phoenixd upgrade

ansible/services/caddy_playbook.yml

@@ -13,17 +13,34 @@
         state: present
         update_cache: yes
 
+    # Caddy's signing subkey carries an expiry date, and Cloudsmith republishes
+    # the key with a refreshed binding signature before it lapses. Re-fetch on
+    # every run: pinning the keyring with `creates:` leaves the host stuck on a
+    # key that eventually expires and breaks `apt update` with an sqv error.
+    - name: Ensure apt keyrings directory exists
+      ansible.builtin.file:
+        path: /etc/apt/keyrings
+        state: directory
+        owner: root
+        group: root
+        mode: '0755'
+
     - name: Download Caddy GPG armored key
       ansible.builtin.get_url:
         url: https://dl.cloudsmith.io/public/caddy/stable/gpg.key
-        dest: /tmp/caddy-stable-archive-keyring.asc
+        dest: /etc/apt/keyrings/caddy-stable-archive-keyring.asc
         mode: '0644'
+      register: caddy_key_download
+
+    - name: Check for existing Caddy keyring
+      ansible.builtin.stat:
+        path: /usr/share/keyrings/caddy-stable-archive-keyring.gpg
+      register: caddy_keyring
 
     - name: Convert ASCII armored key to binary keyring
       ansible.builtin.command:
-        cmd: gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg /tmp/caddy-stable-archive-keyring.asc
-      args:
-        creates: /usr/share/keyrings/caddy-stable-archive-keyring.gpg
+        cmd: gpg --batch --yes --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg /etc/apt/keyrings/caddy-stable-archive-keyring.asc
+      when: caddy_key_download.changed or not caddy_keyring.stat.exists
 
     - name: Ensure permissions on keyring file
       ansible.builtin.file: