I was a bit put off by the very first thing being a download of unverified source code over a non-encrypted protocol, which was then run as root. Later worked o

I was a bit put off by the very first thing being a download of unverified source code over a non-encrypted protocol, which was then run as root. Later worked out that you only did that on the ansible server, not on every server you deploy, but still. The use of files in /tmp in the ansible rules is also asking for trouble (unless ansible goes to lengths to securely write to files in /tmp without eg following symlinks). debconf-set-selections can read from stdin, or you can put the file somewhere better.