diff --git a/playbooks/deploy_vhosts_otel-collector.yml b/playbooks/deploy_vhosts_otel-collector.yml
new file mode 100644
index 0000000..c4675b8
--- /dev/null
+++ b/playbooks/deploy_vhosts_otel-collector.yml
@@ -0,0 +1,9 @@
+- name: setup otel exporters
+  hosts: otel.svc.plus
+  become: true
+  vars:
+    group: web
+    exporters:
+      endpoint: https://otel.svc.plus/api/default/
+  roles:
+    - roles/vhosts/otel-collector/
diff --git a/playbooks/roles/vhosts/common/defaults/main.yml b/playbooks/roles/vhosts/common/defaults/main.yml
index a4e5551..058453c 100644
--- a/playbooks/roles/vhosts/common/defaults/main.yml
+++ b/playbooks/roles/vhosts/common/defaults/main.yml
@@ -16,19 +16,37 @@ journald_log_rotation:          # 启用 journald 日志管理
   system_max_use: 1G            # 默认系统日志最大使用空间
   runtime_max_use: 500M         # 默认运行时日志最大使用空间
 
-enable_install_packages: false  # 默认不安装额外的软件包
-# 包列表（可被 play/host/group 覆盖）
-common_packages:
+# 总开关
+enable_common: true
+# 子开关
+repo_setup: true         # 是否配置仓库/keys
+install_packages: true   # 是否安装软件包
+auto_update_cache: true  # 是否在 repo_setup 后自动 apt update
+enable_universe: false    # Ubuntu 是否启用 universe 仓库
+
+# keyring 目录
+apt_key_dir: /etc/apt/keyrings
+
+# 清理的遗留路径
+apt_repo_legacy:
+  - /etc/apt/sources.list.d/hashicorp.sources
+  - /usr/share/keyrings/hashicorp-archive-keyring.gpg
+
+# 声明式仓库列表（传统 .list）
+repos:
+  - name: hashicorp
+    enabled: false
+    uri: "https://apt.releases.hashicorp.com"
+    suite: "{{ ansible_distribution_release }}"
+    components: ["main"]
+    key_url: "https://apt.releases.hashicorp.com/gpg"
+
+# 要安装的软件包
+packages:
   - vault
   - auditd
   - uidmap
   - fuse-overlayfs
-# 是否启用 Ubuntu 的 universe 组件（仅 Ubuntu）
-enable_ubuntu_universe: false
-# 是否启用 HashiCorp 官方仓库
-enable_hashicorp_repo: false
-# 可选：指定 suite，默认用系统发行版代号（jammy/bookworm 等）
-hashicorp_repo_suite: "{{ ansible_distribution_release }}"
 
 
     #config_temp:
diff --git a/playbooks/roles/vhosts/common/handlers/main.yml b/playbooks/roles/vhosts/common/handlers/main.yml
index da6f188..4a4bf1d 100644
--- a/playbooks/roles/vhosts/common/handlers/main.yml
+++ b/playbooks/roles/vhosts/common/handlers/main.yml
@@ -8,3 +8,7 @@
   service:
     name: systemd-journald
     state: restarted
+
+- name: apt-update-cache
+  ansible.builtin.apt:
+    update_cache: true
diff --git a/playbooks/roles/vhosts/common/tasks/install_packages.yml b/playbooks/roles/vhosts/common/tasks/install_packages.yml
deleted file mode 100644
index baf101c..0000000
--- a/playbooks/roles/vhosts/common/tasks/install_packages.yml
+++ /dev/null
@@ -1,122 +0,0 @@
----
-# Install & configure packages on Debian/Ubuntu, driven by defaults/main.yml only.
-
-- block:
-    #####################################################################
-    # 0) Sanitize HashiCorp APT repo to avoid Signed-By conflicts
-    #####################################################################
-    - name: Ensure /etc/apt/keyrings exists (new standard path)
-      ansible.builtin.file:
-        path: /etc/apt/keyrings
-        state: directory
-        owner: root
-        group: root
-        mode: '0755'
-      become: true
-
-    # 删除可能遗留的旧源（list）与旧 deb822（sources），保持只有一种格式
-    - name: Remove legacy HashiCorp .list repo (if any)
-      ansible.builtin.file:
-        path: /etc/apt/sources.list.d/hashicorp.list
-        state: absent
-      become: true
-
-    - name: Remove legacy HashiCorp deb822 .sources (to re-add cleanly)
-      ansible.builtin.file:
-        path: /etc/apt/sources.list.d/hashicorp.sources
-        state: absent
-      become: true
-
-    # 删除历史上可能存在的不同 keyring 路径，避免 APT 仍引用它们
-    - name: Remove legacy keyring in /usr/share/keyrings (if any)
-      ansible.builtin.file:
-        path: /usr/share/keyrings/hashicorp-archive-keyring.gpg
-        state: absent
-      become: true
-
-    # 统一用 /etc/apt/keyrings/hashicorp.gpg；先拿 ASCII，再 dearmor
-    - name: Fetch HashiCorp ASCII key
-      ansible.builtin.get_url:
-        url: https://apt.releases.hashicorp.com/gpg
-        dest: /etc/apt/keyrings/hashicorp.asc
-        mode: '0644'
-      when: enable_hashicorp_repo | default(true) | bool
-      become: true
-
-    - name: Dearmor HashiCorp key to .gpg
-      ansible.builtin.command:
-        cmd: "gpg --dearmor -o /etc/apt/keyrings/hashicorp.gpg /etc/apt/keyrings/hashicorp.asc"
-        creates: /etc/apt/keyrings/hashicorp.gpg
-      when: enable_hashicorp_repo | default(true) | bool
-      become: true
-
-    - name: Ensure keyring permissions (world-readable)
-      ansible.builtin.file:
-        path: /etc/apt/keyrings/hashicorp.gpg
-        owner: root
-        group: root
-        mode: '0644'
-        state: file
-      when: enable_hashicorp_repo | default(true) | bool
-      become: true
-
-    # 只保留 deb822 写法，使用统一的 signed-by 路径
-    - name: Add HashiCorp APT repo via deb822 (clean, unified)
-      ansible.builtin.deb822_repository:
-        name: hashicorp
-        types: [deb]
-        uris: ["https://apt.releases.hashicorp.com"]
-        suites: ["{{ hashicorp_repo_suite | default(ansible_distribution_release) }}"]
-        components: ["main"]
-        signed_by: "/etc/apt/keyrings/hashicorp.gpg"
-        state: "{{ (enable_hashicorp_repo | default(true) | bool) | ternary('present', 'absent') }}"
-      become: true
-
-    #####################################################################
-    # 1) Base APT deps  (不在此处触发 update_cache，避免再次读到坏源)
-    #####################################################################
-    - name: Ensure base APT deps (no update now)
-      ansible.builtin.apt:
-        name:
-          - ca-certificates
-          - gnupg
-        state: present
-        update_cache: false
-      become: true
-
-    #####################################################################
-    # 2) Ubuntu universe（仅 Ubuntu，且可控开关）
-    #####################################################################
-    - name: Enable Ubuntu 'universe' component (Ubuntu only)
-      ansible.builtin.apt_repository:
-        repo: "deb http://archive.ubuntu.com/ubuntu {{ ansible_distribution_release }} main universe"
-        state: present
-        filename: "ubuntu-{{ ansible_distribution_release }}-universe"
-      when:
-        - ansible_facts.distribution == 'Ubuntu'
-        - enable_ubuntu_universe | default(true) | bool
-      become: true
-
-    #####################################################################
-    # 3) 现在再统一 update cache
-    #####################################################################
-    - name: Update apt cache after repo normalization
-      ansible.builtin.apt:
-        update_cache: true
-      become: true
-
-    #####################################################################
-    # 4) 安装包（仅当 enable_install_packages=true）
-    #####################################################################
-    - name: Install packages (guarded by enable_install_packages)
-      ansible.builtin.apt:
-        name: "{{ common_packages | default(['vault', 'auditd', 'uidmap', 'fuse-overlayfs']) }}"
-        state: present
-      environment:
-        DEBIAN_FRONTEND: noninteractive
-        APT_LISTCHANGES_FRONTEND: none
-      when: enable_install_packages | bool
-      become: true
-
-  when: ansible_facts.os_family == 'Debian'
-  tags: [pkgs, baseline]
diff --git a/playbooks/roles/vhosts/common/tasks/main.yml b/playbooks/roles/vhosts/common/tasks/main.yml
index b99e4e7..6e572b9 100644
--- a/playbooks/roles/vhosts/common/tasks/main.yml
+++ b/playbooks/roles/vhosts/common/tasks/main.yml
@@ -13,10 +13,20 @@
 - name: Run secure_ssh.sh script
   script: files/secure_ssh.sh
 
-- name: Install packages
-  include_tasks: install_packages.yml
-  when: ansible_facts.os_family == 'Debian'
-  tags: [pkgs, baseline]
+- name: "Common | Run on Debian family only"
+  when:
+    - enable_common | bool
+    - ansible_facts.os_family == 'Debian'
+  block:
+    - name: "Common | Repo & keys"
+      ansible.builtin.include_tasks: repo_setup.yml
+      when: repo_setup | bool
+      tags: [repo, baseline]
+
+    - name: "Common | Packages"
+      ansible.builtin.include_tasks: packages.yml
+      when: install_packages | bool
+      tags: [pkgs, baseline]
 
 #- name: Include GPU Configuration
 #  include_tasks: include_gpu.yaml
diff --git a/playbooks/roles/vhosts/common/tasks/packages.yml b/playbooks/roles/vhosts/common/tasks/packages.yml
new file mode 100644
index 0000000..d4b8ed9
--- /dev/null
+++ b/playbooks/roles/vhosts/common/tasks/packages.yml
@@ -0,0 +1,22 @@
+---
+# 基础依赖（不在此处 update_cache，避免读取未规范化源）
+- name: Ensure base APT deps (no update now)
+  ansible.builtin.apt:
+    name:
+      - ca-certificates
+      - gnupg
+    state: present
+    update_cache: false
+  become: true
+
+# 实际安装
+- name: Install packages
+  ansible.builtin.apt:
+    name: "{{ packages | default([]) }}"
+    state: present
+  environment:
+    DEBIAN_FRONTEND: noninteractive
+    APT_LISTCHANGES_FRONTEND: none
+  when: (packages | default([])) | length > 0
+  become: true
+
diff --git a/playbooks/roles/vhosts/common/tasks/repo_setup.yml b/playbooks/roles/vhosts/common/tasks/repo_setup.yml
new file mode 100644
index 0000000..0bb2ab9
--- /dev/null
+++ b/playbooks/roles/vhosts/common/tasks/repo_setup.yml
@@ -0,0 +1,96 @@
+---
+# 0) 统一 keyring 路径
+- name: Ensure keyring dir exists
+  ansible.builtin.file:
+    path: "{{ apt_key_dir }}"
+    state: directory
+    owner: root
+    group: root
+    mode: '0755'
+  become: true
+
+# 0.1) 确保 dearmor 可用
+- name: Ensure gnupg is present for dearmor
+  ansible.builtin.apt:
+    name: gnupg
+    state: present
+    update_cache: false
+  become: true
+
+# 1) 清理历史遗留
+- name: Remove legacy repo/keyring paths
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: absent
+  loop: "{{ apt_repo_legacy | default([]) }}"
+  become: true
+
+# 2) Ubuntu 可选 universe
+- name: Enable Ubuntu 'universe' component (Ubuntu only)
+  ansible.builtin.apt_repository:
+    repo: "deb http://archive.ubuntu.com/ubuntu {{ ansible_distribution_release }} main universe"
+    state: present
+    filename: "ubuntu-{{ ansible_distribution_release }}-universe"
+  when:
+    - ansible_facts.distribution == 'Ubuntu'
+    - enable_universe | bool
+  become: true
+
+# 3) 每个仓库：下载 key（可选）→ dearmor（可选）→ 添加 .list（含 signed-by）
+- name: "Fetch ASCII key (if key_url provided)"
+  ansible.builtin.get_url:
+    url: "{{ repo.key_url }}"
+    dest: "{{ apt_key_dir }}/{{ repo.name }}.asc"
+    mode: '0644'
+  when: repo.key_url is defined and repo.key_url | length > 0
+  loop: "{{ repos | default([]) }}"
+  loop_control:
+    loop_var: repo
+    label: "{{ repo.name }}"
+  become: true
+
+- name: "Dearmor key"
+  ansible.builtin.command:
+    cmd: "gpg --dearmor -o {{ apt_key_dir }}/{{ repo.name }}.gpg {{ apt_key_dir }}/{{ repo.name }}.asc"
+    creates: "{{ apt_key_dir }}/{{ repo.name }}.gpg"
+  when: repo.key_url is defined and repo.key_url | length > 0
+  loop: "{{ repos | default([]) }}"
+  loop_control:
+    loop_var: repo
+    label: "{{ repo.name }}"
+  become: true
+
+- name: "Ensure keyring permission"
+  ansible.builtin.file:
+    path: "{{ (repo.signed_by | default(apt_key_dir ~ '/' ~ repo.name ~ '.gpg')) }}"
+    owner: root
+    group: root
+    mode: '0644'
+    state: file
+  when: (repo.key_url is defined and repo.key_url | length > 0) or (repo.signed_by is defined)
+  loop: "{{ repos | default([]) }}"
+  loop_control:
+    loop_var: repo
+    label: "{{ repo.name }}"
+  become: true
+
+- name: "Add classic .list repo with signed-by"
+  ansible.builtin.apt_repository:
+    repo: >-
+      deb [signed-by={{ repo.signed_by | default(apt_key_dir ~ '/' ~ repo.name ~ '.gpg') }}]
+      {{ repo.uri }} {{ repo.suite }} {{ (repo.components | default(['main'])) | join(' ') }}
+    filename: "{{ repo.name }}"
+    state: "{{ (repo.enabled | default(false) | bool) | ternary('present','absent') }}"
+  when: repo.enabled | default(false) | bool
+  loop: "{{ repos | default([]) }}"
+  loop_control:
+    loop_var: repo
+    label: "{{ repo.name }}"
+  become: true
+
+# 4) 统一更新 apt cache（可控）
+- name: Update apt cache after repo setup
+  ansible.builtin.apt:
+    update_cache: true
+  when: auto_update_cache | bool
+  become: true