From 74db5f28c7b3a049a6f451266750567df04e2737 Mon Sep 17 00:00:00 2001
From: Emil Simeonov <emil@theliberatededge.org>
Date: Sat, 20 Jun 2026 21:46:33 +0200
Subject: [PATCH] fix: dearmor Docker GPG key with gpg --dearmor for
 apt_repository

The deb822_repository module isn't available in the CI Ansible
collection. Reverted to apt_repository but now properly dearmors
the GPG key using gpg --dearmor before referencing it in signed-by.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---
 ansible/roles/gitea-runner/defaults/main.yml  |  2 +-
 .../gitea-runner/tasks/rootless_docker.yml    | 30 ++++++++++++++-----
 2 files changed, 23 insertions(+), 9 deletions(-)

diff --git a/ansible/roles/gitea-runner/defaults/main.yml b/ansible/roles/gitea-runner/defaults/main.yml
index d0b41ad..166fb23 100644
--- a/ansible/roles/gitea-runner/defaults/main.yml
+++ b/ansible/roles/gitea-runner/defaults/main.yml
@@ -30,4 +30,4 @@ gitea_runner_container_label: "gitea-runner=true"
 gitea_runner_file: ".runner"
 
 # Docker installation (for rootless dependencies)
-docker_gpg_key_path: "/etc/apt/keyrings/docker.asc"
+docker_gpg_key_path: "/etc/apt/keyrings/docker.gpg"
diff --git a/ansible/roles/gitea-runner/tasks/rootless_docker.yml b/ansible/roles/gitea-runner/tasks/rootless_docker.yml
index 4949446..6065fcf 100644
--- a/ansible/roles/gitea-runner/tasks/rootless_docker.yml
+++ b/ansible/roles/gitea-runner/tasks/rootless_docker.yml
@@ -1,13 +1,27 @@
 ---
+- name: Ensure keyrings directory exists (Debian/Ubuntu)
+  ansible.builtin.file:
+    path: "/etc/apt/keyrings"
+    state: directory
+    mode: "0755"
+  when: ansible_facts['os_family'] == 'Debian'
+
+- name: Download and dearmor Docker GPG key (Debian/Ubuntu)
+  ansible.builtin.shell: |
+    set -o pipefail
+    curl -fsSL "https://download.docker.com/linux/{{ ansible_facts['distribution'] | lower }}/gpg" | gpg --dearmor -o {{ docker_gpg_key_path }}
+  args:
+    creates: "{{ docker_gpg_key_path }}"
+  when: ansible_facts['os_family'] == 'Debian'
+
 - name: Add Docker APT repository (Debian/Ubuntu)
-  community.general.deb822_repository:
-    name: docker
-    types: deb
-    uris: "https://download.docker.com/linux/{{ ansible_facts['distribution'] | lower }}"
-    suites: "{{ ansible_facts['distribution_release'] }}"
-    components: stable
-    architectures: "{{ ansible_facts['architecture'] }}"
-    signed_by: "https://download.docker.com/linux/{{ ansible_facts['distribution'] | lower }}/gpg"
+  ansible.builtin.apt_repository:
+    repo: >-
+      deb [arch={{ ansible_facts['architecture'] }} signed-by={{ docker_gpg_key_path }}]
+      https://download.docker.com/linux/{{ ansible_facts['distribution'] | lower }}
+      {{ ansible_facts['distribution_release'] }} stable
+    state: present
+    update_cache: true
   when: ansible_facts['os_family'] == 'Debian'
 
 - name: Install rootless Docker dependencies (Debian/Ubuntu)