[PATCH v2 8/9] devconfig: add automatic APT mirror fallback for Debian testing

[Luis Chamberlain <mcgrof@kernel.org>]

Debian testing (trixie) VMs can fail to provision when configured APT
mirrors become unavailable or unresponsive. This is particularly common
with local or regional mirrors that may have intermittent connectivity
issues.

This fix adds automatic mirror health checking specifically for Debian
testing systems. The implementation:

1. Extracts the currently configured APT mirror hostname
2. Tests connectivity to the mirror on port 80 with a 10 second timeout
3. Falls back to official Debian mirrors if the test fails
4. Backs up the original sources.list before making changes
5. Updates the APT cache after switching mirrors
6. Provides clear user notification about the fallback

The check only runs on Debian testing systems where devconfig_debian_testing
is set to true, avoiding any impact on stable Debian or other distributions.

This ensures that Debian testing VMs can successfully provision even when
the initially configured mirror is unavailable, improving reliability for
development and testing workflows.

Generated-by: Claude AI
Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
---
 .../devconfig/tasks/check-apt-mirrors.yml     | 63 +++++++++++++++++++
 playbooks/roles/devconfig/tasks/main.yml      |  8 +++
 .../debian-testing-fallback-sources.list      | 10 +++
 3 files changed, 81 insertions(+)
 create mode 100644 playbooks/roles/devconfig/tasks/check-apt-mirrors.yml
 create mode 100644 playbooks/roles/devconfig/templates/debian-testing-fallback-sources.list

diff --git a/playbooks/roles/devconfig/tasks/check-apt-mirrors.yml b/playbooks/roles/devconfig/tasks/check-apt-mirrors.yml
new file mode 100644
index 00000000..02e0c800
--- /dev/null
+++ b/playbooks/roles/devconfig/tasks/check-apt-mirrors.yml
@@ -0,0 +1,63 @@
+---
+# Only run mirror checks for Debian testing (trixie) where mirror issues are common
+- name: Extract current APT mirror hostname
+  shell: |
+    grep -E "^deb\s+http" /etc/apt/sources.list | head -1 | awk '{print $2}' | sed 's|http://||' | cut -d'/' -f1
+  register: apt_mirror_host
+  changed_when: false
+  ignore_errors: yes
+
+- name: Check connectivity to current APT mirror
+  wait_for:
+    host: "{{ apt_mirror_host.stdout }}"
+    port: 80
+    timeout: 10
+  register: mirror_connectivity
+  ignore_errors: yes
+  when: apt_mirror_host.stdout != ""
+
+- name: Display mirror check results
+  debug:
+    msg: |
+      Current APT mirror: {{ apt_mirror_host.stdout | default('Not found') }}
+      Mirror connectivity: {{ 'OK' if mirror_connectivity is not failed else 'FAILED' }}
+  when: apt_mirror_host.stdout != ""
+
+- name: Fall back to official Debian mirrors if current mirror fails
+  block:
+    - name: Backup current sources.list
+      copy:
+        src: /etc/apt/sources.list
+        dest: /etc/apt/sources.list.backup
+        remote_src: yes
+      become: yes
+
+    - name: Apply Debian testing fallback sources
+      template:
+        src: debian-testing-fallback-sources.list
+        dest: /etc/apt/sources.list
+        owner: root
+        group: root
+        mode: '0644'
+      become: yes
+
+    - name: Update APT cache after mirror change
+      apt:
+        update_cache: yes
+        cache_valid_time: 0
+      become: yes
+
+    - name: Inform user about mirror fallback
+      debug:
+        msg: |
+          WARNING: The configured APT mirror '{{ apt_mirror_host.stdout }}' is not accessible.
+          Falling back to official Debian testing mirrors:
+          - deb.debian.org for main packages
+          - security.debian.org for security updates
+
+          This may result in slower package downloads depending on your location.
+          Consider configuring a local mirror for better performance.
+
+  when:
+    - apt_mirror_host.stdout != ""
+    - mirror_connectivity is failed
diff --git a/playbooks/roles/devconfig/tasks/main.yml b/playbooks/roles/devconfig/tasks/main.yml
index 656d5389..ceb0f2e8 100644
--- a/playbooks/roles/devconfig/tasks/main.yml
+++ b/playbooks/roles/devconfig/tasks/main.yml
@@ -30,6 +30,14 @@
   tags: hostname
 
 # Distro specific
+
+# Check and fix APT mirrors for Debian testing before installing dependencies
+- name: Check and fix APT mirrors for Debian testing
+  include_tasks: check-apt-mirrors.yml
+  when:
+    - devconfig_debian_testing is defined
+    - devconfig_debian_testing | bool
+
 - name: Install dependencies
   ansible.builtin.include_tasks: install-deps/main.yml
   tags: ['vars', 'vars_simple']
diff --git a/playbooks/roles/devconfig/templates/debian-testing-fallback-sources.list b/playbooks/roles/devconfig/templates/debian-testing-fallback-sources.list
new file mode 100644
index 00000000..456ed60f
--- /dev/null
+++ b/playbooks/roles/devconfig/templates/debian-testing-fallback-sources.list
@@ -0,0 +1,10 @@
+deb http://deb.debian.org/debian testing main contrib non-free non-free-firmware
+deb-src http://deb.debian.org/debian testing main contrib non-free non-free-firmware
+
+# Security updates
+deb http://security.debian.org/debian-security testing-security main contrib non-free non-free-firmware
+deb-src http://security.debian.org/debian-security testing-security main contrib non-free non-free-firmware
+
+# Updates (if available for testing)
+deb http://deb.debian.org/debian testing-updates main contrib non-free non-free-firmware
+deb-src http://deb.debian.org/debian testing-updates main contrib non-free non-free-firmware
\ No newline at end of file
-- 
2.47.2