From 8aa00c7091967b4c6e02541eb441c8d4eb2dd921 Mon Sep 17 00:00:00 2001
From: Emil Simeonov <emil@theliberatededge.org>
Date: Sat, 20 Jun 2026 21:35:19 +0200
Subject: [PATCH] fix: use deb822_repository for Docker APT repo (proper GPG
 handling)

The apt_repository module with signed-by wasn't working because the
downloaded GPG key wasn't properly dearmored. The deb822_repository
module handles GPG key download and dearmoring automatically.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---
 .../gitea-runner/tasks/rootless_docker.yml    | 22 +++++++------------
 1 file changed, 8 insertions(+), 14 deletions(-)

diff --git a/ansible/roles/gitea-runner/tasks/rootless_docker.yml b/ansible/roles/gitea-runner/tasks/rootless_docker.yml
index 7a3f11b..4949446 100644
--- a/ansible/roles/gitea-runner/tasks/rootless_docker.yml
+++ b/ansible/roles/gitea-runner/tasks/rootless_docker.yml
@@ -1,19 +1,13 @@
 ---
-- name: Install Docker GPG key (Debian/Ubuntu)
-  ansible.builtin.get_url:
-    url: "https://download.docker.com/linux/{{ ansible_facts['distribution'] | lower }}/gpg"
-    dest: "{{ docker_gpg_key_path }}"
-    mode: "0644"
-  when: ansible_facts['os_family'] == 'Debian'
-
 - name: Add Docker APT repository (Debian/Ubuntu)
-  ansible.builtin.apt_repository:
-    repo: >-
-      deb [arch={{ ansible_facts['architecture'] }} signed-by={{ docker_gpg_key_path }}]
-      https://download.docker.com/linux/{{ ansible_facts['distribution'] | lower }}
-      {{ ansible_facts['distribution_release'] }} stable
-    state: present
-    update_cache: true
+  community.general.deb822_repository:
+    name: docker
+    types: deb
+    uris: "https://download.docker.com/linux/{{ ansible_facts['distribution'] | lower }}"
+    suites: "{{ ansible_facts['distribution_release'] }}"
+    components: stable
+    architectures: "{{ ansible_facts['architecture'] }}"
+    signed_by: "https://download.docker.com/linux/{{ ansible_facts['distribution'] | lower }}/gpg"
   when: ansible_facts['os_family'] == 'Debian'
 
 - name: Install rootless Docker dependencies (Debian/Ubuntu)