[markuslf]

The merge gate is met: Linuxfabrik Monitoring Plugins 8.1.0, the first release built by Linuxfabrik/packaging (Linuxfabrik/packaging#56), is in the release channel of repo.linuxfabrik.ch since 2026-10-27, on all targets. #489 and #491 are merged; this branch is rebased onto main, and the setup_icinga2_master conflict with #491 is resolved: repo_linuxfabrik runs together with acme_sh or with the package install of the monitoring plugins.

The RPM and DEB build of the monitoring plugins moves to Linuxfabrik/packaging, which publishes to the Linuxfabrik repository (el/<ver>/<arch>/linuxfabrik/<channel>/ and so on) instead of repo.linuxfabrik.ch/monitoring-plugins/. The former tree is frozen and is removed after a transition period.

Changes

• repo_monitoring_plugins only removes the former repository: every linuxfabrik-monitoring-plugins* file in /etc/yum.repos.d, /etc/zypp/repos.d and /etc/apt/sources.list.d (including the backups and the files of tools/install-monitoring-plugins), and /etc/apt/keyrings/linuxfabrik.asc. The rpm key stays, since it also signs the Linuxfabrik repository. The role is deprecated.
• The run aborts while repo_monitoring_plugins__basic_auth_login, __mirror_url or __testing is set, naming the repo_linuxfabrik__* replacement. repo_linuxfabrik__testing_repo_enabled adds the testing channel instead of replacing the release channel.
• monitoring_plugins and icinga2_agent run repo_monitoring_plugins (cleanup), then repo_linuxfabrik for monitoring_plugins__install_method: 'package' (*_skip_repo_linuxfabrik).
• setup_basic already deploys repo_linuxfabrik (feat(roles/repo_linuxfabrik): add role #489); setup_icinga2_master runs it after EPEL together with the package install of the monitoring plugins. This is the spot feat(roles/acme_sh): install acme.sh from the Linuxfabrik repository #491 uses for acme.sh. The conflict there comes down to OR-ing the two default conditions.
• repo_linuxfabrik supports Debian 11, which the monitoring plugins are built for until 2027-02-28. apt 2.2.4 reads the deb822 file, checks the signature and skips the disabled testing stanza (verified against the bookworm suite; bullseye is served once Linuxfabrik/packaging builds for it).
• Removing the package for a switch to the source install keeps the Linuxfabrik repository, since other packages may come from it: --tags monitoring_plugins:remove.

Tests

• Molecule monitoring_plugins is split into install (fresh host) and migrate (8.0.0 installed and locked from the former repository). verify checks that the latest release runs and came from the Linuxfabrik repository (from_repo / apt-cache madison), that nothing of the former repository is left, and that the lock moved to the new version. On EL it also checks that -selinux was upgraded along.
• monitoring_plugins_source/remove no longer expects the rpm key to be gone.
• repo_linuxfabrik runs on debian11-vm too.
• Run by hand in Rocky 9 and Debian 13 containers, with 8.0.0 from the former repository and locked: the former files and linuxfabrik.asc were removed, the Linuxfabrik repository was active, the lock was kept, and the second run reported changed=0. With repo_monitoring_plugins__testing=true, the run aborted with the hint.
• pre-commit and tests/unit/test_playbooks.py pass. ansible-lint reports nothing in the changed files.