Drop unsigned repository when adding a signed one

docker-host/tasks/main.yml

@@ -31,6 +31,12 @@
     state: present
     filename: docker.list
 
+- name: Drop unsigned Docker repository
+  apt_repository:
+    repo: 'deb https://download.docker.com/linux/debian {{ ansible_distribution_release }} stable'
+    state: absent
+    filename: docker.list
+
 - name: Install Docker
   apt:
     name:

elasticsearch/tasks/packages.yml

@@ -48,6 +48,16 @@
     - elasticsearch
     - packages
 
+- name: Unsigned Elastic sources list is not available
+  apt_repository:
+    repo: "deb https://artifacts.elastic.co/packages/{{ elastic_stack_version | mandatory }}/apt stable main"
+    filename: elastic
+    state: absent
+    update_cache: yes
+  tags:
+    - elasticsearch
+    - packages
+
 - name: Elasticsearch is installed
   apt:
     name: elasticsearch

evolinux-base/tasks/hardware.yml

@@ -96,6 +96,13 @@
       tags:
         - packages
 
+    - name: Remove unsigned HPE repository
+      apt_repository:
+        repo: 'deb https://downloads.linux.hpe.com/SDR/repo/mcp {{ ansible_distribution_release }}/current non-free'
+        state: absent
+      tags:
+        - packages
+
     - name: Install HPE Smart Storage Administrator (ssacli)
       apt:
         name: ssacli
@@ -224,6 +231,13 @@
       tags:
         - packages
 
+    - name: Remove unsigned HW tool repository
+      apt_repository:
+        repo: 'deb http://hwraid.le-vert.net/debian {{ ansible_distribution_release }} main'
+        state: absent
+      tags:
+        - packages
+
     - name: Install packages for DELL/LSI hardware
       apt:
         name:

filebeat/tasks/main.yml

@@ -48,6 +48,16 @@
     - filebeat
     - packages
 
+- name: Unsigned Elastic sources list is not available
+  apt_repository:
+    repo: "deb https://artifacts.elastic.co/packages/{{ elastic_stack_version | mandatory }}/apt stable main"
+    filename: elastic
+    state: absent
+    update_cache: yes
+  tags:
+    - filebeat
+    - packages
+
 - name: Filebeat is installed
   apt:
     name: filebeat

fluentd/tasks/main.yml

@@ -40,6 +40,16 @@
     - packages
     - fluentd
 
+- name: Unsigned Fluentd sources list is not available
+  apt_repository:
+    repo: "deb http://packages.treasuredata.com/3/debian/{{ ansible_distribution_release }}/ {{ ansible_distribution_release }} contrib"
+    filename: treasuredata
+    update_cache: yes
+    state: absent
+  tags:
+    - packages
+    - fluentd
+
 - name: Fluentd is installed.
   apt:
     name: td-agent

jenkins/tasks/main.yml

@@ -32,6 +32,13 @@
     filename: jenkins
     update_cache: yes
 
+- name: Remove unsigned jenkins APT repository
+  apt_repository:
+    repo: deb http://pkg.jenkins-ci.org/debian-stable binary/
+    filename: jenkins
+    update_cache: yes
+    state: absent
+
 - name: Install Jenkins
   apt:
     name: jenkins

kibana/tasks/main.yml

@@ -48,6 +48,16 @@
     - kibana
     - packages
 
+- name: Unsigned Elastic sources list is not available
+  apt_repository:
+    repo: "deb https://artifacts.elastic.co/packages/{{ elastic_stack_version | mandatory }}/apt stable main"
+    filename: elastic
+    state: absent
+    update_cache: yes
+  tags:
+    - kibana
+    - packages
+
 - name: Kibana is installed
   apt:
     name: kibana

logstash/tasks/main.yml

@@ -48,6 +48,16 @@
     - logstash
     - packages
 
+- name: Unsigned Elastic sources list is not available
+  apt_repository:
+    repo: "deb https://artifacts.elastic.co/packages/{{ elastic_stack_version | mandatory }}/apt stable main"
+    filename: elastic
+    state: absent
+    update_cache: yes
+  tags:
+    - logstash
+    - packages
+
 - name: Logstash is installed
   apt:
     name: logstash

metricbeat/tasks/main.yml

@@ -48,6 +48,16 @@
     - metricbeat
     - packages
 
+- name: Elastic sources list is available
+  apt_repository:
+    repo: "deb https://artifacts.elastic.co/packages/{{ elastic_stack_version | mandatory }}/apt stable main"
+    filename: elastic
+    state: absent
+    update_cache: yes
+  tags:
+    - metricbeat
+    - packages
+
 - name: Metricbeat is installed
   apt:
     name: metricbeat

mongodb/tasks/main_bullseye.yml

@@ -27,13 +27,20 @@
     owner: root
     group: root
 
-- name: enable APT sources list
+- name: Enable APT sources list
   apt_repository:
     repo: "deb [signed-by={{ apt_keyring_dir }}/mongodb-server-{{mongodb_version}}.asc] http://repo.mongodb.org/apt/debian bullseye/mongodb-org/{{mongodb_version}} main"
     state: present
     filename: "mongodb-org-{{mongodb_version}}"
     update_cache: yes
 
+- name: Disable unsigned APT sources list
+  apt_repository:
+    repo: "deb http://repo.mongodb.org/apt/debian bullseye/mongodb-org/{{mongodb_version}} main"
+    state: absent
+    filename: "mongodb-org-{{mongodb_version}}"
+    update_cache: yes
+
 - name: Install packages
   apt:
     name: mongodb-org

mongodb/tasks/main_buster.yml

@@ -21,13 +21,20 @@
     owner: root
     group: root
 
-- name: enable APT sources list
+- name: Enable APT sources list
   apt_repository:
     repo: "deb [signed-by={{ apt_keyring_dir }}/mongodb-server-{{ mongodb_version }}.asc] http://repo.mongodb.org/apt/debian buster/mongodb-org/{{ mongodb_version }} main"
     state: present
     filename: "mongodb-org-{{mongodb_version}}"
     update_cache: yes
 
+- name: Disable unsigned APT sources list
+  apt_repository:
+    repo: "deb http://repo.mongodb.org/apt/debian buster/mongodb-org/{{ mongodb_version }} main"
+    state: absent
+    filename: "mongodb-org-{{mongodb_version}}"
+    update_cache: yes
+
 - name: Install packages
   apt:
     name: mongodb-org

mongodb/tasks/main_jessie.yml

@@ -21,13 +21,20 @@
     owner: root
     group: root
 
-- name: enable APT sources list
+- name: Enable APT sources list
   apt_repository:
     repo: "deb http://repo.mongodb.org/apt/debian jessie/mongodb-org/{{mongodb_version}} main"
     state: present
     filename: "mongodb-org-{{mongodb_version}}"
     update_cache: yes
 
+- name: Disable APT sources list
+  apt_repository:
+    repo: "deb http://repo.mongodb.org/apt/debian jessie/mongodb-org/{{mongodb_version}} main"
+    state: absent
+    filename: "mongodb-org-{{mongodb_version}}"
+    update_cache: yes
+
 - name: Install packages
   apt:
     name: mongodb-org

newrelic/tasks/sources.yml

@@ -27,3 +27,10 @@
     state: present
     filename: newrelic
     update_cache: yes
+
+- name: Desinstall unsigned NewRelic repository
+  apt_repository:
+    repo: "deb http://apt.newrelic.com/debian/ newrelic non-free"
+    state: absent
+    filename: newrelic
+    update_cache: yes

nodejs/tasks/main.yml

@@ -52,6 +52,17 @@
     - packages
     - nodejs
 
+- name: Unsigned NodeJS sources list ({{ nodejs_apt_version }}) is not available
+  apt_repository:
+    repo: "deb https://deb.nodesource.com/{{ nodejs_apt_version }} {{ ansible_distribution_release }} main"
+    filename: nodesource
+    update_cache: yes
+    state: absent
+  tags:
+    - system
+    - packages
+    - nodejs
+
 - name: NodeJS is installed
   apt:
     name: nodejs

nodejs/tasks/yarn.yml

@@ -47,6 +47,18 @@
     - nodejs
     - yarn
 
+- name: Unsigned Yarn sources list is not available
+  apt_repository:
+    repo: "deb https://dl.yarnpkg.com/debian/ stable main"
+    filename: yarn
+    update_cache: yes
+    state: absent
+  tags:
+    - system
+    - packages
+    - nodejs
+    - yarn
+
 - name: Yarn is installed
   apt:
     name: yarn

php/tasks/sury_pre.yml

@@ -24,6 +24,12 @@
     filename: sury
     state: present
 
+- name: Setup deb.sury.org repository - Remove unsigned source list
+  apt_repository:
+    repo: "deb https://packages.sury.org/php/ {{ ansible_distribution_release }} main"
+    filename: sury
+    state: absent
+
 - name: "Override package list for Sury (Debian 9 or later)"
   set_fact:
     php_stretch_packages:

postgresql/tasks/pgdg-repo.yml

@@ -34,6 +34,12 @@
     repo: "deb [signed-by={{ apt_keyring_dir }}/postgresql.asc] http://apt.postgresql.org/pub/repos/apt/ {{ansible_distribution_release}}-pgdg main"
     update_cache: yes
 
+- name: Remove unsigned PGDG repository
+  apt_repository:
+    repo: "deb http://apt.postgresql.org/pub/repos/apt/ {{ansible_distribution_release}}-pgdg main"
+    update_cache: yes
+    state: absent
+
 - name: Add APT preference file
   template:
     src: postgresql.pref.j2