fix(ansible): make apt itself wait for the dpkg lock #68

Merged

jfraeys merged 1 commit from jfraeys/fix/apt-dpkg-lock-timeout into main

2026-10-11 15:48:01 -04:00

jfraeys commented

2026-10-11 15:45:17 -04:00

Owner

Staging run 471: backups : Install restic failed 4s after starting with Could not get lock /var/lib/dpkg/lock-frontend ... (unattended-upgr) despite the play's lock_timeout: 300. That module option only covers python-apt's cache lock; the apt-get it spawns fails immediately. A pre-task now drops /etc/apt/apt.conf.d/99dpkg-lock-timeout (DPkg::Lock::Timeout "600") so every apt-get in the play waits, in services, web, hardening and ci-ephemeral.

Verified in a Debian 12 container with a real fcntl lock holder: without the file apt-get fails at once (rc 100, same message); with it, it waited 8s for the lock and succeeded. ansible-lint, yamllint and syntax-check pass for all four playbooks. The file persists on hosts (harmless in steady state). The ci-ephemeral change reaches the provisioner after a role redeploy. 🤖 Generated with Claude Code

Staging run 471: `backups : Install restic` failed 4s after starting with `Could not get lock /var/lib/dpkg/lock-frontend ... (unattended-upgr)` despite the play's `lock_timeout: 300`. That module option only covers python-apt's cache lock; the apt-get it spawns fails immediately. A pre-task now drops `/etc/apt/apt.conf.d/99dpkg-lock-timeout` (`DPkg::Lock::Timeout "600"`) so every apt-get in the play waits, in services, web, hardening and ci-ephemeral. Verified in a Debian 12 container with a real fcntl lock holder: without the file apt-get fails at once (rc 100, same message); with it, it waited 8s for the lock and succeeded. ansible-lint, yamllint and syntax-check pass for all four playbooks. The file persists on hosts (harmless in steady state). The ci-ephemeral change reaches the provisioner after a role redeploy. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

jfraeys added 1 commit

2026-10-11 15:45:19 -04:00

fix(ansible): make apt itself wait for the dpkg lock

Lint / lint (pull_request) Successful in 1m17s

Details

Secret scan / scan (pull_request) Successful in 15s

Details

1f5a496835

module_defaults lock_timeout only covers python-apt's cache lock; the apt-get it spawns failed at once on
unattended-upgrades' lock (staging run 471, backups: Install restic). A pre-task drops an apt.conf.d file with
DPkg::Lock::Timeout 600 in services, web, hardening and ci-ephemeral.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

jfraeys merged commit 96002059a0 into main

2026-10-11 15:48:01 -04:00

jfraeys referenced this pull request from a commit

2026-10-11 15:48:02 -04:00

Merge pull request 'fix(ansible): make apt itself wait for the dpkg lock' (#68) from jfraeys/fix/apt-dpkg-lock-timeout into main

jfraeys referenced this pull request

2026-10-12 12:35:05 -04:00

fix(ansible): wait for background apt/dpkg to finish before the play (covers the archives lock) #71