brushing up backups

ansible/roles/backup_source/tasks/main.yml

@@ -16,12 +16,22 @@
 
 # Declared here rather than assumed. Stage 1 installed it by hand; this is what
 # makes a rebuilt host get it too.
+# Cache refresh is best-effort on purpose. An unrelated third-party repo with a
+# bad signing key (spacey had two: an expired Caddy subkey and a SHA1 nodesource
+# key) makes `apt-get update` return warnings, which the apt module treats as a
+# hard failure — and that must not stop backups being configured. Installing the
+# package is NOT best-effort: if age is genuinely unavailable, the next task fails.
+- name: Refresh the apt cache (best effort)
+  ansible.builtin.apt:
+    update_cache: yes
+    cache_valid_time: 3600
+  failed_when: false
+  changed_when: false
+
 - name: Ensure age is installed
   ansible.builtin.apt:
     name: age
     state: present
-    update_cache: yes
-    cache_valid_time: 3600
 
 # The pull account: unprivileged, no sudo, exists only so small-backups-box can
 # read the dump directory. Trust points one way — the box can read backups, and