because Ansible is dumb
-- set_fact:
+- ansible.builtin.set_fact:
     ansible_distribution_major_version: 11
     ansible_distribution: "Debian"
     ansible_distribution_release: "bullseye"

certbot/handlers/main.yml

@@ -1,23 +1,24 @@
 ---
 
 - name: reload nginx
-  service:
+  ansible.builtin.systemd:
     name: nginx
     state: reloaded
 
 - name: reload apache
-  service:
+  ansible.builtin.systemd:
     name: apache2
     state: reloaded
 
 - name: reload haproxy
-  service:
+  ansible.builtin.systemd:
     name: haproxy
     state: reloaded
 
 - name: systemd daemon-reload
-  systemd:
+  ansible.builtin.systemd:
     daemon_reload: yes
 
 - name: install letsencrypt-auto
-  command: /usr/local/bin/letsencrypt-auto --noninteractive --install-only --no-self-upgrade
+  ansible.builtin.command:
+    cmd: /usr/local/bin/letsencrypt-auto --noninteractive --install-only --no-self-upgrade

certbot/tasks/acme-challenge.yml

@@ -1,18 +1,18 @@
 ---
 
 - name: Certbot work directory is present
-  file:
+  ansible.builtin.file:
     dest: "{{ certbot_work_dir }}"
     state: directory
     mode: "0755"
 
 - name: Check if Nginx is installed
-  stat:
+  ansible.builtin.stat:
     path: /etc/nginx
   register: is_nginx
 
 - name: ACME challenge for Nginx is installed
-  template:
+  ansible.builtin.template:
     src: acme-challenge/nginx.conf.j2
     dest: /etc/nginx/snippets/letsencrypt.conf
     force: yes
@@ -20,32 +20,33 @@
   when: is_nginx.stat.exists
 
 - name: Check if Apache is installed
-  stat:
+  ansible.builtin.stat:
     path: /usr/sbin/apachectl
   register: is_apache
 
 - name: ACME challenge for Apache
   block:
     - name: ACME challenge for Apache is installed
-      template:
+      ansible.builtin.template:
         src: acme-challenge/apache.conf.j2
         dest: /etc/apache2/conf-available/letsencrypt.conf
         force: yes
       notify: reload apache
 
     - name: ACME challenge for Apache is enabled
-      command: "a2enconf letsencrypt"
+      ansible.builtin.command:
+        cmd: "a2enconf letsencrypt"
       register: command_result
       changed_when: "'Enabling' in command_result.stderr"
       notify: reload apache
   when: is_apache.stat.exists
 
 - name: Check if HAProxy is installed
-  stat:
+  ansible.builtin.stat:
     path: /etc/haproxy
   register: is_haproxy
 
 - name: ACME challenge for HAProxy is installed
-  debug:
+  ansible.builtin.debug:
     msg: "ACME challenge configuration for HAProxy must be configured manually"
   when: is_haproxy.stat.exists

certbot/tasks/install-legacy.yml

@@ -1,16 +1,16 @@
 ---
 
 - name: certbot package is removed
-  apt:
+  ansible.builtin.apt:
     name: certbot
     state: absent
 
-- include_role:
+- ansible.builtin.include_role:
     name: evolix/remount-usr
 
 # copied and customized from https://raw.githubusercontent.com/certbot/certbot/v1.14.0/letsencrypt-auto
 - name: Let's Encrypt script is present
-  copy:
+  ansible.builtin.copy:
     src: letsencrypt-auto
     dest: /usr/local/bin/letsencrypt-auto
     mode: '0755'
@@ -20,22 +20,23 @@
   notify: install letsencrypt-auto
 
 - name: Check certbot script
-  stat:
+  ansible.builtin.stat:
     path: /usr/local/bin/certbot
   register: certbot_path
 
 - name: Rename certbot script if present
-  command: "mv /usr/local/bin/certbot /usr/local/bin/certbot.bak"
+  ansible.builtin.command:
+    cmd: "mv /usr/local/bin/certbot /usr/local/bin/certbot.bak"
   when: certbot_path.stat.exists
 
 - name: Let's Encrypt script is symlinked as certbot
-  file:
+  ansible.builtin.file:
     src: "/usr/local/bin/letsencrypt-auto"
     dest: "/usr/local/bin/certbot"
     state: link
 
 - name: systemd artefacts are absent
-  file:
+  ansible.builtin.file:
     dest: "{{ item }}"
     state: absent
   loop:
@@ -45,14 +46,14 @@
   notify: systemd daemon-reload
 
 - name: custom crontab is present
-  copy:
+  ansible.builtin.copy:
     src: cron_jessie
     dest: /etc/cron.d/certbot
     force: yes
   when: certbot_custom_crontab | bool
 
 - name: disable self-upgrade
-  ini_file:
+  community.general.ini_file:
     dest: "/etc/letsencrypt/cli.ini"
     section: null
     option: "no-self-upgrade"

certbot/tasks/install-package.yml

@@ -1,6 +1,6 @@
 ---
 
 - name: certbot package is installed
-  apt:
+  ansible.builtin.apt:
     name: certbot
     state: latest

certbot/tasks/main.yml

@@ -1,28 +1,28 @@
 ---
 
 - name: "System compatibility checks"
-  assert:
+  ansible.builtin.assert:
     that:
       - ansible_distribution == "Debian"
       - ansible_distribution_major_version is version('8', '>=')
     msg: only compatible with Debian 9+
 
 - name: Install legacy script on Debian 8
-  include: install-legacy.yml
+  ansible.builtin.include: install-legacy.yml
   when:
     - ansible_distribution == "Debian"
     - ansible_distribution_major_version is version('9', '<')
 
 - name: Install package on Debian 9+
-  include: install-package.yml
+  ansible.builtin.include: install-package.yml
   when:
     - ansible_distribution == "Debian"
     - ansible_distribution_major_version is version('9', '>=')
 
-- include: acme-challenge.yml
+- ansible.builtin.include: acme-challenge.yml
 
 - name: Deploy hooks are present
-  copy:
+  ansible.builtin.copy:
     src: hooks/deploy/
     dest: /etc/letsencrypt/renewal-hooks/deploy/
     mode: "0700"
@@ -30,7 +30,7 @@
     group: root
 
 - name: Manual deploy hook is present
-  copy:
+  ansible.builtin.copy:
     src: hooks/manual-deploy.sh
     dest: /etc/letsencrypt/renewal-hooks/manual-deploy.sh
     mode: "0700"
@@ -38,7 +38,7 @@
     group: root
 
 - name: "sync_remote is configured with servers"
-  lineinfile:
+  ansible.builtin.lineinfile:
     dest: /etc/letsencrypt/renewal-hooks/deploy/sync_remote.cf
     regexp: "^servers="
     line: "servers=\"{{ certbot_hooks_sync_remote_servers | join(' ') }}\""
@@ -46,14 +46,15 @@
 
 # begining of backward compatibility tasks
 - name: Move deploy/commit-etc.sh to deploy/z-commit-etc.sh if present
-  command: "mv /etc/letsencrypt/renewal-hooks/deploy/commit-etc.sh /etc/letsencrypt/renewal-hooks/deploy/z-commit-etc.sh"
+  ansible.builtin.command:
+    cmd: "mv /etc/letsencrypt/renewal-hooks/deploy/commit-etc.sh /etc/letsencrypt/renewal-hooks/deploy/z-commit-etc.sh"
   args:
     removes: /etc/letsencrypt/renewal-hooks/deploy/commit-etc.sh
     creates: /etc/letsencrypt/renewal-hooks/deploy/z-commit-etc.sh
 # end of backward compatibility tasks
 
 - name: "certbot lock is ignored by Git"
-  lineinfile:
+  ansible.builtin.lineinfile:
     dest: /etc/.gitignore
     line: letsencrypt/.certbot.lock
     create: yes

clamav/handlers/main.yml

@@ -1,5 +1,5 @@
 ---
 - name: restart clamav
-  service:
+  ansible.builtin.service:
     name: clamav-daemon
     state: restarted

clamav/tasks/main.yml

@@ -1,6 +1,6 @@
 ---
 - name: configure clamav-daemon
-  debconf:
+  ansible.builtin.debconf:
     name: clamav-daemon
     question: "{{ item.key }}"
     value: "{{ item.value }}"
@@ -52,7 +52,7 @@
   - clamav
 
 - name: configure clamav-freshclam
-  debconf:
+  ansible.builtin.debconf:
     name: clamav-freshclam
     question: "{{ item.key }}"
     value: "{{ item.value }}"
@@ -73,7 +73,7 @@
   - clamav
 
 - name: install ClamAV
-  apt:
+  ansible.builtin.apt:
     name:
       - clamav-daemon
       - clamav
@@ -92,7 +92,7 @@
   - clamav
 
 - name: add clamav user to amavis group
-  user:
+  ansible.builtin.user:
     name: clamav
     groups: amavis
     append: True
@@ -100,7 +100,7 @@
   - clamav
 
 - name: allow supplementary groups
-  replace:
+  ansible.builtin.replace:
     dest: /etc/clamav/clamd.conf
     regexp: 'AllowSupplementaryGroups false'
     replace: 'AllowSupplementaryGroups true'

dhcpd/handlers/main.yml

@@ -1,5 +1,5 @@
 ---
 - name: restart dhcp
-  service:
+  ansible.builtin.service:
     name: isc-dhcp-server
     state: restarted

dhcpd/tasks/main.yml

@@ -1,4 +1,4 @@
 - name: ensure packages are installed
-  apt:
+  ansible.builtin.apt:
     name: isc-dhcp-server
     state: present

docker-host/handlers/main.yml

@@ -1,10 +1,10 @@
 ---
 - name: reload systemd
-  systemd:
+  ansible.builtin.systemd:
     daemon-reload: yes
 
 - name: restart docker
-  service:
+  ansible.builtin.systemd:
     name: docker
     state: restarted
     enabled: yes

docker-host/tasks/main.yml

@@ -1,7 +1,7 @@
 # This role installs the docker daemon
 ---
 - name: Remove older docker packages
-  apt:
+  ansible.builtin.apt:
     name:
       - docker
       - docker-engine
@@ -9,15 +9,21 @@
     state: absent
 
 - name: Install source requirements
-  apt:
+  ansible.builtin.apt:
     name:
-      - apt-transport-https
       - ca-certificates
       - gnupg2
     state: present
 
+- name: Install apt-transport-https (Debian <10)
+  ansible.builtin.apt:
+    name:
+      - apt-transport-https
+    state: present
+  when: ansible_distribution_major_version is version('10', '<')
+
 - name: Add Docker's official GPG key
-  copy:
+  ansible.builtin.copy:
     src: docker-debian.asc
     dest: "{{ apt_keyring_dir }}/docker-debian.asc"
     force: yes
@@ -25,53 +31,61 @@
     owner: root
     group: root
 
-- name: Add Docker repository
+- name: Add Docker repository (Debian <12)
-  apt_repository:
+  ansible.builtin.apt_repository:
     repo: 'deb [signed-by={{ apt_keyring_dir }}/docker-debian.asc] https://download.docker.com/linux/debian {{ ansible_distribution_release }} stable'
+    filename: docker
     state: present
-    filename: docker.list
+    update_cache: yes
+  when: ansible_distribution_major_version is version('12', '<')
 
-- name: Drop unsigned Docker repository
+- name: Add Docker repository (Debian >=12)
-  apt_repository:
+  ansible.builtin.template:
-    repo: 'deb https://download.docker.com/linux/debian {{ ansible_distribution_release }} stable'
+    src: docker.sources.j2
-    state: absent
+    dest: /etc/apt/sources.list.d/docker.sources
-    filename: docker.list
+    state: present
+  register: docker_sources
+  when: ansible_distribution_major_version is version('12', '>=')
+
+- name: Update APT cache
+  ansible.builtin.apt:
+    update_cache: yes
+  when: docker_sources is changed
 
 - name: Install Docker
-  apt:
+  ansible.builtin.apt:
     name:
       - docker-ce
       - docker-ce-cli
       - containerd.io
-    update_cache: yes
 
 - name: python-docker is installed
-  apt:
+  ansible.builtin.apt:
     name: python-docker
     state: present
   when: ansible_python_version is version('3', '<')
 
 - name: python3-docker is installed
-  apt:
+  ansible.builtin.apt:
     name: python3-docker
     state: present
   when: ansible_python_version is version('3', '>=')
 
 - name: Copy Docker daemon configuration file
-  template:
+  ansible.builtin.template:
     src: daemon.json.j2
     dest: /etc/docker/daemon.json
   notify: restart docker
 
 - name: Creating Docker tmp directory
-  file:
+  ansible.builtin.file:
     path: "{{ docker_tmpdir }}"
     state: directory
     mode: "0644"
     owner: root
 
 - name: Creating Docker TLS directory
-  file:
+  ansible.builtin.file:
     path: "{{ docker_tls_path }}"
     state: directory
     mode: "0644"
@@ -79,7 +93,7 @@
   when: docker_tls_enabled | bool
 
 - name: Copy shellpki utility to Docker TLS directory
-  template:
+  ansible.builtin.template:
     src: "{{ item }}.j2"
     dest: "{{ docker_tls_path }}/{{ item }}"
     mode: "0744"
@@ -89,12 +103,13 @@
   when: docker_tls_enabled | bool
 
 - name: Check if certs are already created
-  stat:
+  ansible.builtin.stat:
     path: "{{ docker_tls_path }}/certs"
   register: tls_certs_stat
 
 - name: Creating a CA, server key
-  command: "{{ docker_tls_path }}/shellpki.sh init"
+  ansible.builtin.command:
+    cmd: "{{ docker_tls_path }}/shellpki.sh init"
   when:
     - docker_tls_enabled | bool
     - not tls_certs_stat.stat.isdir

docker-host/templates/docker.sources.j2

@@ -0,0 +1,8 @@
+# {{ ansible_managed }}
+
+Types: deb
+URIs: https://download.docker.com/linux/debian
+Suites: {{ ansible_distribution_release }}
+Components: stable
+Signed-by: {{ apt_keyring_dir }}/docker-debian.asc
+Enabled: yes

dovecot/handlers/main.yml

@@ -1,16 +1,16 @@
 ---
 - name: restart dovecot
-  service:
+  ansible.builtin.service:
     name: dovecot
     state: restarted
 
 - name: reload dovecot
-  service:
+  ansible.builtin.service:
     name: dovecot
     state: reloaded
 
 - name: restart log2mail
-  service:
+  ansible.builtin.service:
     name: log2mail
     state: restarted
 

dovecot/tasks/main.yml

@@ -1,5 +1,5 @@
 - name: ensure packages are installed
-  apt:
+  ansible.builtin.apt:
     name:
       - dovecot-ldap
       - dovecot-imapd
@@ -11,12 +11,12 @@
   - dovecot
 
 - name: Generate 4096 bits Diffie-Hellman parameters (may take several minutes)
-  openssl_dhparam:
+  community.crypto.openssl_dhparam:
     path: /etc/ssl/dhparams.pem
     size: 4096
 
 - name: disable pam auth
-  replace:
+  ansible.builtin.replace:
     dest: /etc/dovecot/conf.d/10-auth.conf
     regexp: "[^#]!include auth-system.conf.ext"
     replace: "#!include auth-system.conf.ext"
@@ -24,7 +24,7 @@
   - dovecot
 
 - name: update ldap auth
-  lineinfile:
+  ansible.builtin.lineinfile:
     dest: /etc/dovecot/dovecot-ldap.conf.ext
     line: "{{ item.key }} = {{ item.value }}"
     regexp: "^#*{{ item.key }}"
@@ -43,7 +43,7 @@
   - dovecot
 
 - name: create vmail group
-  group:
+  ansible.builtin.group:
     name: vmail
     gid: "{{ dovecot_vmail_gid }}"
     system: True
@@ -51,7 +51,7 @@
   - dovecot
 
 - name: create vmail user
-  user:
+  ansible.builtin.user:
     name: vmail
     group: vmail
     uid: "{{ dovecot_vmail_uid }}"
@@ -61,7 +61,7 @@
   - dovecot
 
 - name: deploy evolix config
-  template:
+  ansible.builtin.template:
     src: z-evolinux-defaults.conf.j2
     dest: /etc/dovecot/conf.d/z-evolinux-defaults.conf
     mode: "0644"
@@ -70,7 +70,7 @@
   - dovecot
 
 - name: deploy file for custom configuration
-  template:
+  ansible.builtin.template:
     src: zzz-evolinux-custom.conf.j2
     dest: /etc/dovecot/conf.d/zzz-evolinux-custom.conf
     mode: "0644"
@@ -78,18 +78,18 @@
   tags:
   - dovecot
 
-- include: munin.yml
+- ansible.builtin.include: munin.yml
   tags:
-  - dovecot
+    - dovecot
 
 - name: log2mail is installed
-  apt:
+  ansible.builtin.apt:
     name: log2mail
     state: present
   tags: dovecot
 
 - name: dovecot is configured in log2mail
-  blockinfile:
+  ansible.builtin.blockinfile:
     path: /etc/log2mail/config/mail.conf
     create: true
     owner: log2mail

dovecot/tasks/munin.yml

@@ -1,7 +1,7 @@
 ---
 
 - name: is Munin present ?
-  stat:
+  ansible.builtin.stat:
     path: /etc/munin/plugin-conf.d/munin-node
   check_mode: no
   register: munin_node_plugins_config
@@ -9,13 +9,13 @@
 - name: Munin plugins are present and configured
   block:
     - name: Install munin plugin
-      copy:
+      ansible.builtin.copy:
         src: munin_plugin
         dest: /etc/munin/plugins/dovecot
         mode: "0755"
 
     - name: Install munin config
-      copy:
+      ansible.builtin.copy:
         src: munin_config
         dest: /etc/munin/plugin-conf.d/dovecot
         mode: "0644"

drbd/handlers/main.yml

@@ -1,5 +1,5 @@
 ---
 - name: restart munin-node
-  service:
+  ansible.builtin.service:
     name: munin-node
     state: restarted

drbd/tasks/main.yml

@@ -1,6 +1,6 @@
 ---
-- include: packages.yml
+- ansible.builtin.include: packages.yml
 
-- include: munin.yml
+- ansible.builtin.include: munin.yml
 
-- include: nagios.yml
+- ansible.builtin.include: nagios.yml

drbd/tasks/munin.yml

@@ -1,7 +1,7 @@
 ---
 
 - name: Check if Munin plugins exists
-  stat:
+  ansible.builtin.stat:
     path: /etc/munin/plugins/
   register: munin_plugins_dir
   check_mode: no
@@ -10,7 +10,7 @@
 
 # https://raw.githubusercontent.com/munin-monitoring/contrib/master/plugins/drbd/drbd
 - name: Get Munin plugin
-  copy:
+  ansible.builtin.copy:
     src: munin/drbd-plugin
     dest: /etc/munin/plugins/drbd
     mode: "0755"
@@ -20,7 +20,7 @@
   - drbd
 
 - name: Copy Munin plugin conf
-  copy:
+  ansible.builtin.copy:
     src: munin/drbd-config
     dest: /etc/munin/plugin-conf.d/drbd
     mode: "0644"

drbd/tasks/nagios.yml

@@ -1,21 +1,21 @@
 ---
 
 - name: Check if Nagios is installed
-  stat:
+  ansible.builtin.stat:
     path: /usr/local/lib/nagios/plugins/
   register: nagios_plugins_dir
   check_mode: no
   tags:
   - drbd
 
-- include_role:
+- ansible.builtin.include_role:
     name: evolix/remount-usr
   tags:
   - drbd
 
 # https://exchange.nagios.org/components/com_mtree/attachment.php?link_id=3367&cf_id=30
 - name: Install Nagios plugin
-  copy:
+  ansible.builtin.copy:
     src: "nagios/check_drbd"
     dest: "/usr/local/lib/nagios/plugins/check_drbd"
     mode: "0755"

drbd/tasks/packages.yml

@@ -1,5 +1,5 @@
 - name: Install dependency
-  apt:
+  ansible.builtin.apt:
     name:
       - drbd-utils
       - lvm2
@@ -7,7 +7,7 @@
   - drbd
 
 - name: Enable drbd.service
-  service:
+  ansible.builtin.service:
     name: drbd
     enabled: yes
   tags:

elasticsearch/handlers/main.yml

@@ -1,7 +1,7 @@
 ---
 
 - name: restart elasticsearch
-  systemd:
+  ansible.builtin.systemd:
     daemon_reload: yes
     name: elasticsearch
     state: restarted

elasticsearch/tasks/additional_scripts.yml

@@ -1,11 +1,11 @@
 ---
 
-- include_role:
+- ansible.builtin.include_role:
     name: evolix/remount-usr
   when: elasticsearch_additional_scripts_dir is search("/usr")
 
 - name: "{{ elasticsearch_additional_scripts_dir }} exists"
-  file:
+  ansible.builtin.file:
     dest: "{{ elasticsearch_additional_scripts_dir }}"
     mode: "0700"
     owner: root
@@ -13,7 +13,7 @@
     state: directory
 
 - name: Plugins upgrade script is installed
-  copy:
+  ansible.builtin.copy:
     src: upgrade_elasticsearch_plugins.sh
     dest: "{{ elasticsearch_additional_scripts_dir }}/upgrade_elasticsearch_plugins.sh"
     mode: "0755"

elasticsearch/tasks/apt_sources.yml

@@ -0,0 +1,36 @@
+---
+- name: APT https transport is enabled (Debian <10)
+  ansible.builtin.apt:
+    name: apt-transport-https
+    state: present
+  when: ansible_distribution_major_version is version('10', '<')
+
+- name: Elastic GPG key is installed
+  ansible.builtin.copy:
+    src: elastic.asc
+    dest: "{{ apt_keyring_dir }}/elastic.asc"
+    force: yes
+    mode: "0644"
+    owner: root
+    group: root
+
+- name: Add Elastic repository (Debian <12)
+  ansible.builtin.apt_repository:
+    repo: "deb [signed-by={{ apt_keyring_dir }}/elastic.asc] https://artifacts.elastic.co/packages/{{ elastic_stack_version | mandatory }}/apt stable main"
+    filename: elastic
+    state: present
+    update_cache: yes
+  when: ansible_distribution_major_version is version('12', '<')
+
+- name: Add Elastic repository (Debian >=12)
+  ansible.builtin.template:
+    src: elastic.sources.j2
+    dest: /etc/apt/sources.list.d/elastic.sources
+    state: present
+  register: elastic_sources
+  when: ansible_distribution_major_version is version('12', '>=')
+
+- name: Update APT cache
+  ansible.builtin.apt:
+    update_cache: yes
+  when: elastic_sources is changed

elasticsearch/tasks/bootstrap_checks.yml

@@ -1,7 +1,8 @@
 ---
 
 - name: Read maximum map count
-  command: "sysctl -n vm.max_map_count"
+  ansible.builtin.command:
+    cmd: "sysctl -n vm.max_map_count"
   register: max_map_count
   failed_when: False
   changed_when: False
@@ -9,7 +10,7 @@
   - config
 
 - name: Maximum map count check
-  sysctl:
+  ansible.posix.sysctl:
     name: vm.max_map_count
     value: 262144
     sysctl_file: /etc/sysctl.d/elasticsearch.conf
@@ -18,7 +19,7 @@
   - config
 
 - name: bootstrap.memory_lock
-  lineinfile:
+  ansible.builtin.lineinfile:
     dest: /etc/elasticsearch/elasticsearch.yml
     line: "bootstrap.memory_lock: true"
     regexp: "^bootstrap.memory_lock:"
@@ -27,12 +28,12 @@
   - config
 
 - name: Create a system config directory for systemd overrides
-  file:
+  ansible.builtin.file:
     path: /etc/systemd/system/elasticsearch.service.d
     state: directory
 
 - name: Override memory config in systemd unit
-  ini_file:
+  community.general.ini_file:
     dest: /etc/systemd/system/elasticsearch.service.d/elasticsearch.conf
     section: Service
     option: "LimitMEMLOCK"

elasticsearch/tasks/configuration.yml

@@ -1,7 +1,7 @@
 ---
 
 - name: Configure cluster name
-  lineinfile:
+  ansible.builtin.lineinfile:
     dest: /etc/elasticsearch/elasticsearch.yml
     line: "cluster.name: {{ elasticsearch_cluster_name }}"
     regexp: "^cluster.name:"
@@ -11,7 +11,7 @@
     - config
 
 - name: Configure node name
-  lineinfile:
+  ansible.builtin.lineinfile:
     dest: /etc/elasticsearch/elasticsearch.yml
     line: "node.name: {{ elasticsearch_node_name }}"
     regexp: "^node.name:"
@@ -20,7 +20,7 @@
     - config
 
 - name: Configure network host
-  lineinfile:
+  ansible.builtin.lineinfile:
     dest: /etc/elasticsearch/elasticsearch.yml
     line: "network.host: {{ elasticsearch_network_host  }}"
     regexp: "^network.host:"
@@ -30,7 +30,7 @@
     - config
 
 - name: Configure network publish_host
-  lineinfile:
+  ansible.builtin.lineinfile:
     dest: /etc/elasticsearch/elasticsearch.yml
     line: "network.publish_host: {{ elasticsearch_network_publish_host  }}"
     regexp: "^network.publish_host:"
@@ -40,7 +40,7 @@
     - config
 
 - name: Configure http publish_host
-  lineinfile:
+  ansible.builtin.lineinfile:
     dest: /etc/elasticsearch/elasticsearch.yml
     line: "http.publish_host: {{ elasticsearch_http_publish_host  }}"
     regexp: "^http.publish_host:"
@@ -50,7 +50,7 @@
     - config
 
 - name: Configure discovery seed hosts
-  lineinfile:
+  ansible.builtin.lineinfile:
     dest: /etc/elasticsearch/elasticsearch.yml
     line: "discovery.seed_hosts: {{ elasticsearch_discovery_seed_hosts | to_yaml(default_flow_style=True) }}"
     regexp: "^discovery.seed_hosts:"
@@ -59,7 +59,7 @@
     - config
 
 - name: Configure empty discovery seed hosts
-  lineinfile:
+  ansible.builtin.lineinfile:
     dest: /etc/elasticsearch/elasticsearch.yml
     regexp: "^discovery.seed_hosts:"
     state: absent
@@ -68,7 +68,7 @@
     - config
 
 - name: Configure initial master nodes
-  lineinfile:
+  ansible.builtin.lineinfile:
     dest: /etc/elasticsearch/elasticsearch.yml
     line: "cluster.initial_master_nodes: {{ elasticsearch_cluster_initial_master_nodes | to_yaml(default_flow_style=True) }}"
     regexp: "^cluster.initial_master_nodes:"
@@ -77,7 +77,7 @@
     - config
 
 - name: Configure empty initial master nodes
-  lineinfile:
+  ansible.builtin.lineinfile:
     dest: /etc/elasticsearch/elasticsearch.yml
     regexp: "^cluster.initial_master_nodes:"
     state: absent
@@ -86,7 +86,7 @@
     - config
 
 - name: Configure RESTART_ON_UPGRADE
-  lineinfile:
+  ansible.builtin.lineinfile:
     dest: /etc/default/elasticsearch
     line: "RESTART_ON_UPGRADE={{ elasticsearch_restart_on_upgrade | bool | ternary('true','false') }}"
     regexp: "^RESTART_ON_UPGRADE="
@@ -95,7 +95,7 @@
     - config
 
 - name: JVM Heap size (min) is set
-  lineinfile:
+  ansible.builtin.lineinfile:
     dest: /etc/elasticsearch/jvm.options.d/evolinux.options
     regexp: "^-Xms"
     line: "-Xms{{ elasticsearch_jvm_xms }}"
@@ -107,7 +107,7 @@
     - config
 
 - name: JVM Heap size (max) is set
-  lineinfile:
+  ansible.builtin.lineinfile:
     dest: /etc/elasticsearch/jvm.options.d/evolinux.options
     regexp: "^-Xmx"
     line: "-Xmx{{ elasticsearch_jvm_xmx }}"
@@ -119,7 +119,7 @@
     - config
 
 - name: Disable garbage collector logs (JDK >= 9)
-  lineinfile:
+  ansible.builtin.lineinfile:
     dest: /etc/elasticsearch/jvm.options
     regexp: "Xlog:gc"
     line: "#9-:-Xlog:gc*,gc+age=trace,safepoint:file=/opt/my-app/gc.log:utctime,pid,tags:filecount=32,filesize=64m"
@@ -130,7 +130,7 @@
     - config
 
 - name: Configure cluster members
-  lineinfile:
+  ansible.builtin.lineinfile:
     dest: /etc/elasticsearch/elasticsearch.yml
     line: "discovery.zen.ping.unicast.hosts: {{ elasticsearch_cluster_members }}"
     regexp: "^discovery.zen.ping.unicast.hosts:"
@@ -140,7 +140,7 @@
     - config
 
 - name: Configure minimum master nodes
-  lineinfile:
+  ansible.builtin.lineinfile:
     dest: /etc/elasticsearch/elasticsearch.yml
     line: "discovery.zen.minimum_master_nodes: {{ elasticsearch_minimum_master_nodes }}"
     regexp: "^discovery.zen.minimum_master_nodes:"

elasticsearch/tasks/curator.yml

@@ -1,11 +1,11 @@
 ---
 
 - name: Use the correct debian repository
-  set_fact:
+  ansible.builtin.set_fact:
     curator_debian_repository: '{% if ansible_distribution_release == "jessie" %}debian{% else %}debian9{% endif %}'
 
 - name: Curator sources list is available
-  apt_repository:
+  ansible.builtin.apt_repository:
     repo: "deb https://packages.elastic.co/curator/5/{{ curator_debian_repository }} stable main"
     filename: curator
     update_cache: yes
@@ -15,7 +15,7 @@
     - packages
 
 - name: Curator package is installed
-  apt:
+  ansible.builtin.apt:
     name: elasticsearch-curator
     state: present
   tags:

elasticsearch/tasks/datadir.yml

@@ -3,13 +3,13 @@
 - name: Set real datadir value when customized
   block:
     - name: "Is custom datadir present ?"
-      stat:
+      ansible.builtin.stat:
         path: "{{ elasticsearch_custom_datadir }}"
       register: elasticsearch_custom_datadir_test
       check_mode: no
 
     - name: "read the real datadir"
-      command: readlink -f /var/lib/elasticsearch
+      ansible.builtin.command: readlink -f /var/lib/elasticsearch
       changed_when: False
       register: elasticsearch_current_real_datadir_test
       check_mode: no
@@ -22,23 +22,24 @@
 - name: Datadir is moved to custom path
   block:
     - name: elasticsearch is stopped
-      service:
+      ansible.builtin.service:
         name: elasticsearch
         state: stopped
 
     - name: Move elasticsearch datadir to custom datadir
-      command: mv {{ elasticsearch_current_real_datadir_test.stdout }} {{ elasticsearch_custom_datadir }}
+      ansible.builtin.command:
+        cmd: mv {{ elasticsearch_current_real_datadir_test.stdout }} {{ elasticsearch_custom_datadir }}
       args:
         creates: "{{ elasticsearch_custom_datadir }}"
 
     - name: Symlink {{ elasticsearch_custom_datadir }} to /var/lib/elasticsearch
-      file:
+      ansible.builtin.file:
         src: "{{ elasticsearch_custom_datadir }}"
         dest: '/var/lib/elasticsearch'
         state: link
 
     - name: elasticsearch is started
-      service:
+      ansible.builtin.service:
         name: elasticsearch
         state: started
   tags:

elasticsearch/tasks/logs.yml

@@ -1,8 +1,8 @@
 ---
 
 - name: Check if cron is installed
-  shell: "set -o pipefail && dpkg -l cron 2>/dev/null | grep -q -E '^(i|h)i'"
+  ansible.builtin.shell:
-  args:
+    cmd: "set -o pipefail && dpkg -l cron 2>/dev/null | grep -q -E '^(i|h)i'"
     executable: /bin/bash
   check_mode: no
   failed_when: False
@@ -10,7 +10,7 @@
   register: is_cron_installed
 
 - name: "log rotation script"
-  template:
+  ansible.builtin.template:
     src: rotate_elasticsearch_logs.j2
     dest: /etc/cron.daily/rotate_elasticsearch_logs
     owner: root

elasticsearch/tasks/main.yml

@@ -1,21 +1,21 @@
 ---
 
-- include: packages.yml
+- ansible.builtin.include: packages.yml
 
-- include: configuration.yml
+- ansible.builtin.include: configuration.yml
 
-- include: bootstrap_checks.yml
+- ansible.builtin.include: bootstrap_checks.yml
 
-- include: tmpdir.yml
+- ansible.builtin.include: tmpdir.yml
 
-- include: datadir.yml
+- ansible.builtin.include: datadir.yml
 
-- include: logs.yml
+- ansible.builtin.include: logs.yml
 
-- include: additional_scripts.yml
+- ansible.builtin.include: additional_scripts.yml
 
-- include: plugin_head.yml
+- ansible.builtin.include: plugin_head.yml
   when: elasticsearch_plugin_head | bool
 
-- include: curator.yml
+- ansible.builtin.include: curator.yml
   when: elasticsearch_curator | bool

elasticsearch/tasks/packages.yml

@@ -1,73 +1,23 @@
 ---
-
+- name: APT sources
-- name: APT https transport is enabled
+  ansible.builtin.import_tasks: apt_sources.yml
-  apt:
+  args:
-    name: apt-transport-https
+    apply:
-    state: present
+      tags:
-  tags:
+        - elasticsearch
-    - elasticsearch
+        - packages
-    - packages
-
-- name: Look for legacy apt keyring
-  stat:
-    path: /etc/apt/trusted.gpg
-  register: _trusted_gpg_keyring
-  tags:
-    - elasticsearch
-    - packages
-
-- name: Elastic embedded GPG key is absent
-  apt_key:
-    id: "D88E42B4"
-    keyring: /etc/apt/trusted.gpg
-    state: absent
-  when: _trusted_gpg_keyring.stat.exists
-  tags:
-    - elasticsearch
-    - packages
-
-- name: Elastic GPG key is installed
-  copy:
-    src: elastic.asc
-    dest: "{{ apt_keyring_dir }}/elastic.asc"
-    force: yes
-    mode: "0644"
-    owner: root
-    group: root
-  tags:
-    - elasticsearch
-    - packages
-
-- name: Elastic sources list is available
-  apt_repository:
-    repo: "deb [signed-by={{ apt_keyring_dir }}/elastic.asc] https://artifacts.elastic.co/packages/{{ elastic_stack_version | mandatory }}/apt stable main"
-    filename: elastic
-    state: present
-    update_cache: yes
-  tags:
-    - elasticsearch
-    - packages
-
-- name: Unsigned Elastic sources list is not available
-  apt_repository:
-    repo: "deb https://artifacts.elastic.co/packages/{{ elastic_stack_version | mandatory }}/apt stable main"
-    filename: elastic
-    state: absent
-    update_cache: yes
-  tags:
-    - elasticsearch
-    - packages
 
 - name: Elasticsearch is installed
-  apt:
+  ansible.builtin.apt:
     name: elasticsearch
     state: present
+    update_cache: yes
   tags:
     - elasticsearch
     - packages
 
 - name: Elasticsearch service is enabled
-  service:
+  ansible.builtin.systemd:
     name: elasticsearch
     enabled: yes
   tags:

elasticsearch/tasks/plugin_head.yml

@@ -1,7 +1,7 @@
 ---
 
 - name: "User {{ elasticsearch_plugin_head_owner }} is present"
-  user:
+  ansible.builtin.user:
     name: "{{ elasticsearch_plugin_head_owner }}"
     home: "{{ elasticsearch_plugin_head_home }}"
     createhome: yes
@@ -11,7 +11,7 @@
 - name: Head plugin is installed
   block:
     - name: Head repository is checked-out
-      git:
+      ansible.builtin.git:
         repo: "https://github.com/mobz/elasticsearch-head.git"
         dest: "{{ elasticsearch_plugin_head_clone_dir }}"
         clone: yes
@@ -19,12 +19,12 @@
         - packages
 
     - name: Create tmpdir
-      file:
+      ansible.builtin.file:
         dest: "{{ elasticsearch_plugin_head_tmp_dir }}"
         state: directory
 
     - name: NPM packages for head are installed
-      npm:
+      community.general.npm:
         path: "{{ elasticsearch_plugin_head_clone_dir }}"
       tags:
         - packages
@@ -35,7 +35,7 @@
   become: yes
 
 - name: Elasticsearch HTTP/CORS are enabled
-  lineinfile:
+  ansible.builtin.lineinfile:
     dest: /etc/elasticsearch/elasticsearch.yml
     line: "http.cors.enabled: true"
     regexp: "^http.cors.enabled:"
@@ -46,7 +46,7 @@
     - elasticsearch
 
 - name: Elasticsearch HTTP/CORS accepts all origins
-  lineinfile:
+  ansible.builtin.lineinfile:
     dest: /etc/elasticsearch/elasticsearch.yml
     line: "http.cors.allow-origin: \"*\""
     regexp: "^http.cors.allow-origin:"
@@ -57,7 +57,7 @@
     - elasticsearch
 
 - name: Install systemd unit
-  template:
+  ansible.builtin.template:
     src: elasticsearch-head.service.j2
     dest: /etc/systemd/system/elasticsearch-head.service
   tags:
@@ -65,7 +65,7 @@
     - systemd
 
 - name: Enable systemd unit
-  systemd:
+  ansible.builtin.systemd:
     name: elasticsearch-head
     daemon_reload: yes
     enabled: yes

elasticsearch/tasks/tmpdir.yml

@@ -1,7 +1,8 @@
 ---
 
 - name: Check if /tmp is noexec
-  shell: "cat /etc/fstab | grep -E \" +/tmp\" | grep noexec"
+  ansible.builtin.shell:
+    cmd: "cat /etc/fstab | grep -E \" +/tmp\" | grep noexec"
   register: fstab_tmp_noexec
   failed_when: False
   changed_when: False
@@ -9,13 +10,13 @@
 
 - name: Tmpdir is moved to custom path
   block:
-    - set_fact:
+    - ansible.builtin.set_fact:
         _elasticsearch_custom_tmpdir: "{{ elasticsearch_custom_tmpdir | default(elasticsearch_default_tmpdir, True) | mandatory }}"
       tags:
         - elasticsearch
 
     - name: "Create {{ _elasticsearch_custom_tmpdir }}"
-      file:
+      ansible.builtin.file:
         path: "{{ _elasticsearch_custom_tmpdir }}"
         owner: elasticsearch
         group: elasticsearch
@@ -25,7 +26,7 @@
         - elasticsearch
 
     - name: change JVM tmpdir (< 6.x)
-      lineinfile:
+      ansible.builtin.lineinfile:
         dest: /etc/elasticsearch/jvm.options.d/evolinux.options
         line: "-Djava.io.tmpdir={{ _elasticsearch_custom_tmpdir }}"
         regexp: "^-Djava.io.tmpdir="
@@ -40,7 +41,7 @@
       when: elastic_stack_version is version('6', '<')
 
     - name: check if ES_TMPDIR is available (>= 6.x)
-      lineinfile:
+      ansible.builtin.lineinfile:
         dest: /etc/default/elasticsearch
         line: "ES_TMPDIR={{ _elasticsearch_custom_tmpdir }}"
         regexp: "^ES_TMPDIR="
@@ -53,7 +54,7 @@
 
     # Note : Should not do any changes as -Djava.io.tmpdir=${ES_TMPDIR} is already here in the default config.
     - name: change JVM tmpdir (>= 6.x)
-      lineinfile:
+      ansible.builtin.lineinfile:
         dest: /etc/elasticsearch/jvm.options
         line: "-Djava.io.tmpdir=${ES_TMPDIR}"
         regexp: "^-Djava.io.tmpdir="

elasticsearch/templates/elastic.sources.j2

@@ -0,0 +1,8 @@
+# {{ ansible_managed }}
+
+Types: deb
+URIs: https://artifacts.elastic.co/packages/{{ elastic_stack_version | mandatory }}/apt
+Suites: stable
+Components: main
+Signed-by: {{ apt_keyring_dir }}/elastic.asc
+Enabled: yes

etc-git/tasks/commit.yml

@@ -1,7 +1,8 @@
 ---
 
 - name: "Execute ansible-commit"
-  command: "/usr/local/bin/ansible-commit --verbose --message \"{{ commit_message | mandatory }}\""
+  ansible.builtin.command:
+    cmd: "/usr/local/bin/ansible-commit --verbose --message \"{{ commit_message | mandatory }}\""
   changed_when:
     - _ansible_commit.stdout
     - "'CHANGED:' in _ansible_commit.stdout"

etc-git/tasks/lxc_commit.yml

@@ -1,15 +1,15 @@
 ---
 - name: "Assert that we have been called with `container` defined"
-  assert:
+  ansible.builtin.assert:
     that:
       - container is defined
 
 - name: "Define path to /etc in {{ container }} container"
-  set_fact:
+  ansible.builtin.set_fact:
     container_etc: "{{ ('/var/lib/lxc', container, 'rootfs/etc') | path_join }}"
 
 - name: "Check if /etc is a git repository in {{ container }}"
-  stat:
+  ansible.builtin.stat:
     path: "{{ (container_etc, '.git') | path_join }}"
     get_attributes: no
     get_checksum: no
@@ -17,7 +17,7 @@
   register: "container_etc_git"
 
 - name: "Evocommit /etc of {{ container }}"
-  command:
+  ansible.builtin.command:
     argv:
       - /usr/local/bin/evocommit
       - '--ansible'

etc-git/tasks/main.yml

@@ -1,7 +1,7 @@
 ---
 
 - name: Git is installed (Debian)
-  apt:
+  ansible.builtin.apt:
     name: git
     state: present
   tags:
@@ -10,12 +10,12 @@
     - ansible_distribution == "Debian"
 
 - name: Install and configure utilities
-  include: utils.yml
+  ansible.builtin.include: utils.yml
   tags:
     - etc-git
 
 - name: Configure repositories
-  include: repositories.yml
+  ansible.builtin.include: repositories.yml
   tags:
     - etc-git
   when: etc_git_config_repositories | bool

etc-git/tasks/repositories.yml

@@ -1,6 +1,6 @@
 ---
 
-- include: repository.yml
+- ansible.builtin.include: repository.yml
   vars:
     repository_path: "/etc"
     gitignore_items:
@@ -15,18 +15,18 @@
     - etc-git
 
 - name: verify /usr/share/scripts presence
-  stat:
+  ansible.builtin.stat:
     path: /usr/share/scripts
   register: _usr_share_scripts
   tags:
     - etc-git
 
-- include_role:
+- ansible.builtin.include_role:
     name: evolix/remount-usr
   when:
     - _usr_share_scripts.stat.isdir
 
-- include: repository.yml
+- ansible.builtin.include: repository.yml
   vars:
     repository_path: "/usr/share/scripts"
     gitignore_items: []

etc-git/tasks/repository.yml

@@ -1,11 +1,12 @@
 ---
 
-- include_role:
+- ansible.builtin.include_role:
     name: evolix/remount-usr
   when: repository_path is search("/usr")
 
 - name: "{{ repository_path }} is versioned with git"
-  command: "git init ."
+  ansible.builtin.command:
+    cmd: "git init ."
   args:
     chdir: "{{ repository_path }}"
     creates: "{{ repository_path }}/.git/"
@@ -14,7 +15,7 @@
     - etc-git
 
 - name: Git user.email is configured
-  git_config:
+  community.general.git_config:
     name: user.email
     repo: "{{ repository_path }}"
     scope: local
@@ -23,7 +24,7 @@
     - etc-git
 
 - name: "{{ repository_path }}/.git is restricted to root"
-  file:
+  ansible.builtin.file:
     path: "{{ repository_path }}/.git"
     owner: root
     mode: "0700"
@@ -32,7 +33,7 @@
     - etc-git
 
 - name: "{{ repository_path }}/.gitignore is present"
-  copy:
+  ansible.builtin.copy:
     src: gitignore
     dest: "{{ repository_path }}/.gitignore"
     owner: root
@@ -42,7 +43,7 @@
     - etc-git
 
 - name: "Some entries MUST be in the {{ repository_path }}/.gitignore file"
-  lineinfile:
+  ansible.builtin.lineinfile:
     dest: "{{ repository_path }}/.gitignore"
     line: "{{ item }}"
   loop: "{{ gitignore_items | default([]) }}"
@@ -50,7 +51,8 @@
     - etc-git
 
 - name: "does {{ repository_path }}/ have any commit?"
-  command: "git log"
+  ansible.builtin.command:
+    cmd: "git log"
   args:
     chdir: "{{ repository_path }}"
   changed_when: False
@@ -61,7 +63,8 @@
     - etc-git
 
 - name: initial commit is present?
-  shell: "git add -A . && git commit -m \"Initial commit via Ansible\""
+  ansible.builtin.shell:
+    cmd: "git add -A . && git commit -m \"Initial commit via Ansible\""
   args:
     chdir: "{{ repository_path }}"
   register: git_commit

etc-git/tasks/utils.yml

@@ -1,12 +1,12 @@
 ---
 
-- include_role:
+- ansible.builtin.include_role:
     name: evolix/remount-usr
   tags:
     - etc-git
 
 - name: "evocommit script is installed"
-  copy:
+  ansible.builtin.copy:
     src: evocommit
     dest: /usr/local/bin/evocommit
     mode: "0755"
@@ -15,7 +15,7 @@
     - etc-git
 
 - name: "ansible-commit script is installed"
-  copy:
+  ansible.builtin.copy:
     src: ansible-commit
     dest: /usr/local/bin/ansible-commit
     mode: "0755"
@@ -24,7 +24,7 @@
     - etc-git
 
 - name: "etc-git-optimize script is installed"
-  copy:
+  ansible.builtin.copy:
     src: etc-git-optimize
     dest: /usr/share/scripts/etc-git-optimize
     mode: "0755"
@@ -33,7 +33,7 @@
     - etc-git
 
 - name: "etc-git-status script is installed"
-  copy:
+  ansible.builtin.copy:
     src: etc-git-status
     dest: /usr/share/scripts/etc-git-status
     mode: "0755"
@@ -42,8 +42,8 @@
     - etc-git
 
 - name: Check if cron is installed
-  shell: "set -o pipefail && dpkg -l cron 2>/dev/null | grep -q -E '^(i|h)i'"
+  ansible.builtin.shell:
-  args:
+    cmd: "set -o pipefail && dpkg -l cron 2>/dev/null | grep -q -E '^(i|h)i'"
     executable: /bin/bash
   failed_when: False
   changed_when: False
@@ -52,7 +52,7 @@
 
 - block:
   - name: Legacy cron jobs for /etc/.git status are absent
-    file:
+    ansible.builtin.file:
       dest: "{{ item }}"
       state: absent
     loop:
@@ -60,7 +60,7 @@
       - /etc/cron.d/etc-git-status
 
   - name: Cron job for monthly git optimization
-    cron:
+    ansible.builtin.cron:
       name: "Monthly optimization"
       cron_file: etc-git
       special_time: "monthly"
@@ -68,7 +68,7 @@
       job: "/usr/share/scripts/etc-git-optimize"
 
   - name: Cron job for hourly git status
-    cron:
+    ansible.builtin.cron:
       name: "Hourly warning for unclean Git repository if nobody is connected"
       cron_file: etc-git
       special_time: "hourly"
@@ -77,7 +77,7 @@
       state: "{{ etc_git_monitor_status | bool | ternary('present','absent') }}"
 
   - name: Cron job for daily git status
-    cron:
+    ansible.builtin.cron:
       name: "Daily warning for unclean Git repository"
       cron_file: etc-git
       user: root

evoacme/handlers/main.yml

@@ -1,25 +1,27 @@
 - name: newaliases
-  command: newaliases
+  ansible.builtin.command:
+    cmd: newaliases
 
 - name: Test Apache conf
-  command: apache2ctl -t
+  ansible.builtin.command:
+    cmd: apache2ctl -t
   notify: "Reload Apache conf"
 
 - name: reload apache2
-  service:
+  ansible.builtin.service:
     name: apache2
     state: reloaded
 
 - name: apt update
-  apt:
+  ansible.builtin.apt:
     update_cache: yes
 
 - name: reload squid3
-  service:
+  ansible.builtin.service:
     name: squid3
     state: reloaded
 
 - name: reload squid
-  service:
+  ansible.builtin.service:
     name: squid
     state: reloaded

evoacme/tasks/certbot.yml

@@ -1,27 +1,29 @@
 ---
 - name: Do no install certbot crontab
-  set_fact:
+  ansible.builtin.set_fact:
     certbot_custom_crontab: False
 
-- include_role:
+- ansible.builtin.include_role:
     name: evolix/certbot
 
-- include_role:
+- ansible.builtin.include_role:
     name: evolix/remount-usr
 
 
 - name: Disable /etc/cron.d/certbot
-  command: mv -f /etc/cron.d/certbot /etc/cron.d/certbot.disabled
+  ansible.builtin.command:
+    cmd: mv -f /etc/cron.d/certbot /etc/cron.d/certbot.disabled
   args:
     removes: /etc/cron.d/certbot
 
 - name: Disable /etc/cron.daily/certbot
-  command: mv -f /etc/cron.daily/certbot /etc/cron.daily/certbot.disabled
+  ansible.builtin.command:
+    cmd: mv -f /etc/cron.daily/certbot /etc/cron.daily/certbot.disabled
   args:
     removes: /etc/cron.daily/certbot
 
 - name: Install evoacme custom cron
-  copy:
+  ansible.builtin.copy:
     src: evoacme.cron
     dest: /etc/cron.daily/evoacme
     mode: "0755"

evoacme/tasks/conf.yml

@@ -1,5 +1,5 @@
 ---
-- ini_file:
+- community.general.ini_file:
     dest: "{{ evoacme_crt_dir }}/openssl.cnf"
     section: 'req'
     option: "{{ item.name }}"
@@ -11,7 +11,7 @@
      - { name: 'prompt', var: 'no' }
 
 - name: Update openssl conf
-  ini_file:
+  community.general.ini_file:
     dest: "{{ evoacme_crt_dir }}/openssl.cnf"
     section: 'req_dn'
     option: "{{ item.name }}"
@@ -25,7 +25,7 @@
      - { name: 'emailAddress', var: "{{ evoacme_ssl_email }}" }
 
 - name: Copy new evoacme conf
-  template:
+  ansible.builtin.template:
     src: templates/evoacme.conf.j2
     dest: /etc/default/evoacme
     owner: root

evoacme/tasks/evoacme_hook.yml

@@ -1,18 +1,19 @@
 ---
 
 - name: "Create {{ hook_name }} hook directory"
-  file:
+  ansible.builtin.file:
     dest: "{{ evoacme_hooks_dir }}"
     state: directory
 
 - name: "Search for {{ hook_name }} hook"
-  command: "find {{ evoacme_hooks_dir }} -type f \\( -name '{{ hook_name }}' -o -name '{{ hook_name }}.*' \\)"
+  ansible.builtin.command:
+    cmd: "find {{ evoacme_hooks_dir }} -type f \\( -name '{{ hook_name }}' -o -name '{{ hook_name }}.*' \\)"
   check_mode: no
   changed_when: False
   register: _find_hook
 
 - name: "Copy {{ hook_name }} hook if missing"
-  copy:
+  ansible.builtin.copy:
     src: "hooks/{{ hook_name }}"
     dest: "{{ evoacme_hooks_dir }}/{{ hook_name }}"
     mode: "0750"

evoacme/tasks/main.yml

@@ -1,16 +1,16 @@
 ---
 
 - name: Verify Debian version
-  assert:
+  ansible.builtin.assert:
     that:
       - ansible_distribution == "Debian"
       - ansible_distribution_major_version is version('9', '>=')
     msg: only compatible with Debian >= 9
   when: not (evoacme_disable_debian_check | bool)
 
-- include: certbot.yml
+- ansible.builtin.include: certbot.yml
 
-- include: permissions.yml
+- ansible.builtin.include: permissions.yml
 
 # Enable this task if you want to deploy hooks
 # - include: evoacme_hook.yml
@@ -18,6 +18,6 @@
 #     hook_name: "{{ item }}"
 #   loop: []
 
-- include: conf.yml
+- ansible.builtin.include: conf.yml
 
-- include: scripts.yml
+- ansible.builtin.include: scripts.yml

evoacme/tasks/permissions.yml

@@ -1,7 +1,7 @@
 ---
 
 - name: Fix crt directory permissions
-  file:
+  ansible.builtin.file:
     path: "{{ evoacme_crt_dir }}"
     mode: "0755"
     owner: root
@@ -9,7 +9,7 @@
     state: directory
 
 - name: "Fix hooks directory permissions"
-  file:
+  ansible.builtin.file:
     path: "{{ evoacme_hooks_dir }}"
     mode: "0700"
     owner: root
@@ -17,7 +17,7 @@
     state: directory
 
 - name: Fix log directory permissions
-  file:
+  ansible.builtin.file:
     path: "{{ evoacme_log_dir }}"
     mode: "0755"
     owner: root
@@ -25,7 +25,7 @@
     state: directory
 
 - name: Fix challenge directory permissions
-  file:
+  ansible.builtin.file:
     path: "{{ evoacme_acme_dir }}"
     mode: "0755"
     owner: root

evoacme/tasks/scripts.yml

@@ -1,10 +1,10 @@
 ---
 
-- include_role:
+- ansible.builtin.include_role:
     name: evolix/remount-usr
 
 - name: Create CSR dir
-  file:
+  ansible.builtin.file:
     path: "{{ evoacme_csr_dir }}"
     state: directory
     owner: root
@@ -12,7 +12,7 @@
     mode: "0755"
 
 - name: Copy make-csr.sh script
-  copy:
+  ansible.builtin.copy:
     src: make-csr.sh
     dest: /usr/local/sbin/make-csr
     owner: root
@@ -20,7 +20,7 @@
     mode: "0755"
 
 - name: Copy vhost-domains.sh script
-  copy:
+  ansible.builtin.copy:
     src: vhost-domains.sh
     dest: /usr/local/sbin/vhost-domains
     owner: root
@@ -28,7 +28,7 @@
     mode: "0755"
 
 - name: Copy evoacme script
-  copy:
+  ansible.builtin.copy:
     src: evoacme.sh
     dest: /usr/local/sbin/evoacme
     owner: root
@@ -36,7 +36,7 @@
     mode: "0755"
 
 - name: Delete scripts in old location
-  file:
+  ansible.builtin.file:
     path: "/usr/local/bin/{{ item }}"
     state: absent
   loop:

evoacme/templates/evoacme.conf.j2

@@ -1,9 +1,9 @@
 ### File generated by Ansible ###
 
-SSL_KEY_DIR=${SSL_KEY_DIR:-{{ evoacme_ssl_key_dir }} }
+SSL_KEY_DIR=${SSL_KEY_DIR:-"{{ evoacme_ssl_key_dir }}"}
-ACME_DIR=${ACME_DIR:-{{ evoacme_acme_dir }} }
+ACME_DIR=${ACME_DIR:-"{{ evoacme_acme_dir }}"}
-CSR_DIR=${CSR_DIR:-{{ evoacme_csr_dir }} }
+CSR_DIR=${CSR_DIR:-"{{ evoacme_csr_dir }}"}
-CRT_DIR=${CRT_DIR:-{{ evoacme_crt_dir }} }
+CRT_DIR=${CRT_DIR:-"{{ evoacme_crt_dir }}"}
 HOOKS_DIR=${HOOKS_DIR:-"{{ evoacme_hooks_dir }}"}
-LOG_DIR=${LOG_DIR:-{{ evoacme_log_dir }} }
+LOG_DIR=${LOG_DIR:-"{{ evoacme_log_dir }}"}
-SSL_MINDAY=${SSL_MINDAY:-{{ evoacme_ssl_minday }} }
+SSL_MINDAY=${SSL_MINDAY:-"{{ evoacme_ssl_minday }}"}

evobackup-client/handlers/main.yml

@@ -1,17 +1,20 @@
 ---
 - name: restart minifirewall
-  command: /etc/init.d/minifirewall restart
+  ansible.builtin.command:
+    cmd: /etc/init.d/minifirewall restart
   register: minifirewall_init_restart
   failed_when:
     - "'starting IPTables rules is now finish : OK' not in minifirewall_init_restart.stdout"
     - "'minifirewall started' not in minifirewall_init_restart.stdout"
 
 - name: 'created new jail'
-  command: "bkctld restart {{ evolinux_hostname }}"
+  ansible.builtin.command:
+    cmd: "bkctld restart {{ evolinux_hostname }}"
   delegate_to: "{{ evobackup_client__hosts[0].ip }}"
 
 - name: 'jail updated'
-  command: "bkctld restart {{ evolinux_hostname }}"
+  ansible.builtin.command:
+    cmd: "bkctld restart {{ evolinux_hostname }}"
 #    - "bkctld sync {{ evolinux_hostname }}"
   delegate_to: "{{ evobackup_client__hosts[0].ip }}"
   when: evobackup_client__hosts | length > 1

evobackup-client/tasks/jail.yml

@@ -1,7 +1,8 @@
 ---
 
 - name: 'create jail'
-  command: "bkctld init {{ evolinux_hostname }}"
+  ansible.builtin.command:
+    cmd: "bkctld init {{ evolinux_hostname }}"
   args:
     creates: "/backup/jails/{{ evolinux_hostname }}/"
   become: true
@@ -15,7 +16,8 @@
 # temp fix for bkctld 2.x because the ip and key command return 1
 # if the jail is not started, see https://gitea.evolix.org/evolix/evobackup/issues/31
 - name: 'start jail'
-  command: "bkctld restart {{ evolinux_hostname }}"
+  ansible.builtin.command:
+    cmd: "bkctld restart {{ evolinux_hostname }}"
   become: true
   delegate_to: "{{ evobackup_client__hosts[0].ip }}"
   tags:
@@ -23,7 +25,8 @@
     - evobackup_client_jail
 
 - name: 'add ip to jail'
-  command: "bkctld ip {{ evolinux_hostname }} {{ ansible_host }}"
+  ansible.builtin.command:
+    cmd: "bkctld ip {{ evolinux_hostname }} {{ ansible_host }}"
   become: true
   delegate_to: "{{ evobackup_client__hosts[0].ip }}"
   notify:  'jail updated'
@@ -32,7 +35,8 @@
     - evobackup_client_jail
 
 - name: 'add key to jail'
-  command: "bkctld key {{ evolinux_hostname }} /root/{{ evolinux_hostname }}.pub"
+  ansible.builtin.command:
+    cmd: "bkctld key {{ evolinux_hostname }} /root/{{ evolinux_hostname }}.pub"
   become: true
   delegate_to: "{{ evobackup_client__hosts[0].ip }}"
   notify:  'jail updated'
@@ -41,7 +45,8 @@
     - evobackup_client_jail
 
 - name: 'get jail port'
-  command: "bkctld port {{ evolinux_hostname }}"
+  ansible.builtin.command:
+    cmd: "bkctld port {{ evolinux_hostname }}"
   become: true
   register: bkctld_port
   delegate_to: "{{ evobackup_client__hosts[0].ip }}"
@@ -50,7 +55,7 @@
     - evobackup_client_jail
 
 - name: 'register jail port'
-  set_fact:
+  ansible.builtin.set_fact:
     evobackup_ssh_port={{ bkctld_port.stdout }}
   tags:
     - evobackup_client

evobackup-client/tasks/main.yml

@@ -1,26 +1,26 @@
 ---
 
-- include: "ssh_key.yml"
+- ansible.builtin.include: "ssh_key.yml"
   tags:
     - evobackup_client
     - evobackup_client_backup_ssh_key
 
-- include: "jail.yml"
+- ansible.builtin.include: "jail.yml"
   tags:
     - evobackup_client
     - evobackup_client_jail
 
-- include: "upload_scripts.yml"
+- ansible.builtin.include: "upload_scripts.yml"
   tags:
     - evobackup_client
     - evobackup_client_backup_scripts
 
-- include: "open_ssh_ports.yml"
+- ansible.builtin.include: "open_ssh_ports.yml"
   tags:
     - evobackup_client
     - evobackup_client_backup_firewall
 
-- include: "verify_ssh.yml"
+- ansible.builtin.include: "verify_ssh.yml"
   tags:
     - evobackup_client
     - evobackup_client_backup_hosts

evobackup-client/tasks/open_ssh_ports.yml

@@ -1,7 +1,7 @@
 ---
 
 - name: Is there a Minifirewall ?
-  stat:
+  ansible.builtin.stat:
     path: /etc/default/minifirewall
   register: evobackup_client__minifirewall
   tags:
@@ -9,7 +9,7 @@
     - evobackup_client_backup_firewall
 
 - name: Add backup SSH port in /etc/default/minifirewall
-  blockinfile:
+  ansible.builtin.blockinfile:
     dest: /etc/default/minifirewall
     marker: "# {mark} {{ item.name }}"
     block: |

evobackup-client/tasks/ssh_key.yml

@@ -1,7 +1,7 @@
 ---
 
 - name: Create SSH key
-  user:
+  ansible.builtin.user:
     name: root
     generate_ssh_key: true
     ssh_key_file: "{{ evobackup_client__root_key_path }}"
@@ -12,7 +12,7 @@
     - evobackup_client_backup_ssh_key
 
 - name: Print SSH key
-  debug:
+  ansible.builtin.debug:
     var: evobackup_client__root_key.ssh_public_key
   when: evobackup_client__root_key.ssh_public_key is defined
   tags:
@@ -20,7 +20,7 @@
     - evobackup_client_backup_ssh_key
 
 - name: 'copy ssh public key to backup server'
-  copy:
+  ansible.builtin.copy:
     content: "{{ evobackup_client__root_key.ssh_public_key }}"
     dest: "/root/{{ evolinux_hostname }}.pub"
   become: true

evobackup-client/tasks/upload_scripts.yml

@@ -1,7 +1,7 @@
 ---
 
 - name: Upload evobackup script
-  template:
+  ansible.builtin.template:
     src: "{{ item }}"
     dest: "{{ evobackup_client__cron_path }}"
     force: true

evobackup-client/tasks/verify_ssh.yml

@@ -1,7 +1,7 @@
 ---
 
 - name: Verify evolix backup servers
-  known_hosts:
+  ansible.builtin.known_hosts:
     path: /root/.ssh/known_hosts
     name: "[{{ item.name }}]:{{ item.port }}"
     key: "[{{ item.name }}]:{{ item.port }} {{ item.fingerprint }}"

evocheck/files/evocheck.jessie.sh

@@ -4,7 +4,7 @@
 # Script to verify compliance of a Linux (Debian) server
 # powered by Evolix
 
-VERSION="23.03.01"
+VERSION="23.04.01"
 readonly VERSION
 
 # base functions