From 37364e5204a800d2005f17f8b067e47a4765afbf Mon Sep 17 00:00:00 2001
From: Felix Nehrke <felix@nehrke.info>
Date: Wed, 15 Jul 2026 01:42:22 +0200
Subject: [PATCH] Fix `repos` tag and add `base` tag

The `repos` tag was slightly broken because it was applied to the
include task but not to the included tasks. This is now fixed by simply
adding the necessary tag declaration to the included tasks.

Furthermore, I experienced a bad deadlock when the PGP key for the
Spotify packages expired. Because of that, every APT operation failed
and Ansible was unable to gather the facts required by package-related
tasks. Since the installation of the base utilities was coupled to the
`repos` tag, that tag failed as well. Because I use that tag to update
repository keys, I ended up in a deadlock.

The solution is the new `base` tag, which is only responsible for
installing the base utilities. This allows repository keys to be updated
independently of any preceding APT installations.
---
 README.adoc                                     | 1 +
 roles/debian/tasks/3rd-party-apt-repository.yml | 2 ++
 roles/debian/tasks/main.yml                     | 2 +-
 3 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/README.adoc b/README.adoc
index c94f710..3f9b06d 100644
--- a/README.adoc
+++ b/README.adoc
@@ -68,6 +68,7 @@ To restrict the scope of execution the playbook uses a couple of tags as describ
 |===
 | Tag | Scope description
 
+| base | Install install-utils, needed to make the other installs work
 | repos | Install 3rd party apt-repositories (only useful on linux)
 | packages | Install system-packages
 | dotfiles | Install my dotfiles and apply them
diff --git a/roles/debian/tasks/3rd-party-apt-repository.yml b/roles/debian/tasks/3rd-party-apt-repository.yml
index 48e351d..86e8cf7 100644
--- a/roles/debian/tasks/3rd-party-apt-repository.yml
+++ b/roles/debian/tasks/3rd-party-apt-repository.yml
@@ -1,5 +1,6 @@
 - name: "Download key for {{ item.name }}"
   become: yes
+  tags: [repos]
   get_url:
     url: "{{ key.url }}"
     dest: "/etc/apt/keyrings/{{ key.name | default(item.name) }}.{{ key.format | default('asc') }}"
@@ -10,6 +11,7 @@
 
 - name: "Setup apt repository for {{ item.name }}"
   become: yes
+  tags: [repos]
   deb822_repository:
     name: "{{ item.name }}"
     types: "{{ item.types | default('deb') }}"
diff --git a/roles/debian/tasks/main.yml b/roles/debian/tasks/main.yml
index 15ea0a5..26efd04 100644
--- a/roles/debian/tasks/main.yml
+++ b/roles/debian/tasks/main.yml
@@ -4,8 +4,8 @@
     use: systemd
 
 - name: Ensure tools to add additional apt sources
-  tags: [repos]
   become: yes
+  tags: [base]
   package:
     name:
     - ca-certificates