From f4f0ed2b447824181cf1f4176507325e03a626af Mon Sep 17 00:00:00 2001
From: Aaron Gibson <aagbsn@extc.org>
Date: Thu, 24 Sep 2026 09:12:49 +0200
Subject: [PATCH 1/4] Update fastpath_image to latest tag

---
 ansible/host_vars/fastpath.prod.ooni.io/vars.yml           | 2 +-
 ansible/host_vars/fastpath2.prod.ooni.io/vars.yml          | 2 +-
 ansible/host_vars/reuploaderfastpath.prod.ooni.io/vars.yml | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/ansible/host_vars/fastpath.prod.ooni.io/vars.yml b/ansible/host_vars/fastpath.prod.ooni.io/vars.yml
index b2847e9d..986a62f6 100644
--- a/ansible/host_vars/fastpath.prod.ooni.io/vars.yml
+++ b/ansible/host_vars/fastpath.prod.ooni.io/vars.yml
@@ -4,4 +4,4 @@ bucket_name: "ooni-data-eu-fra"
 # COLLECTOR ID SHOULD BE DIFFERENT BETWEEN EACH FASTPATH INSTANCE
 collector_id: "1"
 env: "prod"
-fastpath_image: "ooni/fastpath:20260908-c4d5a24d"
+fastpath_image: "ooni/fastpath:20260921-ac774cb4"
diff --git a/ansible/host_vars/fastpath2.prod.ooni.io/vars.yml b/ansible/host_vars/fastpath2.prod.ooni.io/vars.yml
index 1be99841..26123dcc 100644
--- a/ansible/host_vars/fastpath2.prod.ooni.io/vars.yml
+++ b/ansible/host_vars/fastpath2.prod.ooni.io/vars.yml
@@ -4,4 +4,4 @@ bucket_name: "ooni-data-eu-fra"
 # COLLECTOR ID SHOULD BE DIFFERENT BETWEEN EACH FASTPATH INSTANCE
 collector_id: "4"
 env: "prod"
-fastpath_image: "ooni/fastpath:20260908-c4d5a24d"
+fastpath_image: "ooni/fastpath:20260921-ac774cb4"
diff --git a/ansible/host_vars/reuploaderfastpath.prod.ooni.io/vars.yml b/ansible/host_vars/reuploaderfastpath.prod.ooni.io/vars.yml
index 430f3f49..eef14c04 100644
--- a/ansible/host_vars/reuploaderfastpath.prod.ooni.io/vars.yml
+++ b/ansible/host_vars/reuploaderfastpath.prod.ooni.io/vars.yml
@@ -4,4 +4,4 @@ bucket_name: "ooni-data-eu-fra"
 # COLLECTOR ID SHOULD BE DIFFERENT BETWEEN EACH FASTPATH INSTANCE
 collector_id: "5"
 env: "prod"
-fastpath_image: "ooni/fastpath:20260908-c4d5a24d"
+fastpath_image: "ooni/fastpath:20260921-ac774cb4"

From 425247dd52921940ae7bc02851245a85d6dcb5f5 Mon Sep 17 00:00:00 2001
From: Aaron Gibson <aagbsn@extc.org>
Date: Thu, 24 Sep 2026 09:29:19 +0200
Subject: [PATCH 2/4] clean up old nginx apt sources

use nginx_install_method: official repo
---
 ansible/deploy-fastpath.yml | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/ansible/deploy-fastpath.yml b/ansible/deploy-fastpath.yml
index b9a8e502..5030fe1e 100644
--- a/ansible/deploy-fastpath.yml
+++ b/ansible/deploy-fastpath.yml
@@ -6,6 +6,27 @@
     - fastpath2.prod.ooni.io
     - reuploaderfastpath.prod.ooni.io
   become: true
+  vars:
+    nginx_install_method: official_repo
+  pre_tasks:
+    - name: Find any nginx.org apt source files left over from a previous nginxinc.nginx install
+      ansible.builtin.find:
+        paths: /etc/apt/sources.list.d
+        patterns: "*.list"
+        contains: "nginx.org/packages"
+      register: _stale_nginx_apt_sources
+      tags:
+        - nginx
+        - packages
+
+    - name: Remove stale nginx.org apt source files (avoids "Conflicting values set for option Signed-By")
+      ansible.builtin.file:
+        path: "{{ item.path }}"
+        state: absent
+      loop: "{{ _stale_nginx_apt_sources.files }}"
+      tags:
+        - nginx
+        - packages
   roles:
     - role: bootstrap
     - role: nginx

From 8fd1280fd4f884519a0952c519a39cf877a296db Mon Sep 17 00:00:00 2001
From: Aaron Gibson <aagbsn@extc.org>
Date: Thu, 24 Sep 2026 09:37:15 +0200
Subject: [PATCH 3/4] fix repo path for ubuntu host compatibility

---
 ansible/roles/nginx/tasks/main.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ansible/roles/nginx/tasks/main.yml b/ansible/roles/nginx/tasks/main.yml
index dbb2c3fc..bd70a7cd 100644
--- a/ansible/roles/nginx/tasks/main.yml
+++ b/ansible/roles/nginx/tasks/main.yml
@@ -71,7 +71,7 @@
 
     - name: Add the nginx.org apt repository
       ansible.builtin.apt_repository:
-        repo: "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://nginx.org/packages/debian {{ ansible_distribution_release }} nginx"
+        repo: "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://nginx.org/packages/{{ ansible_distribution | lower }} {{ ansible_distribution_release }} nginx"
         filename: nginx
         state: present
 

From 43b216704c8fee065a02b4fe04c3834d227ef8c1 Mon Sep 17 00:00:00 2001
From: Aaron Gibson <aagbsn@extc.org>
Date: Thu, 24 Sep 2026 10:45:53 +0200
Subject: [PATCH 4/4] match nginx.org/packages in sources.list.d files

---
 ansible/deploy-fastpath.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/ansible/deploy-fastpath.yml b/ansible/deploy-fastpath.yml
index 5030fe1e..8795c8b7 100644
--- a/ansible/deploy-fastpath.yml
+++ b/ansible/deploy-fastpath.yml
@@ -13,7 +13,8 @@
       ansible.builtin.find:
         paths: /etc/apt/sources.list.d
         patterns: "*.list"
-        contains: "nginx.org/packages"
+        contains: "nginx\\.org/packages"
+        read_whole_file: true
       register: _stale_nginx_apt_sources
       tags:
         - nginx