Add unstable sources.list

roles/common/tasks/main.yaml

@@ -15,6 +15,8 @@
     group: "{{ item.group | default('root') }}"
   with_items:
     - { src: "apt.conf.j2", dest: "/etc/apt/apt.conf" }
+    - { src: "apt-defaultrelease.j2", dest: "/etc/apt/apt.conf.d/09defaultrelease" }
+    - { src: "apt-preferences-stable.j2", dest: "/etc/apt/preferences.d/stableonly" }
     - { src: "sources.list.j2", dest: "/etc/apt/sources.list" }
     - { src: "apt-auto-upgrades.j2", dest: "/etc/apt/apt.conf.d/20auto-upgrades" }
     - { src: "apt-unattended-upgrades.j2", dest: "/etc/apt/apt.conf.d/50unattended-upgrades" }

roles/common/templates/apt-defaultrelease.j2

@@ -0,0 +1 @@
+APT::Default-Release "{{ ansible_distribution_release }}";

roles/common/templates/apt-preferences-stable.j2

@@ -0,0 +1,19 @@
+# Prefer packages from our release
+# Prevent auto-installation from testing/unstable/sid/whatever
+
+Package: *
+Pin: release n={{ ansible_distribution_release }}
+Pin-Priority: 900
+
+Package: *
+Pin: release n=sid
+Pin-Priority: -10
+
+Package: *
+Pin: release n=testing
+Pin-Priority: -10
+
+Package: *
+Pin: release n=unstable
+Pin-Priority: -10
+

roles/common/templates/sources.list.j2

@@ -20,5 +20,8 @@ deb {{ debian_repourl }} {{ ansible_distribution_release }}-backports {{ compone
 #
 # Security patches
 deb {{ debian_securityurl }} {{ ansible_distribution_release }}-security {{ components }}
-{{ SRC }}deb-src {{ debian_securityurl }} {{ ansible_distribution_release }}-security main contrib non-  free
+{{ SRC }}deb-src {{ debian_securityurl }} {{ ansible_distribution_release }}-security {{ components }}
 
+# Testing/Unstable repos
+deb {{ debian_repourl }} testing {{ components }}
+deb {{ debian_repourl }} sid {{ components }}