From 040fa1270550a0f4d1d0b2fe2eea42ee148e90e7 Mon Sep 17 00:00:00 2001
From: n0mad1k <n0mad1k@users.noreply.github.com>
Date: Tue, 10 Mar 2026 10:59:06 -0400
Subject: [PATCH] Split base hardening packages into required and optional
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

software-properties-common removed — dropped from Debian 13 (trixie).
unattended-upgrades and apt-listchanges moved to optional task with
ignore_errors so missing packages don't fail the entire deployment.
---
 phantom/playbooks/common/base_hardening.yml | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/phantom/playbooks/common/base_hardening.yml b/phantom/playbooks/common/base_hardening.yml
index bf09785..7c65f9a 100644
--- a/phantom/playbooks/common/base_hardening.yml
+++ b/phantom/playbooks/common/base_hardening.yml
@@ -27,16 +27,22 @@
         name:
           - ufw
           - fail2ban
-          - unattended-upgrades
-          - apt-listchanges
           - curl
           - wget
           - gnupg
           - ca-certificates
-          - software-properties-common
         state: present
       when: ansible_os_family == "Debian"
 
+    - name: Install optional hardening packages
+      apt:
+        name:
+          - unattended-upgrades
+          - apt-listchanges
+        state: present
+      when: ansible_os_family == "Debian"
+      ignore_errors: true
+
     # ─── UFW Firewall ───────────────────────────────────────────────────
     - name: Set UFW default deny incoming
       ufw: