From c8e75c4f5fc79bb9a53fa43687aca6ed4ec2d02e Mon Sep 17 00:00:00 2001
From: Rasmus Wejlgaard <pez@pez.sh>
Date: Tue, 15 Sep 2026 20:30:28 +0100
Subject: [PATCH] Fix apt sources on london-b and the Proxmox hosts

The first scheduled deploy failed on london-b because GitHub's gh apt
signing key expired on 2026-09-05. The common role now refreshes the
keyring from upstream wherever the github-cli repo is configured.

The proxmox_ve role was still writing a bookworm no-subscription source
onto hosts that are now trixie / PVE 9. I've switched it to a deb822
proxmox.sources using the host's release, and it cleans up the old
.list plus the enterprise repos in both formats.
---
 ansible/roles/common/tasks/main.yml     | 18 ++++++++++++++
 ansible/roles/proxmox_ve/tasks/main.yml | 31 +++++++++++++++++--------
 2 files changed, 39 insertions(+), 10 deletions(-)

diff --git a/ansible/roles/common/tasks/main.yml b/ansible/roles/common/tasks/main.yml
index 2edb843..6dc12fe 100644
--- a/ansible/roles/common/tasks/main.yml
+++ b/ansible/roles/common/tasks/main.yml
@@ -2,6 +2,24 @@
 # Common baseline for all Linux hosts.
 # Installs core packages, configures SSH, sets up the shell environment.
 
+# GitHub's gh apt signing key expired on 2026-09-05 and was replaced upstream.
+# Hosts with the repo configured kept the stale keyring, so apt update failed
+# (NO_PUBKEY) and took the whole deploy down. Keep the keyring in sync with
+# upstream wherever the repo exists; get_url only reports a change when the
+# key actually differs.
+- name: Detect GitHub CLI apt source
+  ansible.builtin.stat:
+    path: /etc/apt/sources.list.d/github-cli.list
+  register: common_github_cli_source
+
+- name: Refresh GitHub CLI apt keyring
+  ansible.builtin.get_url:
+    url: https://cli.github.com/packages/githubcli-archive-keyring.gpg
+    dest: /usr/share/keyrings/githubcli-archive-keyring.gpg
+    mode: '0644'
+    force: true
+  when: common_github_cli_source.stat.exists
+
 - name: Update apt cache
   ansible.builtin.apt:
     update_cache: true
diff --git a/ansible/roles/proxmox_ve/tasks/main.yml b/ansible/roles/proxmox_ve/tasks/main.yml
index 9f77472..62598b9 100644
--- a/ansible/roles/proxmox_ve/tasks/main.yml
+++ b/ansible/roles/proxmox_ve/tasks/main.yml
@@ -1,22 +1,33 @@
 ---
 # Configure Proxmox VE apt sources for the no-subscription tier.
-# Removes the enterprise repo (requires paid subscription) and enables
+# Removes the enterprise repos (require a paid subscription) and enables
 # the free no-subscription repo so apt update works without credentials.
 
-- name: Remove PVE enterprise apt source
+# PVE 9 (trixie) uses deb822 .sources files. Clear out the enterprise repos in
+# both formats, plus the old one-line no-subscription .list this role used to
+# write with a hardcoded bookworm suite (mixing suites on a trixie host).
+- name: Remove enterprise and legacy Proxmox apt sources
   ansible.builtin.file:
-    path: /etc/apt/sources.list.d/pve-enterprise.list
-    state: absent
-
-- name: Remove Ceph enterprise apt source
-  ansible.builtin.file:
-    path: /etc/apt/sources.list.d/ceph.list
+    path: "/etc/apt/sources.list.d/{{ item }}"
     state: absent
+  loop:
+    - pve-enterprise.list
+    - pve-enterprise.sources
+    - ceph.list
+    - ceph.sources
+    - pve.sources
+    - pve-no-subscription.list
+  notify: Update apt cache
 
 - name: Add PVE no-subscription apt source
   ansible.builtin.copy:
-    dest: /etc/apt/sources.list.d/pve-no-subscription.list
-    content: "deb http://download.proxmox.com/debian/pve bookworm pve-no-subscription\n"
+    dest: /etc/apt/sources.list.d/proxmox.sources
+    content: |
+      Types: deb
+      URIs: http://download.proxmox.com/debian/pve
+      Suites: {{ ansible_facts['distribution_release'] }}
+      Components: pve-no-subscription
+      Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg
     owner: root
     group: root
     mode: "0644"