fix(playbooks): apply the apt lock wait to every apt task #41

Merged

jfraeys merged 1 commit from jfraeys/fix/apt-lock-module-defaults into main

2026-10-10 10:39:34 -04:00

jfraeys commented

2026-10-10 10:36:18 -04:00

Owner

Staging runs fail intermittently with Unable to acquire the dpkg frontend lock (latest: the crowdsec=1.8.1 install on staging-web, with DPkg::Lock::Timeout=60 in the command).

Cause: playbooks/web.yml set lock_timeout: 120 as a parameter of the one "Install UFW" task. Every other apt task in every role kept the module default of 60s, so a fresh VM whose unattended-upgrades/apt-daily holds the dpkg lock past 60s fails whichever apt task runs next. ci-ephemeral.yml already uses the right pattern (play-level module_defaults).

Fix: play-level module_defaults: ansible.builtin.apt: lock_timeout: 300 in web.yml, services.yml and hardening.yml; the now-redundant per-task parameter is removed.

Verified: syntax-check of all three; in a scratch play, an apt task inside a role gets lock_timeout 300 with the default and 60 without it.
Not verified: the race itself is nondeterministic, so one green staging run proves little; it needs a few.

🤖 Generated with Claude Code

Staging runs fail intermittently with `Unable to acquire the dpkg frontend lock` (latest: the crowdsec=1.8.1 install on staging-web, with `DPkg::Lock::Timeout=60` in the command). Cause: playbooks/web.yml set `lock_timeout: 120` as a parameter of the one "Install UFW" task. Every other apt task in every role kept the module default of 60s, so a fresh VM whose unattended-upgrades/apt-daily holds the dpkg lock past 60s fails whichever apt task runs next. ci-ephemeral.yml already uses the right pattern (play-level `module_defaults`). Fix: play-level `module_defaults: ansible.builtin.apt: lock_timeout: 300` in web.yml, services.yml and hardening.yml; the now-redundant per-task parameter is removed. Verified: syntax-check of all three; in a scratch play, an apt task inside a role gets lock_timeout 300 with the default and 60 without it. Not verified: the race itself is nondeterministic, so one green staging run proves little; it needs a few. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

jfraeys added 1 commit

2026-10-10 10:36:18 -04:00

fix(playbooks): apply the apt lock wait to every apt task, not one

Lint / lint (pull_request) Successful in 1m31s

Details

ba096b4d35

web.yml set lock_timeout: 120 as a parameter on the single "Install UFW" task;
every other apt task (crowdsec, fail2ban, hardening, ...) kept apt's 60s
default and failed on a fresh VM whose unattended-upgrades held the dpkg lock
(crowdsec=1.8.1 install, staging run 2026-10-10). Move it to play-level
module_defaults (as ci-ephemeral.yml already does) in web, services and
hardening, at 300s. Verified in a scratch play that an apt task inside a role
gets lock_timeout 300 with the default and 60 without it.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

jfraeys merged commit e129679bb2 into main

2026-10-10 10:39:34 -04:00

jfraeys referenced this pull request from a commit

2026-10-10 10:39:34 -04:00

Merge pull request 'fix(playbooks): apply the apt lock wait to every apt task' (#41) from jfraeys/fix/apt-lock-module-defaults into main

jfraeys referenced this pull request

2026-10-10 10:42:00 -04:00

fix(ci): run lint when its own config changes #42