From 2acf307ac0f791974f274d34f6c72c91a8121970 Mon Sep 17 00:00:00 2001
From: Phil <phil@tsol.re>
Date: Sat, 31 Oct 2026 17:52:02 -0600
Subject: [PATCH] Add Docker's apt repo with a signed-by key, ready for Debian
 13

Debian 13 drops apt-key and software-properties-common, so the old tasks
would fail after the upgrade. The key now lives in /etc/apt/keyrings
(same fingerprint, 9DC8...CD88), the repo is a deb822 file whose release
name follows the installed Debian, and the old .list file is removed.
The apt tasks get a docker_apt tag so they can be deployed on their own.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 roles/docker/tasks/main.yml | 36 +++++++++++++++++++++++++++---------
 1 file changed, 27 insertions(+), 9 deletions(-)

diff --git a/roles/docker/tasks/main.yml b/roles/docker/tasks/main.yml
index cb56457..d080c84 100644
--- a/roles/docker/tasks/main.yml
+++ b/roles/docker/tasks/main.yml
@@ -4,7 +4,6 @@
       - apt-transport-https
       - ca-certificates
       - curl
-      - software-properties-common
       - python3-pip
       - virtualenv
       - python3-setuptools
@@ -15,21 +14,40 @@
 - name: setup shell
   import_tasks: shell.yml
 
-- name: Add Docker GPG apt Key
-  apt_key:
-    url: https://download.docker.com/linux/ubuntu/gpg
-    state: present
+# Docker's repo, signed by its own key file. The release name comes from the
+# installed Debian, so this keeps working across upgrades. (Debian 13 has no
+# apt-key, so the key can't go in the shared trusted.gpg any more.)
+- name: Download Docker's apt key
+  ansible.builtin.get_url:
+    url: https://download.docker.com/linux/debian/gpg
+    dest: /etc/apt/keyrings/docker.asc
+    owner: root
+    mode: '0644'
+  tags: docker_apt
 
-- name: Add Docker Repository
-  apt_repository:
-    repo: deb https://download.docker.com/linux/debian bookworm stable
-    state: present
+- name: Add Docker's apt repository
+  ansible.builtin.deb822_repository:
+    name: docker
+    types: deb
+    uris: https://download.docker.com/linux/debian
+    suites: "{{ ansible_distribution_release }}"
+    components: stable
+    signed_by: /etc/apt/keyrings/docker.asc
+  tags: docker_apt
+
+# Written by the old apt_repository task; docker.sources replaces it.
+- name: Remove the old Docker repo list
+  ansible.builtin.file:
+    path: /etc/apt/sources.list.d/download_docker_com_linux_debian.list
+    state: absent
+  tags: docker_apt
 
 - name: Update apt and install docker-ce
   apt:
     name: docker-ce
     state: latest
     update_cache: true
+  tags: docker_apt
 
 - name: copy over ufw-docker.sh
   ansible.builtin.copy: