rewrite with higher security

tasks_debian.yml

@@ -0,0 +1,50 @@
+- block:
+  - name: add gpg keys
+    ansible.builtin.apt_key:
+      url: "{{ item.gpg }}"
+      state: present
+    loop: "{{ nondefault_package_installs }}"
+    when: nondefault_package_installs is defined
+
+  - name: update apt source.list.d
+    ansible.builtin.apt_repository:
+      repo: "{{ item.source }}"
+      state: present
+      filename: programms
+      update_cache: yes
+    loop: "{{ nondefault_package_installs }}"
+    when: nondefault_package_installs is defined
+
+  - name: install non-default packages with package manager
+    ansible.builtin.package:
+      name:
+        - "{{ item.name }}"
+      state: present
+    loop: "{{ nondefault_package_installs }}"
+    when: nondefault_package_installs is defined
+
+  - name: download deb files
+    ansible.builtin.get_url:
+      url: "{{ item.url }}"
+      dest: "/tmp/{{ item.name }}.deb"
+      mode: "0440"
+    loop: "{{ deb_installs }}"
+    when: deb_installs is defined
+
+  - name: install deb files
+    ansible.builtin.apt:
+      deb: "/tmp/{{ item.name }}.deb"
+    loop: "{{ deb_installs }}"
+    when: deb_installs is defined
+
+  - name: update all packages
+    apt:
+      name: '*'
+      state: latest
+      update_cache: yes
+
+  - name: clean apt cache
+    apt:
+      autoclean: yes
+
+  when: ansible_os_family == "Debian"