From 8b6eec595c6061b0888bcdc3b6fa6c74fa31d409 Mon Sep 17 00:00:00 2001 From: "martin.fencl" Date: Mon, 24 Nov 2025 21:28:04 +0100 Subject: [PATCH] Add Immich update playbook for Proxmox VM management --- inv_linuxes | 3 +- update_immich.yml | 186 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 188 insertions(+), 1 deletion(-) create mode 100644 update_immich.yml diff --git a/inv_linuxes b/inv_linuxes index 1da3504..7f3fb54 100644 --- a/inv_linuxes +++ b/inv_linuxes @@ -1,2 +1,3 @@ [linux_servers] -proxmox ansible_host=192.168.69.2 \ No newline at end of file +proxmox ansible_host=192.168.69.2 +proxmox ansible_host2=192.168.69.2 \ No newline at end of file diff --git a/update_immich.yml b/update_immich.yml new file mode 100644 index 0000000..9c60296 --- /dev/null +++ b/update_immich.yml @@ -0,0 +1,186 @@ +# update_immich.yml + +- name: Update Immich on VM via Proxmox + hosts: proxmox + gather_facts: false + become: true + become_user: root + become_method: sudo + + vars: + # --- Connection to VM (provided by Semaphore env vars) --- + vm_ip: "{{ lookup('env', 'VM_IP') }}" + vm_user: "{{ lookup('env', 'VM_USER') }}" + vm_pass: "{{ lookup('env', 'VM_PASS') }}" + use_sudo: false + + # --- Debug mode (controlled via Semaphore variable) --- + DEBUG: "{{ lookup('env', 'DEBUG') | default(0) | int }}" + RETRIES: "{{ lookup('env', 'RETRIES') | default(25) | int }}" + + # --- Immich specifics --- + immich_project: "immich" + immich_compose_file: "/opt/immich/docker-compose.yml" + immich_port: 2283 + + # Optional external URL for controller-side readiness check + # e.g. https://immich.martinfencl.eu/photos + immich_url: "{{ lookup('env', 'IMMICH_URL') | default('', true) }}" + + immich_retries: "{{ RETRIES }}" + immich_delay: 2 + + # Docker command prefix (consistent behavior and quiet hints) + docker_prefix: "unalias docker 2>/dev/null || true; DOCKER_CLI_HINTS=0; command docker" + + # Commands to run on the target VM (quiet outputs) + # Uses the version in docker-compose.yml (.env -> IMMICH_VERSION or default "release") + immich_commands: + - "{{ docker_prefix }} compose -p {{ immich_project }} -f {{ immich_compose_file }} pull >/dev/null" + - "{{ docker_prefix }} compose -p {{ immich_project }} -f {{ immich_compose_file }} up -d --remove-orphans >/dev/null" + + tasks: + - name: Ensure sshpass is installed (for password-based SSH) # English comments + ansible.builtin.apt: + name: sshpass + state: present + update_cache: yes + + - name: Run Immich update commands on VM (via SSH) # use SSHPASS env, hide item value + ansible.builtin.command: + argv: + - sshpass + - -e # read password from SSHPASS environment + - ssh + - -o + - StrictHostKeyChecking=no + - -o + - ConnectTimeout=15 + - "{{ vm_user }}@{{ vm_ip }}" + - bash + - -lc + - "{{ ('sudo ' if use_sudo else '') + item }}" + environment: + SSHPASS: "{{ vm_pass }}" # supply password via environment + loop: "{{ immich_commands }}" + loop_control: + index_var: idx # capture loop index + label: "cmd-{{ idx }}" # avoid printing full command in (item=...) line + register: immich_cmds + changed_when: false + no_log: "{{ DEBUG == 0 }}" # hide outputs and env when not debugging + + - name: Show outputs for each Immich command + ansible.builtin.debug: + msg: | + CMD: {{ item.item }} + RC: {{ item.rc }} + STDOUT: + {{ (item.stdout | default('')).strip() }} + STDERR: + {{ (item.stderr | default('')).strip() }} + loop: "{{ immich_cmds.results }}" + when: DEBUG == 1 + + - name: Fail play if any Immich command failed # also hide item label + ansible.builtin.assert: + that: "item.rc == 0" + fail_msg: "Immich update failed on VM: {{ item.item }} (rc={{ item.rc }})" + success_msg: "All Immich update commands succeeded." + loop: "{{ immich_cmds.results }}" + loop_control: + index_var: idx + label: "cmd-{{ idx }}" + + # ------------------------- + # Readiness checks (controller first, then VM fallback) + # ------------------------- + + - name: Immich | Wait for web UI (controller first, with retries) + ansible.builtin.uri: + url: "{{ (immich_url | regex_replace('/$','')) + '/' }}" + method: GET + return_content: true + # Validate TLS only when using https:// + validate_certs: "{{ (immich_url | default('')) is match('^https://') }}" + status_code: 200 + register: immich_controller + delegate_to: localhost + run_once: true + when: immich_url is defined and (immich_url | length) > 0 + retries: "{{ immich_retries }}" + delay: "{{ immich_delay }}" + until: immich_controller.status == 200 + failed_when: false + changed_when: false + + - name: Immich | VM-side fetch (HTML via Python, with retries) # use SSHPASS env here too + ansible.builtin.command: + argv: + - sshpass + - -e + - ssh + - -o + - StrictHostKeyChecking=no + - -o + - ConnectTimeout=15 + - "{{ vm_user }}@{{ vm_ip }}" + - bash + - -lc + - | + python3 - <<'PY' + # Fetch Immich web UI from localhost and print HTML to stdout + import urllib.request, sys + try: + with urllib.request.urlopen("http://127.0.0.1:{{ immich_port }}/", timeout=15) as r: + sys.stdout.write(r.read().decode(errors='ignore')) + except Exception: + pass + PY + environment: + SSHPASS: "{{ vm_pass }}" + register: immich_vm + changed_when: false + failed_when: false + when: immich_controller.status | default(0) != 200 or immich_controller.content is not defined + retries: "{{ immich_retries }}" + delay: "{{ immich_delay }}" + until: (immich_vm.stdout | default('') | trim | length) > 0 and ('Immich' in (immich_vm.stdout | default(''))) + no_log: "{{ DEBUG == 0 }}" + + - name: Immich | Choose homepage HTML (controller wins, else VM) # safe guard against empty result + ansible.builtin.set_fact: + immich_home_html: >- + {{ + ( + immich_controller.content + if (immich_controller is defined) + and ((immich_controller.status|default(0))==200) + and (immich_controller.content is defined) + else + (immich_vm.stdout | default('') | trim) + ) + }} + when: + - (immich_controller is defined and (immich_controller.status|default(0))==200 and (immich_controller.content is defined)) + or ((immich_vm.stdout | default('') | trim | length) > 0) + + - name: Immich | Print concise summary + ansible.builtin.debug: + msg: >- + Immich web UI {{ 'reachable' if (immich_home_html is defined) else 'NOT reachable' }}. + Source={{ 'controller' if ((immich_controller is defined) and (immich_controller.status|default(0))==200 and (immich_controller.content is defined)) else 'vm' if (immich_vm.stdout|default('')|trim|length>0) else 'n/a' }}; + length={{ (immich_home_html | default('')) | length }}; + contains('Immich')={{ (immich_home_html is defined) and ('Immich' in immich_home_html) }} + when: DEBUG == 1 + + - name: Immich | Web UI unavailable (after retries) + ansible.builtin.debug: + msg: "Immich web není dostupný ani po pokusech." + when: immich_home_html is not defined and DEBUG == 1 + + # Optional detailed dump (short excerpt only) + - name: Immich | HTML excerpt (debug) + ansible.builtin.debug: + msg: "{{ (immich_home_html | default(''))[:500] }}" + when: immich_home_html is defined and DEBUG == 1