feat(mm-nd): update DNS settings and add cron jobs for service monitoring

group_vars/all/main.yml

@@ -158,7 +158,7 @@ apt_manage_sources_list: true
 apt_src_enable: true
 apt_backports_enable: true
 
-apt_debian_mirror: http://ftp2.de.debian.org/debian/
+apt_debian_mirror: http://ftp.de.debian.org/debian/
 apt_debian_contrib_nonfree_enable: true
 
 # Ubuntu mirror

host_vars/backup.oopen.de/backup-common.yml

@@ -299,6 +299,7 @@ default_user:
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDNIGI5HpfYnZCvDM3bf3UQti8SRhgL7wLu8LfxZLqwB root@meet.akweb.de'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINoLG5tE0tHh+iFRzellU80eJTxZfqDB3e6Dg4XRKBrA root@meet.oopen.de'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF2bxZZNXrlsvERYo0VyXzdW1AZuGmsTNjgF4oQJNfnn root@mm-irights'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINy+3uf7VKQBQuXPeFSlSG4lcNbkCTysMhIideNTyMKr root@mm-nd'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILpKuS8DFuHHvfQZCHOGiurOvzlFkx1unnMfZWEM3wUY root@mm-rav'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMnwSzzSrAQJN3I0Y3xRU0rjlrO2KlHD3tFMgCqEyk0i root@mm'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILXSGiRst5AQ396FQY6jrr1jTCpwGDLWv5akw6SiMUGq root@nd-gate'
@@ -337,6 +338,7 @@ default_user:
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDW54VI+M5SjV6dQLew/IA31RI1GOneIqg5dI1/VZQgJ root@o42'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII2b60T/OXKCoze083GsHXuMFtm8Zo3WnCFb9Q9ofGie root@o43'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPytU2q7RmehrJyRnXRIZp7qcoswSANsClJP8v3zv6D7 root@o44'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFS0XtUKLgDqciQLr64VbtQSTlz7eHuvA8x9QZiAg9RA root@o45'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMUnxlKIffm8a5BmoQE40h8ut0R6eCxcm+Iewv3evmE9 root@oolm-shop'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF4ylglAkPst7G6kES2lE96ECp0AGXGjzCVkZSqGVru6 root@oolm-shop-dev'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIUZ0WNd3rTqHH1tiXAELwssGw6xUP1ROdhgxKbMinYY root@oolm-web'

host_vars/mm-nd.oopen.de/mm-nd-common.yml

@@ -0,0 +1,205 @@
+---
+
+# ---
+# vars used by roles/ansible_dependencies
+# ---
+
+
+# ---
+# vars used by roles/ansible_user
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/basic.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sshd.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/apt.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/systemd-resolved.yml
+# ---
+
+systemd_resolved: true
+
+# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
+#   Primäre DNS-Adresse: 38.132.106.139
+#   Sekundäre DNS-Adresse: 194.187.251.67
+#
+# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
+#   primäre DNS-Adresse
+#      IPv4: 1.1.1.1
+#      IPv6: 2606:4700:4700::1111
+#   sekundäre DNS-Adresse
+#      IPv4: 1.0.0.1
+#      IPv6: 2606:4700:4700::1001
+#
+# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
+#   primäre DNS-Adresse
+#      IPv4: 8.8.8.8
+#      IPv6: 2001:4860:4860::8888
+#   sekundäre DNS-Adresse
+#      IPv4: 8.8.4.4
+#      IPv6: 2001:4860:4860::8844
+#
+# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
+#   primäre DNS-Adresse
+#      IPv4: 9.9.9.9
+#      IPv6: 2620:fe::fe
+#   sekundäre DNS-Adresse
+#      IPv4: 149.112.112.112
+#      IPv6: 2620:fe::9
+#
+# OpenNIC - https://www.opennic.org/
+#      IPv4: 195.10.195.195 - ns31.de
+#      IPv4: 94.16.114.254  - ns28.de
+#      IPv4: 51.254.162.59  - ns9.de
+#      IPv4: 194.36.144.87  - ns29.de
+#      IPv6: 2a00:f826:8:2::195 - ns31.de
+#
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
+#    IPv4: 5.1.66.255
+#    IPv6: 2001:678:e68:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    IPv4: 185.150.99.255
+#    IPv6: 2001:678:ed0:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
+resolved_nameserver:
+  - 185.12.64.2
+  - 2a01:4ff:ff00::add:1
+  - 185.12.64.1
+  - 2a01:4ff:ff00::add:2
+
+# search domains
+#
+# If there are more than one search domains, then specify them here in the order in which
+# the resolver should also search them
+#
+# resolved_domains: []
+resolved_domains:
+  - ~.
+  - oopen.de
+
+resolved_dnssec: false
+
+# dns.as250.net: 194.150.168.168
+#
+resolved_fallback_nameserver:
+  - 194.150.168.168
+
+
+# ---
+# vars used by roles/common/tasks/cron.yml
+# ---
+
+cron_env_entries:
+  - name: PATH
+    job: /root/bin/admin-stuff;/root/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+
+  - name: SHELL
+    job: /bin/bash
+    insertafter: PATH
+
+
+cron_user_special_time_entries:
+
+  - name: "Restart DNS Cache service 'systemd-resolved'"
+    special_time: reboot
+    job: "sleep 5 ; /bin/systemctl restart systemd-resolved"
+    insertafter: PATH
+
+  - name: "Check if postfix mailservice is running. Restart service if needed."
+    special_time: reboot
+    job: "sleep 10 ; /root/bin/monitoring/check_postfix.sh > /dev/null 2>&1"
+    insertafter: PATH
+
+  - name: "Check if mattermost service is running. Restart service if needed."
+    special_time: reboot
+    job: "sleep 10 ; /root/bin/monitoring/check_local_mattermost_service.sh > /dev/null 2>&1"
+    insertafter: PATH
+
+
+cron_user_entries:
+
+  - name: "Check if mattermost service ist running - Restart Service if needed."
+    minute: '*/16'
+    hour: '*'
+    job: /root/bin/monitoring/check_local_mattermost_service.sh
+
+  - name: "Check if SSH service is running. Restart service if needed."
+    minute: '*/5'
+    hour: '*'
+    job: /root/bin/monitoring/check_ssh.sh
+
+  - name: "Check if Postfix Mailservice is up and running?"
+    minute: '*/15'
+    hour: '*'
+    job: /root/bin/monitoring/check_postfix.sh
+
+  - name: "Generate/Renew Let's Encrypt Certificates if needed (using dehydrated script)"
+    minute: '01'
+    hour: '05'
+    job: /var/lib/dehydrated/cron/dehydrated_cron.sh
+
+  - name: "Check whether all certificates are included in the VHOST configurations"
+    minute: '33'
+    hour: '05'
+    job: /var/lib/dehydrated/tools/update_ssl_directives.sh
+
+
+# ---
+# vars used by roles/common/tasks/users.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/users-systemfiles.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/webadmin-user.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sudoers.yml
+# ---
+#
+# see: roles/common/tasks/vars
+
+
+# ---
+# vars used by roles/common/tasks/caching-nameserver.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/git.yml
+# ---
+
+git_firewall_repository:
+  name: ipt-server
+  repo: https://git.oopen.de/firewall/ipt-server
+  dest: /usr/local/src/ipt-server
+
+# ==============================
+
+
+# ---
+# vars used by scripts/reset_root_passwd.yml
+# ---
+
+root_user:
+  name: root
+  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.

host_vars/o45.oopen.de/o45-common.yml

@@ -0,0 +1,328 @@
+---
+
+# ---
+# vars used by roles/network_interfaces
+# ---
+
+
+# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
+network_manage_devices: true
+
+# Should the interfaces be reloaded after config change?
+network_interface_reload: false
+
+network_interface_path: /etc/network/interfaces.d
+network_interface_required_packages:
+  - vlan
+  - bridge-utils
+  - ifmetric
+  - ifupdown
+  - ifenslave
+
+
+network_interfaces:
+
+  - device: br0
+    # use only once per device (for the first device entry)
+    headline: br0 - bridge over device enp6s0
+
+    # auto & allow are only used for the first device entry
+    allow: [] # array of allow-[stanzas] eg. allow-hotplug
+    auto: true
+
+    family: inet
+    method: static
+    hwaddress: 08:bf:b8:a6:9b:96
+    description:
+    address: 135.181.239.145
+    netmask: 26
+    gateway: 135.181.239.129
+    metric:
+    pointopoint:
+    mtu:
+    scope:
+
+    # additional user by dhcp method
+    #
+    hostname:
+    leasehours:
+    leasetime:
+    vendor:
+    client:
+
+    # additional used by bootp method
+    #
+    bootfile:
+    server:
+    hwaddr:
+
+    # optional dns settings nameservers: []
+    #
+    #    nameservers:
+    #      - 194.150.168.168  # dns.as250.net
+    #      - 91.239.100.100   # anycast.censurfridns.dk
+    #    search: warenform.de
+    #
+    # ** MOVED TO systemd-resolved
+    #
+    nameservers:
+    search:
+
+    # optional bridge parameters bridge: {}
+    # bridge:
+    #   ports:
+    #   stp:
+    #   fd:
+    #   maxwait:
+    #   waitport:
+    bridge:
+      ports: eno1 # for mor devices support a blank separated list
+      stp: !!str off
+      fd: 5
+      hello: 2
+      maxage: 12
+
+    #  optional bonding parameters bond: {}
+    #  bond:
+    #    master
+    #    primary
+    #    slave
+    #    method:
+    #    miimon:
+    #    lacp-rate:
+    #    ad-select-rate:
+    #    master:
+    #    slaves:
+    bond: {}
+
+    # optional vlan settings | vlan: {}
+    # vlan: {}
+    #   raw-device: 'eth0'
+    vlan: {}
+
+    # inline hook scripts
+    pre-up: [] # pre-up script lines
+    up:
+      - !!str "route add -net 135.181.239.128 netmask 255.255.255.192 gw 135.181.239.129 dev br0" # up script lines
+    post-up: [] # post-up script lines (alias for up)
+    pre-down: [] # pre-down script lines (alias for down)
+    down:
+      - !!str "route del -net 135.181.239.128 netmask 255.255.255.192 gw 135.181.239.129 dev br0" # up script lines
+    post-down: [] # post-down script lines
+
+
+  - device: br0
+    family: inet6
+    method: static
+    address: '2a01:4f9:3080:3d2d::2'
+    netmask: 64
+    gateway: 'fe80::1'
+
+
+# ---
+# vars used by roles/ansible_dependencies
+# ---
+
+
+# ---
+# vars used by roles/ansible_user
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/basic.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sshd.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/apt.yml
+# ---
+
+apt_install_extra_pkgs: true
+apt_extra_pkgs:
+  - systemd-cryptsetup
+
+
+# ---
+# vars used by roles/common/tasks/systemd-resolved.yml
+# ---
+
+systemd_resolved: true
+
+# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
+#   Primäre DNS-Adresse: 38.132.106.139
+#   Sekundäre DNS-Adresse: 194.187.251.67
+#
+# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
+#   primäre DNS-Adresse
+#      IPv4: 1.1.1.1
+#      IPv6: 2606:4700:4700::1111
+#   sekundäre DNS-Adresse
+#      IPv4: 1.0.0.1
+#      IPv6: 2606:4700:4700::1001
+#
+# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
+#   primäre DNS-Adresse
+#      IPv4: 8.8.8.8
+#      IPv6: 2001:4860:4860::8888
+#   sekundäre DNS-Adresse
+#      IPv4: 8.8.4.4
+#      IPv6: 2001:4860:4860::8844
+#
+# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
+#   primäre DNS-Adresse
+#      IPv4: 9.9.9.9
+#      IPv6: 2620:fe::fe
+#   sekundäre DNS-Adresse
+#      IPv4: 149.112.112.112
+#      IPv6: 2620:fe::9
+#
+# OpenNIC - https://www.opennic.org/
+#      IPv4: 195.10.195.195 - ns31.de
+#      IPv4: 94.16.114.254  - ns28.de
+#      IPv4: 51.254.162.59  - ns9.de
+#      IPv4: 194.36.144.87  - ns29.de
+#      IPv6: 2a00:f826:8:2::195 - ns31.de
+#
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
+#    IPv4: 5.1.66.255
+#    IPv6: 2001:678:e68:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    IPv4: 185.150.99.255
+#    IPv6: 2001:678:ed0:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
+resolved_nameserver:
+  - 185.12.64.1
+  - 2a01:4ff:ff00::add:2
+  - 185.12.64.2
+  - 2a01:4ff:ff00::add:1
+
+# search domains
+#
+# If there are more than one search domains, then specify them here in the order in which
+# the resolver should also search them
+#
+# resolved_domains: []
+resolved_domains:
+  - ~.
+  - oopen.de
+
+resolved_dnssec: false
+
+# dns.as250.net: 194.150.168.168
+#
+resolved_fallback_nameserver:
+  - 194.150.168.168
+
+
+# ---
+# vars used by roles/common/tasks/cron.yml
+# ---
+
+cron_env_entries:
+  - name: PATH
+    job: /root/bin/admin-stuff;/root/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+
+  - name: SHELL
+    job: /bin/bash
+    insertafter: PATH
+
+
+cron_user_special_time_entries:
+
+  - name: "Restart DNS Cache service 'systemd-resolved'"
+    special_time: reboot
+    job: "sleep 5 ; /bin/systemctl restart systemd-resolved"
+    insertafter: PATH
+
+  - name: "Check if postfix mailservice is running. Restart service if needed."
+    special_time: reboot
+    job: "sleep 10 ; /root/bin/monitoring/check_postfix.sh > /dev/null 2>&1"
+    insertafter: PATH
+
+  - name: "Check if Check if all autostart LX-Container are running."
+    special_time: reboot
+    job: "sleep 120 ; /root/bin/LXC/boot-autostart-lx-container.sh"
+    insertafter: PATH
+
+  - name: "Restart NTP service 'ntpsec'"
+    special_time: reboot
+    job: "sleep 2 ; /bin/systemctl restart ntpsec > /dev/null 2>&1"
+    insertafter: PATH
+
+
+cron_user_entries:
+
+  - name: "Check if SSH service is running. Restart service if needed."
+    minute: '*/5'
+    hour: '*'
+    job: /root/bin/monitoring/check_ssh.sh
+
+  - name: "Check if Postfix Mailservice is up and running?"
+    minute: '*/15'
+    hour: '*'
+    job: /root/bin/monitoring/check_postfix.sh
+
+  - name: "Check if NTP service 'ntpsec' is up and running?"
+    minute: '*/30'
+    hour: '*'
+    job: /root/bin/monitoring/check_ntpsec_service.sh > /dev/null 2>&1
+
+  - name: "Check hard disc usage."
+    minute: '43'
+    hour: '6'
+    job: /root/bin/admin-stuff/check-disc-usage.sh -c 85
+
+
+# ---
+# vars used by roles/common/tasks/users.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/users-systemfiles.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/webadmin-user.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sudoers.yml
+# ---
+#
+# see: roles/common/tasks/vars
+
+
+# ---
+# vars used by roles/common/tasks/caching-nameserver.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/git.yml
+# ---
+
+git_firewall_repository:
+  name: ipt-server
+  repo: https://git.oopen.de/firewall/ipt-server
+  dest: /usr/local/src/ipt-server
+
+# ==============================
+
+
+# ---
+# vars used by scripts/reset_root_passwd.yml
+# ---
+
+root_user:
+  name: root
+  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.

host_vars/o45.oopen.de/o45-ipt-server.yml

@@ -0,0 +1,36 @@
+---
+# ipt-firewall configuration for a.mx.oopen.de
+# Generated by extract-fw-host-vars.py - review before committing!
+# Place in: host_vars/<hostname>/ipt_firewall.yml
+
+fw_manage_config: true
+
+# --- Network
+fw_ext_interfaces:
+  - "br0"
+fw_ext_ips_v4:
+  - "135.181.239.145"
+fw_ext_ips_v6:
+  - "2a01:4f9:3080:3d2d::2"
+
+fw_lxc_guest_ips_v4:
+  - "95.216.231.188"
+  - "135.181.239.139"
+  - "135.181.239.144"
+fw_lxc_guest_ips_v6:
+  - "2a01:4f9:3080:3d2d::139"
+  - "2a01:4f9:3080:3d2d::144"
+  - "a01:4f9:3080:3d2d::188"
+
+# --- Munin
+munin_remote_ipv4: 37.27.121.227
+munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
+
+# --- Bridged / LXC
+fw_do_not_firewall_bridged_traffic: true
+fw_do_not_firewall_lx_guest_systems: true
+
+# --- Forwarding
+fw_kernel_activate_forwarding: true
+fw_kernel_forward_between_interfaces: true
+

hosts

@@ -303,6 +303,10 @@ test-nd.oopen.de
 o44.oopen.de
 cl-nd.oopen.de
 
+# o45 - mm matomom h.mc
+o45.oopen.de
+mm-nd.oopen.de
+
 # Hetzner  Cloud
 cl-nd-test.oopen.de
 
@@ -532,6 +536,10 @@ test-nd.oopen.de
 o44.oopen.de
 cl-nd.oopen.de
 
+# o45 - mm matomom h.mc
+o45.oopen.de
+mm-nd.oopen.de
+
 # Hetzner  Cloud
 cl-nd-test.oopen.de
 
@@ -984,6 +992,9 @@ iam-nd.oopen.de
 prometheus-nd.oopen.de
 web-nd.oopen.de
 
+# o45 - ND
+mm-nd.oopen.de
+
 # GA - Gemeinschaft Altensclirf
 ga-st-services.ga.netz
 
@@ -1129,6 +1140,9 @@ keycloak-nd.oopen.de
 iam-nd.oopen.de
 prometheus-nd.oopen.de
 
+# o45 - ND
+mm-nd.oopen.de
+
 
 [mysql_server]
 
@@ -1606,6 +1620,9 @@ o43.oopen.de
 # ND - cloud
 o44.oopen.de
 
+# o45 - mm matomom h.mc
+o45.oopen.de
+
 
 lxc-host-kb.anw-kb.netz
 
@@ -1781,6 +1798,9 @@ test-nd.oopen.de
 # o44 - ND cloud
 cl-nd.oopen.de
 
+# o45 - ND
+mm-nd.oopen.de
+
 # Hetzner  Cloud
 cl-nd-test.oopen.de
 
@@ -2036,6 +2056,10 @@ test-nd.oopen.de
 o44.oopen.de
 cl-nd.oopen.de
 
+# o45 - mm matomom h.mc
+o45.oopen.de
+mm-nd.oopen.de
+
 # Hetzner  Cloud
 cl-nd-test.oopen.de
 

roles/common/tasks/apt.yml

@@ -166,10 +166,10 @@
     - apt-configuration
 
 - name: (apt.yml) apt update
-  ansible.builtin.apt:
+  ansible.builtin.command: apt-get update # noqa: command-instead-of-module
-    update_cache: true
-    cache_valid_time: "{{ 0 if common_apt_config_updated is defined and common_apt_config_updated.changed else apt_update_cache_valid_time }}"
   changed_when: false
+  environment:
+    DEBIAN_FRONTEND: noninteractive
   when: apt_update|bool
   tags:
     - apt-update

roles/common/tasks/basic.yml

@@ -224,28 +224,20 @@
   tags:
     - unattended-upgrades
 
-- name: (basic.yml) check if /etc/apt/apt.conf.d/20auto-upgrades exists
+- name: (basic.yml) configure auto-upgrades periodic settings
-  ansible.builtin.stat:
+  ansible.builtin.copy:
-    path: /etc/apt/apt.conf.d/20auto-upgrades
+    dest: /etc/apt/apt.conf.d/20auto-upgrades
-  register: common_ua_enabled
+    content: |
+      APT::Periodic::Update-Package-Lists "1";
+      APT::Periodic::Unattended-Upgrade "1";
+    owner: root
+    group: root
+    mode: "0644"
   when:
     - ansible_facts['distribution'] == "Debian"
   tags:
     - unattended-upgrades
 
-- name: (basic.yml) activate unattended upgrades
-  ansible.builtin.command:
-    cmd: dpkg-reconfigure -plow unattended-upgrades
-    creates: /etc/apt/apt.conf.d/20auto-upgrades
-  environment:
-    DEBIAN_FRONTEND: noninteractive
-    DEBCONF_NONINTERACTIVE_SEEN: "true"
-  when:
-    - ansible_facts['distribution'] == "Debian"
-    - not common_ua_enabled.stat.exists
-  tags:
-    - unattended-upgrades
-
 - name: (basic.yml) copy apt-listchanges.conf
   ansible.builtin.template:
     src: etc/apt/listchanges.conf.j2

roles/common/tasks/caching-nameserver.yml

@@ -4,10 +4,10 @@
 # ---
 
 - name: (caching-nameserver.yml) update
-  ansible.builtin.apt:
+  ansible.builtin.command: apt-get update # noqa: command-instead-of-module
-    update_cache: true
-    cache_valid_time: "{{ 0 if common_apt_config_updated is defined and common_apt_config_updated.changed else apt_update_cache_valid_time }}"
   changed_when: false
+  environment:
+    DEBIAN_FRONTEND: noninteractive
   when:
     - ansible_facts["distribution"] == "Debian"
     - apt_update|bool

roles/common/tasks/redis-server.yml

@@ -8,22 +8,6 @@
         else '/etc/redis/redis.conf'
       }}
 
-- name: (redis-server.yml) update
-  ansible.builtin.apt:
-    update_cache: true
-    cache_valid_time: >-
-      {{
-        0
-        if apt_config_updated is defined and apt_config_updated.changed
-        else apt_update_cache_valid_time
-      }}
-  changed_when: false
-  when:
-    - ansible_facts['distribution'] == "Debian"
-    - apt_update|bool
-  tags:
-    - redis-server
-
 - name: >-
     (redis-server.yml) Configure any half-installed packages
     'dpkg --configure -a'
@@ -37,10 +21,21 @@
   tags:
     - redis-server
 
+- name: (redis-server.yml) update
+  ansible.builtin.command: apt-get update # noqa: command-instead-of-module
+  changed_when: false
+  environment:
+    DEBIAN_FRONTEND: noninteractive
+  when:
+    - ansible_facts['distribution'] == "Debian"
+    - apt_update|bool
+  tags:
+    - redis-server
+
 - name: (redis-server.yml) upgrade
   ansible.builtin.apt:
     upgrade: "{{ apt_upgrade_type }}"
-    # apt cache is refreshed in the preceding "update" task
+    # apt cache refresh happens in the preceding redis update task
     update_cache: false
     dpkg_options: "{{ apt_upgrade_dpkg_options | join(',') }}"
   when: