enhance PHP configuration - add additional opcache settings and ensure apt keyring directory exists

tasks/main.yml

@@ -6,4 +6,5 @@
   include_tasks: install.yml
 
 - name: php | create fpm pools
-  include_tasks: fpm_pools.yml
+  include_tasks: fpm_pools.yml
+  when: php_pools is defined and php_pools | length > 0

tasks/requirements.yml

@@ -11,16 +11,33 @@
       - lsb-release
       - ca-certificates
       - curl
+      - gnupg
     state: present
 
-- name: php | add sury key
-  ansible.builtin.apt_key:
+- name: php | ensure apt keyring directory exists
+  ansible.builtin.file:
+    path: /usr/share/keyrings
+    state: directory
+    mode: '0755'
+
+- name: php | download Sury PHP GPG key (ASCII)
+  ansible.builtin.get_url:
     url: https://packages.sury.org/php/apt.gpg
-    keyring: /etc/apt/trusted.gpg.d/php.gpg
-    state: present
+    dest: /usr/share/keyrings/sury-php-archive-keyring.asc
+    mode: '0644'
 
-- name: php | add sury repository
+- name: php | dearmor Sury PHP GPG key
+  ansible.builtin.command:
+    cmd: gpg --dearmor -o /usr/share/keyrings/sury-php-archive-keyring.gpg /usr/share/keyrings/sury-php-archive-keyring.asc
+  args:
+    creates: /usr/share/keyrings/sury-php-archive-keyring.gpg
+
+- name: php | add Sury PHP APT repository (signed-by)
   ansible.builtin.apt_repository:
-    repo: deb https://packages.sury.org/php/ {{ ansible_distribution_release }} main
+    repo: "deb [signed-by=/usr/share/keyrings/sury-php-archive-keyring.gpg] https://packages.sury.org/php/ {{ ansible_distribution_release }} main"
     state: present
     filename: php-sury
+
+- name: php | apt update cache after adding repo
+  ansible.builtin.apt:
+    update_cache: yes