diff --git a/update_immich.yml b/update_immich.yml index 0ac4067..559ce3a 100644 --- a/update_immich.yml +++ b/update_immich.yml @@ -8,7 +8,7 @@ become_method: sudo vars: - # --- Connection to VM (provided by Semaphore env vars) --- + # VM connection (provided by Semaphore env vars) vm_ip: "{{ lookup('env', 'VM_IP') }}" vm_user: "{{ lookup('env', 'VM_USER') }}" vm_pass: "{{ lookup('env', 'VM_PASS') }}" @@ -18,38 +18,88 @@ DEBUG: "{{ lookup('env', 'DEBUG') | default(0) | int }}" RETRIES: "{{ lookup('env', 'RETRIES') | default(25) | int }}" - # --- Immich specifics --- + # Immich specifics + immich_dir: "/opt/immich" immich_project: "immich" - - # Where compose file lives on the VM - immich_compose_dir: "/opt/immich" - immich_compose_file: "{{ immich_compose_dir }}/docker-compose.yml" - - # Official Immich compose URL (latest release) immich_compose_url: "https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml" - + immich_compose_file: "/opt/immich/docker-compose.yml" + immich_override_file: "/opt/immich/docker-compose.override.yml" immich_port: 2283 - # Optional external URL for controller-side readiness check - # Default to https://photos.martinfencl.eu/photos if IMMICH_URL is not set - immich_url: "{{ lookup('env', 'IMMICH_URL') | default('https://photos.martinfencl.eu/photos', true) }}" + # Optional external URL for controller-side readiness check (e.g., https://photos.example.com) + immich_url: "{{ lookup('env', 'IMMICH_URL') | default('', true) }}" + # Retry policy immich_retries: "{{ RETRIES }}" immich_delay: 2 - # Docker command prefix (consistent behavior and quiet hints) + # Docker command prefix (consistent behavior) docker_prefix: "unalias docker 2>/dev/null || true; DOCKER_CLI_HINTS=0; command docker" - # Commands to run on the target VM (quiet outputs) - # 1) Download latest docker-compose.yml from GitHub (with backup) - # 2) Pull images according to compose - # 3) Start / update stack - immich_commands: - - "cd {{ immich_compose_dir }} && wget -qO docker-compose.yml.new {{ immich_compose_url }} || true; if [ -s docker-compose.yml.new ]; then echo 'Downloaded new docker-compose.yml from GitHub (Immich latest).'; if [ -f docker-compose.yml ]; then cp docker-compose.yml docker-compose.yml.bak-$(date +%F_%H-%M-%S); echo 'Existing docker-compose.yml backed up.'; fi; mv docker-compose.yml.new docker-compose.yml; else echo 'WARNING: Failed to download a valid docker-compose.yml, keeping existing one.' >&2; rm -f docker-compose.yml.new 2>/dev/null || true; fi" - - "{{ docker_prefix }} compose -p {{ immich_project }} -f {{ immich_compose_file }} pull >/dev/null" - - "{{ docker_prefix }} compose -p {{ immich_project }} -f {{ immich_compose_file }} up -d --remove-orphans --force-recreate >/dev/null" - # - "{{ docker_prefix }} compose -p {{ immich_project }} -f {{ immich_compose_file }} up -d --remove-orphans >/dev/null" + # Compose command (always include override to keep local mounts separate from upstream compose) + immich_compose_cmd: >- + {{ docker_prefix }} compose + -p {{ immich_project }} + -f {{ immich_compose_file }} + -f {{ immich_override_file }} + # Commands to run on the target VM (quiet outputs) + immich_commands: + - "cd {{ immich_dir }} && test -f .env" + + - | + cd {{ immich_dir }} + mkdir -p backups + if [ -f docker-compose.yml ]; then + cp -a docker-compose.yml "backups/docker-compose.yml.$(date +%F_%H%M%S).bak" + fi + + - | + cd {{ immich_dir }} + # Download latest compose from Immich releases (requires curl or wget) + if command -v curl >/dev/null 2>&1; then + curl -fsSL -o docker-compose.yml "{{ immich_compose_url }}" + elif command -v wget >/dev/null 2>&1; then + wget -qO docker-compose.yml "{{ immich_compose_url }}" + else + echo "Neither curl nor wget is available on the VM." + exit 1 + fi + + - | + cd {{ immich_dir }} + # Create override file if missing (keep local mounts here so upstream compose can be replaced safely) + python3 - <<'PY' + # Write docker-compose.override.yml only if it doesn't exist + from pathlib import Path + + p = Path("docker-compose.override.yml") + if p.exists(): + raise SystemExit(0) + + content = """\ + # Local overrides for Immich (kept separate from upstream docker-compose.yml). + # If you want read-only mounts, append ':ro' to the right side. + services: + immich-server: + volumes: + - /mnt/nextcloud-howard-photos:/mnt/nextcloud-howard-photos + - /mnt/nextcloud-kamilkaprdelka-photos:/mnt/nextcloud-kamilkaprdelka-photos + """ + p.write_text(content, encoding="utf-8") + PY + + - | + cd {{ immich_dir }} + # Docker Engine <25 may not support healthcheck.start_interval; comment it out if present + server_major="$({{ docker_prefix }} version --format '{{ "{{.Server.Version}}" }}' 2>/dev/null | cut -d. -f1 || echo 0)" + if [ "${server_major:-0}" -lt 25 ]; then + sed -i -E 's/^([[:space:]]*)start_interval:/\1# start_interval:/' docker-compose.yml || true + fi + + - "cd {{ immich_dir }} && {{ immich_compose_cmd }} config >/dev/null" + - "cd {{ immich_dir }} && {{ immich_compose_cmd }} pull >/dev/null" + - "cd {{ immich_dir }} && {{ immich_compose_cmd }} up -d --remove-orphans >/dev/null" tasks: - name: Ensure sshpass is installed (for password-based SSH) # English comments @@ -58,7 +108,7 @@ state: present update_cache: yes - - name: Run Immich update commands on VM (via SSH) # use SSHPASS env, hide item value + - name: Run Immich update commands on VM (via SSH) # use SSHPASS env, hide item label ansible.builtin.command: argv: - sshpass @@ -81,7 +131,6 @@ register: immich_cmds changed_when: false no_log: "{{ DEBUG == 0 }}" - run_once: true # <<< přidat - name: Show outputs for each Immich command ansible.builtin.debug: @@ -104,18 +153,16 @@ loop_control: index_var: idx label: "cmd-{{ idx }}" - run_once: true # ------------------------- # Readiness checks (controller first, then VM fallback) # ------------------------- - - name: Immich | Wait for web UI (controller first, with retries) + - name: Immich | Wait for API ping (controller first, with retries) ansible.builtin.uri: - url: "{{ (immich_url | regex_replace('/$','')) + '/' }}" + url: "{{ (immich_url | regex_replace('/$','')) + '/api/server/ping' }}" method: GET return_content: true - # Validate TLS only when using https:// validate_certs: "{{ (immich_url | default('')) is match('^https://') }}" status_code: 200 register: immich_controller @@ -124,11 +171,11 @@ when: immich_url is defined and (immich_url | length) > 0 retries: "{{ immich_retries }}" delay: "{{ immich_delay }}" - until: immich_controller.status == 200 - failed_when: false # allow task to finish without failing the play + until: immich_controller.status == 200 and ('pong' in (immich_controller.content | default(''))) + failed_when: false changed_when: false - - name: Immich | VM-side fetch (HTML via Python, with retries) # use SSHPASS env here too + - name: Immich | VM-side ping (JSON via Python, with retries) ansible.builtin.command: argv: - sshpass @@ -143,10 +190,10 @@ - -lc - | python3 - <<'PY' - # Fetch Immich web UI from localhost and print HTML to stdout + # Ping Immich API from localhost and print response to stdout import urllib.request, sys try: - with urllib.request.urlopen("http://127.0.0.1:{{ immich_port }}/", timeout=15) as r: + with urllib.request.urlopen("http://127.0.0.1:{{ immich_port }}/api/server/ping", timeout=15) as r: sys.stdout.write(r.read().decode(errors='ignore')) except Exception: pass @@ -156,62 +203,15 @@ register: immich_vm changed_when: false failed_when: false - when: immich_controller.status | default(0) != 200 or immich_controller.content is not defined + when: immich_controller.status | default(0) != 200 retries: "{{ immich_retries }}" delay: "{{ immich_delay }}" - until: (immich_vm.stdout | default('') | trim | length) > 0 and ('Immich' in (immich_vm.stdout | default(''))) + until: (immich_vm.stdout | default('') | trim | length) > 0 and ('pong' in (immich_vm.stdout | default(''))) no_log: "{{ DEBUG == 0 }}" - - name: Immich | Choose homepage HTML (controller wins, else VM) # safe guard against empty result - ansible.builtin.set_fact: - immich_home_html: >- - {{ - ( - immich_controller.content - if (immich_controller is defined) - and ((immich_controller.status|default(0))==200) - and (immich_controller.content is defined) - else - (immich_vm.stdout | default('') | trim) - ) - }} - when: - - (immich_controller is defined and (immich_controller.status|default(0))==200 and (immich_controller.content is defined)) - or ((immich_vm.stdout | default('') | trim | length) > 0) - - name: Immich | Print concise summary ansible.builtin.debug: msg: >- - Immich web UI {{ 'reachable' if (immich_home_html is defined) else 'NOT reachable' }}. - Source={{ 'controller' if ((immich_controller is defined) and (immich_controller.status|default(0))==200 and (immich_controller.content is defined)) else 'vm' if (immich_vm.stdout|default('')|trim|length>0) else 'n/a' }}; - length={{ (immich_home_html | default('')) | length }}; - contains('Immich')={{ (immich_home_html is defined) and ('Immich' in immich_home_html) }} + Immich API ping {{ 'OK' if (('pong' in (immich_controller.content|default(''))) or ('pong' in (immich_vm.stdout|default('')))) else 'NOT OK' }}. + Source={{ 'controller' if (immich_controller.status|default(0))==200 else 'vm' if (immich_vm.stdout|default('')|trim|length>0) else 'n/a' }}. when: DEBUG == 1 - - - name: Immich | Web UI unavailable (after retries) - ansible.builtin.debug: - msg: "Immich web není dostupný ani po pokusech." - when: immich_home_html is not defined and DEBUG == 1 - - # Optional detailed dump (short excerpt only) - - name: Immich | HTML excerpt (debug) - ansible.builtin.debug: - msg: "{{ (immich_home_html | default(''))[:500] }}" - when: immich_home_html is defined and DEBUG == 1 - - # ------------------------- - # Final assertion: controller URL must be reachable - # ------------------------- - - - name: Immich | Assert controller URL reachable (if configured) - ansible.builtin.assert: - that: - - > - not (immich_url is defined and (immich_url | length) > 0) - or - ( - immich_controller is defined - and (immich_controller.status | default(0)) == 200 - ) - fail_msg: "Immich controller URL {{ immich_url }} is NOT reachable with HTTP 200 after retries." - success_msg: "Immich controller URL {{ immich_url }} is reachable with HTTP 200." diff --git a/update_immich_old.yml b/update_immich_old.yml new file mode 100644 index 0000000..0ac4067 --- /dev/null +++ b/update_immich_old.yml @@ -0,0 +1,217 @@ +# update_immich.yml + +- name: Update Immich on VM via Proxmox + hosts: linux_servers + gather_facts: false + become: true + become_user: root + become_method: sudo + + vars: + # --- Connection to VM (provided by Semaphore env vars) --- + vm_ip: "{{ lookup('env', 'VM_IP') }}" + vm_user: "{{ lookup('env', 'VM_USER') }}" + vm_pass: "{{ lookup('env', 'VM_PASS') }}" + use_sudo: false + + # --- Debug mode (controlled via Semaphore variable) --- + DEBUG: "{{ lookup('env', 'DEBUG') | default(0) | int }}" + RETRIES: "{{ lookup('env', 'RETRIES') | default(25) | int }}" + + # --- Immich specifics --- + immich_project: "immich" + + # Where compose file lives on the VM + immich_compose_dir: "/opt/immich" + immich_compose_file: "{{ immich_compose_dir }}/docker-compose.yml" + + # Official Immich compose URL (latest release) + immich_compose_url: "https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml" + + immich_port: 2283 + + # Optional external URL for controller-side readiness check + # Default to https://photos.martinfencl.eu/photos if IMMICH_URL is not set + immich_url: "{{ lookup('env', 'IMMICH_URL') | default('https://photos.martinfencl.eu/photos', true) }}" + + immich_retries: "{{ RETRIES }}" + immich_delay: 2 + + # Docker command prefix (consistent behavior and quiet hints) + docker_prefix: "unalias docker 2>/dev/null || true; DOCKER_CLI_HINTS=0; command docker" + + # Commands to run on the target VM (quiet outputs) + # 1) Download latest docker-compose.yml from GitHub (with backup) + # 2) Pull images according to compose + # 3) Start / update stack + immich_commands: + - "cd {{ immich_compose_dir }} && wget -qO docker-compose.yml.new {{ immich_compose_url }} || true; if [ -s docker-compose.yml.new ]; then echo 'Downloaded new docker-compose.yml from GitHub (Immich latest).'; if [ -f docker-compose.yml ]; then cp docker-compose.yml docker-compose.yml.bak-$(date +%F_%H-%M-%S); echo 'Existing docker-compose.yml backed up.'; fi; mv docker-compose.yml.new docker-compose.yml; else echo 'WARNING: Failed to download a valid docker-compose.yml, keeping existing one.' >&2; rm -f docker-compose.yml.new 2>/dev/null || true; fi" + - "{{ docker_prefix }} compose -p {{ immich_project }} -f {{ immich_compose_file }} pull >/dev/null" + - "{{ docker_prefix }} compose -p {{ immich_project }} -f {{ immich_compose_file }} up -d --remove-orphans --force-recreate >/dev/null" + # - "{{ docker_prefix }} compose -p {{ immich_project }} -f {{ immich_compose_file }} up -d --remove-orphans >/dev/null" + + + tasks: + - name: Ensure sshpass is installed (for password-based SSH) # English comments + ansible.builtin.apt: + name: sshpass + state: present + update_cache: yes + + - name: Run Immich update commands on VM (via SSH) # use SSHPASS env, hide item value + ansible.builtin.command: + argv: + - sshpass + - -e + - ssh + - -o + - StrictHostKeyChecking=no + - -o + - ConnectTimeout=15 + - "{{ vm_user }}@{{ vm_ip }}" + - bash + - -lc + - "{{ ('sudo ' if use_sudo else '') + item }}" + environment: + SSHPASS: "{{ vm_pass }}" + loop: "{{ immich_commands }}" + loop_control: + index_var: idx + label: "cmd-{{ idx }}" + register: immich_cmds + changed_when: false + no_log: "{{ DEBUG == 0 }}" + run_once: true # <<< přidat + + - name: Show outputs for each Immich command + ansible.builtin.debug: + msg: | + CMD: {{ item.item }} + RC: {{ item.rc }} + STDOUT: + {{ (item.stdout | default('')).strip() }} + STDERR: + {{ (item.stderr | default('')).strip() }} + loop: "{{ immich_cmds.results }}" + when: DEBUG == 1 + + - name: Fail play if any Immich command failed + ansible.builtin.assert: + that: "item.rc == 0" + fail_msg: "Immich update failed on VM: {{ item.item }} (rc={{ item.rc }})" + success_msg: "All Immich update commands succeeded." + loop: "{{ immich_cmds.results }}" + loop_control: + index_var: idx + label: "cmd-{{ idx }}" + run_once: true + + # ------------------------- + # Readiness checks (controller first, then VM fallback) + # ------------------------- + + - name: Immich | Wait for web UI (controller first, with retries) + ansible.builtin.uri: + url: "{{ (immich_url | regex_replace('/$','')) + '/' }}" + method: GET + return_content: true + # Validate TLS only when using https:// + validate_certs: "{{ (immich_url | default('')) is match('^https://') }}" + status_code: 200 + register: immich_controller + delegate_to: localhost + run_once: true + when: immich_url is defined and (immich_url | length) > 0 + retries: "{{ immich_retries }}" + delay: "{{ immich_delay }}" + until: immich_controller.status == 200 + failed_when: false # allow task to finish without failing the play + changed_when: false + + - name: Immich | VM-side fetch (HTML via Python, with retries) # use SSHPASS env here too + ansible.builtin.command: + argv: + - sshpass + - -e + - ssh + - -o + - StrictHostKeyChecking=no + - -o + - ConnectTimeout=15 + - "{{ vm_user }}@{{ vm_ip }}" + - bash + - -lc + - | + python3 - <<'PY' + # Fetch Immich web UI from localhost and print HTML to stdout + import urllib.request, sys + try: + with urllib.request.urlopen("http://127.0.0.1:{{ immich_port }}/", timeout=15) as r: + sys.stdout.write(r.read().decode(errors='ignore')) + except Exception: + pass + PY + environment: + SSHPASS: "{{ vm_pass }}" + register: immich_vm + changed_when: false + failed_when: false + when: immich_controller.status | default(0) != 200 or immich_controller.content is not defined + retries: "{{ immich_retries }}" + delay: "{{ immich_delay }}" + until: (immich_vm.stdout | default('') | trim | length) > 0 and ('Immich' in (immich_vm.stdout | default(''))) + no_log: "{{ DEBUG == 0 }}" + + - name: Immich | Choose homepage HTML (controller wins, else VM) # safe guard against empty result + ansible.builtin.set_fact: + immich_home_html: >- + {{ + ( + immich_controller.content + if (immich_controller is defined) + and ((immich_controller.status|default(0))==200) + and (immich_controller.content is defined) + else + (immich_vm.stdout | default('') | trim) + ) + }} + when: + - (immich_controller is defined and (immich_controller.status|default(0))==200 and (immich_controller.content is defined)) + or ((immich_vm.stdout | default('') | trim | length) > 0) + + - name: Immich | Print concise summary + ansible.builtin.debug: + msg: >- + Immich web UI {{ 'reachable' if (immich_home_html is defined) else 'NOT reachable' }}. + Source={{ 'controller' if ((immich_controller is defined) and (immich_controller.status|default(0))==200 and (immich_controller.content is defined)) else 'vm' if (immich_vm.stdout|default('')|trim|length>0) else 'n/a' }}; + length={{ (immich_home_html | default('')) | length }}; + contains('Immich')={{ (immich_home_html is defined) and ('Immich' in immich_home_html) }} + when: DEBUG == 1 + + - name: Immich | Web UI unavailable (after retries) + ansible.builtin.debug: + msg: "Immich web není dostupný ani po pokusech." + when: immich_home_html is not defined and DEBUG == 1 + + # Optional detailed dump (short excerpt only) + - name: Immich | HTML excerpt (debug) + ansible.builtin.debug: + msg: "{{ (immich_home_html | default(''))[:500] }}" + when: immich_home_html is defined and DEBUG == 1 + + # ------------------------- + # Final assertion: controller URL must be reachable + # ------------------------- + + - name: Immich | Assert controller URL reachable (if configured) + ansible.builtin.assert: + that: + - > + not (immich_url is defined and (immich_url | length) > 0) + or + ( + immich_controller is defined + and (immich_controller.status | default(0)) == 200 + ) + fail_msg: "Immich controller URL {{ immich_url }} is NOT reachable with HTTP 200 after retries." + success_msg: "Immich controller URL {{ immich_url }} is reachable with HTTP 200."