use separate role for package management

ansible/hermes.yml

@@ -6,20 +6,8 @@
 
 - name: Install services
   hosts: all
-  pre_tasks:
-    - name: Update repositories
-      apt:
-        autoremove: true
-        upgrade: yes
-        state: latest
-        update_cache: yes
-        cache_valid_time: 86400 # One day
-    - name: Install packages
-      apt:
-        pkg:
-          - qemu-guest-agent
-          - dnsutils
   roles:
+    - {role: 'setup-apt', tags: 'setup-apt'}
     - {role: 'dnsmasq', tags: 'dnsmasq'}
     - {role: 'nsd', tags: 'nsd'}
     - {role: 'ssh-ca', tags: 'ssh-ca'}

ansible/inventory/host_vars/hermes.yml

@@ -1,3 +1,7 @@
+apt_install_packages:
+  - qemu-guest-agent
+  - dnsutils
+
 ssh_ca_dir: /root/ssh_ca
 ssh_ca_user_ca_public_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGKOClnK6/Hj8INjEgULY/lD2FM/nbiJHqaSXtEw4+Fj User Certificate Authority for DMZ"
 ssh_ca_host_ca_public_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAX2IhgHNxC6JTvLu9cej+iWuG+uJFMXn4AiRro9533x Host Certficate Authority for DMZ"

ansible/requirements.yml

@@ -1,3 +1,6 @@
+- name: setup-apt
+  src: https://github.com/sunscrapers/ansible-role-apt.git
+  scm: git
 - name: cloudinit-wait
   src: https://git.pim.kunis.nl/pim/ansible-role-cloudinit-wait
   scm: git