This is basically the same as prometheus!4 (merged).
While at it, I also included a small optimisation in the apt role (run apt update only once at the end and not for every repository change).
apt
apt update