Re-enable london-b's third-party apt repos from Ansible

The lunar -> noble upgrade disabled every third-party repo on london-b, so
tailscale, jellyfin and plex have been frozen since. The common role can now
manage deb822 repos and clean up stale source/keyring files per host, and
london-b uses it for tailscale, jellyfin and plex (now on repo.plex.tv with
the v2 key). The dead sonarr v3, mono, nvidia, datadog and PPA leftovers go.

.gitignore

@@ -13,6 +13,7 @@ override.tf.json
 
 # Ansible
 *.retry
+.ansible/
 
 # Secrets — never commit plaintext secrets
 *.key

ansible/inventory/host_vars/london-b.yml

@@ -20,6 +20,51 @@ snap_services:
 apt_user_services:
   - syncthing@pez
 
+# Third-party apt repos (deployed by common role). The lunar -> noble upgrade
+# disabled all of them (PESO-160). Plex moved to repo.plex.tv with a new key;
+# the old downloads.plex.tv repo stopped at 1.42.2.
+common_apt_repositories:
+  - name: tailscale
+    uris: https://pkgs.tailscale.com/stable/ubuntu
+    suites: "{{ ansible_facts['distribution_release'] }}"
+    components: main
+    signed_by: "https://pkgs.tailscale.com/stable/ubuntu/{{ ansible_facts['distribution_release'] }}.noarmor.gpg"
+  - name: jellyfin
+    uris: https://repo.jellyfin.org/ubuntu
+    suites: "{{ ansible_facts['distribution_release'] }}"
+    components: main
+    signed_by: https://repo.jellyfin.org/jellyfin_team.gpg.key
+  - name: plexmediaserver
+    uris: https://repo.plex.tv/deb
+    suites: public
+    components: main
+    signed_by: https://downloads.plex.tv/plex-keys/PlexSign.v2.key
+
+# Leftovers from the upgrade. Sonarr v3 (apt.sonarr.tv) and its mono repo are
+# dead ends, nvidia-container-toolkit isn't used by Docker here, and datadog
+# is retired, so those repos go without replacements.
+common_apt_cleanup_files:
+  - /etc/apt/sources.list.d/datadog.list.distUpgrade
+  - /etc/apt/sources.list.d/graphics-drivers-ubuntu-ppa-lunar.list.distUpgrade
+  - /etc/apt/sources.list.d/graphics-drivers-ubuntu-ppa-lunar.sources
+  - /etc/apt/sources.list.d/jcfp-ubuntu-nobetas-lunar.list.distUpgrade
+  - /etc/apt/sources.list.d/jcfp-ubuntu-nobetas-lunar.sources
+  - /etc/apt/sources.list.d/jellyfin.sources.distUpgrade
+  - /etc/apt/sources.list.d/mediaarea.list.distUpgrade
+  - /etc/apt/sources.list.d/mediaarea.sources
+  - /etc/apt/sources.list.d/mono-official-stable.list.distUpgrade
+  - /etc/apt/sources.list.d/nvidia-container-toolkit.list.distUpgrade
+  - /etc/apt/sources.list.d/plexmediaserver.list.distUpgrade
+  - /etc/apt/sources.list.d/sonarr.list.distUpgrade
+  - /etc/apt/sources.list.d/tailscale.list.distUpgrade
+  - /etc/apt/keyrings/jellyfin.gpg
+  - /usr/share/keyrings/plexmediaserver.gpg
+  - /usr/share/keyrings/mono-official-archive-keyring.gpg
+  - /usr/share/keyrings/mono-official-archive-keyring.gpg~
+  - /usr/share/keyrings/sonarr-keyring.gpg
+  - /usr/share/keyrings/sonarr-keyring.gpg~
+  - /usr/share/keyrings/nvidia-container-toolkit-keyring.gpg
+
 zfs_pools:
   - hdd
 

ansible/roles/common/defaults/main.yml

@@ -5,3 +5,10 @@ common_ufw_enabled: true
 common_ufw_allowed_ports: []
 #   - {port: 80, proto: tcp, comment: "HTTP"}
 #   - {port: 443, proto: tcp, comment: "HTTPS"}
+
+# Third-party apt repositories, written as deb822 .sources files.
+# Each item needs name, uris, suites, components and signed_by (key URL).
+common_apt_repositories: []
+
+# Leftover apt source and keyring files to delete, e.g. after a release upgrade.
+common_apt_cleanup_files: []

ansible/roles/common/tasks/main.yml

@@ -20,10 +20,41 @@
     force: true
   when: common_github_cli_source.stat.exists
 
+# Third-party apt repos are declared per host in common_apt_repositories. A
+# release upgrade disables them silently (london-b's lunar -> noble upgrade
+# left tailscale, jellyfin and plex frozen for a year), so they live in code.
+# A URL in signed_by is fetched into /etc/apt/keyrings by deb822_repository.
+- name: Install deb822_repository dependency
+  ansible.builtin.apt:
+    name: python3-debian
+    state: present
+  when: common_apt_repositories | length > 0
+
+- name: Configure third-party apt repositories
+  ansible.builtin.deb822_repository:
+    name: "{{ item.name }}"
+    types: deb
+    uris: "{{ item.uris }}"
+    suites: "{{ item.suites }}"
+    components: "{{ item.components }}"
+    signed_by: "{{ item.signed_by }}"
+  loop: "{{ common_apt_repositories }}"
+  loop_control:
+    label: "{{ item.name }}"
+  register: common_apt_repositories_result
+
+- name: Remove stale apt sources and keyrings
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: absent
+  loop: "{{ common_apt_cleanup_files }}"
+  register: common_apt_cleanup_result
+
+# Refresh straight away when the sources changed, otherwise at most hourly.
 - name: Update apt cache
   ansible.builtin.apt:
     update_cache: true
-    cache_valid_time: 3600
+    cache_valid_time: "{{ 0 if (common_apt_repositories_result is changed or common_apt_cleanup_result is changed) else 3600 }}"
 
 - name: Install baseline packages
   ansible.builtin.apt: