Join a fresh host to NetBird idempotently with the keyring, the management URL and the interface blacklist from the vars, and edit the blacklist and log level of a joined one

netbird_client/tasks/install.yml

@@ -1,26 +1,28 @@
 - name: Install Packages
-#  when: docker_file.stat.exists == False
   package:
     name:
       - ca-certificates
       - curl
       - gnupg
 
-- name: Add netbird-key
-  apt_key:
-    url: https://pkgs.wiretrustee.com/debian/public.key
-    state: present
+# Same keyring path the hand-installed hosts use, so the repository line is identical.
+- name: Install the netbird repository keyring
+  ansible.builtin.shell:
+    cmd: set -o pipefail && curl -fsSL https://pkgs.netbird.io/debian/public.key | gpg --dearmor -o /usr/share/keyrings/netbird-archive-keyring.gpg
+    executable: /bin/bash
+    creates: /usr/share/keyrings/netbird-archive-keyring.gpg
 
 - name: Add netbird-repository
   apt_repository:
-    repo: "deb https://pkgs.wiretrustee.com/debian stable main"
+    repo: "deb [signed-by=/usr/share/keyrings/netbird-archive-keyring.gpg] https://pkgs.netbird.io/debian stable main"
     state: present
     filename: netbird
     update_cache: yes
 
+# present, not latest: an upgrade restarts the daemon and drops the tunnels of the node.
 - name: Install wireguard & netbird
   package:
     name:
       - wireguard
       - netbird
-    state: latest
+    state: present