feat: uniform system.content source schema across installers and repositories

roles/bootstrap/tasks/archlinux.yml

@@ -1,9 +1,4 @@
 ---
-- name: Refresh Arch keyring in the live environment
-  ansible.builtin.command: pacman -Sy --noconfirm archlinux-keyring
-  register: bootstrap_arch_keyring
-  changed_when: bootstrap_arch_keyring.rc == 0
-
 - name: Bootstrap ArchLinux
   vars:
     _config: "{{ lookup('vars', bootstrap_var_key) }}"
@@ -13,7 +8,44 @@
         | reject('equalto', '')
         | list
       }}
-  ansible.builtin.command: >-
-    pacstrap /mnt {{ bootstrap_archlinux_packages | join(' ') }}
-  register: bootstrap_result
-  changed_when: bootstrap_result.rc == 0
+  block:
+    - name: Notify that mirror mode falls back to the public mirrorlist
+      when:
+        - system_cfg.content.source == 'mirror'
+        - system_cfg.content.url | length == 0
+      ansible.builtin.debug:
+        msg: >-
+          content.source is 'mirror' but content.url is empty: keeping the live
+          ISO public mirrorlist (refreshed by reflector). Set content.url to pin
+          a specific mirror.
+
+    - name: Point pacman at the content mirror
+      when: system_cfg.content.url | length > 0
+      ansible.builtin.copy:
+        dest: /etc/pacman.d/mirrorlist
+        content: "Server = {{ system_cfg.content.url }}/$repo/os/$arch\n"
+        mode: "0644"
+
+    - name: Refresh Arch keyring in the live environment
+      ansible.builtin.command: pacman -Sy --noconfirm archlinux-keyring
+      environment:
+        http_proxy: "{{ system_cfg.content.proxy }}"
+        https_proxy: "{{ system_cfg.content.proxy }}"
+      register: bootstrap_arch_keyring
+      changed_when: bootstrap_arch_keyring.rc == 0
+
+    - name: Install Arch base system
+      ansible.builtin.command: >-
+        pacstrap /mnt {{ bootstrap_archlinux_packages | join(' ') }}
+      environment:
+        http_proxy: "{{ system_cfg.content.proxy }}"
+        https_proxy: "{{ system_cfg.content.proxy }}"
+      register: bootstrap_result
+      changed_when: bootstrap_result.rc == 0
+
+    - name: Persist the content mirror in the installed system
+      when: system_cfg.content.url | length > 0
+      ansible.builtin.copy:
+        dest: /mnt/etc/pacman.d/mirrorlist
+        content: "Server = {{ system_cfg.content.url }}/$repo/os/$arch\n"
+        mode: "0644"

roles/bootstrap/tasks/debian.yml

@@ -43,7 +43,10 @@
         debootstrap --keyring=/usr/share/keyrings/debian-archive-keyring.gpg
         --include={{ bootstrap_debian_base_csv }}
         {{ bootstrap_debian_release }} /mnt
-        {{ system_cfg.mirror | default('http://deb.debian.org/debian', true) }}
+        {{ system_cfg.content.url }}
+      environment:
+        http_proxy: "{{ system_cfg.content.proxy }}"
+        https_proxy: "{{ system_cfg.content.proxy }}"
       register: bootstrap_debian_base_result
       changed_when: bootstrap_debian_base_result.rc == 0
 
@@ -60,6 +63,10 @@
           Acquire::Retries "3";
           Acquire::http::Pipeline-Depth "10";
           APT::Install-Recommends "false";
+          {% if system_cfg.content.proxy | length > 0 %}
+          Acquire::http::Proxy "{{ system_cfg.content.proxy }}";
+          Acquire::https::Proxy "{{ system_cfg.content.proxy }}";
+          {% endif %}
         mode: "0644"
 
     - name: Update package lists

roles/bootstrap/tasks/rhel.yml

@@ -24,12 +24,14 @@
         - "'grub2-common' not in (bootstrap_result.stderr | default(''))"
 
     - name: Ensure chroot RHEL DVD directory exists
+      when: system_cfg.content.source != 'mirror'
       ansible.builtin.file:
         path: /mnt/usr/local/install/redhat/dvd
         state: directory
         mode: "0755"
 
     - name: Bind mount RHEL DVD into chroot
+      when: system_cfg.content.source != 'mirror'
       ansible.posix.mount:
         src: /usr/local/install/redhat/dvd
         path: /mnt/usr/local/install/redhat/dvd

roles/bootstrap/tasks/ubuntu.yml

@@ -42,7 +42,10 @@
         --keyring=/usr/share/keyrings/ubuntu-archive-keyring.gpg
         --include={{ bootstrap_ubuntu_base_csv }}
         {{ bootstrap_ubuntu_release }} /mnt
-        {{ system_cfg.mirror | default('http://archive.ubuntu.com/ubuntu', true) }}
+        {{ system_cfg.content.url }}
+      environment:
+        http_proxy: "{{ system_cfg.content.proxy }}"
+        https_proxy: "{{ system_cfg.content.proxy }}"
       register: bootstrap_ubuntu_base_result
       changed_when: bootstrap_ubuntu_base_result.rc == 0
 
@@ -59,6 +62,10 @@
           Acquire::Retries "3";
           Acquire::http::Pipeline-Depth "10";
           APT::Install-Recommends "false";
+          {% if system_cfg.content.proxy | length > 0 %}
+          Acquire::http::Proxy "{{ system_cfg.content.proxy }}";
+          Acquire::https::Proxy "{{ system_cfg.content.proxy }}";
+          {% endif %}
         mode: "0644"
 
     - name: Update package lists

roles/bootstrap/templates/debian.sources.list.j2

@@ -1,6 +1,6 @@
 # Managed by Ansible.
 {% set release = bootstrap_debian_release %}
-{% set mirror = system_cfg.mirror | default('http://deb.debian.org/debian', true) %}
+{% set mirror = system_cfg.content.url | default('http://deb.debian.org/debian', true) %}
 {% set components = 'main contrib non-free non-free-firmware' %}
 
 deb {{ mirror }} {{ release }} {{ components }}

roles/bootstrap/templates/ubuntu.sources.list.j2

@@ -1,6 +1,6 @@
 # Managed by Ansible.
 {% set release = bootstrap_ubuntu_release %}
-{% set mirror = system_cfg.mirror %}
+{% set mirror = system_cfg.content.url %}
 {% set components = 'main restricted universe multiverse' %}
 
 deb {{ mirror }} {{ release }} {{ components }}

roles/bootstrap/vars/main.yml

@@ -314,7 +314,6 @@ bootstrap_archlinux:
     - nfs-utils
     - ppp
     - python
-    - reflector
     - rsync
     - sudo
     - tldr
@@ -327,5 +326,6 @@ bootstrap_archlinux:
       (['openssh'] if system_cfg.features.ssh.enabled | bool else [])
       + (['iptables-nft'] if system_cfg.features.firewall.toolkit == 'nftables' and system_cfg.features.firewall.enabled | bool else [])
       + (['sbctl'] if system_cfg.features.secure_boot.enabled | bool else [])
+      + (['reflector'] if system_cfg.content.url | length == 0 else [])
       + (bootstrap_common_conditional | reject('equalto', 'nftables') | list)
     }}