Update mikrotikbackup_clean.yml

check_stack_nextcloud.yml

@@ -1,29 +0,0 @@
----
-- name: Upload and run stack health checks
-  hosts: proxmox
-  become: true
-
-  vars:
-    health_script_path: /data/compose/nextcloud/stack-health.sh
-
-  tasks:
-    - name: Upload stack-health.sh
-      ansible.builtin.copy:
-        src: files/stack-health.sh
-        dest: "{{ health_script_path }}"
-        mode: '0755'
-
-    - name: Run stack-health.sh
-      ansible.builtin.shell: "{{ health_script_path }}"
-      register: health
-      args:
-        executable: /bin/bash
-
-    - name: Show health output
-      ansible.builtin.debug:
-        msg: "{{ health.stdout | default('no stdout') }}"
-
-    - name: Fail if checks failed (rc != 0)
-      ansible.builtin.fail:
-        msg: "Health checks failed"
-      when: health.rc != 0

collabora_update.yml

@@ -1,30 +0,0 @@
----
-- name: Update Collabora (pull + recreate in same compose project)
-  hosts: proxmox
-  become: true
-
-  vars:
-    collabora_compose_path: /data/compose/nextcloud/collabora-only.yml
-    collabora_project_name: nextcloud-collabora   # based on your labels
-
-  tasks:
-    - name: Pull collabora/code:latest image
-      community.docker.docker_image:
-        name: collabora/code
-        tag: latest
-        source: pull
-
-    # Compose file contains only service "collabora", so this acts on that service only
-    - name: Compose pull (ensure freshest image)
-      community.docker.docker_compose_v2:
-        project_name: "{{ collabora_project_name }}"
-        files: ["{{ collabora_compose_path }}"]
-        pull: always
-        state: present
-
-    - name: Recreate collabora with new image
-      community.docker.docker_compose_v2:
-        project_name: "{{ collabora_project_name }}"
-        files: ["{{ collabora_compose_path }}"]
-        recreate: always
-        state: present

homarr.yml

@@ -0,0 +1,39 @@
+- name: Update Homarr
+  hosts: linux_servers
+  become: true
+  gather_facts: false
+
+  vars:
+    homarr_project: homarr
+    homarr_compose_file: /data/compose/homarr/docker-compose-homarr.yml
+    homarr_service: homarr
+    homarr_port: 7575
+
+  tasks:
+    - name: Pull latest Homarr image
+      community.docker.docker_compose_v2:
+        project_src: "{{ homarr_compose_file | dirname }}"
+        files:
+          - "{{ homarr_compose_file | basename }}"
+        pull: always
+
+    - name: Recreate Homarr service
+      community.docker.docker_compose_v2:
+        project_src: "{{ homarr_compose_file | dirname }}"
+        files:
+          - "{{ homarr_compose_file | basename }}"
+        services:
+          - "{{ homarr_service }}"
+        state: present
+        recreate: always
+
+    - name: Wait for Homarr port
+      ansible.builtin.wait_for:
+        host: 127.0.0.1
+        port: "{{ homarr_port }}"
+        timeout: 60
+
+    - name: Check Homarr HTTP endpoint
+      ansible.builtin.uri:
+        url: "http://127.0.0.1:{{ homarr_port }}/"
+        status_code: 200

initial_setup.yml

@@ -0,0 +1,111 @@
+---
+- name: Baseline user setup
+  hosts: all
+  become: true
+
+  vars:
+    users:
+      - name: automation
+        shell: /bin/bash
+        groups: []
+        sudo_nopasswd: true
+        ssh_keys:
+          - "ssh-ed25519 AAAAC3..."
+
+      - name: hellsos
+        shell: /bin/bash
+        groups: []
+        sudo_nopasswd: true
+        ssh_keys:
+          - "ssh-ed25519 AAAAC3..."
+
+      - name: jim
+        shell: /bin/bash
+        groups: []
+        sudo_nopasswd: true
+        ssh_keys:
+          - "ssh-ed25519 AAAAC3..."
+
+  tasks:
+
+    - name: Pick sudo group per distro
+      set_fact:
+        sudo_group: >-
+          {{ 'wheel'
+             if ansible_facts.os_family in
+             ['RedHat','Rocky','AlmaLinux','Fedora','OracleLinux','Suse']
+             else 'sudo' }}
+
+    - name: Ensure user exists
+      ansible.builtin.user:
+        name: "{{ item.name }}"
+        shell: "{{ item.shell }}"
+        groups: "{{ sudo_group }}"
+        append: true
+        create_home: true
+      loop: "{{ users }}"
+
+    - name: Enforce authorized SSH keys
+      ansible.builtin.authorized_key:
+        user: "{{ item.name }}"
+        key: "{{ item.ssh_keys | join('\n') }}"
+        exclusive: true
+      loop: "{{ users }}"
+
+    - name: Grant passwordless sudo
+      ansible.builtin.copy:
+        dest: "/etc/sudoers.d/{{ item.name }}"
+        mode: '0440'
+        content: "{{ item.name }} ALL=(ALL) NOPASSWD:ALL\n"
+        validate: 'visudo -cf %s'
+      loop: "{{ users }}"
+      when: item.sudo_nopasswd
+
+# ==============================
+# SECOND PLAY: SSH HARDENING
+# ==============================
+
+- name: SSH Hardening
+  hosts: all
+  become: true
+  tags: never,hardening
+
+  tasks:
+
+    - name: Detect if system is Proxmox
+      ansible.builtin.stat:
+        path: /usr/bin/pveversion
+      register: proxmox_check
+
+    - name: Ensure sshd_config.d directory exists
+      ansible.builtin.file:
+        path: /etc/ssh/sshd_config.d
+        state: directory
+
+    - name: Deploy SSH hardening config
+      ansible.builtin.copy:
+        dest: /etc/ssh/sshd_config.d/99-ansible-hardening.conf
+        mode: '0644'
+        content: |
+          PasswordAuthentication no
+          ChallengeResponseAuthentication no
+          PubkeyAuthentication yes
+          AuthenticationMethods publickey
+          UsePAM yes
+
+          {% if not proxmox_check.stat.exists %}
+          PermitRootLogin no
+          {% else %}
+          PermitRootLogin prohibit-password
+          {% endif %}
+        validate: 'sshd -t -f %s'
+      notify: Restart SSH
+
+  handlers:
+    - name: Restart SSH
+      ansible.builtin.service:
+        name: "{{ 'sshd'
+                  if ansible_facts.os_family in
+                  ['RedHat','Rocky','AlmaLinux','Fedora','OracleLinux','Suse']
+                  else 'ssh' }}"
+        state: restarted

inv_linuxes

@@ -1,2 +1,9 @@
 [linux_servers]
-proxmox ansible_host=192.168.69.2
+jimbuntu ansible_host=192.168.19.4
+jim_storage ansible_host=192.168.19.7
+portainer2_hellsos ansible_host=192.168.52.9
+portainernode_hellsos ansible_host=192.168.52.21
+portainernode2_jim ansible_host=192.168.19.8
+
+[local]
+localhost ansible_connection=local

inv_mikrotiks

@@ -1,2 +1,16 @@
-[mikrotiks]
-main_mikrotik_fencl ansible_host=192.168.69.1
+[mikrotik_routers]
+jim_main ansible_host=192.168.19.2
+jim_gw2 ansible_host=192.168.19.3
+hellsos ansible_host=192.168.40.1
+ewolet ansible_host=192.168.90.1
+Poli ansible_host=192.168.2.1
+Schmid ansible_host=192.168.177.1
+#Volf ansible_host=192.168.88.1
+fencl_home ansible_host=192.168.68.1
+fencl_tata ansible_host=192.168.69.1
+
+
+[mikrotik_routers:vars]
+ansible_connection=network_cli
+ansible_network_os=community.routeros.routeros
+ansible_command_timeout=15

mikrotikbackup.yml

@@ -33,7 +33,7 @@
         current_date: "{{ date_output.stdout }}"
 
     - name: Export router config
-      shell: timeout 15 ssh -o StrictHostKeyChecking=no {{ ansible_user }}@{{ ansible_host }} -p {{ ansible_port }} "/export"
+      shell: timeout 15 ssh -o StrictHostKeyChecking=no {{ ansible_user }}@{{ ansible_host }} -p {{ ansible_port }} "/export show-sensitive"
       register: export_output
       delegate_to: localhost
       when: system_identity.rc == 0
@@ -59,4 +59,4 @@
     - name: Remove backup file from router
       shell: timeout 15 ssh -o StrictHostKeyChecking=no {{ ansible_user }}@{{ ansible_host }} -p {{ ansible_port }} "/file remove {{ router_name }}-{{ current_date }}-backup.backup"
       delegate_to: localhost
-      when: system_identity.rc == 0
+      when: system_identity.rc == 0

mikrotikbackup_clean.yml

@@ -0,0 +1,108 @@
+- name: Backup and/or Upgrade MikroTik
+  hosts: mikrotik_routers
+  gather_facts: no
+
+  vars:
+    backup_dir: /opt/mikrotik_backups/
+
+  tasks:
+
+    # ----------------------------
+    # Always: identity + timestamp
+    # ----------------------------
+    - name: Get router identity
+      community.routeros.command:
+        commands: /system identity print
+      register: identity_raw
+      tags: always
+
+    - name: Parse router name
+      set_fact:
+        router_name: "{{ identity_raw.stdout[0].split(': ')[1] | trim }}"
+      tags: always
+
+    - name: Get timestamp
+      ansible.builtin.command: date +%Y-%m-%d_%H-%M-%S
+      register: date_out
+      delegate_to: localhost
+      tags: always
+
+    - name: Set timestamp fact
+      set_fact:
+        ts: "{{ date_out.stdout }}"
+      tags: always
+
+    # ----------------------------
+    # Backup (tag: backup)
+    # ----------------------------
+    - name: Ensure local backup directory exists
+      ansible.builtin.file:
+        path: "{{ backup_dir }}"
+        state: directory
+        mode: "0755"
+      delegate_to: localhost
+      tags: [backup, never]
+
+    - name: Export router config
+      community.routeros.command:
+        commands: /export terse show-sensitive
+      register: export_cfg
+      tags: [backup, never]
+
+    - name: Save export locally
+      ansible.builtin.copy:
+        content: "{{ export_cfg.stdout[0] }}"
+        dest: "{{ backup_dir }}/{{ router_name }}-{{ ts }}.rsc"
+      delegate_to: localhost
+      tags: [backup, never]
+
+    # ----------------------------
+    # Upgrade (tag: upgrade)
+    # ----------------------------
+    - name: Check current and latest available package versions
+      community.routeros.command:
+        commands: /system package update check-for-updates
+      register: update_check
+      tags: [upgrade, never]
+
+    - name: Parse installed and latest versions
+      set_fact:
+        installed_version: "{{ update_check.stdout[0] | regex_search('installed-version: ([\\d.]+)', '\\1') | first }}"
+        latest_version: "{{ update_check.stdout[0] | regex_search('latest-version: ([\\d.]+)', '\\1') | first }}"
+      tags: [upgrade, never]
+
+    - name: Skip upgrade if already on latest
+      ansible.builtin.debug:
+        msg: "Router {{ router_name }} is already on latest version {{ installed_version }}. Skipping upgrade."
+      when: installed_version == latest_version
+      tags: [upgrade, never]
+
+    - name: Trigger package download and install
+      community.routeros.command:
+        commands: /system package update install
+      register: upgrade_result
+      when: installed_version != latest_version
+      tags: [upgrade, never]
+
+    - name: Wait for router to come back online after reboot
+      ansible.builtin.wait_for_connection:
+        delay: 180
+        timeout: 300
+        sleep: 10
+      when:
+        - installed_version != latest_version
+        - upgrade_result is not failed
+      tags: [upgrade, never]
+
+    - name: Confirm upgraded version
+      community.routeros.command:
+        commands: /system resource print
+      register: post_upgrade_info
+      when: installed_version != latest_version
+      tags: [upgrade, never]
+
+    - name: Show post-upgrade RouterOS version
+      ansible.builtin.debug:
+        msg: "{{ post_upgrade_info.stdout[0] | regex_search('version: .+') }}"
+      when: installed_version != latest_version
+      tags: [upgrade, never]

nextcloud_backup.yml

@@ -1,38 +0,0 @@
----
-- name: Nextcloud backup (config, custom_apps, DB)
-  hosts: proxmox
-  become: true
-
-  vars:
-    nc_root: /data/compose/nextcloud
-    backup_dir: "{{ nc_root }}/backup-{{ ansible_date_time.date }}"
-    db_container: nextcloud-db
-
-  tasks:
-    - name: Ensure backup directory exists
-      ansible.builtin.file:
-        path: "{{ backup_dir }}"
-        state: directory
-        mode: '0755'
-
-    # Use archive module to create tar.gz directly on the remote host
-    - name: Archive config directory
-      ansible.builtin.archive:
-        path: "{{ nc_root }}/config"
-        dest: "{{ backup_dir }}/config.tgz"
-        format: gz
-
-    - name: Archive custom_apps directory
-      ansible.builtin.archive:
-        path: "{{ nc_root }}/custom_apps"
-        dest: "{{ backup_dir }}/custom_apps.tgz"
-        format: gz
-
-    # Dump DB directly to a file on the host (avoid shuttling dump through Ansible)
-    - name: Dump MariaDB from container to file
-      ansible.builtin.shell: |
-        set -euo pipefail
-        docker exec {{ db_container }} sh -c 'command -v mariadb-dump >/dev/null && mariadb-dump -u"$$MYSQL_USER" -p"$$MYSQL_PASSWORD" "$$MYSQL_DATABASE" || mysqldump -u"$$MYSQL_USER" -p"$$MYSQL_PASSWORD" "$$MYSQL_DATABASE"' \
-          > "{{ backup_dir }}/db.sql"
-      args:
-        executable: /bin/bash

nextcloud_upgrade.yml

@@ -1,112 +0,0 @@
----
-- name: Upgrade Nextcloud to 31-apache (pull + recreate + occ)
-  hosts: proxmox
-  become: true
-
-  vars:
-    nc_container: nextcloud
-    nc_image_tag: "31-apache"      # change to 32-apache when you step to next major
-    # Ports/volumes/env exactly as you use:
-    nc_root: /data/compose/nextcloud
-    nc_http_port: "8080:80"
-
-  tasks:
-    - name: Gather nextcloud container info
-      community.docker.docker_container_info:
-        name: "{{ nc_container }}"
-      register: nc_info
-
-    - name: Derive compose project & network from existing container
-      ansible.builtin.set_fact:
-        nc_project: "{{ nc_info.container.Config.Labels['com.docker.compose.project'] | default('nextcloud') }}"
-        nc_networks: "{{ (nc_info.container.NetworkSettings.Networks | default({})).keys() | list }}"
-        nc_net_primary: "{{ (nc_info.container.NetworkSettings.Networks | default({})).keys() | list | first }}"
-      when: nc_info.exists
-
-    - name: Enable maintenance mode
-      community.docker.docker_container_exec:
-        container: "{{ nc_container }}"
-        user: "www-data"
-        command: php occ maintenance:mode --on
-
-    - name: Render one-off compose for nextcloud (single-service)
-      ansible.builtin.copy:
-        dest: /tmp/nc.yml
-        mode: '0644'
-        content: |
-          name: {{ nc_project }}
-          services:
-            nextcloud:
-              image: nextcloud:{{ nc_image_tag }}
-              container_name: {{ nc_container }}
-              restart: unless-stopped
-              networks: [cloud]
-              ports: ["{{ nc_http_port }}"]
-              volumes:
-                - {{ nc_root }}/config:/var/www/html/config
-                - {{ nc_root }}/data:/var/www/html/data
-                - {{ nc_root }}/custom_apps:/var/www/html/custom_apps
-              environment:
-                TZ: Europe/Prague
-                MYSQL_DATABASE: nextcloud
-                MYSQL_USER: nextcloud
-                MYSQL_PASSWORD: dbpassword
-                MYSQL_HOST: nextclouddb
-                REDIS_HOST: redis
-                NEXTCLOUD_ADMIN_USER: root
-                NEXTCLOUD_ADMIN_PASSWORD: '1234SilneHeslo.-.'
-          networks:
-            cloud:
-              external: true
-              name: {{ nc_net_primary }}
-
-    - name: Pull the new Nextcloud image
-      community.docker.docker_compose_v2:
-        project_name: "{{ nc_project }}"
-        files: ["/tmp/nc.yml"]
-        pull: always
-        state: present
-
-    - name: Recreate Nextcloud with the new image
-      community.docker.docker_compose_v2:
-        project_name: "{{ nc_project }}"
-        files: ["/tmp/nc.yml"]
-        recreate: always
-        state: present
-
-    - name: Run occ upgrade
-      community.docker.docker_container_exec:
-        container: "{{ nc_container }}"
-        user: "www-data"
-        command: php occ upgrade
-
-    - name: Recommended DB maintenance (safe to run)
-      community.docker.docker_container_exec:
-        container: "{{ nc_container }}"
-        user: "www-data"
-        command: php occ db:add-missing-indices
-      ignore_errors: true
-
-    - name: Convert filecache bigint (safe)
-      community.docker.docker_container_exec:
-        container: "{{ nc_container }}"
-        user: "www-data"
-        command: php occ db:convert-filecache-bigint --no-interaction
-      ignore_errors: true
-
-    - name: Disable maintenance mode
-      community.docker.docker_container_exec:
-        container: "{{ nc_container }}"
-        user: "www-data"
-        command: php occ maintenance:mode --off
-
-    - name: Show status
-      community.docker.docker_container_exec:
-        container: "{{ nc_container }}"
-        user: "www-data"
-        command: php occ status
-      register: nc_status
-
-    - name: Print status
-      ansible.builtin.debug:
-        msg: "{{ nc_status.stdout | default('no output') }}"

redis_update.yml

@@ -1,75 +0,0 @@
----
-- name: Update Redis (pull + recreate, same stack)
-  hosts: proxmox
-  become: true
-
-  vars:
-    nc_container: nextcloud
-    redis_container: redis
-    redis_image: "redis:7-alpine"
-    nc_root: /data/compose/nextcloud
-
-  tasks:
-    - name: Gather nextcloud container info (to learn project + network)
-      community.docker.docker_container_info:
-        name: "{{ nc_container }}"
-      register: nc_info
-
-    - name: Derive compose project & network
-      ansible.builtin.set_fact:
-        nc_project: "{{ nc_info.container.Config.Labels['com.docker.compose.project'] | default('nextcloud') }}"
-        nc_net_primary: "{{ (nc_info.container.NetworkSettings.Networks | default({})).keys() | list | first }}"
-      when: nc_info.exists
-
-    - name: Enable maintenance mode (optional safety)
-      community.docker.docker_container_exec:
-        container: "{{ nc_container }}"
-        user: "www-data"
-        command: php occ maintenance:mode --on
-      ignore_errors: true
-
-    - name: Render one-off compose for Redis
-      ansible.builtin.copy:
-        dest: /tmp/redis.yml
-        mode: '0644'
-        content: |
-          name: {{ nc_project }}
-          services:
-            redis:
-              image: {{ redis_image }}
-              container_name: {{ redis_container }}
-              restart: unless-stopped
-              networks: [cloud]
-              volumes:
-                - {{ nc_root }}/redis:/data
-          networks:
-            cloud:
-              external: true
-              name: {{ nc_net_primary }}
-
-    - name: Pull redis image
-      community.docker.docker_compose_v2:
-        project_name: "{{ nc_project }}"
-        files: ["/tmp/redis.yml"]
-        pull: always
-        state: present
-
-    - name: Recreate redis
-      community.docker.docker_compose_v2:
-        project_name: "{{ nc_project }}"
-        files: ["/tmp/redis.yml"]
-        recreate: always
-        state: present
-
-    - name: Disable maintenance mode (if we turned it on)
-      community.docker.docker_container_exec:
-        container: "{{ nc_container }}"
-        user: "www-data"
-        command: php occ maintenance:mode --off
-      ignore_errors: true
-
-    - name: Fire one cron tick (cleanup pending jobs)
-      community.docker.docker_container_exec:
-        container: "{{ nc_container }}"
-        user: "www-data"
-        command: php -f /var/www/html/cron.php

requirements.yml

@@ -1,4 +1,2 @@
----
 collections:
-  - name: community.docker
-  - name: ansible.posix
+  - name: community.routeros

test_sms.yml

@@ -0,0 +1,57 @@
+---
+- name: Send and verify SMS delivery via internet-master.cz
+  hosts: localhost
+  gather_facts: false
+  vars:
+    sms_number: "601358865"
+    sms_username: "mikrotik"
+    sms_password_send: "jdkotzHJIOPWhjtr32D"
+    sms_password_recv: "jdkotzHJIOPWhjtr32D"
+    sms_wait_seconds: 120   # Wait 2 minutes for delivery
+
+  tasks:
+    - name: Generate random test string
+      set_fact:
+        random_string: "mikrotik_{{ lookup('password', '/dev/null length=8 chars=ascii_letters') }}"
+
+    - name: Send SMS message
+      uri:
+        url: "https://sms.internet-master.cz/send/?number={{ sms_number }}&message=@mikrotik@{{ random_string | urlencode }}&type=class-1&username={{ sms_username }}&password={{ sms_password_send }}"
+        method: GET
+        return_content: true
+      register: send_result
+
+    - name: Show send API response
+      debug:
+        var: send_result.content
+
+    - name: Wait for SMS to be delivered
+      pause:
+        seconds: "{{ sms_wait_seconds }}"
+
+    - name: Fetch received messages
+      uri:
+        url: "https://sms.internet-master.cz/receive/?username={{ sms_username }}&password={{ sms_password_recv }}"
+        method: GET
+        return_content: true
+      register: recv_result
+
+    - name: Parse received JSON
+      set_fact:
+        inbox: "{{ recv_result.json.inbox | default([]) }}"
+
+    - name: Check if random string message was received
+      set_fact:
+        message_found: "{{ inbox | selectattr('message', 'equalto', random_string) | list | length > 0 }}"
+
+    - name: Report result
+      debug:
+        msg: >
+          SMS with message '{{ random_string }}' was {{
+            'delivered ✅' if message_found else 'NOT delivered ❌'
+          }}.
+
+    - name: Fail if not delivered
+      fail:
+        msg: "Message '{{ random_string }}' not found in received inbox!"
+      when: not message_found

update.yml

@@ -1,34 +1,91 @@
+---
 - name: Update system (APT + Flatpak)
   hosts: all
+  become: yes
+  gather_facts: yes
+  serial: 5
 
-  become: true
-  become_user: root
-  become_method: sudo
   tasks:
-    - name: Update APT cache
+
+    - name: Ensure SSH is reachable (skip host if not)
+      delegate_to: localhost
+      wait_for:
+        host: "{{ ansible_host | default(inventory_hostname) }}"
+        port: 22
+        timeout: 5
+      register: ssh_check
+      ignore_errors: yes
+
+    - meta: end_host
+      when: ssh_check is failed
+
+    - name: Ping with retries (handle intermittent flaps)
+      ping:
+      register: ping_result
+      retries: 5
+      delay: 5
+      until: ping_result is success
+
+    - name: Wait for apt lock to be released
+      shell: |
+        while fuser /var/lib/dpkg/lock-frontend >/dev/null 2>&1; do
+          echo "Waiting for apt lock..."
+          sleep 5
+        done
+      changed_when: false
+
+    - name: Update apt cache
       apt:
         update_cache: yes
 
-    - name: Upgrade all APT packages
+    - name: Perform full upgrade
       apt:
-        upgrade: dist
+        upgrade: full
+        autoremove: yes
+        autoclean: yes
+      register: apt_upgrade
+      retries: 3
+      delay: 10
+      until: apt_upgrade is succeeded
 
-    - name: Check if flatpak binary exists
-      stat:
-        path: /usr/bin/flatpak
-      register: flatpak_bin
+    - name: Fix broken packages
+      command: apt-get -f install -y
+      register: fix_result
+      failed_when: false
+      changed_when: "'Setting up' in fix_result.stdout"
+
+    - name: Check if Flatpak is installed
+      command: which flatpak
+      register: flatpak_check
+      changed_when: false
+      failed_when: false
 
     - name: Update system Flatpaks
-      shell: timeout 300 flatpak update -y
-      register: flatpak_sys
-      failed_when: flatpak_sys.rc != 0 and flatpak_sys.rc != 124
-      when: flatpak_bin.stat.exists
+      command: flatpak update -y --noninteractive --system
+      when: flatpak_check.rc == 0
+      failed_when: false
 
     - name: Update user Flatpaks
-      become_user: jakub
-      environment:
-        XDG_RUNTIME_DIR: /run/user/1000
-      shell: timeout 300 flatpak update -y
-      register: flatpak_user
-      failed_when: flatpak_user.rc != 0 and flatpak_user.rc != 124
-      when: flatpak_bin.stat.exists
+      command: flatpak update -y --noninteractive --user
+      become: false
+      when: flatpak_check.rc == 0
+      failed_when: false
+
+    - name: Remove unused Flatpaks
+      command: flatpak uninstall -y --noninteractive --unused
+      when: flatpak_check.rc == 0
+      failed_when: false
+    
+    - name: Update snap packages
+      command: snap refresh
+      failed_when: false
+    
+    - name: Check if reboot is required
+      stat:
+        path: /var/run/reboot-required
+      register: reboot_required
+
+    - name: Notify if reboot required
+      debug:
+        msg: "Reboot required on {{ inventory_hostname }}"
+      when: reboot_required.stat.exists

users-ssh.yml

@@ -1,15 +1,12 @@
-# users-ssh-nopasswd.yml
+---
 - name: Ensure users, SSH keys, and passwordless sudo
   hosts: all
   become: true
-  become_user: root
-  become_method: sudo
 
   vars:
     users:
       - name: automation
         shell: /bin/bash
-        # optional extra groups besides sudo/wheel
         groups: []
         sudo_nopasswd: true
         keys:
@@ -30,33 +27,43 @@
           - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPFS4fsqMjMMu/Bi/884bw7yJBqvWusDRESvanH6Owco jakub@jimbuntu"
 
   tasks:
+
     - name: Pick sudo group per distro
       ansible.builtin.set_fact:
-        sudo_group: "{{ 'wheel' if ansible_facts.os_family in ['RedHat','Rocky','AlmaLinux','Fedora','OracleLinux','Suse'] else 'sudo' }}"
+        sudo_group: >-
+          {{ 'wheel'
+             if ansible_facts.os_family in
+             ['RedHat','Rocky','AlmaLinux','Fedora','OracleLinux','Suse']
+             else 'sudo' }}
 
     - name: Ensure user exists (creates home)
       ansible.builtin.user:
         name: "{{ item.name }}"
-        shell: "{{ item.shell | default('/bin/bash') }}"
+        shell: "{{ item.shell | default(omit) }}"
         groups: >-
           {{ (
-                (item.groups | default([]))
-                + ([sudo_group] if item.sudo_nopasswd | default(false) else [])
-              ) | unique | join(',') if
-              ((item.groups | default([])) | length > 0) or (item.sudo_nopasswd | default(false))
-              else omit }}
+               (item.groups | default([]))
+               + ([sudo_group] if item.sudo_nopasswd | default(false) else [])
+             ) | unique | join(',')
+             if (
+               (item.groups | default([]) | length > 0)
+               or item.sudo_nopasswd | default(false)
+             )
+             else omit }}
         append: true
         create_home: true
         state: present
       loop: "{{ users }}"
 
-    - name: Install authorized SSH keys
+    - name: Enforce authorized SSH keys
       ansible.builtin.authorized_key:
-        user: "{{ item.0.name }}"
-        key: "{{ item.1 }}"
+        user: "{{ item.name }}"
+        key: "{{ item.keys | join('\n') }}"
         state: present
         manage_dir: true
-      loop: "{{ users | subelements('keys', skip_missing=True) }}"
+        exclusive: true
+      loop: "{{ users }}"
+      when: item.keys is defined
 
     - name: Grant passwordless sudo via sudoers.d
       ansible.builtin.copy:
@@ -64,7 +71,9 @@
         owner: root
         group: root
         mode: '0440'
-        content: "{{ item.name }} ALL=(ALL) NOPASSWD:ALL"
+        content: |
+          # Managed by Ansible
+          {{ item.name }} ALL=(ALL) NOPASSWD:ALL
         validate: 'visudo -cf %s'
       when: item.sudo_nopasswd | default(false)
-      loop: "{{ users }}"
+      loop: "{{ users }}"