Bullseye Compatibility

Changes:

• apt: Add version safeguard for bullseye's name of the security dist.
• shell/sudo: The includedir config directive has changed to not look like a comment.
• shell: Adapt Debian version safeguard to consider testing as higher than any released version.
• basic-system: Make the sysctl file configurable, so that one may leave the distribution provided default intact.
• basic-system/logrotate: Adapt config file to bullseye's default one.
• basic-system/journal: The journal will be persistent by default on bullseye. We will need to consider to remove our package in the future.
• basic-system/journal: Couldn't hold off fixing the name of journal_persitent_with_package to journal_persistent_with_package. Breaking Change! (@hinrikus)
• basic-system/rsyslog: Removed support for jessie and thus configuration of rsyslog in this role. This simplifies the role quiet a bit.
• ssh-server: Use the new drop-in configuration facility provided on bullseye.
• ssh-server: Updated the ssh_strong_crypto configuration option's meaning on bullseye to coincide with some SSH Hardening Guide's Ubuntu 20.04 recommendations that seem reasonable to me.

I did not add usrmerge to basic-system, although we should use it on every updated system (new systems use the new layout by default). What do you think?

apt/tasks/repositories.yml

@@ -47,7 +47,7 @@
     repo: "deb{{ src }} {{ apt_mirror_security }} {{ ansible_distribution_release }}{{ item[1] }} {{ item[0] }}"
   with_nested:
     - "{{ apt_repos }}"
-    - ['/updates']
+    - "{{ ['/updates'] if ansible_distribution_major_version|int(default=99) < 11 else ['-security'] }}"
   when: not raspbian_has_no_security
   notify:
     - update apt cache
@@ -61,7 +61,7 @@
     repo: "deb{{ src }} {{ apt_mirror_security }} {{ ansible_distribution_release }}{{ item[1] }} {{ item[0] }}"
   with_nested:
     - "{{ ['main', 'contrib', 'non-free']|difference(apt_repos) }}"
-    - ['/updates']
+    - "{{ ['/updates'] if ansible_distribution_major_version|int(default=99) < 11 else ['-security'] }}"
   when: not raspbian_has_no_security
   notify:
     - update apt cache