---
- name: Install knot-dns.cz repository

  hosts: ungrouped
  remote_user: root

  vars_files: vars.yaml

  pre_tasks:
    - name: Resynchronize APT packages indexes
      ansible.builtin.apt:
        update_cache: true

    - name: Install required APT packages
      ansible.builtin.apt:
        state: present
        name:
          - ca-certificates
          - apt-transport-https

    - name: Update keyrings/ directory permissions
      ansible.builtin.file:
        path: '/etc/apt/keyrings'
        owner: _apt
        group: nogroup
        mode: '0755'

  tasks:
    - name: Download knot-dns.cz GPG public key
      ansible.builtin.get_url:
        url: "{{ url_knotdns_gpg_public }}"
        dest: "{{ path_knotdns_apt_keyring }}"
        owner: _apt
        group: nogroup
        mode: '0644'

    - name: Add knot-dns.cz APT repository
      ansible.builtin.apt_repository:
        repo: >-
          deb [signed-by={{ path_knotdns_apt_keyring }}]
          https://deb.knot-dns.cz/knot {{ ansible_distribution_release }} main
        filename: knot-dns
...