Align nodejs role with keyring-based repos

roles/vhosts/nodejs/defaults/main.yml

@@ -1,11 +1,15 @@
 ---
 # Node.js version to install (LTS or specific version)
-# Examples: "20.x", "18.x", "20.11.0"
+# Examples: "20.x", "18.x", "20.11.0", "20.19.6"
 nodejs_version: "20.x"
 
 # Install Yarn package manager (default: true)
 install_yarn: true
 
+# Yarn version to install (empty uses distro Yarn package)
+# Example: "4.12.0"
+yarn_version: ""
+
 # Add npm global bin to system PATH (default: true)
 add_npm_to_path: true
 

roles/vhosts/nodejs/tasks/main.yml

@@ -10,10 +10,19 @@
     nodejs_installed_version: "{{ node_version_check.stdout | regex_replace('v', '') | default('') }}"
   when: node_version_check.rc == 0
 
-- name: Update apt cache
-  apt:
-    update_cache: yes
-    cache_valid_time: 3600
+- name: Normalize Node.js version inputs
+  set_fact:
+    nodejs_version_major: "{{ nodejs_version | regex_replace('^([0-9]+).*', '\\1') }}"
+    nodejs_version_pin: "{{ nodejs_version if nodejs_version is match('^\\d+\\.\\d+\\.\\d+$') else '' }}"
+
+- name: Get installed Node.js major version
+  set_fact:
+    nodejs_installed_major: "{{ nodejs_installed_version | regex_replace('^([0-9]+).*', '\\1') }}"
+  when: node_version_check.rc == 0
+
+- name: Decide if Node.js installation is required
+  set_fact:
+    nodejs_needs_install: "{{ (nodejs_version_pin != '' and (nodejs_installed_version | default('')) != nodejs_version_pin) or (nodejs_version_pin == '' and (nodejs_installed_major | default('')) != nodejs_version_major) }}"
 
 - name: Install prerequisites
   apt:
@@ -24,35 +33,50 @@
       - ca-certificates
     state: present
 
-- name: Remove old NodeSource repository if exists
-  apt_repository:
-    repo: "{{ item }}"
+- name: Ensure apt keyrings directory exists
+  file:
+    path: /etc/apt/keyrings
+    state: directory
+    mode: '0755'
+
+- name: Remove old NodeSource repository list files
+  file:
+    path: "{{ item }}"
     state: absent
   loop:
-    - deb https://deb.nodesource.com/node_{{ nodejs_version }}.x {{ ansible_distribution_release }} main
-    - deb-src https://deb.nodesource.com/node_{{ nodejs_version }}.x {{ ansible_distribution_release }} main
-  when: nodejs_installed_version is defined and nodejs_installed_version != nodejs_version
+    - /etc/apt/sources.list.d/nodesource.list
+    - "/etc/apt/sources.list.d/nodesource-node{{ nodejs_version_major }}.list"
+  when: nodejs_needs_install | default(true)
+
+- name: Add NodeSource GPG key
+  get_url:
+    url: "https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key"
+    dest: /etc/apt/keyrings/nodesource.gpg
+    mode: '0644'
+  register: nodesource_key
+  when: nodejs_needs_install | default(true)
 
 - name: Add NodeSource repository
   apt_repository:
-    repo: "deb https://deb.nodesource.com/node_{{ nodejs_version }}.x {{ ansible_distribution_release }} main"
+    repo: "deb [signed-by=/etc/apt/keyrings/nodesource.gpg arch=amd64,arm64] https://deb.nodesource.com/node_{{ nodejs_version_major }}.x nodistro main"
     state: present
     filename: nodesource
-  when: nodejs_installed_version is not defined or nodejs_installed_version != nodejs_version
+  register: nodesource_repo
+  when: nodejs_needs_install | default(true)
 
-- name: Add NodeSource GPG key
-  apt_key:
-    url: "https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key"
-    state: present
-  when: nodejs_installed_version is not defined or nodejs_installed_version != nodejs_version
+- name: Update apt cache for NodeSource repository
+  apt:
+    update_cache: yes
+    cache_valid_time: 3600
+  when: nodejs_needs_install | default(true) and (nodesource_key.changed or nodesource_repo.changed)
 
 - name: Install Node.js
   apt:
     name:
-      - "nodejs={{ nodejs_version }}-1nodesource1"
+      - "{{ 'nodejs=' + nodejs_version_pin + '-1nodesource1' if nodejs_version_pin != '' else 'nodejs' }}"
     state: present
     update_cache: yes
-  when: nodejs_installed_version is not defined or nodejs_installed_version != nodejs_version
+  when: nodejs_needs_install | default(true)
 
 - name: Install npm globally
   npm:
@@ -67,27 +91,51 @@
   failed_when: false
   when: install_yarn | default(true)
 
-- name: Get Yarn GPG key
-  rpm_key:
-    state: present
-    key: https://dl.yarnpkg.com/debian/pubkey.gpg
+- name: Normalize desired Yarn version
+  set_fact:
+    yarn_desired_version: "{{ yarn_version | default('') }}"
   when: install_yarn | default(true)
-  environment:
-    ansible_python_interpreter: /usr/bin/python3
+
+- name: Add Yarn GPG key
+  get_url:
+    url: https://dl.yarnpkg.com/debian/pubkey.gpg
+    dest: /etc/apt/keyrings/yarn.gpg
+    mode: '0644'
+  when:
+    - install_yarn | default(true)
+    - yarn_desired_version | length == 0
 
 - name: Add Yarn repository
   apt_repository:
-    repo: "deb https://dl.yarnpkg.com/debian/ stable main"
+    repo: "deb [signed-by=/etc/apt/keyrings/yarn.gpg] https://dl.yarnpkg.com/debian/ stable main"
     state: present
     filename: yarn
-  when: install_yarn | default(true)
+  when:
+    - install_yarn | default(true)
+    - yarn_desired_version | length == 0
 
 - name: Install Yarn
   apt:
     name: yarn
     state: present
     update_cache: yes
-  when: install_yarn | default(true)
+  when:
+    - install_yarn | default(true)
+    - yarn_desired_version | length == 0
+
+- name: Enable Corepack
+  command: corepack enable
+  changed_when: false
+  when:
+    - install_yarn | default(true)
+    - yarn_desired_version | length > 0
+
+- name: Install Yarn via Corepack
+  command: "corepack prepare yarn@{{ yarn_desired_version }} --activate"
+  when:
+    - install_yarn | default(true)
+    - yarn_desired_version | length > 0
+    - yarn_version_check.stdout != yarn_desired_version
 
 - name: Set npm to use version tags by default
   shell: npm config set save-exact true