edit

update_immich.yml

@@ -60,7 +60,7 @@
       ansible.builtin.command:
         argv:
           - sshpass
-          - -e                     # read password from SSHPASS environment
+          - -e
           - ssh
           - -o
           - StrictHostKeyChecking=no
@@ -71,14 +71,15 @@
           - -lc
           - "{{ ('sudo ' if use_sudo else '') + item }}"
       environment:
-        SSHPASS: "{{ vm_pass }}"    # supply password via environment
+        SSHPASS: "{{ vm_pass }}"
       loop: "{{ immich_commands }}"
       loop_control:
-        index_var: idx              # capture loop index
+        index_var: idx
-        label: "cmd-{{ idx }}"      # avoid printing full command in (item=...) line
+        label: "cmd-{{ idx }}"
       register: immich_cmds
       changed_when: false
-      no_log: "{{ DEBUG == 0 }}"    # hide outputs and env when not debugging
+      no_log: "{{ DEBUG == 0 }}"
+      run_once: true   # <<< přidat
 
     - name: Show outputs for each Immich command
       ansible.builtin.debug:
@@ -92,7 +93,7 @@
       loop: "{{ immich_cmds.results }}"
       when: DEBUG == 1
 
-    - name: Fail play if any Immich command failed  # also hide item label
+    - name: Fail play if any Immich command failed
       ansible.builtin.assert:
         that: "item.rc == 0"
         fail_msg: "Immich update failed on VM: {{ item.item }} (rc={{ item.rc }})"
@@ -101,6 +102,7 @@
       loop_control:
         index_var: idx
         label: "cmd-{{ idx }}"
+      run_once: true
 
     # -------------------------
     # Readiness checks (controller first, then VM fallback)