From 7af00d671faeb876bfb90297839825c14b569acf Mon Sep 17 00:00:00 2001
From: "martin.fencl" <martin@martinfencl.eu>
Date: Thu, 6 Aug 2026 18:18:36 +0200
Subject: [PATCH] .

---
 nextcloud/check_stack_nextcloud.yml | 150 +++++++++++++++-------------
 1 file changed, 81 insertions(+), 69 deletions(-)

diff --git a/nextcloud/check_stack_nextcloud.yml b/nextcloud/check_stack_nextcloud.yml
index 5462976..5deb99e 100644
--- a/nextcloud/check_stack_nextcloud.yml
+++ b/nextcloud/check_stack_nextcloud.yml
@@ -8,7 +8,10 @@
   become_method: sudo
 
   vars:
+    # vm_pass is stored in Semaphore as a secret environment variable.
     vm_password: "{{ lookup('ansible.builtin.env', 'vm_pass') }}"
+
+    # Other values are loaded directly from Semaphore Extra variables.
     vm_use_sudo: "{{ use_sudo | default(false) | bool }}"
 
     nextcloud_container: "nextcloud"
@@ -20,71 +23,71 @@
     collabora_url: "https://collabora.martinfencl.eu/"
     collabora_discovery_url: "https://collabora.martinfencl.eu/hosting/discovery"
 
-        vm_commands:
-          - name: Run Nextcloud cron
-            command: >-
-              docker exec -u www-data
-              {{ nextcloud_container }}
-              php -f /var/www/html/cron.php
+    vm_commands:
+      - name: Run Nextcloud cron
+        command: >-
+          docker exec -u www-data
+          {{ nextcloud_container | quote }}
+          php -f /var/www/html/cron.php
 
-          - name: Update Nextcloud applications
-            command: >-
-              docker exec -u www-data
-              {{ nextcloud_container }}
-              php occ app:update --all
+      - name: Update Nextcloud applications
+        command: >-
+          docker exec -u www-data
+          {{ nextcloud_container | quote }}
+          php occ app:update --all
 
-          - name: Run Nextcloud maintenance repair
-            command: >-
-              docker exec -u www-data
-              {{ nextcloud_container }}
-              php occ maintenance:repair --include-expensive
+      - name: Run Nextcloud maintenance repair
+        command: >-
+          docker exec -u www-data
+          {{ nextcloud_container | quote }}
+          php occ maintenance:repair --include-expensive
 
-          - name: Read Nextcloud status
-            command: >-
-              docker exec -u www-data
-              {{ nextcloud_container }}
-              php occ status
+      - name: Read Nextcloud status
+        command: >-
+          docker exec -u www-data
+          {{ nextcloud_container | quote }}
+          php occ status
 
-          - name: Check required containers
-            command: >-
-              for container in
-              {{ nextcloud_container | quote }}
-              {{ nextcloud_db_container | quote }}
-              {{ redis_container | quote }};
-              do
-                state="$(docker inspect --format '{% raw %}{{.State.Running}}{% endraw %}' "${container}" 2>/dev/null)";
-                if [ "${state}" != "true" ]; then
-                  echo "Container ${container} is not running" >&2;
-                  exit 1;
-                fi;
-              done
+      - name: Check required containers
+        command: >-
+          for container in
+          {{ nextcloud_container | quote }}
+          {{ nextcloud_db_container | quote }}
+          {{ redis_container | quote }};
+          do
+            state="$(docker inspect --format '{% raw %}{{.State.Running}}{% endraw %}' "${container}" 2>/dev/null)";
+            if [ "${state}" != "true" ]; then
+              echo "Container ${container} is not running" >&2;
+              exit 1;
+            fi;
+          done
 
-          - name: Check MariaDB readiness
-            command: >-
-              docker exec
-              {{ nextcloud_db_container }}
-              sh -c
-              'mariadb-admin ping -h 127.0.0.1 --silent 2>/dev/null
-              || mysqladmin ping -h 127.0.0.1 --silent 2>/dev/null'
+      - name: Check MariaDB readiness
+        command: >-
+          docker exec
+          {{ nextcloud_db_container | quote }}
+          sh -c
+          'mariadb-admin ping -h 127.0.0.1 --silent 2>/dev/null
+          || mysqladmin ping -h 127.0.0.1 --silent 2>/dev/null'
 
-          - name: Check Redis readiness
-            command: >-
-              set -o pipefail;
-              docker exec
-              {{ redis_container }}
-              redis-cli -h 127.0.0.1 ping
-              | grep -qx PONG
+      - name: Check Redis readiness
+        command: >-
+          set -o pipefail;
+          docker exec
+          {{ redis_container | quote }}
+          redis-cli -h 127.0.0.1 ping
+          | grep -qx PONG
 
-          - name: Check Nextcloud local status endpoint
-            command: >-
-              set -o pipefail;
-              curl
-              --fail
-              --silent
-              --show-error
-              --max-time 15
-              {{ nextcloud_local_status_url | quote }}
-              | grep -q '"installed":true'
+      - name: Check Nextcloud local status endpoint
+        command: >-
+          set -o pipefail;
+          curl
+          --fail
+          --silent
+          --show-error
+          --max-time 15
+          {{ nextcloud_local_status_url | quote }}
+          | grep -q '"installed":true'
 
   pre_tasks:
     - name: Validate VM connection variables
@@ -94,7 +97,7 @@
           - vm_ip | string | trim | length > 0
           - vm_user is defined
           - vm_user | string | trim | length > 0
-          - vm_password | length > 0
+          - vm_password | string | length > 0
         fail_msg: >-
           Missing vm_ip, vm_user or vm_pass.
           Check the attached Semaphore Variable Group.
@@ -169,6 +172,9 @@
           Command: {{ item.item.command }}
           RC: {{ item.rc }}
 
+          STDOUT:
+          {{ item.stdout | default('') | trim }}
+
           STDERR:
           {{ item.stderr | default('') | trim }}
         quiet: true
@@ -189,9 +195,9 @@
       run_once: true
       changed_when: false
       failed_when: >-
-        collabora_root.status | default(0) != 200
+        (collabora_root.status | default(0) | int != 200)
         or
-        'OK' not in (collabora_root.content | default(''))
+        ('OK' not in (collabora_root.content | default('')))
 
     - name: Check external Collabora discovery endpoint
       ansible.builtin.uri:
@@ -206,19 +212,25 @@
       run_once: true
       changed_when: false
       failed_when: >-
-        collabora_discovery.status | default(0) != 200
+        (collabora_discovery.status | default(0) | int != 200)
         or
-        '<wopi-discovery' not in
-        (collabora_discovery.content | default(''))
+        ('<wopi-discovery' not in
+        (collabora_discovery.content | default('')))
 
     - name: Show final health summary
       ansible.builtin.debug:
         msg: |
-          Nextcloud VM checks: OK
-          Nextcloud containers: OK
-          MariaDB: OK
-          Redis: OK
-          Nextcloud local HTTP: OK
+          Nextcloud VM connection: OK
+          Nextcloud cron: OK
+          Nextcloud applications: OK
+          Nextcloud maintenance repair: OK
+          Nextcloud status: OK
+          Nextcloud container: OK
+          MariaDB container: OK
+          Redis container: OK
+          MariaDB readiness: OK
+          Redis readiness: OK
+          Nextcloud local HTTP endpoint: OK
           Collabora root endpoint: OK
           Collabora discovery endpoint: OK
       run_once: true
\ No newline at end of file