Disable login during deployment

ansible/roles/firstboot/files/ansible_payload/roles/cleanup/tasks/main.yml

@@ -2,6 +2,19 @@
   ansible.builtin.cron:
     name: firstboot
     state: absent
+- name: Restore extra tty
+  ansible.builtin.lineinfile:
+    path: /etc/systemd/logind.conf
+    regexp: "{{ item.regexp }}"
+    line: "{{ item.line }}"
+  loop:
+  - { regexp: '^NAutoVTs=', line: '#NAutoVTs=6'}    
+  - { regexp: '^ReserveVT=', line: '#ReserveVT=6'}
+- name: Unmask getty@tty1 service
+  ansible.builtin.systemd:
+    name: getty@tty1
+    enabled: yes
+    masked: no
 - name: Reboot host
   ansible.builtin.shell:
     cmd: /usr/sbin/reboot now

ansible/roles/os/tasks/main.yml

@@ -1,3 +1,6 @@
+- name: Disable tty logins
+  import_tasks: tty.yml
+
 - name: Remove snapd
   import_tasks: snapd.yml
 

ansible/roles/os/tasks/packages.yml

@@ -11,5 +11,5 @@
     update_cache: yes
 - name: Cleanup
   ansible.builtin.apt:
-    autoclean: yes
     autoremove: yes
+    purge: yes

ansible/roles/os/tasks/snapd.yml

@@ -3,6 +3,14 @@
     name: snapd
     state: absent
     purge: yes
+- name: Delete leftover files
+  ansible.builtin.file:
+    path: /root/snapd
+    state: absent
+- name: Hold snapd package
+  ansible.builtin.dpkg_selections:
+    name: snapd
+    selection: hold
 - name: Reload systemd unit configurations
   ansible.builtin.systemd:
     daemon_reload: yes

ansible/roles/os/tasks/tty.yml

@@ -0,0 +1,13 @@
+- name: Disable extra tty
+  ansible.builtin.lineinfile:
+    path: /etc/systemd/logind.conf
+    regexp: "{{ item.regexp }}"
+    line: "{{ item.line }}"
+  loop:
+  - { regexp: '^#NAutoVTs=', line: 'NAutoVTs=1'}    
+  - { regexp: '^#ReserveVT=', line: 'ReserveVT=11'}
+- name: Mask getty@tty1 service
+  ansible.builtin.systemd:
+    name: getty@tty1
+    enabled: no
+    masked: yes