Clean up bootmgr and fix systemd-boot regression issue

Also update the syntax to use the new loop syntax instead of with_items

4 files changed, 35 insertions, 14 deletions

diff --git a/roles/bootstrap/tasks/install-archlinux.yml b/roles/bootstrap/tasks/install-archlinux.yml
index aa7d183..9e36e70 100644
--- a/roles/bootstrap/tasks/install-archlinux.yml
+++ b/roles/bootstrap/tasks/install-archlinux.yml
@@ -9,9 +9,19 @@
     cmd: "genfstab -t PARTLABEL {{ mnt_root_path }} > {{ mnt_root_path }}/etc/fstab"
   changed_when: true
 
-- name: "Run bootclt"
+- name: "Clean up old Linux Boot Manager entries"
+  ansible.builtin.shell:
+    cmd: |
+      for entry in $(efibootmgr | grep "Linux Boot Manager" | cut -d'*' -f1 | tr -d 'Boot'); do
+        efibootmgr -b $entry -B
+      done
+  changed_when: false
+  failed_when: false
+
+# NOTE: bootctl is not run in chroot to workaround https://github.com/systemd/systemd/issues/36174
+- name: "Run bootctl"
   ansible.builtin.command:
-    cmd: "arch-chroot {{ mnt_root_path }} bootctl install"
+    cmd: "bootctl install --esp-path={{ mnt_boot_path }}"
   changed_when: true
 
 - name: "Enable systemd-boot-update"
@@ -24,7 +34,7 @@
     src: "{{ item.src }}"
     dest: "{{ item.dest }}"
     mode: "0644"
-  with_items:
+  loop:
     - src: "loader.conf.j2"
       dest: "{{ mnt_boot_path }}/loader/loader.conf"
     - src: "archlinux.conf.j2"
@@ -34,15 +44,15 @@
   ansible.builtin.file:
     path: "{{ mnt_boot_path }}/archlinux"
     state: "directory"
-    mode: "0700"
+    mode: "0755"
 
 - name: "Copy kernel to efi partition"
   ansible.builtin.copy:
     src: "{{ item }}"
     dest: "{{ mnt_boot_path }}/archlinux/"
     remote_src: true
-    mode: "0700"
-  with_items:
+    mode: "0644"
+  loop:
     - "{{ mnt_root_path }}/boot/vmlinuz-linux"
     - "{{ mnt_root_path }}/boot/initramfs-linux.img"
     - "{{ mnt_root_path }}/boot/initramfs-linux-fallback.img"
@@ -76,7 +86,7 @@
   ansible.builtin.command:
     cmd: "arch-chroot {{ mnt_root_path }} {{ item }}"
   changed_when: true
-  with_items:
+  loop:
     - "pacman-key --init"
     - "pacman-key --populate"
     - "pacman -Syyu --noconfirm"
diff --git a/roles/bootstrap/tasks/install-raspberry.yml b/roles/bootstrap/tasks/install-raspberry.yml
index e7a6914..a85a168 100644
--- a/roles/bootstrap/tasks/install-raspberry.yml
+++ b/roles/bootstrap/tasks/install-raspberry.yml
@@ -31,7 +31,7 @@
     dest: "{{ item.dest }}"
     mode: "0640"
     content: "{{ item.content }}"
-  with_items:
+  loop:
     - dest: "{{ mnt_root_path }}/etc/apt/preferences.d/ignored-package"
       content: "{{ bootstrap_apt_ignored_preferences }}"
     - dest: "{{ mnt_root_path }}/etc/apt/sources.list"
@@ -53,7 +53,7 @@
   ansible.builtin.command:
     cmd: "arch-chroot {{ mnt_root_path }} {{ item }}"
   changed_when: true
-  with_items:
+  loop:
     - "apt-get update"
     - "apt-get install -y {{ bootstrap_distro.packages | join(' ') }}"
 
@@ -74,7 +74,7 @@
     src: "{{ item.src }}"
     dest: "{{ item.dest }}"
     mode: "0644"
-  with_items:
+  loop:
     - src: "raspberry.config.j2"
       dest: "{{ mnt_boot_path }}/config.txt"
     - src: "raspberry.cmdline.j2"
diff --git a/roles/bootstrap/tasks/install-ubuntu.yml b/roles/bootstrap/tasks/install-ubuntu.yml
index 1b22c69..407da3c 100644
--- a/roles/bootstrap/tasks/install-ubuntu.yml
+++ b/roles/bootstrap/tasks/install-ubuntu.yml
@@ -30,7 +30,7 @@
     dest: "{{ item.dest }}"
     mode: "0640"
     content: "{{ item.content }}"
-  with_items:
+  loop:
     - dest: "{{ mnt_root_path }}/etc/apt/preferences.d/ignored-package"
       content: "{{ bootstrap_apt_ignored_preferences }}"
     - dest: "{{ mnt_root_path }}/etc/apt/sources.list"
@@ -40,11 +40,21 @@
   ansible.builtin.command:
     cmd: "arch-chroot {{ mnt_root_path }} {{ item }}"
   changed_when: true
-  with_items:
+  loop:
     - "apt-get update"
     - "apt-get install -y {{ bootstrap_distro.packages | join(' ') }}"
 
-- name: "Run bootclt"
+- name: "Clean up old Linux Boot Manager entries"
+  ansible.builtin.shell:
+    cmd: |
+      for entry in $(efibootmgr | grep "Linux Boot Manager" | cut -d'*' -f1 | tr -d 'Boot'); do
+        efibootmgr -b $entry -B
+      done
+  changed_when: false
+  failed_when: false
+
+# NOTE: bootctl is not run in chroot to workaround https://github.com/systemd/systemd/issues/36174
+- name: "Run bootctl"
   ansible.builtin.command:
-    cmd: "arch-chroot {{ mnt_root_path }} bootctl install"
+    cmd: "bootctl install --esp-path={{ mnt_boot_path }}"
   changed_when: true
diff --git a/roles/bootstrap/templates/loader.conf.j2 b/roles/bootstrap/templates/loader.conf.j2
index dc9bb34..507c7a0 100644
--- a/roles/bootstrap/templates/loader.conf.j2
+++ b/roles/bootstrap/templates/loader.conf.j2
@@ -1,3 +1,4 @@
 default @saved
 timeout 5
 editor yes
+console-mode auto