custom_apt_repo

Installs a repository signing key, adds the APT source, refreshes the cache and verifies the repository answers. Defaults target the Toolsera Nexus repo, so no variables are required:

- hosts: all
  roles:
    - custom_apt_repo

deb https://nexus.toolsera.lan/repository/toolsera/ stable main

Variables

Variable	Default	Description
`apt_repo_url`	`https://nexus.toolsera.lan/repository/toolsera/`	Base repository URL
`apt_repo_distribution`	`stable`	Suite
`apt_repo_components`	`main`	Space-separated components
`apt_repo_key_source`	`file`	`file` (role `files/`) or `url`
`apt_repo_key_file`	`public.gpg.key`	Key in `files/`, when source is file
`apt_repo_key_url`	`''`	Key URL, when source is url
`apt_repo_key_dest`	`/etc/apt/trusted.gpg.d/toolsera-repo.asc`	Where the key lands
`apt_repo_sources_file`	`/etc/apt/sources.list.d/toolsera.list`	Sources file written
`apt_repo_options`	`''`	e.g. `arch=amd64,arm64`

Apply the role more than once to configure several repositories — each application needs its own apt_repo_key_dest and apt_repo_sources_file, or the second overwrites the first:

- hosts: all
  roles:
    - role: custom_apt_repo # Toolsera Nexus, key from files/
    - role: custom_apt_repo # Smallstep, key fetched over HTTPS
      apt_repo_url: 'https://packages.smallstep.com/stable/debian'
      apt_repo_distribution: 'debs'
      apt_repo_key_source: 'url'
      apt_repo_key_url: 'https://packages.smallstep.com/keys/apt/repo-signing-key.gpg'
      apt_repo_key_dest: '/etc/apt/trusted.gpg.d/smallstep.asc'
      apt_repo_sources_file: '/etc/apt/sources.list.d/smallstep.list'

Tags: apt-key / gpg for the key alone, apt-repo / repository for the source alone.

To rotate the key, replace files/public.gpg.key and re-run — the role updates it when the file content changes.

Troubleshooting

Symptom	Check
Repository not found	`curl -I <apt_repo_url>`, DNS, and that HTTPS is reachable from the target
GPG signature verification failed	The key matches what signed the packages: `gpg --list-packets files/public.gpg.key`
Package not installable	`apt update`, then `apt-cache policy` to confirm the source is listed

Two invocations, two repositories

setup_new_machine.yml applies this role twice: once with the defaults for the Nexus APT repo, and once for the Forgejo Debian package registry.

	Nexus	Forgejo
Fed by	GitHub Actions `publish-package.yml`	Forgejo Actions `publish-package.yml`
URL	`https://nexus.toolsera.lan/repository/toolsera/`	`https://forgejo.toolsera.lan/api/packages/unknown224/debian`
Suite	`stable`	`bookworm`
Key	`files/public.gpg.key` (`apt_repo_key_source: file`)	fetched from `.../repository.key` (`url`)
Trust	`/etc/apt/trusted.gpg.d/`	`/etc/apt/keyrings/` + `signed-by=`

Both are configured on every host so a package released while either forge is unavailable is still installable — APT merges the two sources and installs the higher version.

The Forgejo registry signs and rebuilds its metadata on upload, so it serves a real signed Release file and needs signed-by rather than the trusted=yes escape hatch. It is anonymous because the repository is public on the LAN; a private one would need credentials in the source line.

apt_repo_key_dest drives which directory the role creates, so pointing it at /etc/apt/keyrings is enough — no separate task.