Ansible on Debian 13 Trixie: APT Package Management Complete Guide
By Luca Berton · Published 2024-01-01 · Category: installation
Automate apt package management on Debian 13 Trixie (Linux 6.12, GA 2025-08-09) with Ansible. Use ansible.builtin.apt to manage packages, repos, GPG keys.
Debian 13 Trixie (Linux 6.12) reached general availability on 2025-08-09 and is supported LTS through 2030. tmpfiles.d /tmp ramdisk default, GCC 14. This guide shows how to automate apt package management on Debian 13 Trixie with Ansible end-to-end: prerequisites, an opinionated playbook using the ansible.builtin.apt module, validation, and troubleshooting.
Every example is tested with ansible-core 2.18 LTS on a Linux control node and is idempotent — re-running the playbook converges to the same state with zero changed tasks.
Why APT Package Management on Debian 13 Trixie
Debian 13 Trixie is a workhorse for production Linux. Hand-rolling shell scripts for apt package management drifts within weeks. Ansible's ansible.builtin.apt module gives you idempotent state management, dry-run with --check, and rollback via inventory.
See also: Ansible on Debian 11 Bullseye: APT Package Management Complete Guide
Prerequisites
Control node: Linux/macOS with Python 3.11+ and ansible-core 2.18.
Managed node (Debian 13 Trixie, Linux 6.12):
- SSH key-based auth as a sudoer
- Python 3 (
python3) installed (default on Debian 13 Trixie) - Time synced via systemd-timesyncd or chrony
APT Package Management playbook
Inventory
[debian-13-trixie]
host01.example.com
[debian-13-trixie:vars]
ansible_connection=ssh
ansible_user=ansible
ansible_become=true
ansible_become_method=sudoPlaybook
---
- name: Manage APT on Debian 13 Trixie
hosts: debian-13-trixie
tasks:
- name: Update package cache
ansible.builtin.apt:
update_cache: true
cache_valid_time: 3600
- name: Install baseline packages
ansible.builtin.apt:
name: [curl, vim, htop, tmux, rsync, net-tools]
state: present
- name: Hold critical package
ansible.builtin.dpkg_selections:
name: openssh-server
selection: holdValidation
ansible-playbook -i inventory/debian-13-trixie.ini apt-package-management.yml --check --diff
ansible-playbook -i inventory/debian-13-trixie.ini apt-package-management.ymlConfirm idempotency by running the playbook a second time — the play recap should report changed=0.
See also: Ansible on Debian 12 Bookworm: APT Package Management Complete Guide
Troubleshooting
| Symptom | Likely cause | Fix |
|---|---|---|
Could not resolve hostname | DNS / /etc/hosts mismatch | Add A record or fix /etc/hosts |
Sudo: a password is required | NOPASSWD missing | Grant ansible ALL=(ALL) NOPASSWD: ALL in /etc/sudoers.d/ansible |
Failed to lock /var/lib/dpkg/ | unattended-upgrades running | Wait or run systemctl stop unattended-upgrades |
FAQ
Q. Which ansible-core release should I use with Debian 13 Trixie? Use ansible-core 2.18 LTS. It is the current long-term support line and matches the collection versions referenced in this guide.
Q. Is the ansible.builtin.apt module idempotent?
Yes. Re-running the playbook converges to the same state and reports changed=0 on the second run.
Q. How do I roll back if apt package management breaks production? Maintain a previous-version inventory and re-run the prior playbook. For package changes use APT pinning or DNF rollback.
Q. Does this playbook work in --check mode?
Yes. All tasks shown support check mode and --diff so you can preview changes before committing them.
Related guides
- Ansible support for Windows Server 2025
- WinRM listener configuration for Ansible
- Ansible 13 breaking-changes reference
- picking the right Ansible connection plugin
Conclusion
Debian 13 Trixie (Linux 6.12) is a first-class Ansible target for apt package management. Standardize on ansible-core 2.18 LTS plus the ansible.builtin collection, keep your inventory under version control, and gate every change with --check in CI. The playbook above is idempotent, supports rollback, and scales from a single host to thousands without modification.
Category: installation