Merge pull request #4 from cloud-neutral-workshop/codex/update-nodejs-role-for-specific-versions-syk27k

Align nodejs role with keyring-based NodeSource/Yarn repos and support version pinning

roles/vhosts/nodejs/tasks/main.yml

@@ -10,27 +10,19 @@
     nodejs_installed_version: "{{ node_version_check.stdout | regex_replace('v', '') | default('') }}"
   when: node_version_check.rc == 0
 
-- name: Normalize desired Node.js version
+- name: Normalize Node.js version inputs
   set_fact:
-    nodejs_desired_version: "{{ nodejs_version | regex_replace('^v', '') }}"
-
-- name: Determine Node.js repository major version
-  set_fact:
-    nodejs_repo_major: "{{ nodejs_desired_version.split('.')[0] }}"
-
-- name: Determine if exact Node.js version is requested
-  set_fact:
-    nodejs_exact_version_requested: "{{ nodejs_desired_version is match('^\\d+\\.\\d+\\.\\d+$') }}"
+    nodejs_version_major: "{{ nodejs_version | regex_replace('^([0-9]+).*', '\\1') }}"
+    nodejs_version_pin: "{{ nodejs_version if nodejs_version is match('^\\d+\\.\\d+\\.\\d+$') else '' }}"
 
 - name: Get installed Node.js major version
   set_fact:
-    nodejs_installed_major: "{{ nodejs_installed_version.split('.')[0] }}"
-  when: nodejs_installed_version is defined and nodejs_installed_version != ''
+    nodejs_installed_major: "{{ nodejs_installed_version | regex_replace('^([0-9]+).*', '\\1') }}"
+  when: node_version_check.rc == 0
 
-- name: Update apt cache
-  apt:
-    update_cache: yes
-    cache_valid_time: 3600
+- name: Decide if Node.js installation is required
+  set_fact:
+    nodejs_needs_install: "{{ (nodejs_version_pin != '' and (nodejs_installed_version | default('')) != nodejs_version_pin) or (nodejs_version_pin == '' and (nodejs_installed_major | default('')) != nodejs_version_major) }}"
 
 - name: Install prerequisites
   apt:
@@ -41,46 +33,50 @@
       - ca-certificates
     state: present
 
-- name: Remove old NodeSource repository if exists
-  apt_repository:
-    repo: "{{ item }}"
+- name: Ensure apt keyrings directory exists
+  file:
+    path: /etc/apt/keyrings
+    state: directory
+    mode: '0755'
+
+- name: Remove old NodeSource repository list files
+  file:
+    path: "{{ item }}"
     state: absent
   loop:
-    - deb https://deb.nodesource.com/node_{{ nodejs_repo_major }}.x {{ ansible_distribution_release }} main
-    - deb-src https://deb.nodesource.com/node_{{ nodejs_repo_major }}.x {{ ansible_distribution_release }} main
-  when: nodejs_installed_major is defined and nodejs_installed_major != nodejs_repo_major
+    - /etc/apt/sources.list.d/nodesource.list
+    - "/etc/apt/sources.list.d/nodesource-node{{ nodejs_version_major }}.list"
+  when: nodejs_needs_install | default(true)
+
+- name: Add NodeSource GPG key
+  get_url:
+    url: "https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key"
+    dest: /etc/apt/keyrings/nodesource.gpg
+    mode: '0644'
+  register: nodesource_key
+  when: nodejs_needs_install | default(true)
 
 - name: Add NodeSource repository
   apt_repository:
-    repo: "deb https://deb.nodesource.com/node_{{ nodejs_repo_major }}.x {{ ansible_distribution_release }} main"
+    repo: "deb [signed-by=/etc/apt/keyrings/nodesource.gpg arch=amd64,arm64] https://deb.nodesource.com/node_{{ nodejs_version_major }}.x nodistro main"
     state: present
     filename: nodesource
-  when: nodejs_installed_major is not defined or nodejs_installed_major != nodejs_repo_major
+  register: nodesource_repo
+  when: nodejs_needs_install | default(true)
 
-- name: Add NodeSource GPG key
-  apt_key:
-    url: "https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key"
-    state: present
-  when: nodejs_installed_major is not defined or nodejs_installed_major != nodejs_repo_major
-
-- name: Install Node.js (latest in major series)
+- name: Update apt cache for NodeSource repository
   apt:
-    name: nodejs
-    state: latest
     update_cache: yes
-  when:
-    - not nodejs_exact_version_requested
-    - nodejs_installed_major is not defined or nodejs_installed_major != nodejs_repo_major
+    cache_valid_time: 3600
+  when: nodejs_needs_install | default(true) and (nodesource_key.changed or nodesource_repo.changed)
 
 - name: Install Node.js (exact version)
   apt:
     name:
-      - "nodejs={{ nodejs_desired_version }}-1nodesource1"
+      - "{{ 'nodejs=' + nodejs_version_pin + '-1nodesource1' if nodejs_version_pin != '' else 'nodejs' }}"
     state: present
     update_cache: yes
-  when:
-    - nodejs_exact_version_requested
-    - nodejs_installed_version is not defined or nodejs_installed_version != nodejs_desired_version
+  when: nodejs_needs_install | default(true)
 
 - name: Install npm globally
   npm:
@@ -100,19 +96,18 @@
     yarn_desired_version: "{{ yarn_version | default('') }}"
   when: install_yarn | default(true)
 
-- name: Get Yarn GPG key
-  rpm_key:
-    state: present
-    key: https://dl.yarnpkg.com/debian/pubkey.gpg
+- name: Add Yarn GPG key
+  get_url:
+    url: https://dl.yarnpkg.com/debian/pubkey.gpg
+    dest: /etc/apt/keyrings/yarn.gpg
+    mode: '0644'
   when:
     - install_yarn | default(true)
     - yarn_desired_version | length == 0
-  environment:
-    ansible_python_interpreter: /usr/bin/python3
 
 - name: Add Yarn repository
   apt_repository:
-    repo: "deb https://dl.yarnpkg.com/debian/ stable main"
+    repo: "deb [signed-by=/etc/apt/keyrings/yarn.gpg] https://dl.yarnpkg.com/debian/ stable main"
     state: present
     filename: yarn
   when: