From 08f7b7276dfa63ad83e4a541942f9301a936c6b6 Mon Sep 17 00:00:00 2001
From: "Rasmus \"Pez\" Wejlgaard" <pez@pez.sh>
Date: Fri, 18 Sep 2026 20:22:54 +0100
Subject: [PATCH] Re-enable london-b's third-party apt repos (PESO-160) (#152)

* Re-enable london-b's third-party apt repos from Ansible

The lunar -> noble upgrade disabled every third-party repo on london-b, so
tailscale, jellyfin and plex have been frozen since. The common role can now
manage deb822 repos and clean up stale source/keyring files per host, and
london-b uses it for tailscale, jellyfin and plex (now on repo.plex.tv with
the v2 key). The dead sonarr v3, mono, nvidia, datadog and PPA leftovers go.

* Drop the explanatory comments from the apt repo change
---
 .gitignore                               |  1 +
 ansible/inventory/host_vars/london-b.yml | 39 ++++++++++++++++++++++++
 ansible/roles/common/defaults/main.yml   |  3 ++
 ansible/roles/common/tasks/main.yml      | 28 ++++++++++++++++-
 4 files changed, 70 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index 41572a9..a3c282e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -13,6 +13,7 @@ override.tf.json
 
 # Ansible
 *.retry
+.ansible/
 
 # Secrets — never commit plaintext secrets
 *.key
diff --git a/ansible/inventory/host_vars/london-b.yml b/ansible/inventory/host_vars/london-b.yml
index 9687c23..c446391 100644
--- a/ansible/inventory/host_vars/london-b.yml
+++ b/ansible/inventory/host_vars/london-b.yml
@@ -20,6 +20,45 @@ snap_services:
 apt_user_services:
   - syncthing@pez
 
+common_apt_repositories:
+  - name: tailscale
+    uris: https://pkgs.tailscale.com/stable/ubuntu
+    suites: "{{ ansible_facts['distribution_release'] }}"
+    components: main
+    signed_by: "https://pkgs.tailscale.com/stable/ubuntu/{{ ansible_facts['distribution_release'] }}.noarmor.gpg"
+  - name: jellyfin
+    uris: https://repo.jellyfin.org/ubuntu
+    suites: "{{ ansible_facts['distribution_release'] }}"
+    components: main
+    signed_by: https://repo.jellyfin.org/jellyfin_team.gpg.key
+  - name: plexmediaserver
+    uris: https://repo.plex.tv/deb
+    suites: public
+    components: main
+    signed_by: https://downloads.plex.tv/plex-keys/PlexSign.v2.key
+
+common_apt_cleanup_files:
+  - /etc/apt/sources.list.d/datadog.list.distUpgrade
+  - /etc/apt/sources.list.d/graphics-drivers-ubuntu-ppa-lunar.list.distUpgrade
+  - /etc/apt/sources.list.d/graphics-drivers-ubuntu-ppa-lunar.sources
+  - /etc/apt/sources.list.d/jcfp-ubuntu-nobetas-lunar.list.distUpgrade
+  - /etc/apt/sources.list.d/jcfp-ubuntu-nobetas-lunar.sources
+  - /etc/apt/sources.list.d/jellyfin.sources.distUpgrade
+  - /etc/apt/sources.list.d/mediaarea.list.distUpgrade
+  - /etc/apt/sources.list.d/mediaarea.sources
+  - /etc/apt/sources.list.d/mono-official-stable.list.distUpgrade
+  - /etc/apt/sources.list.d/nvidia-container-toolkit.list.distUpgrade
+  - /etc/apt/sources.list.d/plexmediaserver.list.distUpgrade
+  - /etc/apt/sources.list.d/sonarr.list.distUpgrade
+  - /etc/apt/sources.list.d/tailscale.list.distUpgrade
+  - /etc/apt/keyrings/jellyfin.gpg
+  - /usr/share/keyrings/plexmediaserver.gpg
+  - /usr/share/keyrings/mono-official-archive-keyring.gpg
+  - /usr/share/keyrings/mono-official-archive-keyring.gpg~
+  - /usr/share/keyrings/sonarr-keyring.gpg
+  - /usr/share/keyrings/sonarr-keyring.gpg~
+  - /usr/share/keyrings/nvidia-container-toolkit-keyring.gpg
+
 zfs_pools:
   - hdd
 
diff --git a/ansible/roles/common/defaults/main.yml b/ansible/roles/common/defaults/main.yml
index a7a9fb7..c2e60b4 100644
--- a/ansible/roles/common/defaults/main.yml
+++ b/ansible/roles/common/defaults/main.yml
@@ -5,3 +5,6 @@ common_ufw_enabled: true
 common_ufw_allowed_ports: []
 #   - {port: 80, proto: tcp, comment: "HTTP"}
 #   - {port: 443, proto: tcp, comment: "HTTPS"}
+
+common_apt_repositories: []
+common_apt_cleanup_files: []
diff --git a/ansible/roles/common/tasks/main.yml b/ansible/roles/common/tasks/main.yml
index 6dc12fe..3268b85 100644
--- a/ansible/roles/common/tasks/main.yml
+++ b/ansible/roles/common/tasks/main.yml
@@ -20,10 +20,36 @@
     force: true
   when: common_github_cli_source.stat.exists
 
+- name: Install deb822_repository dependency
+  ansible.builtin.apt:
+    name: python3-debian
+    state: present
+  when: common_apt_repositories | length > 0
+
+- name: Configure third-party apt repositories
+  ansible.builtin.deb822_repository:
+    name: "{{ item.name }}"
+    types: deb
+    uris: "{{ item.uris }}"
+    suites: "{{ item.suites }}"
+    components: "{{ item.components }}"
+    signed_by: "{{ item.signed_by }}"
+  loop: "{{ common_apt_repositories }}"
+  loop_control:
+    label: "{{ item.name }}"
+  register: common_apt_repositories_result
+
+- name: Remove stale apt sources and keyrings
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: absent
+  loop: "{{ common_apt_cleanup_files }}"
+  register: common_apt_cleanup_result
+
 - name: Update apt cache
   ansible.builtin.apt:
     update_cache: true
-    cache_valid_time: 3600
+    cache_valid_time: "{{ 0 if (common_apt_repositories_result is changed or common_apt_cleanup_result is changed) else 3600 }}"
 
 - name: Install baseline packages
   ansible.builtin.apt: