initial commit

roles/debian_dist_upgrade/defaults/main.yml

@@ -0,0 +1,10 @@
+---
+debian_upgrade_source_major_version: "12"
+debian_upgrade_target_major_version: "13"
+debian_upgrade_target_release: trixie
+debian_upgrade_reboot_timeout: 1800
+
+debian_upgrade_sources_list_path: /etc/apt/sources.list
+debian_upgrade_sources_backup_path: /etc/apt/sources.list.bookworm.bak
+debian_upgrade_deb822_sources_path: /etc/apt/sources.list.d/debian.sources
+debian_upgrade_deb822_sources_backup_path: /etc/apt/sources.list.d/debian.sources.bookworm.bak

roles/debian_dist_upgrade/handlers/main.yml

@@ -0,0 +1,6 @@
+---
+- name: Reboot after Debian dist upgrade
+  ansible.builtin.reboot:
+    msg: Rebooting after Debian dist upgrade
+    reboot_timeout: "{{ debian_upgrade_reboot_timeout }}"
+  listen: reboot_after_debian_dist_upgrade

roles/debian_dist_upgrade/tasks/main.yml

@@ -0,0 +1,118 @@
+---
+- name: Validate current host is Debian
+  ansible.builtin.assert:
+    that:
+      - ansible_facts.distribution == "Debian"
+    fail_msg: "This role only supports Debian hosts."
+
+- name: Validate expected source Debian major version
+  ansible.builtin.assert:
+    that:
+      - ansible_facts.distribution_major_version == debian_upgrade_source_major_version
+    fail_msg: >-
+      Expected Debian {{ debian_upgrade_source_major_version }} before upgrade,
+      found Debian {{ ansible_facts.distribution_major_version }}.
+    success_msg: "Host is Debian {{ debian_upgrade_source_major_version }} and ready for upgrade."
+  when: ansible_facts.distribution_major_version != debian_upgrade_target_major_version
+
+- name: Update package cache on current release
+  ansible.builtin.apt:
+    update_cache: true
+    cache_valid_time: 3600
+  when: ansible_facts.distribution_major_version != debian_upgrade_target_major_version
+
+- name: Upgrade installed packages before release change
+  ansible.builtin.apt:
+    upgrade: dist
+    autoremove: true
+    autoclean: true
+  when: ansible_facts.distribution_major_version != debian_upgrade_target_major_version
+
+- name: Check for classic apt sources list
+  ansible.builtin.stat:
+    path: "{{ debian_upgrade_sources_list_path }}"
+  register: debian_upgrade_sources_list_stat
+  when: ansible_facts.distribution_major_version != debian_upgrade_target_major_version
+
+- name: Check for deb822 apt sources
+  ansible.builtin.stat:
+    path: "{{ debian_upgrade_deb822_sources_path }}"
+  register: debian_upgrade_deb822_sources_stat
+  when: ansible_facts.distribution_major_version != debian_upgrade_target_major_version
+
+- name: Back up current apt sources
+  ansible.builtin.copy:
+    src: "{{ debian_upgrade_sources_list_path }}"
+    dest: "{{ debian_upgrade_sources_backup_path }}"
+    remote_src: true
+    mode: "0644"
+    force: false
+  when:
+    - ansible_facts.distribution_major_version != debian_upgrade_target_major_version
+    - debian_upgrade_sources_list_stat.stat.exists
+
+- name: Back up current deb822 apt sources
+  ansible.builtin.copy:
+    src: "{{ debian_upgrade_deb822_sources_path }}"
+    dest: "{{ debian_upgrade_deb822_sources_backup_path }}"
+    remote_src: true
+    mode: "0644"
+    force: false
+  when:
+    - ansible_facts.distribution_major_version != debian_upgrade_target_major_version
+    - debian_upgrade_deb822_sources_stat.stat.exists
+
+- name: Configure Debian target release classic apt sources
+  ansible.builtin.template:
+    src: sources.list.j2
+    dest: "{{ debian_upgrade_sources_list_path }}"
+    owner: root
+    group: root
+    mode: "0644"
+  when:
+    - ansible_facts.distribution_major_version != debian_upgrade_target_major_version
+    - debian_upgrade_sources_list_stat.stat.exists or not debian_upgrade_deb822_sources_stat.stat.exists
+
+- name: Configure Debian target release deb822 apt sources
+  ansible.builtin.template:
+    src: debian.sources.j2
+    dest: "{{ debian_upgrade_deb822_sources_path }}"
+    owner: root
+    group: root
+    mode: "0644"
+  when:
+    - ansible_facts.distribution_major_version != debian_upgrade_target_major_version
+    - debian_upgrade_deb822_sources_stat.stat.exists
+
+- name: Update package cache for target release
+  ansible.builtin.apt:
+    update_cache: true
+  when: ansible_facts.distribution_major_version != debian_upgrade_target_major_version
+
+- name: Perform Debian dist upgrade
+  ansible.builtin.apt:
+    upgrade: dist
+    autoremove: true
+    autoclean: true
+    dpkg_options: force-confdef,force-confold
+  environment:
+    DEBIAN_FRONTEND: noninteractive
+    APT_LISTCHANGES_FRONTEND: none
+  notify: reboot_after_debian_dist_upgrade
+  when: ansible_facts.distribution_major_version != debian_upgrade_target_major_version
+
+- name: Flush reboot handler before verification
+  ansible.builtin.meta: flush_handlers
+
+- name: Gather facts after possible upgrade
+  ansible.builtin.setup:
+
+- name: Verify Debian target version
+  ansible.builtin.assert:
+    that:
+      - ansible_facts.distribution == "Debian"
+      - ansible_facts.distribution_major_version == debian_upgrade_target_major_version
+    fail_msg: >-
+      Debian upgrade did not finish as expected. Found
+      {{ ansible_facts.distribution }} {{ ansible_facts.distribution_major_version }}.
+    success_msg: "Host is running Debian {{ debian_upgrade_target_major_version }}."

roles/debian_dist_upgrade/templates/debian.sources.j2

@@ -0,0 +1,11 @@
+Types: deb
+URIs: http://deb.debian.org/debian
+Suites: {{ debian_upgrade_target_release }} {{ debian_upgrade_target_release }}-updates
+Components: main contrib non-free non-free-firmware
+Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
+
+Types: deb
+URIs: http://security.debian.org/debian-security
+Suites: {{ debian_upgrade_target_release }}-security
+Components: main contrib non-free non-free-firmware
+Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg

roles/debian_dist_upgrade/templates/sources.list.j2

@@ -0,0 +1,3 @@
+deb http://deb.debian.org/debian {{ debian_upgrade_target_release }} main contrib non-free non-free-firmware
+deb http://deb.debian.org/debian {{ debian_upgrade_target_release }}-updates main contrib non-free non-free-firmware
+deb http://security.debian.org/debian-security {{ debian_upgrade_target_release }}-security main contrib non-free non-free-firmware