[MikeiLL]

Switches the nginx, MariaDB and Sury PHP repositories from apt_repository + apt_key to deb822_repository.

Besides the Ansible deprecation, this is required for Ubuntu 26.04 (#1663) and Debian 13: both removed apt-key, so the apt_key tasks fail with Failed to find required executable "apt-key".

Changes

• Each repository gets its own .sources file (nginx, mariadb, sury-php) with Signed-By pointing to a key in /etc/apt/keyrings. The nginx and MariaDB keys are fetched by deb822_repository, and the Sury key keeps its fingerprint check.
• The legacy .list files created by apt_repository are removed first, so existing servers don't end up with duplicate sources.
• Breaking: nginx_ppa and mariadb_ppa are replaced by nginx_repo_uri / nginx_repo_suite / nginx_repo_signing_key and mariadb_repo_uri / mariadb_repo_suite / mariadb_repo_signing_key. If an old variable is still set, provisioning fails with a message pointing to the new ones rather than silently ignoring the override.
• python3-debian is added to the base packages, since deb822_repository requires it.
• The repo URIs use the distribution name instead of a hardcoded ubuntu. That's the same on Ubuntu and is groundwork for Debian.

Testing

On an Ubuntu 24.04 Lima VM previously provisioned with the old .list sources:

• Provisioning replaced the three .list files with .sources files, and apt-get update ran with no warnings or Signed-By conflicts. The nginx, MariaDB and PHP candidates came from the expected repos, and the site still returned 200.
• A second provision of the nginx, mariadb and php roles reported changed=0.
• -e nginx_ppa=foo fails with the replacement message.
• pytest tests/templates and the playbook syntax checks pass.

The keys previously added with apt_key remain in /etc/apt/trusted.gpg on existing servers. They're harmless, and Trellis doesn't clean them up.

🤖 Generated with Claude Code

[swalkinshaw]

Looks like deb822_repository requires a name option. See examples at https://docs.ansible.com/projects/ansible/latest/collections/ansible/builtin/deb822_repository_module.html

[retlehs]

Thanks for starting this. I merged master into the branch and finished it: deb822_repository needs name/uris/suites instead of repo (per the earlier review), plus signed-by keys and cleanup of the old .list files. Details are in the updated description.