Update nextcloud/update_nextcloud_v2.yml

check_raid.yml

@@ -1,439 +1,183 @@
 # check_raid.yml
 
----
-- name: Check Linux MD RAID health on pve1
-  hosts: pve1_vm
+- name: Check Linux MD RAID health on VM via Proxmox
+  hosts: linux_servers
   gather_facts: false
+  become: true
+  become_user: root
+  become_method: sudo
 
   vars:
-    # Semaphore Survey Variables are preferred.
-    # Environment variables are used only as a fallback.
-    raid_md_raw: >-
-      {{
-        RAID_MD
-        | default(lookup('env', 'RAID_MD'), true)
-        | default('auto', true)
-        | string
-        | trim
-        | lower
-      }}
+    # VM connection (provided by Semaphore env vars)
+    vm_ip:   "{{ lookup('env', 'VM_IP') }}"
+    vm_user: "{{ lookup('env', 'VM_USER') }}"
+    vm_pass: "{{ lookup('env', 'VM_PASS') }}"
+    use_sudo: false
 
-    # RAID_MD can be md0, md1, /dev/md0, or auto
-    raid_md_device: "{{ raid_md_raw | regex_replace('^/dev/', '') }}"
+    # Debug mode
+    DEBUG: "{{ lookup('env', 'DEBUG') | default(0) | int }}"
+    RETRIES: "{{ lookup('env', 'RETRIES') | default(25) | int }}"
 
-    # Allow a healthy array to be checking, repairing, recovering,
-    # resyncing, or reshaping
-    raid_allow_sync: >-
-      {{
-        RAID_ALLOW_SYNC
-        | default(lookup('env', 'RAID_ALLOW_SYNC'), true)
-        | default('1', true)
-        | int
-      }}
+    # RAID specifics
+    # RAID_MD can be: md0 / md1 / ... OR "auto" to check all arrays found in /proc/mdstat
+    raid_md_device: "{{ lookup('env', 'RAID_MD') | default('md0', true) }}"
+    raid_allow_sync: "{{ lookup('env', 'RAID_ALLOW_SYNC') | default(1, true) | int }}"
+    raid_allow_no_array: "{{ lookup('env', 'RAID_ALLOW_NO_ARRAY') | default(0, true) | int }}"
 
-    # A server without Linux MD RAID is considered unhealthy by default
-    raid_allow_no_array: >-
-      {{
-        RAID_ALLOW_NO_ARRAY
-        | default(lookup('env', 'RAID_ALLOW_NO_ARRAY'), true)
-        | default('0', true)
-        | int
-      }}
+    raid_retries: "{{ RETRIES }}"
+    raid_delay: 2
+    ssh_hard_timeout: 30
 
-    # Enable raw diagnostic output
-    raid_debug: >-
-      {{
-        DEBUG
-        | default(lookup('env', 'DEBUG'), true)
-        | default('0', true)
-        | int
-      }}
+    # SSH options
+    ssh_opts:
+      - "-o"  # English comments
+      - "StrictHostKeyChecking=no"
+      - "-o"
+      - "UserKnownHostsFile=/dev/null"
+      - "-o"
+      - "GlobalKnownHostsFile=/dev/null"
+      - "-o"
+      - "LogLevel=ERROR"
+      - "-o"
+      - "ConnectTimeout=15"
+      - "-o"
+      - "PreferredAuthentications=password"
+      - "-o"
+      - "PubkeyAuthentication=no"
+      - "-o"
+      - "KbdInteractiveAuthentication=no"
+      - "-o"
+      - "NumberOfPasswordPrompts=1"
 
-    raid_check_script: |
-      import re
-      import sys
+    raid_check_cmd: |
+      python3 - <<'PY'
+      # Print exactly one status line and exit with code:
+      # 0=OK, 1=FAIL (degraded/disallowed sync), 2=ERROR (unexpected/misconfig)
+      import re, sys
 
-      target = {{ raid_md_device | to_json }}
-      allow_sync = bool({{ raid_allow_sync | int }})
-      allow_no_array = bool({{ raid_allow_no_array | int }})
+      target = "{{ raid_md_device }}"
+      allow_sync = int("{{ raid_allow_sync }}")
+      allow_no_array = int("{{ raid_allow_no_array }}")
 
       try:
-          with open(
-              "/proc/mdstat",
-              "r",
-              encoding="utf-8",
-              errors="replace",
-          ) as mdstat_file:
-              mdstat = mdstat_file.read()
-      except Exception as exc:
-          print(
-              "ERROR RAID "
-              f"read_mdstat_failed="
-              f"{type(exc).__name__}:{exc}"
-          )
+          txt = open("/proc/mdstat", "r", encoding="utf-8", errors="ignore").read()
+      except Exception as e:
+          print(f"ERROR RAID read_mdstat err={e}")
           sys.exit(2)
 
-      header_pattern = re.compile(
-          r"^(md\d+)\s*:\s*(.*)$",
-          re.MULTILINE,
-      )
+      arrays = {}
+      header_re = re.compile(r"^(md\d+)\s*:\s*active.*$", re.MULTILINE)
+      token_re  = re.compile(r"^\s*\d+\s+blocks.*\[\d+/\d+\]\s*\[([U_]+)\]\s*$", re.MULTILINE)
 
-      header_matches = list(header_pattern.finditer(mdstat))
-      array_blocks = {}
+      for m in header_re.finditer(txt):
+          name = m.group(1)
+          chunk = txt[m.end():m.end() + 3000]
+          tm = token_re.search(chunk)
+          if tm:
+              arrays[name] = tm.group(1)
 
-      for index, match in enumerate(header_matches):
-          block_end = (
-              header_matches[index + 1].start()
-              if index + 1 < len(header_matches)
-              else len(mdstat)
-          )
-
-          array_blocks[match.group(1)] = mdstat[
-              match.start():block_end
-          ]
-
-      def md_sort_key(name):
-          try:
-              return int(name[2:])
-          except ValueError:
-              return name
-
-      def parse_array(name, block):
-          lines = block.splitlines()
-          header = lines[0]
-          header_data = header.split(":", 1)[1].strip()
-
-          state_match = re.match(
-              r"^(active|inactive)\b",
-              header_data,
-              re.IGNORECASE,
-          )
-
-          state = (
-              state_match.group(1).lower()
-              if state_match
-              else "unknown"
-          )
-
-          remaining_header = (
-              header_data[state_match.end():].strip()
-              if state_match
-              else header_data
-          )
-
-          mode = "rw"
-
-          # Handle states such as "active (auto-read-only)"
-          if remaining_header.startswith("("):
-              closing_parenthesis = remaining_header.find(")")
-
-              if closing_parenthesis >= 0:
-                  mode = remaining_header[
-                      1:closing_parenthesis
-                  ]
-
-                  remaining_header = remaining_header[
-                      closing_parenthesis + 1:
-                  ].strip()
-
-          level = (
-              remaining_header.split()[0].lower()
-              if remaining_header
-              else "unknown"
-          )
-
-          status_match = re.search(
-              r"\[(\d+)\s*/\s*(\d+)\]"
-              r"\s*\[([U_]+)\]",
-              block,
-          )
-
-          active_members = None
-          total_members = None
-          member_status = None
-
-          if status_match:
-              active_members = int(status_match.group(1))
-              total_members = int(status_match.group(2))
-              member_status = status_match.group(3)
-
-          operation_match = re.search(
-              r"\b("
-              r"resync|"
-              r"recovery|"
-              r"reshape|"
-              r"check|"
-              r"repair"
-              r")\b",
-              block,
-              re.IGNORECASE,
-          )
-
-          operation = (
-              operation_match.group(1).lower()
-              if operation_match
-              else "none"
-          )
-
-          progress_match = re.search(
-              r"(?:"
-              r"resync|"
-              r"recovery|"
-              r"reshape|"
-              r"check|"
-              r"repair"
-              r")\s*=\s*([0-9.]+%)",
-              block,
-              re.IGNORECASE,
-          )
-
-          progress = (
-              progress_match.group(1)
-              if progress_match
-              else "none"
-          )
-
-          return {
-              "name": name,
-              "state": state,
-              "mode": mode,
-              "level": level,
-              "active_members": active_members,
-              "total_members": total_members,
-              "member_status": member_status,
-              "operation": operation,
-              "progress": progress,
-              "faulty_member": bool(
-                  re.search(
-                      r"\(F\)",
-                      block,
-                      re.IGNORECASE,
-                  )
-              ),
-          }
-
-      def format_array(array):
-          if array["member_status"] is None:
-              members = "n/a"
-              member_status = "n/a"
-          else:
-              members = (
-                  f'{array["active_members"]}/'
-                  f'{array["total_members"]}'
-              )
-
-              member_status = array["member_status"]
-
-          return (
-              f'{array["name"]}'
-              "{"
-              f'state={array["state"]},'
-              f'mode={array["mode"]},'
-              f'level={array["level"]},'
-              f'members={members},'
-              f'status={member_status},'
-              f'operation={array["operation"]},'
-              f'progress={array["progress"]}'
-              "}"
-          )
-
-      if not array_blocks:
+      if not arrays:
           if allow_no_array:
               print("OK RAID none=no-md-arrays")
               sys.exit(0)
-
           print("ERROR RAID none=no-md-arrays")
           sys.exit(2)
 
-      available_arrays = sorted(
-          array_blocks.keys(),
-          key=md_sort_key,
-      )
+      syncing = bool(re.search(r"\b(resync|recovery|reshape|check|repair)\b", txt))
 
       if target == "auto":
-          selected_names = available_arrays
-      elif target in array_blocks:
-          selected_names = [target]
+          to_check = sorted(arrays.keys())
       else:
-          print(
-              "ERROR RAID "
-              f"target_not_found={target} "
-              f'found={",".join(available_arrays)}'
-          )
-          sys.exit(2)
+          if target not in arrays:
+              found = ",".join(sorted(arrays.keys()))
+              print(f"ERROR RAID target_not_found target={target} found={found}")
+              sys.exit(2)
+          to_check = [target]
 
-      selected_arrays = [
-          parse_array(
-              name,
-              array_blocks[name],
-          )
-          for name in selected_names
-      ]
+      tokens_str = " ".join([f"{name}=[{arrays[name]}]" for name in to_check])
+      degraded = any("_" in arrays[name] for name in to_check)
 
-      failures = []
-      errors = []
-
-      # These RAID levels may not always provide a redundant-member token
-      tokenless_levels = {
-          "raid0",
-          "linear",
-      }
-
-      for array in selected_arrays:
-          name = array["name"]
-
-          if array["state"] != "active":
-              failures.append(
-                  f'{name}:state={array["state"]}'
-              )
-
-          if array["faulty_member"]:
-              failures.append(
-                  f"{name}:faulty-member"
-              )
-
-          if array["member_status"] is not None:
-              if "_" in array["member_status"]:
-                  failures.append(
-                      f'{name}:degraded='
-                      f'[{array["member_status"]}]'
-                  )
-
-              if (
-                  array["active_members"]
-                  != array["total_members"]
-              ):
-                  failures.append(
-                      f'{name}:members='
-                      f'{array["active_members"]}/'
-                      f'{array["total_members"]}'
-                  )
-
-          elif array["level"] not in tokenless_levels:
-              errors.append(
-                  f"{name}:member-status-not-found"
-              )
-
-          if (
-              array["operation"] != "none"
-              and not allow_sync
-          ):
-              failures.append(
-                  f'{name}:operation='
-                  f'{array["operation"]}'
-              )
-
-      details = " ".join(
-          format_array(array)
-          for array in selected_arrays
-      )
-
-      if errors:
-          print(
-              f"ERROR RAID {details} "
-              f'reason={";".join(errors)}'
-          )
-          sys.exit(2)
-
-      if failures:
-          print(
-              f"FAIL RAID {details} "
-              f'reason={";".join(failures)}'
-          )
+      if degraded:
+          print(f"FAIL RAID {tokens_str} syncing={int(syncing)}")
           sys.exit(1)
 
-      print(f"OK RAID {details}")
+      if syncing and not allow_sync:
+          print(f"FAIL RAID {tokens_str} syncing={int(syncing)} allow_sync={allow_sync}")
+          sys.exit(1)
+
+      print(f"OK RAID {tokens_str} syncing={int(syncing)}")
       sys.exit(0)
+      PY
 
   tasks:
-    - name: Validate RAID check configuration
-      ansible.builtin.assert:
-        that:
-          - (raid_allow_sync | int) in [0, 1]
-          - (raid_allow_no_array | int) in [0, 1]
-          - (raid_debug | int) in [0, 1]
-          - >-
-            (
-              raid_md_device
-              | regex_search('^(auto|md[0-9]+)$')
-            ) is not none
-        fail_msg: >-
-          ERROR RAID invalid-configuration.
-          RAID_MD must be auto, md0, md1, or /dev/md0.
-          DEBUG, RAID_ALLOW_SYNC, and RAID_ALLOW_NO_ARRAY
-          must be 0 or 1.
-        quiet: true
+    - name: Ensure sshpass is installed (for password-based SSH)  # English comments
+      ansible.builtin.apt:
+        name: sshpass
+        state: present
+        update_cache: yes
+      run_once: true
 
-    - name: Run Linux MD RAID health check
+    - name: Run RAID check on VM (via SSH)  # single command, no loop
       ansible.builtin.command:
-        argv:
-          - python3
-          - "-"
-        stdin: "{{ raid_check_script }}"
-        stdin_add_newline: true
+        argv: >-
+          {{
+            ['timeout', '-k', '5', (ssh_hard_timeout | string)]
+            + ['sshpass', '-e', 'ssh']
+            + ssh_opts
+            + [ vm_user ~ '@' ~ vm_ip,
+                'bash', '-lc',
+                ('sudo ' if use_sudo else '') + raid_check_cmd
+              ]
+          }}
+      environment:
+        SSHPASS: "{{ vm_pass }}"
       register: raid_cmd
       changed_when: false
-      failed_when: false
+      failed_when: false               # we decide via assert below
+      retries: "{{ raid_retries }}"
+      delay: "{{ raid_delay }}"
+      until: raid_cmd.rc not in [124, 255]
+      run_once: true
 
-    - name: Build one-line RAID result
+    - name: Build one-line summary (always)
       ansible.builtin.set_fact:
         raid_line: >-
-          {%- set stdout = (
-            raid_cmd.stdout
-            | default('')
-            | trim
-            | regex_replace('[\r\n]+', ' ')
-            | regex_replace('\s+', ' ')
-          ) -%}
-          {%- set stderr = (
-            raid_cmd.stderr
-            | default('')
-            | trim
-            | regex_replace('[\r\n]+', ' ')
-            | regex_replace('\s+', ' ')
-          ) -%}
-          {%- if stdout | length > 0 -%}
-          {{ stdout }}
-          {%- elif stderr | length > 0 -%}
-          ERROR RAID command_failed rc={{ raid_cmd.rc }}
-          stderr={{ stderr[:500] }}
-          {%- else -%}
-          ERROR RAID no-output rc={{ raid_cmd.rc }}
-          {%- endif -%}
+          {{
+            (raid_cmd.stdout | default('') | trim)
+            if ((raid_cmd.stdout | default('') | trim) | length) > 0
+            else ('ERROR RAID no-output rc=' ~ (raid_cmd.rc | string))
+          }}
       changed_when: false
+      run_once: true
 
-    - name: Show raw RAID command result
-      ansible.builtin.debug:
-        msg:
-          rc: "{{ raid_cmd.rc }}"
-          stdout: "{{ raid_cmd.stdout | default('') }}"
-          stderr: "{{ raid_cmd.stderr | default('') }}"
-      when: (raid_debug | int) == 1
+    - name: RAID result (always one line)
+      ansible.builtin.assert:
+        that:
+          - raid_cmd.rc == 0
+        success_msg: "{{ raid_line }}"
+        fail_msg: "{{ raid_line }}"
+      run_once: true
 
-    - name: Read raw mdstat in debug mode
+    # Optional verbose debug
+    - name: Debug | /proc/mdstat (VM)
       ansible.builtin.command:
-        argv:
-          - cat
-          - /proc/mdstat
-      register: mdstat_debug
+        argv: >-
+          {{
+            ['timeout', '-k', '5', (ssh_hard_timeout | string)]
+            + ['sshpass', '-e', 'ssh']
+            + ssh_opts
+            + [ vm_user ~ '@' ~ vm_ip, 'bash', '-lc', "cat /proc/mdstat" ]
+          }}
+      environment:
+        SSHPASS: "{{ vm_pass }}"
+      register: mdstat_dbg
       changed_when: false
       failed_when: false
-      when: (raid_debug | int) == 1
+      when: DEBUG == 1
+      run_once: true
 
-    - name: Show raw mdstat in debug mode
+    - name: Debug | mdstat output
       ansible.builtin.debug:
-        msg:
-          rc: "{{ mdstat_debug.rc | default('undefined') }}"
-          stdout: "{{ mdstat_debug.stdout | default('') }}"
-          stderr: "{{ mdstat_debug.stderr | default('') }}"
-      when: (raid_debug | int) == 1
-
-    - name: Show successful RAID result
-      ansible.builtin.debug:
-        msg: "{{ raid_line }}"
-      when: (raid_cmd.rc | int) == 0
-
-    - name: Fail when RAID is unhealthy
-      ansible.builtin.fail:
-        msg: "{{ raid_line }}"
-      when: (raid_cmd.rc | int) != 0
+        msg: "{{ mdstat_dbg.stdout | default('') }}"
+      when: DEBUG == 1
+      run_once: true

docker-compose/docker-compose-bettershift.yml

@@ -1,27 +0,0 @@
-name: bettershift
-
-services:
-  bettershift:
-    container_name: bettershift
-    image: ghcr.io/pantelx/bettershift:v2.2.1
-    restart: unless-stopped
-
-    ports:
-      - '0.0.0.0:3067:3000'
-
-    volumes:
-      - /data/compose/bettershift/data:/app/data
-
-    env_file:
-      - .env.bettershift
-
-    environment:
-      - TZ=Europe/Prague
-
-networks:
-  backend:
-    driver: bridge
-    ipam:
-      config:
-        - subnet: 172.20.0.0/24
-          gateway: 172.20.0.1

docker-compose/docker-compose-collabora.yml

@@ -1,23 +0,0 @@
-version: '3'
-
-services:
-  collabora:
-    image: collabora/code:latest
-    container_name: collabora
-    restart: unless-stopped
-    networks:
-      - cloud
-    environment:
-      - TZ=Europe/Prague
-      - password=password
-      - username=nextcloud
-      - domain=cloud.martinfencl.eu
-      - extra_params=--o:ssl.enable=false --o:ssl.termination=true
-      - aliasgroup1=https://cloud.martinfencl.eu:443,https://collabora.martinfencl.eu:443
-      - dictionaries=de_DE en_GB en_US es_ES fr_FR it nl pt_BR pt_PT ru cs_CZ
-    ports:
-      - 9980:9980
-
-networks:
-  cloud:
-    driver: bridge

docker-compose/docker-compose-homarr.yml

@@ -1,13 +0,0 @@
-services:
-  homarr:
-    container_name: homarr
-    image: ghcr.io/homarr-labs/homarr:latest
-    restart: unless-stopped
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock # Optional, only if you want docker integration
-      - /data/compose/homarr/appdata:/appdata
-    environment:
-      - SECRET_ENCRYPTION_KEY=4fb16028fa1788d9a24fa93a323aa4a278524bed177c8c38454f4c4068c1b9b6
-    ports:
-      - '7575:7575'
-  

docker-compose/docker-compose-immich.override.yml

@@ -1,5 +0,0 @@
-services:
-  immich-server:
-    volumes:
-      - /mnt/nextcloud-howard-photos:/mnt/nextcloud-howard-photos
-      - /mnt/nextcloud-kamilkaprdelka-photos:/mnt/nextcloud-kamilkaprdelka-photos

docker-compose/docker-compose-immich.yml

@@ -1,77 +0,0 @@
-#
-# WARNING: To install Immich, follow our guide: https://docs.immich.app/install/docker-compose
-#
-# Make sure to use the docker-compose.yml of the current release:
-#
-# https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml
-#
-# The compose file on main may not be compatible with the latest release.
-
-name: immich
-
-services:
-  immich-server:
-    container_name: immich_server
-    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
-    # extends:
-    #   file: hwaccel.transcoding.yml
-    #   service: cpu # set to one of [nvenc, quicksync, rkmpp, vaapi, vaapi-wsl] for accelerated transcoding
-    volumes:
-      - ${UPLOAD_LOCATION}:/usr/src/app/upload
-      #- /mnt/nextcloud-howard-photos:/mnt/nextcloud-howard-photos:ro  # read-only external library
-      #- /mnt/nextcloud-kamilkaprdelka-photos:/mnt/nextcloud-kamilkaprdelka-photos:ro  # read-only external library
-      - /mnt/nextcloud-howard-photos:/mnt/nextcloud-howard-photos
-      - /mnt/nextcloud-kamilkaprdelka-photos:/mnt/nextcloud-kamilkaprdelka-photos
-      - /etc/localtime:/etc/localtime:ro
-    env_file:
-      - .env
-    ports:
-      - '2283:2283'
-    depends_on:
-      - redis
-      - database
-    restart: always
-    healthcheck:
-      disable: false
-
-  immich-machine-learning:
-    container_name: immich_machine_learning
-    # For hardware acceleration, add one of -[armnn, cuda, rocm, openvino, rknn] to the image tag.
-    # Example tag: ${IMMICH_VERSION:-release}-cuda
-    image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
-    # extends: # uncomment this section for hardware acceleration - see https://docs.immich.app/features/ml-hardware-acceleration
-    #   file: hwaccel.ml.yml
-    #   service: cpu # set to one of [armnn, cuda, rocm, openvino, openvino-wsl, rknn] for accelerated inference - use the `-wsl` version for WSL2 where applicable
-    volumes:
-      - model-cache:/cache
-    env_file:
-      - .env
-    restart: always
-    healthcheck:
-      disable: false
-
-  redis:
-    container_name: immich_redis
-    image: docker.io/valkey/valkey:8@sha256:81db6d39e1bba3b3ff32bd3a1b19a6d69690f94a3954ec131277b9a26b95b3aa
-    healthcheck:
-      test: redis-cli ping || exit 1
-    restart: always
-
-  database:
-    container_name: immich_postgres
-    image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357191b76a916ae5eb93464d65c07511da41e3bf7a8416db519b40b1c23
-    environment:
-      POSTGRES_PASSWORD: ${DB_PASSWORD}
-      POSTGRES_USER: ${DB_USERNAME}
-      POSTGRES_DB: ${DB_DATABASE_NAME}
-      POSTGRES_INITDB_ARGS: '--data-checksums'
-      # Uncomment the DB_STORAGE_TYPE: 'HDD' var if your database isn't stored on SSDs
-      # DB_STORAGE_TYPE: 'HDD'
-    volumes:
-      # Do not edit the next line. If you want to change the database storage location on your system, edit the value of DB_DATA_LOCATION in the .env file
-      - ${DB_DATA_LOCATION}:/var/lib/postgresql/data
-    shm_size: 128mb
-    restart: always
-
-volumes:
-  model-cache:

docker-compose/docker-compose-jellyfin.yml

@@ -1,33 +0,0 @@
-
-services:
-  jellyfin:
-    image: lscr.io/linuxserver/jellyfin:latest
-    container_name: jellyfin
-    restart: unless-stopped
-
-    ports:
-      - "8096:8096"
-      - "7359:7359/udp"
-      - "1900:1900/udp"
-
-    environment:
-      - TZ=Europe/Prague
-      - PUID=0
-      - PGID=0
-
-    volumes:
-      - /opt/jellyfin/config:/config
-      - /opt/jellyfin/cache:/cache
-      - /mnt/films:/media/films:ro
-      - /mnt/books:/media/books:ro
-      - /mnt/ondrulin:/media/ondrulin:ro
-
-    devices:
-      - /dev/dri:/dev/dri
-
-    group_add:
-      - "104"
-      - "44"
-
-    tmpfs:
-      - /transcode:rw,size=8g,mode=1777

docker-compose/docker-compose-minecraft.yml

@@ -1,54 +0,0 @@
-services:
-  mc:
-    image: itzg/minecraft-server:2026.6.0-java17
-    container_name: mc-futurecraft
-    restart: unless-stopped
-    ports:
-      - "25565:25565"
-    environment:
-      EULA: "TRUE"
-      TYPE: "AUTO_CURSEFORGE"
-      CF_API_KEY: "${CF_API_KEY}"
-      CF_PAGE_URL: "https://www.curseforge.com/minecraft/modpacks/futurecraft-5-0"
-      CF_MODPACK_ZIP: "/modpacks/futurecraft-5.0.zip"
-      # mkdir -p /home/howard/.ansible-compose/docker-compose/modpacks && curl -L -o /home/howard/.ansible-compose/docker-compose/modpacks/futurecraft-5.0.zip "https://edge.forgecdn.net/files/6103/327/Futurecraft%205.0.zi>
-      #CF_SLUG: "futurecraft-5-0"
-      #CF_FILE_ID: "6103327"
-
-      JAVA_VERSION: "17"
-
-      MEMORY: "${MEMORY:-10G}"
-      LEVEL: "world"
-      DIFFICULTY: "normal"
-      VIEW_DISTANCE: "10"
-      SIMULATION_DISTANCE: "6"
-      MAX_PLAYERS: "5"
-
-      ENABLE_RCON: "true"
-      RCON_PASSWORD: "${RCON_PASSWORD}"
-      ONLINE_MODE: "FALSE"
-      ENABLE_WHITELIST: "TRUE"
-    volumes:
-      - mc_data:/data
-      - ./modpacks:/modpacks:ro
-
-  backup:
-    image: itzg/mc-backup:latest
-    container_name: mc-futurecraft-backup
-    restart: unless-stopped
-    depends_on:
-      - mc
-    environment:
-      SRC_DIR: /data
-      DEST_DIR: /data/backups
-      BACKUP_INTERVAL: "12h"
-      INITIAL_DELAY: "5m"
-      PRUNE_BACKUPS_DAYS: "14"
-      EXCLUDES: "backups,cache,logs"
-      RCON_HOST: mc
-      RCON_PASSWORD: "${RCON_PASSWORD}"
-    volumes:
-      - mc_data:/data
-
-volumes:
-  mc_data:

docker-compose/docker-compose-minecraft_old1.yml

@@ -1,49 +0,0 @@
-services:
-  mc:
-    image: itzg/minecraft-server:java17
-    container_name: mc-futurecraft
-    restart: unless-stopped
-    ports:
-      - "25565:25565"
-    environment:
-      EULA: "TRUE"
-      TYPE: "AUTO_CURSEFORGE"
-      CF_API_KEY: "${CF_API_KEY}"
-      CF_SLUG: "futurecraft-5-0"
-
-      JAVA_VERSION: "17"
-
-      MEMORY: "${MEMORY:-10G}"
-      LEVEL: "world"
-      DIFFICULTY: "normal"
-      VIEW_DISTANCE: "10"
-      SIMULATION_DISTANCE: "6"
-      MAX_PLAYERS: "5"
-
-      ENABLE_RCON: "true"
-      RCON_PASSWORD: "${RCON_PASSWORD}"
-      ONLINE_MODE: "FALSE"
-      ENABLE_WHITELIST: "TRUE"
-    volumes:
-      - mc_data:/data
-
-  backup:
-    image: itzg/mc-backup:latest
-    container_name: mc-futurecraft-backup
-    restart: unless-stopped
-    depends_on:
-      - mc
-    environment:
-      SRC_DIR: /data
-      DEST_DIR: /data/backups
-      BACKUP_INTERVAL: "12h"
-      INITIAL_DELAY: "5m"
-      PRUNE_BACKUPS_DAYS: "14"
-      EXCLUDES: "backups,cache,logs"
-      RCON_HOST: mc
-      RCON_PASSWORD: "${RCON_PASSWORD}"
-    volumes:
-      - mc_data:/data
-
-volumes:
-  mc_data:

docker-compose/docker-compose-semaphore.yml

@@ -1,22 +0,0 @@
-services:
-  semaphore:
-    image: git.internet-master.cz/jakub/semaphore:latest
-    container_name: semaphore
-    user: "0:0"
-    ports:
-      - "3008:3000"
-    environment:
-      SEMAPHORE_DB_DIALECT: bolt
-      SEMAPHORE_DB_PATH: /etc/semaphore/semaphore.db.bolt
-      SEMAPHORE_TMP_PATH: /var/lib/semaphore/projects
-      SEMAPHORE_ADMIN: admin
-      SEMAPHORE_ADMIN_NAME: admin
-      SEMAPHORE_ADMIN_EMAIL: admin@localhost
-      SEMAPHORE_ADMIN_PASSWORD: changeme
-      SEMAPHORE_ACCESS_KEY_ENCRYPTION: "rZffGjw4BGlwoM+66fStJ4Pg+ivLc5ghtty3yoscltY="
-    volumes:
-      - /data/compose/semaphore/db:/etc/semaphore
-      - /data/compose/semaphore/projects:/var/lib/semaphore/projects
-      - /data/compose/semaphore/backups:/opt/mikrotik_backups/
-      - /data/compose/semaphore/ansible.cfg:/etc/ansible/ansible.cfg:ro
-    restart: unless-stopped

docker-compose/docker-compose-semaphore_backup.yml

@@ -1,26 +0,0 @@
-version: "3.8"
-
-services:
-  semaphore:
-    image: semaphoreui/semaphore:latest
-    user: "0:0"
-    ports:
-      - "3000:3000"
-
-    environment:
-      SEMAPHORE_DB_DIALECT: bolt
-      SEMAPHORE_DB_PATH: /etc/semaphore/semaphore.db.bolt  # full path to file!
-      SEMAPHORE_TMP_PATH: /var/lib/semaphore/projects
-      SEMAPHORE_ADMIN: admin
-      SEMAPHORE_ADMIN_NAME: admin
-      SEMAPHORE_ADMIN_EMAIL: admin@localhost
-      SEMAPHORE_ADMIN_PASSWORD: changeme
-      SEMAPHORE_ACCESS_KEY_ENCRYPTION: "rZffGjw4BGlwoM+66fStJ4Pg+ivLc5ghtty3yoscltY="
-
-    volumes:
-      - /data/compose/semaphore/db:/etc/semaphore
-      - /data/compose/semaphore/projects:/var/lib/semaphore/projects
-      - /data/compose/semaphore/backups:/opt/mikrotik_backups/
-      - /data/compose/semaphore/ansible.cfg:/etc/ansible.cfg:ro  # mount as file, ne do /etc/ansible/ansible.cfg
-
-    restart: unless-stopped

docker-compose/docker-compose-uptimekuma.yml

@@ -1,12 +0,0 @@
-version: '3.8'
-
-services:
-  uptime-kuma:
-    container_name: uptime-kuma-dev
-    image: louislam/uptime-kuma:latest
-    volumes:
-      #- ./data:/app/data
-
-      - /data/compose/kuma/data:/app/data
-    ports:
-      - "3001:3001"  # <Host Port>:<Container Port>

inv_mikrotiks

@@ -1,8 +1,3 @@
 [mikrotiks]
 mikrotik_fencl_server ansible_host=192.168.69.1
-mikrotik_fencl_5G    ansible_host=192.168.68.1
-
-[mikrotiks:vars]
-ansible_connection=network_cli
-ansible_network_os=community.routeros.routeros
-ansible_command_timeout=15
+mikrotik_fencl_5G    ansible_host=192.168.68.1

inv_vm

@@ -1,5 +1,3 @@
 [vm]
 pve1_vm ansible_host=192.168.69.253
-pve2_vm ansible_host=192.168.69.254
-[lxc]
-pve2_lxc_jellyfin ansible_host=192.168.69.252
+pve2_vm ansible_host=192.168.69.254

mikrotikbackup_clean.yml

@@ -1,331 +0,0 @@
-# mikrotikbackup_clean.yml
-
-
----
-- name: Backup and/or upgrade MikroTik
-  hosts: mikrotiks
-  gather_facts: false
-
-  vars:
-    # This directory is located on the Semaphore runner
-    backup_dir: /opt/mikrotik_backups
-
-    # Maximum time for a router to return after an upgrade
-    upgrade_wait_timeout: 900
-
-  tasks:
-    # -------------------------------------------------------------------------
-    # Common information
-    # -------------------------------------------------------------------------
-
-    - name: Get router identity
-      community.routeros.command:
-        commands:
-          - /system identity get name
-      register: identity_raw
-      changed_when: false
-      tags:
-        - always
-
-    - name: Build safe router name
-      ansible.builtin.set_fact:
-        router_name: >-
-          {{
-            (
-              identity_raw.stdout[0]
-              | default(inventory_hostname, true)
-              | trim
-            )
-            | regex_replace('[^A-Za-z0-9._-]+', '_')
-            | regex_replace('^_+|_+$', '')
-          }}
-      tags:
-        - always
-
-    - name: Validate router name
-      ansible.builtin.assert:
-        that:
-          - router_name | length > 0
-        fail_msg: >-
-          Could not determine RouterOS identity for
-          {{ inventory_hostname }}.
-        quiet: true
-      tags:
-        - always
-
-    - name: Generate backup timestamp
-      ansible.builtin.command:
-        argv:
-          - date
-          - --utc
-          - "+%Y-%m-%d_%H-%M-%S"
-      register: date_out
-      changed_when: false
-      delegate_to: localhost
-      tags:
-        - always
-
-    - name: Set timestamp fact
-      ansible.builtin.set_fact:
-        backup_timestamp: "{{ date_out.stdout | trim }}"
-      tags:
-        - always
-
-    # -------------------------------------------------------------------------
-    # Backup
-    # Run with: --tags backup
-    # -------------------------------------------------------------------------
-
-    - name: Ensure local backup directory exists
-      ansible.builtin.file:
-        path: "{{ backup_dir }}"
-        state: directory
-        mode: "0700"
-      delegate_to: localhost
-      run_once: true
-      tags:
-        - backup
-        - never
-
-    - name: Export RouterOS configuration
-      community.routeros.command:
-        commands:
-          - /export terse show-sensitive
-      register: export_cfg
-      changed_when: false
-      no_log: true
-      tags:
-        - backup
-        - never
-
-    - name: Validate exported configuration
-      ansible.builtin.assert:
-        that:
-          - export_cfg.stdout is defined
-          - export_cfg.stdout | length > 0
-          - export_cfg.stdout[0] | default('') | trim | length > 0
-        fail_msg: >-
-          RouterOS returned an empty configuration export
-          for {{ inventory_hostname }}.
-        quiet: true
-      no_log: true
-      tags:
-        - backup
-        - never
-
-    - name: Set backup filename
-      ansible.builtin.set_fact:
-        backup_file: >-
-          {{
-            backup_dir
-            ~ '/'
-            ~ router_name
-            ~ '-'
-            ~ backup_timestamp
-            ~ '.rsc'
-          }}
-      tags:
-        - backup
-        - never
-
-    - name: Save RouterOS configuration locally
-      ansible.builtin.copy:
-        content: "{{ export_cfg.stdout[0] | trim }}\n"
-        dest: "{{ backup_file }}"
-        mode: "0600"
-      delegate_to: localhost
-      no_log: true
-      diff: false
-      tags:
-        - backup
-        - never
-
-    - name: Show backup result
-      ansible.builtin.debug:
-        msg: >-
-          MikroTik backup completed:
-          host={{ inventory_hostname }}
-          identity={{ router_name }}
-          file={{ backup_file }}
-      tags:
-        - backup
-        - never
-
-    # -------------------------------------------------------------------------
-    # Upgrade
-    # Run with: --tags upgrade
-    # Run with backup before upgrade: --tags backup,upgrade
-    # -------------------------------------------------------------------------
-
-    - name: Check current and latest RouterOS versions
-      community.routeros.command:
-        commands:
-          - /system package update check-for-updates
-      register: update_check
-      changed_when: false
-      tags:
-        - upgrade
-        - never
-
-    - name: Normalize update output
-      ansible.builtin.set_fact:
-        update_text: >-
-          {{
-            update_check.stdout[0]
-            | default('')
-            | replace('\r', '')
-          }}
-      tags:
-        - upgrade
-        - never
-
-    - name: Extract version matches
-      ansible.builtin.set_fact:
-        installed_version_matches: >-
-          {{
-            update_text
-            | regex_findall(
-                '(?im)^\\s*(?:installed|current)-version:\\s*(\\S+)\\s*$'
-              )
-          }}
-        latest_version_matches: >-
-          {{
-            update_text
-            | regex_findall(
-                '(?im)^\\s*(?:latest|newest)-version:\\s*(\\S+)\\s*$'
-              )
-          }}
-      tags:
-        - upgrade
-        - never
-
-    - name: Set installed and latest versions
-      ansible.builtin.set_fact:
-        installed_version: >-
-          {{
-            installed_version_matches[0]
-            if installed_version_matches | length > 0
-            else 'unknown'
-          }}
-        latest_version: >-
-          {{
-            latest_version_matches[0]
-            if latest_version_matches | length > 0
-            else 'unknown'
-          }}
-      tags:
-        - upgrade
-        - never
-
-    - name: Show raw update output
-      ansible.builtin.debug:
-        msg: "{{ update_text }}"
-      tags:
-        - upgrade
-        - never
-
-    - name: Validate parsed RouterOS versions
-      ansible.builtin.assert:
-        that:
-          - installed_version != 'unknown'
-          - latest_version != 'unknown'
-        fail_msg: >-
-          Could not parse RouterOS versions on
-          {{ inventory_hostname }}.
-          Raw output: {{ update_text }}
-        quiet: true
-      tags:
-        - upgrade
-        - never
-
-    - name: Show RouterOS versions
-      ansible.builtin.debug:
-        msg:
-          - "Router: {{ router_name }}"
-          - "Installed: {{ installed_version }}"
-          - "Latest: {{ latest_version }}"
-      tags:
-        - upgrade
-        - never
-
-    - name: Show already up-to-date result
-      ansible.builtin.debug:
-        msg: >-
-          Router {{ router_name }} is already running
-          RouterOS {{ installed_version }}.
-      when: installed_version == latest_version
-      tags:
-        - upgrade
-        - never
-
-    - name: Trigger RouterOS package installation
-      community.routeros.command:
-        commands:
-          - /system package update install
-      register: upgrade_result
-      changed_when: true
-      failed_when: false
-      when: installed_version != latest_version
-      tags:
-        - upgrade
-        - never
-
-    - name: Wait for router SSH service to stop
-      ansible.builtin.wait_for:
-        host: "{{ ansible_host | default(inventory_hostname) }}"
-        port: "{{ ansible_port | default(22) | int }}"
-        state: stopped
-        connect_timeout: 5
-        timeout: 180
-      delegate_to: localhost
-      failed_when: false
-      when: installed_version != latest_version
-      tags:
-        - upgrade
-        - never
-
-    - name: Wait for router SSH service to start
-      ansible.builtin.wait_for:
-        host: "{{ ansible_host | default(inventory_hostname) }}"
-        port: "{{ ansible_port | default(22) | int }}"
-        state: started
-        delay: 10
-        connect_timeout: 5
-        timeout: "{{ upgrade_wait_timeout }}"
-      delegate_to: localhost
-      when: installed_version != latest_version
-      tags:
-        - upgrade
-        - never
-
-    - name: Reset RouterOS connection
-      ansible.builtin.meta: reset_connection
-      when: installed_version != latest_version
-      tags:
-        - upgrade
-        - never
-
-    - name: Read RouterOS version after upgrade
-      community.routeros.command:
-        commands:
-          - /system resource get version
-      register: post_upgrade_version
-      retries: 20
-      delay: 15
-      until: post_upgrade_version is succeeded
-      changed_when: false
-      when: installed_version != latest_version
-      tags:
-        - upgrade
-        - never
-
-    - name: Show RouterOS version after upgrade
-      ansible.builtin.debug:
-        msg: >-
-          Router {{ router_name }} is online.
-          RouterOS version:
-          {{ post_upgrade_version.stdout[0] | default('unknown') | trim }}
-      when: installed_version != latest_version
-      tags:
-        - upgrade
-        - never

nextcloud/update_collabora.yml

@@ -1,92 +1,174 @@
 # nextcloud/update_collabora.yml
 
-- name: Update Collabora
-  hosts: pve2_vm
+- name: Update Collabora CODE on VM via Proxmox
+  hosts: linux_servers
   gather_facts: false
+  become: true
+  become_user: root
+  become_method: sudo
 
   vars:
-    # Compose sync (controller -> target)
-    compose_local_dir: "{{ lookup('env','PWD') }}/docker-compose"
-    compose_remote_base: "/home/{{ ansible_user }}/.ansible-compose"
-    compose_remote_dir: "{{ compose_remote_base }}/docker-compose"
-    compose_remote_archive: "{{ compose_remote_base }}/docker-compose.tar.gz"
+    # --- Connection to VM (provided by Semaphore env vars) ---
+    vm_ip:   "{{ lookup('env', 'VM_IP') }}"
+    vm_user: "{{ lookup('env', 'VM_USER') }}"
+    vm_pass: "{{ lookup('env', 'VM_PASS') }}"
+    use_sudo: false
 
-    # Collabora settings
-    collabora_project: collabora
-    collabora_compose_filename: "docker-compose-collabora.yml"
-    collabora_service: collabora
-    collabora_port: 9980
+    # --- Debug mode (controlled via Semaphore variable) ---
+    DEBUG: "{{ lookup('env', 'DEBUG') | default(0) | int }}"
+    RETRIES: "{{ lookup('env', 'RETRIES') | default(25) | int }}"
+
+    # --- Collabora specifics ---
+    collabora_debug_caps: true
+    collabora_caps_url: "https://collabora.martinfencl.eu/hosting/capabilities"
+
+    # Use the FULL Nextcloud stack compose file; only target the 'collabora' service inside it
+    collabora_project: "nextcloud-collabora"
+    collabora_compose_file: "/data/compose/nextcloud/nextcloud-collabora.yml"
+    collabora_service: "collabora"
+
+    # Docker command prefix (consistent behavior and quiet hints)
+    docker_prefix: "unalias docker 2>/dev/null || true; DOCKER_CLI_HINTS=0; command docker"
+
+    # Commands to run on the target VM (quiet outputs)
+    collabora_commands:
+      - "{{ docker_prefix }} pull -q collabora/code:latest >/dev/null"
+      - "{{ docker_prefix }} compose -p {{ collabora_project }} -f {{ collabora_compose_file }} pull {{ collabora_service }} >/dev/null"
+      - "{{ docker_prefix }} compose -p {{ collabora_project }} -f {{ collabora_compose_file }} up -d --no-deps --force-recreate {{ collabora_service }} >/dev/null"
 
   tasks:
-    - name: Ensure remote base directory exists
-      ansible.builtin.file:
-        path: "{{ compose_remote_base }}"
-        state: directory
-        mode: "0755"
+    - name: Ensure sshpass is installed (for password-based SSH)  # English comments
+      ansible.builtin.apt:
+        name: sshpass
+        state: present
+        update_cache: yes
 
-    - name: Create local archive of docker-compose directory (controller)
-      ansible.builtin.archive:
-        path: "{{ compose_local_dir }}/"
-        dest: "/tmp/docker-compose.tar.gz"
-        format: gz
+    - name: Run Collabora update commands on VM (via SSH)  # use SSHPASS env, hide item value
+      ansible.builtin.command:
+        argv:
+          - sshpass
+          - -e
+          - ssh
+          - -o
+          - StrictHostKeyChecking=no
+          - -o
+          - ConnectTimeout=15
+          - "{{ vm_user }}@{{ vm_ip }}"
+          - bash
+          - -lc
+          - "{{ ('sudo ' if use_sudo else '') + item }}"
+      environment:
+        SSHPASS: "{{ vm_pass }}"
+      loop: "{{ collabora_commands }}"
+      loop_control:
+        index_var: idx              # <-- capture loop index here
+        label: "cmd-{{ idx }}"      # <-- use idx instead of loop.index
+      register: collab_cmds
+      changed_when: false
+      no_log: "{{ DEBUG == 0 }}"
+
+    - name: Show outputs for each Collabora command
+      ansible.builtin.debug:
+        msg: |
+          CMD: {{ item.item }}
+          RC:  {{ item.rc }}
+          STDOUT:
+          {{ (item.stdout | default('')).strip() }}
+          STDERR:
+          {{ (item.stderr | default('')).strip() }}
+      loop: "{{ collab_cmds.results }}"
+      when: DEBUG == 1
+
+    - name: Fail play if any Collabora command failed  # also hide item label
+      ansible.builtin.assert:
+        that: "item.rc == 0"
+        fail_msg: "Collabora update failed on VM: {{ item.item }} (rc={{ item.rc }})"
+        success_msg: "All Collabora update commands succeeded."
+      loop: "{{ collab_cmds.results }}"
+      loop_control:
+        index_var: idx
+        label: "cmd-{{ idx }}"
+
+    # -------------------------
+    # Readiness checks (controller first, then VM fallback)
+    # -------------------------
+
+    - name: Collabora | Wait for capabilities (controller first)
+      ansible.builtin.uri:
+        url: "{{ collabora_caps_url }}"
+        method: GET
+        return_content: true
+        validate_certs: true
+        status_code: 200
+      register: caps_controller
       delegate_to: localhost
       run_once: true
-
-    - name: Upload archive to remote host
-      ansible.builtin.copy:
-        src: "/tmp/docker-compose.tar.gz"
-        dest: "{{ compose_remote_archive }}"
-        mode: "0644"
-
-    - name: Recreate remote compose directory
-      ansible.builtin.file:
-        path: "{{ compose_remote_dir }}"
-        state: absent
-
-    - name: Ensure remote compose directory exists
-      ansible.builtin.file:
-        path: "{{ compose_remote_dir }}"
-        state: directory
-        mode: "0755"
-
-    - name: Extract archive on remote host
-      ansible.builtin.unarchive:
-        src: "{{ compose_remote_archive }}"
-        dest: "{{ compose_remote_dir }}"
-        remote_src: true
-
-    - name: Pull latest Collabora image
-      community.docker.docker_compose_v2:
-        project_name: "{{ collabora_project }}"
-        project_src: "{{ compose_remote_dir }}"
-        files:
-          - "{{ collabora_compose_filename }}"
-        pull: always
-
-    - name: Recreate Collabora service
-      community.docker.docker_compose_v2:
-        project_name: "{{ collabora_project }}"
-        project_src: "{{ compose_remote_dir }}"
-        files:
-          - "{{ collabora_compose_filename }}"
-        services:
-          - "{{ collabora_service }}"
-        state: present
-        recreate: always
-
-    - name: Wait for Collabora port
-      ansible.builtin.wait_for:
-        host: 127.0.0.1
-        port: "{{ collabora_port }}"
-        timeout: 120
-
-    - name: Check Collabora discovery endpoint (retry until ready)
-      ansible.builtin.uri:
-        url: "http://127.0.0.1:{{ collabora_port }}/hosting/discovery"
-        status_code: 200
-        return_content: true
-      register: collabora_http
-      retries: 40
-      delay: 3
-      until: collabora_http.status == 200 and ('<wopi-discovery' in (collabora_http.content | default('')))
+      retries: "{{ RETRIES }}"
+      delay: 2
+      until: caps_controller.status == 200
+      failed_when: false
       changed_when: false
+
+    - name: Collabora | VM-side fetch (pure JSON via Python)  # use SSHPASS env here too
+      ansible.builtin.command:
+        argv:
+          - sshpass
+          - -e
+          - ssh
+          - -o
+          - StrictHostKeyChecking=no
+          - -o
+          - ConnectTimeout=15
+          - "{{ vm_user }}@{{ vm_ip }}"
+          - bash
+          - -lc
+          - |
+            python3 - <<'PY'
+            import json, urllib.request, sys
+            try:
+                with urllib.request.urlopen("{{ collabora_caps_url }}", timeout=15) as r:
+                    sys.stdout.write(r.read().decode())
+            except Exception:
+                pass
+            PY
+      environment:
+        SSHPASS: "{{ vm_pass }}"
+      register: caps_vm
+      changed_when: false
+      failed_when: false
+      when: caps_controller.status | default(0) != 200 or caps_controller.json is not defined
+      no_log: "{{ DEBUG == 0 }}"
+
+    - name: Collabora | Choose JSON (controller wins, else VM)
+      ansible.builtin.set_fact:
+        collab_caps_json: >-
+          {{
+            (caps_controller.json
+              if (caps_controller.status|default(0))==200 and (caps_controller.json is defined)
+              else (
+                (caps_vm.stdout | default('') | trim | length > 0)
+                | ternary((caps_vm.stdout | trim | from_json), omit)
+              )
+            )
+          }}
+      failed_when: false
+
+    - name: Collabora | Print concise summary
+      ansible.builtin.debug:
+        msg: >-
+          Collabora {{ collab_caps_json.productVersion | default('?') }}
+          ({{ collab_caps_json.productName | default('?') }}),
+          convert-to.available={{ collab_caps_json['convert-to']['available'] | default('n/a') }},
+          serverId={{ collab_caps_json.serverId | default('n/a') }}
+      when: collab_caps_json is defined and DEBUG == 1
+
+    - name: Collabora | Capabilities unavailable (after retries)
+      ansible.builtin.debug:
+        msg: "Capabilities endpoint není dostupný ani po pokusech."
+      when: collab_caps_json is not defined and DEBUG == 1
+
+    # Optional full JSON (debug)
+    - name: Collabora | Full JSON (debug)
+      ansible.builtin.debug:
+        var: collab_caps_json
+      when: collabora_debug_caps and (collab_caps_json is defined) and DEBUG == 1

nextcloud/update_nextcloud_v2.yml

@@ -1,287 +1,113 @@
-# nextcloud/update_nextcloud.yml
-
-- name: Update Nextcloud on VM via Proxmox
-  hosts: proxmox_nextcloud  # linux_servers
-  gather_facts: false
+- name: Update Nextcloud (Ansible-native)
+  hosts: proxmox_nextcloud
   become: true
-  become_user: root
-  become_method: sudo
+  gather_facts: false
 
   vars:
-    # --- Connection to VM (provided by Semaphore env vars) ---
-    vm_ip:   "{{ lookup('env', 'VM_IP') }}"
-    vm_user: "{{ lookup('env', 'VM_USER') }}"
-    vm_pass: "{{ lookup('env', 'VM_PASS') }}"
-    use_sudo: false
-
-    # --- Debug / retries ---
     DEBUG: "{{ lookup('env', 'DEBUG') | default(0) | int }}"
     RETRIES: "{{ lookup('env', 'RETRIES') | default(25) | int }}"
 
-    # --- Nextcloud specifics ---
     nextcloud_project: "nextcloud-collabora"
-    nextcloud_compose_file: "/data/compose/nextcloud/docker-compose-nextcloud.yml"
-    nextcloud_service: "nextcloud"
-
-    # Backup directory on the VM (timestamped on controller)
-    backup_dir: "/data/compose/nextcloud/backup-{{ lookup('pipe', 'date +%F-%H%M%S') }}"
+    compose_file: "/data/compose/nextcloud/docker-compose-nextcloud.yml"
+    backup_dir: "/data/compose/nextcloud/backup-{{ ansible_date_time.iso8601_basic_short }}"
 
     nextcloud_base_url: "https://cloud.martinfencl.eu"
     nextcloud_status_url: "{{ nextcloud_base_url }}/status.php"
 
-    # Docker command prefix (consistent behavior and quiet hints)
-    docker_prefix: "unalias docker 2>/dev/null || true; DOCKER_CLI_HINTS=0; command docker"
-    
-    # --- Backup phase commands (run on VM) ---
-    nextcloud_backup_commands:
-      - >-
-        mkdir -p "{{ backup_dir }}"
-      - >-
-        {{ docker_prefix }} exec -u www-data nextcloud php occ maintenance:mode --on
-      - >-
-        {{ docker_prefix }} exec nextcloud sh -c 'tar czf /tmp/nextcloud_conf.tgz -C /var/www/html config custom_apps'
-      - >-
-        {{ docker_prefix }} cp nextcloud:/tmp/nextcloud_conf.tgz "{{ backup_dir }}/nextcloud_conf.tgz"
-      - >-
-        {{ docker_prefix }} exec nextcloud rm /tmp/nextcloud_conf.tgz || true
-      - >-
-        {{ docker_prefix }} exec nextcloud-db sh -c 'command -v mariadb-dump >/dev/null && mariadb-dump -u"$MYSQL_USER" -p"$MYSQL_PASSWORD" "$MYSQL_DATABASE" || mysqldump -u"$MYSQL_USER" -p"$MYSQL_PASSWORD" "$MYSQL_DATABASE"' > "{{ backup_dir }}/db.sql"
-
-    # --- Upgrade phase commands (run on VM) ---
-    nextcloud_upgrade_commands:
-      - >-
-        {{ docker_prefix }} compose -p {{ nextcloud_project }} -f {{ nextcloud_compose_file }} pull {{ nextcloud_service }}
-      - >-
-        {{ docker_prefix }} compose -p {{ nextcloud_project }} -f {{ nextcloud_compose_file }} up -d --no-deps --force-recreate {{ nextcloud_service }}
-      - >-
-        {{ docker_prefix }} exec -u www-data nextcloud php occ maintenance:mode --off
-      - >-
-        {{ docker_prefix }} exec -u www-data nextcloud php occ upgrade
-      - >-
-        {{ docker_prefix }} exec -u www-data nextcloud php occ app:update --all || true
-      - >-
-        {{ docker_prefix }} exec -u www-data nextcloud php occ maintenance:repair --include-expensive || true
-      - >-
-        {{ docker_prefix }} exec -u www-data nextcloud php occ maintenance:mode --on
-
   tasks:
-    - name: Ensure sshpass is installed (for password-based SSH)
-      ansible.builtin.apt:
-        name: sshpass
-        state: present
-        update_cache: yes
-
-    - name: Nextcloud | Show current version before upgrade (DEBUG)
-      ansible.builtin.command:
-        argv:
-          - sshpass
-          - -e
-          - ssh
-          - -o
-          - StrictHostKeyChecking=no
-          - -o
-          - ConnectTimeout=15
-          - "{{ vm_user }}@{{ vm_ip }}"
-          - bash
-          - -lc
-          - 'docker exec -u www-data nextcloud php occ -V || true'
-      environment:
-        SSHPASS: "{{ vm_pass }}"
-      register: nc_version_before
+    # -------------------------
+    # Pre-check
+    # -------------------------
+    - name: Show current Nextcloud version (DEBUG)
+      command: docker exec -u www-data nextcloud php occ -V
+      register: nc_version
       changed_when: false
       failed_when: false
       when: DEBUG == 1
 
-    # -------------------------
-    # Backup phase
-    # -------------------------
-    - name: Nextcloud | Run backup commands on VM (via SSH)  # run plain commands via SSH
-      ansible.builtin.command:
-        argv:
-          - sshpass
-          - -e
-          - ssh
-          - -o
-          - StrictHostKeyChecking=no
-          - -o
-          - ConnectTimeout=15
-          - "{{ vm_user }}@{{ vm_ip }}"
-          - "{{ ('sudo ' if use_sudo else '') + item }}"
-      environment:
-        SSHPASS: "{{ vm_pass }}"
-      loop: "{{ nextcloud_backup_commands }}"
-      loop_control:
-        index_var: idx
-        label: "backup-cmd-{{ idx }}"
-      register: nc_backup_cmds
-      changed_when: false
-      no_log: "{{ DEBUG == 0 }}"
-
-    - name: Nextcloud | Show outputs of backup commands (DEBUG)
-      ansible.builtin.debug:
-        msg: |
-          CMD: {{ item.item }}
-          RC:  {{ item.rc }}
-          STDOUT:
-          {{ (item.stdout | default('')).strip() }}
-          STDERR:
-          {{ (item.stderr | default('')).strip() }}
-      loop: "{{ nc_backup_cmds.results }}"
+    - debug:
+        var: nc_version.stdout
       when: DEBUG == 1
 
-    - name: Nextcloud | Fail play if any backup command failed
-      ansible.builtin.assert:
-        that: "item.rc == 0"
-        fail_msg: "Nextcloud backup step failed on VM: {{ item.item }} (rc={{ item.rc }})"
-        success_msg: "All Nextcloud backup commands succeeded."
-      loop: "{{ nc_backup_cmds.results }}"
-      loop_control:
-        index_var: idx
-        label: "backup-cmd-{{ idx }}"
+    # -------------------------
+    # Backup
+    # -------------------------
+    - name: Enable maintenance mode
+      command: docker exec -u www-data nextcloud php occ maintenance:mode --on
+
+    - name: Create backup directory
+      file:
+        path: "{{ backup_dir }}"
+        state: directory
+
+    - name: Backup config and custom_apps
+      command: >
+        docker exec nextcloud
+        tar czf /tmp/nextcloud_conf.tgz -C /var/www/html config custom_apps
+
+    - name: Copy config backup out of container
+      command: docker cp nextcloud:/tmp/nextcloud_conf.tgz {{ backup_dir }}/
+
+    - name: Remove temp archive from container
+      command: docker exec nextcloud rm -f /tmp/nextcloud_conf.tgz
+
+    - name: Backup database
+      shell: >
+        docker exec nextcloud-db sh -c
+        'command -v mariadb-dump >/dev/null &&
+         mariadb-dump -u"$MYSQL_USER" -p"$MYSQL_PASSWORD" "$MYSQL_DATABASE" ||
+         mysqldump -u"$MYSQL_USER" -p"$MYSQL_PASSWORD" "$MYSQL_DATABASE"'
+      register: db_dump
+
+    - name: Save database dump
+      copy:
+        content: "{{ db_dump.stdout }}"
+        dest: "{{ backup_dir }}/db.sql"
 
     # -------------------------
-    # Upgrade phase
+    # Upgrade
     # -------------------------
+    - name: Pull new Nextcloud image
+      command: docker compose -p {{ nextcloud_project }} -f {{ compose_file }} pull nextcloud
 
-    - name: Nextcloud | Run upgrade commands on VM (via SSH)
-      ansible.builtin.command:
-        argv:
-          - sshpass
-          - -e
-          - ssh
-          - -o
-          - StrictHostKeyChecking=no
-          - -o
-          - ConnectTimeout=15
-          - "{{ vm_user }}@{{ vm_ip }}"
-          - bash
-          - -lc
-          - "{{ ('sudo ' if use_sudo else '') + item }}"
-      environment:
-        SSHPASS: "{{ vm_pass }}"
-      loop: "{{ nextcloud_upgrade_commands }}"
-      loop_control:
-        index_var: idx
-        label: "upgrade-cmd-{{ idx }}"
-      register: nc_upgrade_cmds
-      changed_when: false
+    - name: Recreate Nextcloud container
+      command: docker compose -p {{ nextcloud_project }} -f {{ compose_file }}
+               up -d --no-deps --force-recreate nextcloud
+
+    - name: Run Nextcloud upgrade
+      command: docker exec -u www-data nextcloud php occ upgrade
+
+    - name: Update apps
+      command: docker exec -u www-data nextcloud php occ app:update --all
       failed_when: false
-      no_log: "{{ DEBUG == 0 }}"
 
-    - name: Nextcloud | Show outputs of upgrade commands (DEBUG)
-      ansible.builtin.debug:
-        msg: |
-          CMD: {{ item.item }}
-          RC:  {{ item.rc }}
-          STDOUT:
-          {{ (item.stdout | default('')).strip() }}
-          STDERR:
-          {{ (item.stderr | default('')).strip() }}
-      loop: "{{ nc_upgrade_cmds.results }}"
-      when: DEBUG == 1
+    - name: Run maintenance repair
+      command: docker exec -u www-data nextcloud php occ maintenance:repair --include-expensive
+      failed_when: false
 
-    - name: Nextcloud | Fail play if any upgrade command failed
-      ansible.builtin.assert:
-        that: "item.rc == 0"
-        fail_msg: "Nextcloud upgrade step failed on VM: {{ item.item }} (rc={{ item.rc }})"
-        success_msg: "All Nextcloud upgrade commands succeeded."
-      loop: "{{ nc_upgrade_cmds.results }}"
-      loop_control:
-        index_var: idx
-        label: "upgrade-cmd-{{ idx }}"
-
-    - name: Nextcloud | Disable maintenance mode (only after successful upgrade)
-      ansible.builtin.command:
-        argv:
-          - sshpass
-          - -e
-          - ssh
-          - -o
-          - StrictHostKeyChecking=no
-          - -o
-          - ConnectTimeout=15
-          - "{{ vm_user }}@{{ vm_ip }}"
-          - "{{ ('sudo ' if use_sudo else '') }}docker exec -u www-data nextcloud php occ maintenance:mode --off"
-      environment:
-        SSHPASS: "{{ vm_pass }}"
-      register: nc_maint_off
-      changed_when: false
-      no_log: "{{ DEBUG == 0 }}"
+    - name: Disable maintenance mode
+      command: docker exec -u www-data nextcloud php occ maintenance:mode --off
 
     # -------------------------
-    # Readiness check (status.php)
+    # Readiness check
     # -------------------------
-
-    - name: Nextcloud | Wait for status.php (controller first)
-      ansible.builtin.uri:
+    - name: Wait for status.php
+      uri:
         url: "{{ nextcloud_status_url }}"
-        method: GET
+        status_code: 200
         return_content: true
         validate_certs: true
-        status_code: 200
-      register: nc_status_controller
-      delegate_to: localhost
-      run_once: true
+      register: nc_status
       retries: "{{ RETRIES }}"
       delay: 4
-      until: nc_status_controller.status == 200
-      failed_when: false
+      until: nc_status.status == 200
       changed_when: false
 
-    - name: Nextcloud | VM-side fetch status.php (JSON via Python)
-      ansible.builtin.command:
-        argv:
-          - sshpass
-          - -e
-          - ssh
-          - -o
-          - StrictHostKeyChecking=no
-          - -o
-          - ConnectTimeout=15
-          - "{{ vm_user }}@{{ vm_ip }}"
-          - bash
-          - -lc
-          - |
-            python3 - <<'PY'
-            import json, urllib.request, sys
-            try:
-                with urllib.request.urlopen("{{ nextcloud_status_url }}", timeout=15) as r:
-                    sys.stdout.write(r.read().decode())
-            except Exception:
-                pass
-            PY
-      environment:
-        SSHPASS: "{{ vm_pass }}"
-      register: nc_status_vm
-      changed_when: false
-      failed_when: false
-      when: nc_status_controller.status | default(0) != 200 or nc_status_controller.json is not defined
-      no_log: "{{ DEBUG == 0 }}"
-
-    - name: Nextcloud | Choose status JSON (controller wins, else VM)
-      ansible.builtin.set_fact:
-        nextcloud_status_json: >-
-          {{
-            (nc_status_controller.json
-              if (nc_status_controller.status | default(0)) == 200 and (nc_status_controller.json is defined)
-              else (
-                (nc_status_vm.stdout | default('') | trim | length > 0)
-                | ternary((nc_status_vm.stdout | trim | from_json), omit)
-              )
-            )
-          }}
-      failed_when: false
-
-    - name: Nextcloud | Print concise status summary (DEBUG)
-      ansible.builtin.debug:
-        msg: >-
-          Nextcloud {{ nextcloud_status_json.version | default('?') }}
-          (installed={{ nextcloud_status_json.installed | default('?') }},
-          maintenance={{ nextcloud_status_json.maintenance | default('?') }},
-          needsDbUpgrade={{ nextcloud_status_json.needsDbUpgrade | default('?') }})
-      when: nextcloud_status_json is defined and DEBUG == 1
-
-    - name: Nextcloud | Status JSON not available (DEBUG)
-      ansible.builtin.debug:
-        msg: "status.php is not reachable or did not return JSON."
-      when: nextcloud_status_json is not defined and DEBUG == 1
+    - name: Print status summary (DEBUG)
+      debug:
+        msg: >
+          Nextcloud {{ nc_status.json.version }}
+          (installed={{ nc_status.json.installed }},
+           maintenance={{ nc_status.json.maintenance }},
+           needsDbUpgrade={{ nc_status.json.needsDbUpgrade }})
+      when: DEBUG == 1

old/update_collabora.yml

@@ -1,174 +0,0 @@
-# nextcloud/update_collabora.yml
-
-- name: Update Collabora CODE on VM via Proxmox
-  hosts: linux_servers
-  gather_facts: false
-  become: true
-  become_user: root
-  become_method: sudo
-
-  vars:
-    # --- Connection to VM (provided by Semaphore env vars) ---
-    vm_ip:   "{{ lookup('env', 'VM_IP') }}"
-    vm_user: "{{ lookup('env', 'VM_USER') }}"
-    vm_pass: "{{ lookup('env', 'VM_PASS') }}"
-    use_sudo: false
-
-    # --- Debug mode (controlled via Semaphore variable) ---
-    DEBUG: "{{ lookup('env', 'DEBUG') | default(0) | int }}"
-    RETRIES: "{{ lookup('env', 'RETRIES') | default(25) | int }}"
-
-    # --- Collabora specifics ---
-    collabora_debug_caps: true
-    collabora_caps_url: "https://collabora.martinfencl.eu/hosting/capabilities"
-
-    # Use the FULL Nextcloud stack compose file; only target the 'collabora' service inside it
-    collabora_project: "nextcloud-collabora"
-    collabora_compose_file: "/data/compose/nextcloud/nextcloud-collabora.yml"
-    collabora_service: "collabora"
-
-    # Docker command prefix (consistent behavior and quiet hints)
-    docker_prefix: "unalias docker 2>/dev/null || true; DOCKER_CLI_HINTS=0; command docker"
-
-    # Commands to run on the target VM (quiet outputs)
-    collabora_commands:
-      - "{{ docker_prefix }} pull -q collabora/code:latest >/dev/null"
-      - "{{ docker_prefix }} compose -p {{ collabora_project }} -f {{ collabora_compose_file }} pull {{ collabora_service }} >/dev/null"
-      - "{{ docker_prefix }} compose -p {{ collabora_project }} -f {{ collabora_compose_file }} up -d --no-deps --force-recreate {{ collabora_service }} >/dev/null"
-
-  tasks:
-    - name: Ensure sshpass is installed (for password-based SSH)  # English comments
-      ansible.builtin.apt:
-        name: sshpass
-        state: present
-        update_cache: yes
-
-    - name: Run Collabora update commands on VM (via SSH)  # use SSHPASS env, hide item value
-      ansible.builtin.command:
-        argv:
-          - sshpass
-          - -e
-          - ssh
-          - -o
-          - StrictHostKeyChecking=no
-          - -o
-          - ConnectTimeout=15
-          - "{{ vm_user }}@{{ vm_ip }}"
-          - bash
-          - -lc
-          - "{{ ('sudo ' if use_sudo else '') + item }}"
-      environment:
-        SSHPASS: "{{ vm_pass }}"
-      loop: "{{ collabora_commands }}"
-      loop_control:
-        index_var: idx              # <-- capture loop index here
-        label: "cmd-{{ idx }}"      # <-- use idx instead of loop.index
-      register: collab_cmds
-      changed_when: false
-      no_log: "{{ DEBUG == 0 }}"
-
-    - name: Show outputs for each Collabora command
-      ansible.builtin.debug:
-        msg: |
-          CMD: {{ item.item }}
-          RC:  {{ item.rc }}
-          STDOUT:
-          {{ (item.stdout | default('')).strip() }}
-          STDERR:
-          {{ (item.stderr | default('')).strip() }}
-      loop: "{{ collab_cmds.results }}"
-      when: DEBUG == 1
-
-    - name: Fail play if any Collabora command failed  # also hide item label
-      ansible.builtin.assert:
-        that: "item.rc == 0"
-        fail_msg: "Collabora update failed on VM: {{ item.item }} (rc={{ item.rc }})"
-        success_msg: "All Collabora update commands succeeded."
-      loop: "{{ collab_cmds.results }}"
-      loop_control:
-        index_var: idx
-        label: "cmd-{{ idx }}"
-
-    # -------------------------
-    # Readiness checks (controller first, then VM fallback)
-    # -------------------------
-
-    - name: Collabora | Wait for capabilities (controller first)
-      ansible.builtin.uri:
-        url: "{{ collabora_caps_url }}"
-        method: GET
-        return_content: true
-        validate_certs: true
-        status_code: 200
-      register: caps_controller
-      delegate_to: localhost
-      run_once: true
-      retries: "{{ RETRIES }}"
-      delay: 2
-      until: caps_controller.status == 200
-      failed_when: false
-      changed_when: false
-
-    - name: Collabora | VM-side fetch (pure JSON via Python)  # use SSHPASS env here too
-      ansible.builtin.command:
-        argv:
-          - sshpass
-          - -e
-          - ssh
-          - -o
-          - StrictHostKeyChecking=no
-          - -o
-          - ConnectTimeout=15
-          - "{{ vm_user }}@{{ vm_ip }}"
-          - bash
-          - -lc
-          - |
-            python3 - <<'PY'
-            import json, urllib.request, sys
-            try:
-                with urllib.request.urlopen("{{ collabora_caps_url }}", timeout=15) as r:
-                    sys.stdout.write(r.read().decode())
-            except Exception:
-                pass
-            PY
-      environment:
-        SSHPASS: "{{ vm_pass }}"
-      register: caps_vm
-      changed_when: false
-      failed_when: false
-      when: caps_controller.status | default(0) != 200 or caps_controller.json is not defined
-      no_log: "{{ DEBUG == 0 }}"
-
-    - name: Collabora | Choose JSON (controller wins, else VM)
-      ansible.builtin.set_fact:
-        collab_caps_json: >-
-          {{
-            (caps_controller.json
-              if (caps_controller.status|default(0))==200 and (caps_controller.json is defined)
-              else (
-                (caps_vm.stdout | default('') | trim | length > 0)
-                | ternary((caps_vm.stdout | trim | from_json), omit)
-              )
-            )
-          }}
-      failed_when: false
-
-    - name: Collabora | Print concise summary
-      ansible.builtin.debug:
-        msg: >-
-          Collabora {{ collab_caps_json.productVersion | default('?') }}
-          ({{ collab_caps_json.productName | default('?') }}),
-          convert-to.available={{ collab_caps_json['convert-to']['available'] | default('n/a') }},
-          serverId={{ collab_caps_json.serverId | default('n/a') }}
-      when: collab_caps_json is defined and DEBUG == 1
-
-    - name: Collabora | Capabilities unavailable (after retries)
-      ansible.builtin.debug:
-        msg: "Capabilities endpoint není dostupný ani po pokusech."
-      when: collab_caps_json is not defined and DEBUG == 1
-
-    # Optional full JSON (debug)
-    - name: Collabora | Full JSON (debug)
-      ansible.builtin.debug:
-        var: collab_caps_json
-      when: collabora_debug_caps and (collab_caps_json is defined) and DEBUG == 1

old/update_homarr.yml

@@ -1,194 +0,0 @@
-# update_homarr.yml
-
-- name: Update Homarr on VM via Proxmox
-  hosts: linux_servers
-  gather_facts: false
-  become: true
-  become_user: root
-  become_method: sudo
-
-  vars:
-    # VM connection (provided by Semaphore env vars)
-    vm_ip:   "{{ lookup('env', 'VM_IP') }}"
-    vm_user: "{{ lookup('env', 'VM_USER') }}"
-    vm_pass: "{{ lookup('env', 'VM_PASS') }}"
-    use_sudo: false
-
-    # --- Debug mode (controlled via Semaphore variable) ---
-    DEBUG: "{{ lookup('env', 'DEBUG') | default(0) | int }}"
-    RETRIES: "{{ lookup('env', 'RETRIES') | default(25) | int }}"
-
-    # Homarr specifics
-    homarr_project: "homarr"
-    homarr_compose_file: "/data/compose/homarr/docker-compose-homarr.yml"
-    homarr_service: "homarr"
-    homarr_image: "ghcr.io/homarr-labs/homarr:latest"
-    homarr_port: 7575
-
-    # Optional external URL for controller-side readiness check (e.g., https://homarr.example.com)
-    # If empty/undefined, controller check is skipped and we only probe from the VM.
-    homarr_url: "{{ lookup('env', 'HOMARR_URL') | default('', true) }}"
-
-    # Fixed container name used in your compose (avoid conflicts with any leftover container)
-    homarr_container_name: "homarr"
-
-    # Retry policy (same pattern as Kuma): 25x with 2s delay
-    homarr_retries: "{{ RETRIES }}"
-    homarr_delay: 2
-
-    # Docker command prefix (consistent behavior)
-    docker_prefix: "unalias docker 2>/dev/null || true; DOCKER_CLI_HINTS=0; command docker"
-
-    # Commands to run on the target VM (quiet outputs)
-    homarr_commands:
-      - "{{ docker_prefix }} pull -q {{ homarr_image }} >/dev/null"
-      - "{{ docker_prefix }} compose -p {{ homarr_project }} -f {{ homarr_compose_file }} pull {{ homarr_service }} >/dev/null"
-      # remove conflicting container name before compose up (silently)
-      - "{{ docker_prefix }} rm -f {{ homarr_container_name }} >/dev/null 2>&1 || true"
-      - "{{ docker_prefix }} compose -p {{ homarr_project }} -f {{ homarr_compose_file }} up -d --no-deps --force-recreate {{ homarr_service }} >/dev/null"
-
-  tasks:
-    - name: Ensure sshpass is installed (for password-based SSH)  # English comments
-      ansible.builtin.apt:
-        name: sshpass
-        state: present
-        update_cache: yes
-
-    - name: Run Homarr update commands on VM (via SSH)  # use SSHPASS env, hide item label
-      ansible.builtin.command:
-        argv:
-          - sshpass
-          - -e                     # read password from SSHPASS environment
-          - ssh
-          - -o
-          - StrictHostKeyChecking=no
-          - -o
-          - ConnectTimeout=15
-          - "{{ vm_user }}@{{ vm_ip }}"
-          - bash
-          - -lc
-          - "{{ ('sudo ' if use_sudo else '') + item }}"
-      environment:
-        SSHPASS: "{{ vm_pass }}"    # supply password via environment
-      loop: "{{ homarr_commands }}"
-      loop_control:
-        index_var: idx              # capture loop index
-        label: "cmd-{{ idx }}"      # avoid printing full command in (item=...) line
-      register: homarr_cmds
-      changed_when: false
-      no_log: "{{ DEBUG == 0 }}"    # hide outputs and env when not debugging
-
-    - name: Show outputs for each Homarr command
-      ansible.builtin.debug:
-        msg: |
-          CMD: {{ item.item }}
-          RC:  {{ item.rc }}
-          STDOUT:
-          {{ (item.stdout | default('')).strip() }}
-          STDERR:
-          {{ (item.stderr | default('')).strip() }}
-      loop: "{{ homarr_cmds.results }}"
-      when: DEBUG == 1
-
-    - name: Fail play if any Homarr command failed  # also hide item label
-      ansible.builtin.assert:
-        that: "item.rc == 0"
-        fail_msg: "Homarr update failed on VM: {{ item.item }} (rc={{ item.rc }})"
-        success_msg: "All Homarr update commands succeeded."
-      loop: "{{ homarr_cmds.results }}"
-      loop_control:
-        index_var: idx
-        label: "cmd-{{ idx }}"
-
-    # -------------------------
-    # Readiness checks (controller first, then VM fallback)
-    # -------------------------
-
-    - name: Homarr | Wait for homepage (controller first, with retries)
-      ansible.builtin.uri:
-        url: "{{ (homarr_url | regex_replace('/$','')) + '/' }}"
-        method: GET
-        return_content: true
-        # Validate TLS only when using https://
-        validate_certs: "{{ (homarr_url | default('')) is match('^https://') }}"
-        status_code: 200
-      register: homarr_controller
-      delegate_to: localhost
-      run_once: true
-      when: homarr_url is defined and (homarr_url | length) > 0
-      retries: "{{ homarr_retries }}"
-      delay: "{{ homarr_delay }}"
-      until: homarr_controller.status == 200
-      failed_when: false
-      changed_when: false
-
-    - name: Homarr | VM-side fetch (HTML via Python, with retries)  # use SSHPASS env here too
-      ansible.builtin.command:
-        argv:
-          - sshpass
-          - -e
-          - ssh
-          - -o
-          - StrictHostKeyChecking=no
-          - -o
-          - ConnectTimeout=15
-          - "{{ vm_user }}@{{ vm_ip }}"
-          - bash
-          - -lc
-          - |
-            python3 - <<'PY'
-            # Fetch Homarr homepage from localhost and print HTML to stdout
-            import urllib.request, sys
-            try:
-                with urllib.request.urlopen("http://127.0.0.1:{{ homarr_port }}/", timeout=15) as r:
-                    sys.stdout.write(r.read().decode(errors='ignore'))
-            except Exception:
-                pass
-            PY
-      environment:
-        SSHPASS: "{{ vm_pass }}"
-      register: homarr_vm
-      changed_when: false
-      failed_when: false
-      when: homarr_controller.status | default(0) != 200 or homarr_controller.content is not defined
-      retries: "{{ homarr_retries }}"
-      delay: "{{ homarr_delay }}"
-      until: (homarr_vm.stdout | default('') | trim | length) > 0 and ('Homarr' in (homarr_vm.stdout | default('')))
-      no_log: "{{ DEBUG == 0 }}"
-
-    - name: Homarr | Choose homepage HTML (controller wins, else VM)  # safe guard against empty result
-      ansible.builtin.set_fact:
-        homarr_home_html: >-
-          {{
-            (
-              homarr_controller.content
-              if (homarr_controller is defined)
-                 and ((homarr_controller.status|default(0))==200)
-                 and (homarr_controller.content is defined)
-              else
-                 (homarr_vm.stdout | default('') | trim)
-            )
-          }}
-      when:
-        - (homarr_controller is defined and (homarr_controller.status|default(0))==200 and (homarr_controller.content is defined))
-          or ((homarr_vm.stdout | default('') | trim | length) > 0)
-
-    - name: Homarr | Print concise summary
-      ansible.builtin.debug:
-        msg: >-
-          Homarr homepage {{ 'reachable' if (homarr_home_html is defined) else 'NOT reachable' }}.
-          Source={{ 'controller' if ((homarr_controller is defined) and (homarr_controller.status|default(0))==200 and (homarr_controller.content is defined)) else 'vm' if (homarr_vm.stdout|default('')|trim|length>0) else 'n/a' }};
-          length={{ (homarr_home_html | default('')) | length }};
-          contains('Homarr')={{ (homarr_home_html is defined) and ('Homarr' in homarr_home_html) }}
-      when: DEBUG == 1
-
-    - name: Homarr | Homepage unavailable (after retries)
-      ansible.builtin.debug:
-        msg: "Homarr web není dostupný ani po pokusech."
-      when: homarr_home_html is not defined and DEBUG == 1
-
-    # Optional detailed dump (short excerpt only)
-    - name: Homarr | HTML excerpt (debug)
-      ansible.builtin.debug:
-        msg: "{{ (homarr_home_html | default(''))[:500] }}"
-      when: homarr_home_html is defined and DEBUG == 1

old/update_immich.yml

@@ -1,313 +0,0 @@
-# update_immich.yml
-
-- name: Update Immich on VM via Proxmox
-  hosts: linux_servers
-  gather_facts: false
-  become: true
-  become_user: root
-  become_method: sudo
-
-  vars:
-    # VM connection (provided by Semaphore env vars)
-    vm_ip:   "{{ lookup('env', 'VM_IP') }}"
-    vm_user: "{{ lookup('env', 'VM_USER') }}"
-    vm_pass: "{{ lookup('env', 'VM_PASS') }}"
-    use_sudo: false
-
-    # --- Debug mode (controlled via Semaphore variable) ---
-    DEBUG: "{{ lookup('env', 'DEBUG') | default(0) | int }}"
-    RETRIES: "{{ lookup('env', 'RETRIES') | default(25) | int }}"
-
-    # Immich specifics
-    immich_dir: "/opt/immich"
-    immich_project: "immich"
-    immich_compose_url: "https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml"
-    immich_compose_file: "/opt/immich/docker-compose.yml"
-    immich_override_file: "/opt/immich/docker-compose.override.yml"
-    immich_port: 2283
-
-    # Optional external URL for controller-side readiness check (e.g., https://photos.example.com)
-    immich_url: "{{ lookup('env', 'IMMICH_URL') | default('', true) }}"
-
-    # Retry policy
-    immich_retries: "{{ RETRIES }}"
-    immich_delay: 2
-
-    # Docker command prefix (consistent behavior)
-    docker_prefix: "unalias docker 2>/dev/null || true; DOCKER_CLI_HINTS=0; command docker"
-
-    # Compose command (always include override to keep local mounts separate from upstream compose)
-    immich_compose_cmd: >-
-      {{ docker_prefix }} compose
-      -p {{ immich_project }}
-      -f {{ immich_compose_file }}
-      -f {{ immich_override_file }}
-
-    # Commands to run on the target VM
-    immich_commands:
-      - "cd {{ immich_dir }}"
-
-      - |
-        cd {{ immich_dir }}
-        mkdir -p backups
-        if [ -f docker-compose.yml ]; then
-          cp -a docker-compose.yml "backups/docker-compose.yml.$(date +%F_%H%M%S).bak"
-        fi
-        if [ -f .env ]; then
-          cp -a .env "backups/.env.$(date +%F_%H%M%S).bak"
-        fi
-        if [ -f docker-compose.override.yml ]; then
-          cp -a docker-compose.override.yml "backups/docker-compose.override.yml.$(date +%F_%H%M%S).bak"
-        fi
-
-      - |
-        cd {{ immich_dir }}
-        # Download latest compose from Immich releases (requires curl or wget)
-        if command -v curl >/dev/null 2>&1; then
-          curl -fsSL -o docker-compose.yml "{{ immich_compose_url }}"
-        elif command -v wget >/dev/null 2>&1; then
-          wget -qO docker-compose.yml "{{ immich_compose_url }}"
-        else
-          echo "Neither curl nor wget is available on the VM."
-          exit 1
-        fi
-
-      - |
-        cd {{ immich_dir }}
-        # Ensure override compose exists (create if missing)
-        if [ ! -f "{{ immich_override_file }}" ]; then
-          printf '%s\n' \
-            'services:' \
-            '  immich-server:' \
-            '    volumes:' \
-            '      - /mnt/nextcloud-howard-photos:/mnt/nextcloud-howard-photos' \
-            '      - /mnt/nextcloud-kamilkaprdelka-photos:/mnt/nextcloud-kamilkaprdelka-photos' \
-            > "{{ immich_override_file }}"
-        fi
-        # Fail early if override is still missing/empty
-        test -s "{{ immich_override_file }}"
-
-
-      - |
-        cd {{ immich_dir }}
-        # Ensure .env exists. If missing, try to reconstruct it from running containers to avoid breaking DB creds.
-        python3 - <<'PY'
-        import json
-        import subprocess
-        from pathlib import Path
-
-        env_path = Path(".env")
-        if env_path.exists():
-            raise SystemExit(0)
-
-        def run(cmd):
-            p = subprocess.run(cmd, capture_output=True, text=True)
-            return p.returncode, p.stdout, p.stderr
-
-        rc, out, err = run(["bash", "-lc", "command docker inspect immich_postgres immich_server"])
-        if rc != 0 or not out.strip():
-            print("ERROR: .env is missing and cannot inspect running containers (immich_postgres/immich_server).", flush=True)
-            print("Create /opt/immich/.env manually or ensure the containers exist.", flush=True)
-            raise SystemExit(1)
-
-        data = json.loads(out)
-
-        by_name = {}
-        for c in data:
-            name = (c.get("Name") or "").lstrip("/")
-            by_name[name] = c
-
-        pg = by_name.get("immich_postgres")
-        srv = by_name.get("immich_server")
-        if not pg or not srv:
-            print("ERROR: Could not find immich_postgres and immich_server in docker inspect output.", flush=True)
-            raise SystemExit(1)
-
-        def env_map(container):
-            m = {}
-            for kv in (container.get("Config", {}).get("Env") or []):
-                if "=" in kv:
-                    k, v = kv.split("=", 1)
-                    m[k] = v
-            return m
-
-        def find_mount_source(container, dest):
-            for m in (container.get("Mounts") or []):
-                if m.get("Destination") == dest:
-                    return m.get("Source")
-            return ""
-
-        pg_env = env_map(pg)
-        db_user = pg_env.get("POSTGRES_USER", "")
-        db_pass = pg_env.get("POSTGRES_PASSWORD", "")
-        db_name = pg_env.get("POSTGRES_DB", "")
-
-        db_data = find_mount_source(pg, "/var/lib/postgresql/data")
-        upload_loc = find_mount_source(srv, "/usr/src/app/upload")
-
-        # Try to preserve the currently used image tag as IMMICH_VERSION (optional but safer)
-        immich_version = ""
-        image = (srv.get("Config", {}).get("Image") or "")
-        if ":" in image and "@" not in image:
-            immich_version = image.rsplit(":", 1)[-1]
-        elif ":" in image and "@" in image:
-            # image like repo:tag@sha256:...
-            immich_version = image.split("@", 1)[0].rsplit(":", 1)[-1]
-
-        missing = []
-        for k, v in [
-            ("DB_USERNAME", db_user),
-            ("DB_PASSWORD", db_pass),
-            ("DB_DATABASE_NAME", db_name),
-            ("DB_DATA_LOCATION", db_data),
-            ("UPLOAD_LOCATION", upload_loc),
-        ]:
-            if not v:
-                missing.append(k)
-
-        if missing:
-            print("ERROR: Could not reconstruct these .env values from containers: " + ", ".join(missing), flush=True)
-            raise SystemExit(1)
-
-        lines = [
-            f"UPLOAD_LOCATION={upload_loc}",
-            f"DB_DATA_LOCATION={db_data}",
-            f"DB_USERNAME={db_user}",
-            f"DB_PASSWORD={db_pass}",
-            f"DB_DATABASE_NAME={db_name}",
-        ]
-        if immich_version:
-            lines.append(f"IMMICH_VERSION={immich_version}")
-
-        env_path.write_text("\n".join(lines) + "\n", encoding="utf-8")
-        print("Created .env from running containers.", flush=True)
-        PY
-
-      - |
-        cd {{ immich_dir }}
-        # Comment out healthcheck.start_interval if present (safe no-op if missing)
-        sed -i -E 's/^([[:space:]]*)start_interval:/\1# start_interval:/' docker-compose.yml || true
-
-      - "cd {{ immich_dir }} && {{ immich_compose_cmd }} config >/dev/null"
-      - "cd {{ immich_dir }} && {{ immich_compose_cmd }} pull >/dev/null"
-      - "cd {{ immich_dir }} && {{ immich_compose_cmd }} up -d --remove-orphans --force-recreate >/dev/null"
-
-  tasks:
-    - name: Ensure sshpass is installed (for password-based SSH)  # English comments
-      ansible.builtin.apt:
-        name: sshpass
-        state: present
-        update_cache: yes
-
-    - name: Run Immich update commands on VM (via SSH)  # use SSHPASS env, hide item label
-      ansible.builtin.command:
-        argv:
-          - sshpass
-          - -e
-          - ssh
-          - -o
-          - StrictHostKeyChecking=no
-          - -o
-          - ConnectTimeout=15
-          - "{{ vm_user }}@{{ vm_ip }}"
-          - bash
-          - -lc
-          - "{{ ('sudo ' if use_sudo else '') + item }}"
-      environment:
-        SSHPASS: "{{ vm_pass }}"
-      loop: "{{ immich_commands }}"
-      loop_control:
-        index_var: idx
-        label: "cmd-{{ idx }}"
-      register: immich_cmds
-      changed_when: false
-      no_log: "{{ DEBUG == 0 }}"
-      run_once: true
-
-    - name: Show outputs for each Immich command
-      ansible.builtin.debug:
-        msg: |
-          CMD: {{ item.item }}
-          RC:  {{ item.rc }}
-          STDOUT:
-          {{ (item.stdout | default('')).strip() }}
-          STDERR:
-          {{ (item.stderr | default('')).strip() }}
-      loop: "{{ immich_cmds.results }}"
-      when: DEBUG == 1
-      run_once: true
-
-    - name: Fail play if any Immich command failed
-      ansible.builtin.assert:
-        that: "item.rc == 0"
-        fail_msg: "Immich update failed on VM: {{ item.item }} (rc={{ item.rc }})"
-        success_msg: "All Immich update commands succeeded."
-      loop: "{{ immich_cmds.results }}"
-      loop_control:
-        index_var: idx
-        label: "cmd-{{ idx }}"
-      run_once: true
-
-    # -------------------------
-    # Readiness checks (controller first, then VM fallback)
-    # -------------------------
-
-    - name: Immich | Wait for API ping (controller first, with retries)
-      ansible.builtin.uri:
-        url: "{{ (immich_url | regex_replace('/$','')) + '/api/server/ping' }}"
-        method: GET
-        return_content: true
-        validate_certs: "{{ (immich_url | default('')) is match('^https://') }}"
-        status_code: 200
-      register: immich_controller
-      delegate_to: localhost
-      run_once: true
-      when: immich_url is defined and (immich_url | length) > 0
-      retries: "{{ immich_retries }}"
-      delay: "{{ immich_delay }}"
-      until: immich_controller.status == 200 and ('pong' in (immich_controller.content | default('')))
-      failed_when: false
-      changed_when: false
-
-    - name: Immich | VM-side ping (JSON via Python, with retries)
-      ansible.builtin.command:
-        argv:
-          - sshpass
-          - -e
-          - ssh
-          - -o
-          - StrictHostKeyChecking=no
-          - -o
-          - ConnectTimeout=15
-          - "{{ vm_user }}@{{ vm_ip }}"
-          - bash
-          - -lc
-          - |
-            python3 - <<'PY'
-            # Ping Immich API from localhost and print response to stdout
-            import urllib.request, sys
-            try:
-                with urllib.request.urlopen("http://127.0.0.1:{{ immich_port }}/api/server/ping", timeout=15) as r:
-                    sys.stdout.write(r.read().decode(errors='ignore'))
-            except Exception:
-                pass
-            PY
-      environment:
-        SSHPASS: "{{ vm_pass }}"
-      register: immich_vm
-      changed_when: false
-      failed_when: false
-      when: immich_controller.status | default(0) != 200
-      retries: "{{ immich_retries }}"
-      delay: "{{ immich_delay }}"
-      until: (immich_vm.stdout | default('') | trim | length) > 0 and ('pong' in (immich_vm.stdout | default('')))
-      no_log: "{{ DEBUG == 0 }}"
-      run_once: true
-
-    - name: Immich | Print concise summary
-      ansible.builtin.debug:
-        msg: >-
-          Immich API ping {{ 'OK' if (('pong' in (immich_controller.content|default(''))) or ('pong' in (immich_vm.stdout|default('')))) else 'NOT OK' }}.
-          Source={{ 'controller' if (immich_controller.status|default(0))==200 else 'vm' if (immich_vm.stdout|default('')|trim|length>0) else 'n/a' }}.
-      when: DEBUG == 1
-      run_once: true

old/update_semaphore.yml

@@ -1,65 +0,0 @@
-# update_semaphore.yml
-
-- name: Update Semaphore on VM via Proxmox
-  hosts: linux_servers
-  gather_facts: false
-  become: true
-  become_user: root
-  become_method: sudo
-
-  vars:
-    # --- Connection to VM (provided by Semaphore env vars) ---
-    vm_ip:   "{{ lookup('env', 'VM_IP') }}"      # IP vm-portainer
-    vm_user: "{{ lookup('env', 'VM_USER') }}"
-    vm_pass: "{{ lookup('env', 'VM_PASS') }}"
-    use_sudo: false
-
-    # --- Debug mode (controlled via Semaphore variable) ---
-    DEBUG: "{{ lookup('env', 'DEBUG') | default(0) | int }}"
-
-    # --- Semaphore specifics ---
-    semaphore_project: "semaphore"
-    semaphore_compose_file: "/data/compose/semaphore/docker-compose.yml"
-    semaphore_service: "semaphore"
-
-  tasks:
-    - name: Ensure sshpass is installed (for password-based SSH)  # English comments
-      ansible.builtin.apt:
-        name: sshpass
-        state: present
-        update_cache: yes
-
-    - name: Run Semaphore self-update on VM in background (nohup)
-      ansible.builtin.command:
-        argv:
-          - sshpass
-          - -e
-          - ssh
-          - -o
-          - StrictHostKeyChecking=no
-          - -o
-          - ConnectTimeout=15
-          - "{{ vm_user }}@{{ vm_ip }}"
-          - bash
-          - -lc
-          - |
-            nohup bash -c '
-              unalias docker 2>/dev/null || true
-              DOCKER_CLI_HINTS=0 docker compose \
-                -p {{ semaphore_project }} \
-                -f {{ semaphore_compose_file }} \
-                up -d --no-deps --force-recreate --pull always {{ semaphore_service }}
-            ' >/dev/null 2>&1 &
-      environment:
-        SSHPASS: "{{ vm_pass }}"
-      register: semaphore_update
-      changed_when: false
-      no_log: "{{ DEBUG == 0 }}"
-
-    - name: Show result of Semaphore self-update (debug)
-      ansible.builtin.debug:
-        msg: |
-          RC:      {{ semaphore_update.rc }}
-          STDOUT:  {{ (semaphore_update.stdout | default('')).strip() }}
-          STDERR:  {{ (semaphore_update.stderr | default('')).strip() }}
-      when: DEBUG == 1

old/update_uptime_kuma.yml

@@ -1,194 +0,0 @@
-# nextcloud/update_uptime_kuma.yml
-
-- name: Update Uptime Kuma on VM via Proxmox
-  hosts: linux_servers
-  gather_facts: false
-  become: true
-  become_user: root
-  become_method: sudo
-
-  vars:
-    # VM connection (provided by Semaphore env vars)
-    vm_ip:   "{{ lookup('env', 'VM_IP') }}"
-    vm_user: "{{ lookup('env', 'VM_USER') }}"
-    vm_pass: "{{ lookup('env', 'VM_PASS') }}"
-    use_sudo: false
-
-    # --- Debug mode (controlled via Semaphore variable) ---
-    DEBUG: "{{ lookup('env', 'DEBUG') | default(0) | int }}"
-    RETRIES: "{{ lookup('env', 'RETRIES') | default(25) | int }}"
-
-    # Uptime Kuma specifics
-    kuma_project: "uptime-kuma"
-    kuma_compose_file: "/data/compose/uptime-kuma/docker-compose-uptime-kuma.yml"
-    kuma_service: "uptime-kuma"
-    kuma_image: "louislam/uptime-kuma:latest"
-    kuma_port: 3001
-
-    # Optional external URL for controller-side readiness check (e.g., https://kuma.example.com)
-    # If empty/undefined, controller check is skipped and we only probe from the VM.
-    kuma_url: "{{ lookup('env', 'KUMA_URL') | default('', true) }}"
-
-    # Fixed container name used in your compose (conflicts with previous/Portainer-run container)
-    kuma_container_name: "uptime-kuma-dev"
-
-    # Retry policy
-    kuma_retries: "{{ RETRIES }}"
-    kuma_delay: 2
-
-    # Docker command prefix (consistent behavior)
-    docker_prefix: "unalias docker 2>/dev/null || true; DOCKER_CLI_HINTS=0; command docker"
-
-    # Commands to run on the target VM (quiet outputs like in Collabora play)
-    kuma_commands:
-      - "{{ docker_prefix }} pull -q {{ kuma_image }} >/dev/null"
-      - "{{ docker_prefix }} compose -p {{ kuma_project }} -f {{ kuma_compose_file }} pull {{ kuma_service }} >/dev/null"
-      # remove conflicting container name before compose up (silently)
-      - "{{ docker_prefix }} rm -f {{ kuma_container_name }} >/dev/null 2>&1 || true"
-      - "{{ docker_prefix }} compose -p {{ kuma_project }} -f {{ kuma_compose_file }} up -d --no-deps --force-recreate {{ kuma_service }} >/dev/null"
-
-  tasks:
-    - name: Ensure sshpass is installed (for password-based SSH)  # English comments
-      ansible.builtin.apt:
-        name: sshpass
-        state: present
-        update_cache: yes
-
-    - name: Run Uptime Kuma update commands on VM (via SSH)  # use SSHPASS env, hide item label
-      ansible.builtin.command:
-        argv:
-          - sshpass
-          - -e                     # read password from SSHPASS environment
-          - ssh
-          - -o
-          - StrictHostKeyChecking=no
-          - -o
-          - ConnectTimeout=15
-          - "{{ vm_user }}@{{ vm_ip }}"
-          - bash
-          - -lc
-          - "{{ ('sudo ' if use_sudo else '') + item }}"
-      environment:
-        SSHPASS: "{{ vm_pass }}"    # supply password via environment
-      loop: "{{ kuma_commands }}"
-      loop_control:
-        index_var: idx              # capture loop index
-        label: "cmd-{{ idx }}"      # avoid printing full command in (item=...) line
-      register: kuma_cmds
-      changed_when: false
-      no_log: "{{ DEBUG == 0 }}"    # hide outputs and env when not debugging
-
-    - name: Show outputs for each Uptime Kuma command
-      ansible.builtin.debug:
-        msg: |
-          CMD: {{ item.item }}
-          RC:  {{ item.rc }}
-          STDOUT:
-          {{ (item.stdout | default('')).strip() }}
-          STDERR:
-          {{ (item.stderr | default('')).strip() }}
-      loop: "{{ kuma_cmds.results }}"
-      when: DEBUG == 1
-
-    - name: Fail play if any Uptime Kuma command failed  # also hide item label
-      ansible.builtin.assert:
-        that: "item.rc == 0"
-        fail_msg: "Uptime Kuma update failed on VM: {{ item.item }} (rc={{ item.rc }})"
-        success_msg: "All Uptime Kuma update commands succeeded."
-      loop: "{{ kuma_cmds.results }}"
-      loop_control:
-        index_var: idx
-        label: "cmd-{{ idx }}"
-
-    # -------------------------
-    # Readiness checks (controller first, then VM fallback)
-    # -------------------------
-
-    - name: Kuma | Wait for homepage (controller first, with retries)
-      ansible.builtin.uri:
-        url: "{{ (kuma_url | regex_replace('/$','')) + '/' }}"
-        method: GET
-        return_content: true
-        # Validate TLS only when using https://
-        validate_certs: "{{ (kuma_url | default('')) is match('^https://') }}"
-        status_code: 200
-      register: kuma_controller
-      delegate_to: localhost
-      run_once: true
-      when: kuma_url is defined and (kuma_url | length) > 0
-      retries: "{{ kuma_retries }}"
-      delay: "{{ kuma_delay }}"
-      until: kuma_controller.status == 200
-      failed_when: false
-      changed_when: false
-
-    - name: Kuma | VM-side fetch (HTML via Python, with retries)  # use SSHPASS env here too
-      ansible.builtin.command:
-        argv:
-          - sshpass
-          - -e
-          - ssh
-          - -o
-          - StrictHostKeyChecking=no
-          - -o
-          - ConnectTimeout=15
-          - "{{ vm_user }}@{{ vm_ip }}"
-          - bash
-          - -lc
-          - |
-            python3 - <<'PY'
-            # Fetch Kuma homepage from localhost and print HTML to stdout
-            import urllib.request, sys
-            try:
-                with urllib.request.urlopen("http://127.0.0.1:{{ kuma_port }}/", timeout=15) as r:
-                    sys.stdout.write(r.read().decode(errors='ignore'))
-            except Exception:
-                pass
-            PY
-      environment:
-        SSHPASS: "{{ vm_pass }}"
-      register: kuma_vm
-      changed_when: false
-      failed_when: false
-      when: kuma_controller.status | default(0) != 200 or kuma_controller.content is not defined
-      retries: "{{ kuma_retries }}"
-      delay: "{{ kuma_delay }}"
-      until: (kuma_vm.stdout | default('') | trim | length) > 0 and ('Uptime Kuma' in (kuma_vm.stdout | default('')))
-      no_log: "{{ DEBUG == 0 }}"   # hide command and output when not debugging
-
-    - name: Kuma | Choose homepage HTML (controller wins, else VM)  # safe guard against empty result
-      ansible.builtin.set_fact:
-        kuma_home_html: >-
-          {{
-            (
-              kuma_controller.content
-              if (kuma_controller is defined)
-                 and ((kuma_controller.status|default(0))==200)
-                 and (kuma_controller.content is defined)
-              else
-                 (kuma_vm.stdout | default('') | trim)
-            )
-          }}
-      when:
-        - (kuma_controller is defined and (kuma_controller.status|default(0))==200 and (kuma_controller.content is defined))
-          or ((kuma_vm.stdout | default('') | trim | length) > 0)
-
-    - name: Kuma | Print concise summary
-      ansible.builtin.debug:
-        msg: >-
-          Uptime Kuma homepage {{ 'reachable' if (kuma_home_html is defined) else 'NOT reachable' }}.
-          Source={{ 'controller' if ((kuma_controller is defined) and (kuma_controller.status|default(0))==200 and (kuma_controller.content is defined)) else 'vm' if (kuma_vm.stdout|default('')|trim|length>0) else 'n/a' }};
-          length={{ (kuma_home_html | default('')) | length }};
-          contains('Uptime Kuma')={{ (kuma_home_html is defined) and ('Uptime Kuma' in kuma_home_html) }}
-      when: DEBUG == 1
-
-    - name: Kuma | Homepage unavailable (after retries)
-      ansible.builtin.debug:
-        msg: "Kuma web není dostupná ani po pokusech."
-      when: kuma_home_html is not defined and DEBUG == 1
-
-    # Optional detailed dump (short excerpt only)
-    - name: Kuma | HTML excerpt (debug)
-      ansible.builtin.debug:
-        msg: "{{ (kuma_home_html | default(''))[:500] }}"
-      when: kuma_home_html is defined and DEBUG == 1

portainer/update_portainer_agent_lxc.yml

@@ -1,69 +0,0 @@
-# update_portainer_agent_lxc.yml
-
-- name: Update Portainer Agent (LXC, no compose)
-  hosts: pve2_lxc_jellyfin
-  gather_facts: false
-
-  vars:
-    agent_container_name: portainer_agent
-    agent_port: 9001
-
-  tasks:
-    - name: Check if agent container exists
-      ansible.builtin.command:
-        argv:
-          - bash
-          - -lc
-          - "docker ps -a --format '{{ \"{{\" }}.Names{{ \"}}\" }}' | grep -x '{{ agent_container_name }}'"
-      register: agent_exists
-      changed_when: false
-      failed_when: false
-
-    - name: Abort if agent container is missing
-      ansible.builtin.fail:
-        msg: "Container '{{ agent_container_name }}' not found."
-      when: agent_exists.rc != 0
-
-    - name: Read current agent image
-      ansible.builtin.command:
-        argv:
-          - bash
-          - -lc
-          - "docker inspect -f '{{ \"{{\" }}.Config.Image{{ \"}}\" }}' {{ agent_container_name }}"
-      register: agent_image
-      changed_when: false
-
-    - name: Pull latest image tag for current agent image
-      ansible.builtin.command:
-        argv:
-          - bash
-          - -lc
-          - "docker pull {{ agent_image.stdout | trim }}"
-      changed_when: true
-
-    - name: Recreate agent container with standard Portainer Agent args
-      ansible.builtin.command:
-        argv:
-          - bash
-          - -lc
-          - |
-            set -euo pipefail
-
-            # Stop/remove old container
-            docker rm -f "{{ agent_container_name }}" >/dev/null 2>&1 || true
-
-            # Run Portainer Agent with common, safe defaults
-            docker run -d \
-              --name "{{ agent_container_name }}" \
-              --restart=always \
-              -p {{ agent_port }}:9001 \
-              -v /var/run/docker.sock:/var/run/docker.sock \
-              -v /var/lib/docker/volumes:/var/lib/docker/volumes \
-              "{{ agent_image.stdout | trim }}"
-      changed_when: true
-
-    - name: Wait for agent port
-      ansible.builtin.wait_for:
-        host: 127.0.0.1
-        port: "{{ agent_port }}"
-        timeout: 60

portainer/update_portainer_agent_vm.yml

@@ -1,69 +0,0 @@
-# update_portainer_agent_vm.yml
-
-- name: Update Portainer Agent (VM, no compose)
-  hosts: pve2_vm
-  gather_facts: false
-
-  vars:
-    agent_container_name: portainer_agent
-    agent_port: 9001
-
-  tasks:
-    - name: Check if agent container exists
-      ansible.builtin.command:
-        argv:
-          - bash
-          - -lc
-          - "docker ps -a --format '{{ \"{{\" }}.Names{{ \"}}\" }}' | grep -x '{{ agent_container_name }}'"
-      register: agent_exists
-      changed_when: false
-      failed_when: false
-
-    - name: Abort if agent container is missing
-      ansible.builtin.fail:
-        msg: "Container '{{ agent_container_name }}' not found."
-      when: agent_exists.rc != 0
-
-    - name: Read current agent image
-      ansible.builtin.command:
-        argv:
-          - bash
-          - -lc
-          - "docker inspect -f '{{ \"{{\" }}.Config.Image{{ \"}}\" }}' {{ agent_container_name }}"
-      register: agent_image
-      changed_when: false
-
-    - name: Pull latest image tag for current agent image
-      ansible.builtin.command:
-        argv:
-          - bash
-          - -lc
-          - "docker pull {{ agent_image.stdout | trim }}"
-      changed_when: true
-
-    - name: Recreate agent container with standard Portainer Agent args
-      ansible.builtin.command:
-        argv:
-          - bash
-          - -lc
-          - |
-            set -euo pipefail
-
-            # Stop/remove old container
-            docker rm -f "{{ agent_container_name }}" >/dev/null 2>&1 || true
-
-            # Run Portainer Agent with common, safe defaults
-            docker run -d \
-              --name "{{ agent_container_name }}" \
-              --restart=always \
-              -p {{ agent_port }}:9001 \
-              -v /var/run/docker.sock:/var/run/docker.sock \
-              -v /var/lib/docker/volumes:/var/lib/docker/volumes \
-              "{{ agent_image.stdout | trim }}"
-      changed_when: true
-
-    - name: Wait for agent port
-      ansible.builtin.wait_for:
-        host: 127.0.0.1
-        port: "{{ agent_port }}"
-        timeout: 60

update_bettershift.yml

@@ -1,85 +0,0 @@
-# update_bettershift.yml
-
-- name: Update BetterShift
-  hosts: pve2_vm
-  gather_facts: false
-
-  vars:
-    compose_local_dir: "{{ playbook_dir }}/docker-compose"
-    compose_remote_base: "/home/{{ ansible_user }}/.ansible-compose/docker-compose"
-
-    bettershift_project: bettershift
-    bettershift_compose_filename: "docker-compose-bettershift.yml"
-    bettershift_service: bettershift
-    bettershift_port: 3067
-    bettershift_data_dir: "/data/compose/bettershift/data"
-
-  tasks:
-    - name: Ensure remote compose directory exists
-      ansible.builtin.file:
-        path: "{{ compose_remote_base }}"
-        state: directory
-        mode: "0755"
-
-    - name: Ensure BetterShift data directory exists
-      ansible.builtin.file:
-        path: "{{ bettershift_data_dir }}"
-        state: directory
-        mode: "0755"
-
-    - name: Upload BetterShift compose file to remote host
-      ansible.builtin.copy:
-        src: "{{ compose_local_dir }}/{{ bettershift_compose_filename }}"
-        dest: "{{ compose_remote_base }}/{{ bettershift_compose_filename }}"
-        mode: "0644"
-
-    - name: Check BetterShift env file exists on remote host
-      ansible.builtin.stat:
-        path: "{{ compose_remote_base }}/.env.bettershift"
-      register: bettershift_env_file
-
-    - name: Fail if BetterShift env file is missing
-      ansible.builtin.fail:
-        msg: >-
-          Missing {{ compose_remote_base }}/.env.bettershift on remote host.
-          Create it manually because it contains secrets.
-      when: not bettershift_env_file.stat.exists
-
-    - name: Pull latest BetterShift image
-      community.docker.docker_compose_v2:
-        project_name: "{{ bettershift_project }}"
-        project_src: "{{ compose_remote_base }}"
-        files:
-          - "{{ bettershift_compose_filename }}"
-        pull: always
-
-    - name: Recreate BetterShift service
-      community.docker.docker_compose_v2:
-        project_name: "{{ bettershift_project }}"
-        project_src: "{{ compose_remote_base }}"
-        files:
-          - "{{ bettershift_compose_filename }}"
-        services:
-          - "{{ bettershift_service }}"
-        state: present
-        recreate: always
-
-    - name: Wait for BetterShift port
-      ansible.builtin.wait_for:
-        host: 127.0.0.1
-        port: "{{ bettershift_port }}"
-        timeout: 60
-
-    - name: Check BetterShift HTTP endpoint
-      ansible.builtin.uri:
-        url: "http://127.0.0.1:{{ bettershift_port }}/"
-        status_code:
-          - 200
-          - 307
-          - 308
-        follow_redirects: none
-      register: bettershift_http
-      retries: 30
-      delay: 3
-      until: bettershift_http.status in [200, 307, 308]
-      changed_when: false

update_homarr.yml

@@ -1,64 +1,194 @@
 # update_homarr.yml
 
-- name: Update Homarr
-  hosts: pve2_vm
+- name: Update Homarr on VM via Proxmox
+  hosts: linux_servers
   gather_facts: false
+  become: true
+  become_user: root
+  become_method: sudo
 
   vars:
-    # Compose sync (controller -> target)
-    compose_local_dir: "{{ playbook_dir }}/docker-compose"
-    compose_remote_base: "/home/{{ ansible_user }}/.ansible-compose"
+    # VM connection (provided by Semaphore env vars)
+    vm_ip:   "{{ lookup('env', 'VM_IP') }}"
+    vm_user: "{{ lookup('env', 'VM_USER') }}"
+    vm_pass: "{{ lookup('env', 'VM_PASS') }}"
+    use_sudo: false
 
-    # Homarr settings
-    homarr_project: homarr
-    homarr_compose_filename: "docker-compose-homarr.yml"
-    homarr_service: homarr
+    # --- Debug mode (controlled via Semaphore variable) ---
+    DEBUG: "{{ lookup('env', 'DEBUG') | default(0) | int }}"
+    RETRIES: "{{ lookup('env', 'RETRIES') | default(25) | int }}"
+
+    # Homarr specifics
+    homarr_project: "homarr"
+    homarr_compose_file: "/data/compose/homarr/docker-compose-homarr.yml"
+    homarr_service: "homarr"
+    homarr_image: "ghcr.io/homarr-labs/homarr:latest"
     homarr_port: 7575
 
+    # Optional external URL for controller-side readiness check (e.g., https://homarr.example.com)
+    # If empty/undefined, controller check is skipped and we only probe from the VM.
+    homarr_url: "{{ lookup('env', 'HOMARR_URL') | default('', true) }}"
+
+    # Fixed container name used in your compose (avoid conflicts with any leftover container)
+    homarr_container_name: "homarr"
+
+    # Retry policy (same pattern as Kuma): 25x with 2s delay
+    homarr_retries: "{{ RETRIES }}"
+    homarr_delay: 2
+
+    # Docker command prefix (consistent behavior)
+    docker_prefix: "unalias docker 2>/dev/null || true; DOCKER_CLI_HINTS=0; command docker"
+
+    # Commands to run on the target VM (quiet outputs)
+    homarr_commands:
+      - "{{ docker_prefix }} pull -q {{ homarr_image }} >/dev/null"
+      - "{{ docker_prefix }} compose -p {{ homarr_project }} -f {{ homarr_compose_file }} pull {{ homarr_service }} >/dev/null"
+      # remove conflicting container name before compose up (silently)
+      - "{{ docker_prefix }} rm -f {{ homarr_container_name }} >/dev/null 2>&1 || true"
+      - "{{ docker_prefix }} compose -p {{ homarr_project }} -f {{ homarr_compose_file }} up -d --no-deps --force-recreate {{ homarr_service }} >/dev/null"
+
   tasks:
-    - name: Ensure remote compose directory exists
-      ansible.builtin.file:
-        path: "{{ compose_remote_base }}"
-        state: directory
-        mode: "0755"
-
-    - name: Upload Homarr compose file to remote host
-      ansible.builtin.copy:
-        src: "{{ compose_local_dir }}/{{ homarr_compose_filename }}"
-        dest: "{{ compose_remote_base }}/{{ homarr_compose_filename }}"
-        mode: "0644"
-
-    - name: Pull latest Homarr image
-      community.docker.docker_compose_v2:
-        project_name: "{{ homarr_project }}"
-        project_src: "{{ compose_remote_base }}"
-        files:
-          - "{{ homarr_compose_filename }}"
-        pull: always
-
-    - name: Recreate Homarr service
-      community.docker.docker_compose_v2:
-        project_name: "{{ homarr_project }}"
-        project_src: "{{ compose_remote_base }}"
-        files:
-          - "{{ homarr_compose_filename }}"
-        services:
-          - "{{ homarr_service }}"
+    - name: Ensure sshpass is installed (for password-based SSH)  # English comments
+      ansible.builtin.apt:
+        name: sshpass
         state: present
-        recreate: always
+        update_cache: yes
 
-    - name: Wait for Homarr port
-      ansible.builtin.wait_for:
-        host: 127.0.0.1
-        port: "{{ homarr_port }}"
-        timeout: 60
-
-    - name: Check Homarr HTTP endpoint
-      ansible.builtin.uri:
-        url: "http://127.0.0.1:{{ homarr_port }}/"
-        status_code: 200
-      register: homarr_http
-      retries: 30
-      delay: 3
-      until: homarr_http.status == 200
+    - name: Run Homarr update commands on VM (via SSH)  # use SSHPASS env, hide item label
+      ansible.builtin.command:
+        argv:
+          - sshpass
+          - -e                     # read password from SSHPASS environment
+          - ssh
+          - -o
+          - StrictHostKeyChecking=no
+          - -o
+          - ConnectTimeout=15
+          - "{{ vm_user }}@{{ vm_ip }}"
+          - bash
+          - -lc
+          - "{{ ('sudo ' if use_sudo else '') + item }}"
+      environment:
+        SSHPASS: "{{ vm_pass }}"    # supply password via environment
+      loop: "{{ homarr_commands }}"
+      loop_control:
+        index_var: idx              # capture loop index
+        label: "cmd-{{ idx }}"      # avoid printing full command in (item=...) line
+      register: homarr_cmds
       changed_when: false
+      no_log: "{{ DEBUG == 0 }}"    # hide outputs and env when not debugging
+
+    - name: Show outputs for each Homarr command
+      ansible.builtin.debug:
+        msg: |
+          CMD: {{ item.item }}
+          RC:  {{ item.rc }}
+          STDOUT:
+          {{ (item.stdout | default('')).strip() }}
+          STDERR:
+          {{ (item.stderr | default('')).strip() }}
+      loop: "{{ homarr_cmds.results }}"
+      when: DEBUG == 1
+
+    - name: Fail play if any Homarr command failed  # also hide item label
+      ansible.builtin.assert:
+        that: "item.rc == 0"
+        fail_msg: "Homarr update failed on VM: {{ item.item }} (rc={{ item.rc }})"
+        success_msg: "All Homarr update commands succeeded."
+      loop: "{{ homarr_cmds.results }}"
+      loop_control:
+        index_var: idx
+        label: "cmd-{{ idx }}"
+
+    # -------------------------
+    # Readiness checks (controller first, then VM fallback)
+    # -------------------------
+
+    - name: Homarr | Wait for homepage (controller first, with retries)
+      ansible.builtin.uri:
+        url: "{{ (homarr_url | regex_replace('/$','')) + '/' }}"
+        method: GET
+        return_content: true
+        # Validate TLS only when using https://
+        validate_certs: "{{ (homarr_url | default('')) is match('^https://') }}"
+        status_code: 200
+      register: homarr_controller
+      delegate_to: localhost
+      run_once: true
+      when: homarr_url is defined and (homarr_url | length) > 0
+      retries: "{{ homarr_retries }}"
+      delay: "{{ homarr_delay }}"
+      until: homarr_controller.status == 200
+      failed_when: false
+      changed_when: false
+
+    - name: Homarr | VM-side fetch (HTML via Python, with retries)  # use SSHPASS env here too
+      ansible.builtin.command:
+        argv:
+          - sshpass
+          - -e
+          - ssh
+          - -o
+          - StrictHostKeyChecking=no
+          - -o
+          - ConnectTimeout=15
+          - "{{ vm_user }}@{{ vm_ip }}"
+          - bash
+          - -lc
+          - |
+            python3 - <<'PY'
+            # Fetch Homarr homepage from localhost and print HTML to stdout
+            import urllib.request, sys
+            try:
+                with urllib.request.urlopen("http://127.0.0.1:{{ homarr_port }}/", timeout=15) as r:
+                    sys.stdout.write(r.read().decode(errors='ignore'))
+            except Exception:
+                pass
+            PY
+      environment:
+        SSHPASS: "{{ vm_pass }}"
+      register: homarr_vm
+      changed_when: false
+      failed_when: false
+      when: homarr_controller.status | default(0) != 200 or homarr_controller.content is not defined
+      retries: "{{ homarr_retries }}"
+      delay: "{{ homarr_delay }}"
+      until: (homarr_vm.stdout | default('') | trim | length) > 0 and ('Homarr' in (homarr_vm.stdout | default('')))
+      no_log: "{{ DEBUG == 0 }}"
+
+    - name: Homarr | Choose homepage HTML (controller wins, else VM)  # safe guard against empty result
+      ansible.builtin.set_fact:
+        homarr_home_html: >-
+          {{
+            (
+              homarr_controller.content
+              if (homarr_controller is defined)
+                 and ((homarr_controller.status|default(0))==200)
+                 and (homarr_controller.content is defined)
+              else
+                 (homarr_vm.stdout | default('') | trim)
+            )
+          }}
+      when:
+        - (homarr_controller is defined and (homarr_controller.status|default(0))==200 and (homarr_controller.content is defined))
+          or ((homarr_vm.stdout | default('') | trim | length) > 0)
+
+    - name: Homarr | Print concise summary
+      ansible.builtin.debug:
+        msg: >-
+          Homarr homepage {{ 'reachable' if (homarr_home_html is defined) else 'NOT reachable' }}.
+          Source={{ 'controller' if ((homarr_controller is defined) and (homarr_controller.status|default(0))==200 and (homarr_controller.content is defined)) else 'vm' if (homarr_vm.stdout|default('')|trim|length>0) else 'n/a' }};
+          length={{ (homarr_home_html | default('')) | length }};
+          contains('Homarr')={{ (homarr_home_html is defined) and ('Homarr' in homarr_home_html) }}
+      when: DEBUG == 1
+
+    - name: Homarr | Homepage unavailable (after retries)
+      ansible.builtin.debug:
+        msg: "Homarr web není dostupný ani po pokusech."
+      when: homarr_home_html is not defined and DEBUG == 1
+
+    # Optional detailed dump (short excerpt only)
+    - name: Homarr | HTML excerpt (debug)
+      ansible.builtin.debug:
+        msg: "{{ (homarr_home_html | default(''))[:500] }}"
+      when: homarr_home_html is defined and DEBUG == 1

update_homarr2.yml

@@ -0,0 +1,40 @@
+# update_homarr2.yml
+
+- name: Update Homarr
+  hosts: pve2_vm
+  gather_facts: false
+
+  vars:
+    homarr_project: homarr
+    homarr_compose_file: /data/compose/homarr/docker-compose-homarr.yml
+    homarr_service: homarr
+    homarr_port: 7575
+
+  tasks:
+    - name: Pull latest Homarr image
+      community.docker.docker_compose_v2:
+        project_src: "{{ homarr_compose_file | dirname }}"
+        files:
+          - "{{ homarr_compose_file | basename }}"
+        pull: always
+
+    - name: Recreate Homarr service
+      community.docker.docker_compose_v2:
+        project_src: "{{ homarr_compose_file | dirname }}"
+        files:
+          - "{{ homarr_compose_file | basename }}"
+        services:
+          - "{{ homarr_service }}"
+        state: present
+        recreate: always
+
+    - name: Wait for Homarr port
+      ansible.builtin.wait_for:
+        host: 127.0.0.1
+        port: "{{ homarr_port }}"
+        timeout: 60
+
+    - name: Check Homarr HTTP endpoint
+      ansible.builtin.uri:
+        url: "http://127.0.0.1:{{ homarr_port }}/"
+        status_code: 200

update_immich.yml

@@ -1,116 +1,313 @@
 # update_immich.yml
 
-- name: Update Immich
-  hosts: pve2_vm
+- name: Update Immich on VM via Proxmox
+  hosts: linux_servers
   gather_facts: false
+  become: true
+  become_user: root
+  become_method: sudo
 
   vars:
-    # Compose sync (controller -> target)
-    compose_local_dir: "{{ playbook_dir }}/docker-compose"
-    compose_remote_base: "/home/{{ ansible_user }}/.ansible-compose"
-    compose_remote_dir: "{{ compose_remote_base }}/docker-compose"
-    compose_remote_archive: "{{ compose_remote_base }}/docker-compose.tar.gz"
+    # VM connection (provided by Semaphore env vars)
+    vm_ip:   "{{ lookup('env', 'VM_IP') }}"
+    vm_user: "{{ lookup('env', 'VM_USER') }}"
+    vm_pass: "{{ lookup('env', 'VM_PASS') }}"
+    use_sudo: false
 
-    # Immich settings
-    immich_project: immich
+    # --- Debug mode (controlled via Semaphore variable) ---
+    DEBUG: "{{ lookup('env', 'DEBUG') | default(0) | int }}"
+    RETRIES: "{{ lookup('env', 'RETRIES') | default(25) | int }}"
+
+    # Immich specifics
+    immich_dir: "/opt/immich"
+    immich_project: "immich"
+    immich_compose_url: "https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml"
+    immich_compose_file: "/opt/immich/docker-compose.yml"
+    immich_override_file: "/opt/immich/docker-compose.override.yml"
     immich_port: 2283
-    immich_compose_files:
-      - docker-compose-immich.yml
-      - docker-compose-immich.override.yml
 
-    # Persistent env file on the VM (NOT in git)
-    immich_env_persistent: "{{ compose_remote_base }}/env/immich.env"
+    # Optional external URL for controller-side readiness check (e.g., https://photos.example.com)
+    immich_url: "{{ lookup('env', 'IMMICH_URL') | default('', true) }}"
+
+    # Retry policy
+    immich_retries: "{{ RETRIES }}"
+    immich_delay: 2
+
+    # Docker command prefix (consistent behavior)
+    docker_prefix: "unalias docker 2>/dev/null || true; DOCKER_CLI_HINTS=0; command docker"
+
+    # Compose command (always include override to keep local mounts separate from upstream compose)
+    immich_compose_cmd: >-
+      {{ docker_prefix }} compose
+      -p {{ immich_project }}
+      -f {{ immich_compose_file }}
+      -f {{ immich_override_file }}
+
+    # Commands to run on the target VM
+    immich_commands:
+      - "cd {{ immich_dir }}"
+
+      - |
+        cd {{ immich_dir }}
+        mkdir -p backups
+        if [ -f docker-compose.yml ]; then
+          cp -a docker-compose.yml "backups/docker-compose.yml.$(date +%F_%H%M%S).bak"
+        fi
+        if [ -f .env ]; then
+          cp -a .env "backups/.env.$(date +%F_%H%M%S).bak"
+        fi
+        if [ -f docker-compose.override.yml ]; then
+          cp -a docker-compose.override.yml "backups/docker-compose.override.yml.$(date +%F_%H%M%S).bak"
+        fi
+
+      - |
+        cd {{ immich_dir }}
+        # Download latest compose from Immich releases (requires curl or wget)
+        if command -v curl >/dev/null 2>&1; then
+          curl -fsSL -o docker-compose.yml "{{ immich_compose_url }}"
+        elif command -v wget >/dev/null 2>&1; then
+          wget -qO docker-compose.yml "{{ immich_compose_url }}"
+        else
+          echo "Neither curl nor wget is available on the VM."
+          exit 1
+        fi
+
+      - |
+        cd {{ immich_dir }}
+        # Ensure override compose exists (create if missing)
+        if [ ! -f "{{ immich_override_file }}" ]; then
+          printf '%s\n' \
+            'services:' \
+            '  immich-server:' \
+            '    volumes:' \
+            '      - /mnt/nextcloud-howard-photos:/mnt/nextcloud-howard-photos' \
+            '      - /mnt/nextcloud-kamilkaprdelka-photos:/mnt/nextcloud-kamilkaprdelka-photos' \
+            > "{{ immich_override_file }}"
+        fi
+        # Fail early if override is still missing/empty
+        test -s "{{ immich_override_file }}"
+
+
+      - |
+        cd {{ immich_dir }}
+        # Ensure .env exists. If missing, try to reconstruct it from running containers to avoid breaking DB creds.
+        python3 - <<'PY'
+        import json
+        import subprocess
+        from pathlib import Path
+
+        env_path = Path(".env")
+        if env_path.exists():
+            raise SystemExit(0)
+
+        def run(cmd):
+            p = subprocess.run(cmd, capture_output=True, text=True)
+            return p.returncode, p.stdout, p.stderr
+
+        rc, out, err = run(["bash", "-lc", "command docker inspect immich_postgres immich_server"])
+        if rc != 0 or not out.strip():
+            print("ERROR: .env is missing and cannot inspect running containers (immich_postgres/immich_server).", flush=True)
+            print("Create /opt/immich/.env manually or ensure the containers exist.", flush=True)
+            raise SystemExit(1)
+
+        data = json.loads(out)
+
+        by_name = {}
+        for c in data:
+            name = (c.get("Name") or "").lstrip("/")
+            by_name[name] = c
+
+        pg = by_name.get("immich_postgres")
+        srv = by_name.get("immich_server")
+        if not pg or not srv:
+            print("ERROR: Could not find immich_postgres and immich_server in docker inspect output.", flush=True)
+            raise SystemExit(1)
+
+        def env_map(container):
+            m = {}
+            for kv in (container.get("Config", {}).get("Env") or []):
+                if "=" in kv:
+                    k, v = kv.split("=", 1)
+                    m[k] = v
+            return m
+
+        def find_mount_source(container, dest):
+            for m in (container.get("Mounts") or []):
+                if m.get("Destination") == dest:
+                    return m.get("Source")
+            return ""
+
+        pg_env = env_map(pg)
+        db_user = pg_env.get("POSTGRES_USER", "")
+        db_pass = pg_env.get("POSTGRES_PASSWORD", "")
+        db_name = pg_env.get("POSTGRES_DB", "")
+
+        db_data = find_mount_source(pg, "/var/lib/postgresql/data")
+        upload_loc = find_mount_source(srv, "/usr/src/app/upload")
+
+        # Try to preserve the currently used image tag as IMMICH_VERSION (optional but safer)
+        immich_version = ""
+        image = (srv.get("Config", {}).get("Image") or "")
+        if ":" in image and "@" not in image:
+            immich_version = image.rsplit(":", 1)[-1]
+        elif ":" in image and "@" in image:
+            # image like repo:tag@sha256:...
+            immich_version = image.split("@", 1)[0].rsplit(":", 1)[-1]
+
+        missing = []
+        for k, v in [
+            ("DB_USERNAME", db_user),
+            ("DB_PASSWORD", db_pass),
+            ("DB_DATABASE_NAME", db_name),
+            ("DB_DATA_LOCATION", db_data),
+            ("UPLOAD_LOCATION", upload_loc),
+        ]:
+            if not v:
+                missing.append(k)
+
+        if missing:
+            print("ERROR: Could not reconstruct these .env values from containers: " + ", ".join(missing), flush=True)
+            raise SystemExit(1)
+
+        lines = [
+            f"UPLOAD_LOCATION={upload_loc}",
+            f"DB_DATA_LOCATION={db_data}",
+            f"DB_USERNAME={db_user}",
+            f"DB_PASSWORD={db_pass}",
+            f"DB_DATABASE_NAME={db_name}",
+        ]
+        if immich_version:
+            lines.append(f"IMMICH_VERSION={immich_version}")
+
+        env_path.write_text("\n".join(lines) + "\n", encoding="utf-8")
+        print("Created .env from running containers.", flush=True)
+        PY
+
+      - |
+        cd {{ immich_dir }}
+        # Comment out healthcheck.start_interval if present (safe no-op if missing)
+        sed -i -E 's/^([[:space:]]*)start_interval:/\1# start_interval:/' docker-compose.yml || true
+
+      - "cd {{ immich_dir }} && {{ immich_compose_cmd }} config >/dev/null"
+      - "cd {{ immich_dir }} && {{ immich_compose_cmd }} pull >/dev/null"
+      - "cd {{ immich_dir }} && {{ immich_compose_cmd }} up -d --remove-orphans --force-recreate >/dev/null"
 
   tasks:
-    - name: Ensure remote base directory exists
-      ansible.builtin.file:
-        path: "{{ compose_remote_base }}"
-        state: directory
-        mode: "0755"
+    - name: Ensure sshpass is installed (for password-based SSH)  # English comments
+      ansible.builtin.apt:
+        name: sshpass
+        state: present
+        update_cache: yes
 
-    - name: Ensure remote env directory exists
-      ansible.builtin.file:
-        path: "{{ compose_remote_base }}/env"
-        state: directory
-
-    - name: Fail if persistent Immich env file is missing
-      ansible.builtin.stat:
-        path: "{{ immich_env_persistent }}"
-      register: immich_env_stat
-
-    - name: Abort when Immich env is missing
-      ansible.builtin.fail:
-        msg: >-
-          Missing persistent env file: {{ immich_env_persistent }}.
-          Create it on the VM with DB_* and UPLOAD_LOCATION variables.
-      when: not immich_env_stat.stat.exists
-
-    - name: Create local archive of docker-compose directory (controller)
-      ansible.builtin.archive:
-        path: "{{ compose_local_dir }}/"
-        dest: "/tmp/docker-compose.tar.gz"
-        format: gz
-      delegate_to: localhost
+    - name: Run Immich update commands on VM (via SSH)  # use SSHPASS env, hide item label
+      ansible.builtin.command:
+        argv:
+          - sshpass
+          - -e
+          - ssh
+          - -o
+          - StrictHostKeyChecking=no
+          - -o
+          - ConnectTimeout=15
+          - "{{ vm_user }}@{{ vm_ip }}"
+          - bash
+          - -lc
+          - "{{ ('sudo ' if use_sudo else '') + item }}"
+      environment:
+        SSHPASS: "{{ vm_pass }}"
+      loop: "{{ immich_commands }}"
+      loop_control:
+        index_var: idx
+        label: "cmd-{{ idx }}"
+      register: immich_cmds
+      changed_when: false
+      no_log: "{{ DEBUG == 0 }}"
       run_once: true
 
-    - name: Upload archive to remote host
-      ansible.builtin.copy:
-        src: "/tmp/docker-compose.tar.gz"
-        dest: "{{ compose_remote_archive }}"
-        mode: "0644"
+    - name: Show outputs for each Immich command
+      ansible.builtin.debug:
+        msg: |
+          CMD: {{ item.item }}
+          RC:  {{ item.rc }}
+          STDOUT:
+          {{ (item.stdout | default('')).strip() }}
+          STDERR:
+          {{ (item.stderr | default('')).strip() }}
+      loop: "{{ immich_cmds.results }}"
+      when: DEBUG == 1
+      run_once: true
 
-    - name: Recreate remote compose directory
-      ansible.builtin.file:
-        path: "{{ compose_remote_dir }}"
-        state: absent
+    - name: Fail play if any Immich command failed
+      ansible.builtin.assert:
+        that: "item.rc == 0"
+        fail_msg: "Immich update failed on VM: {{ item.item }} (rc={{ item.rc }})"
+        success_msg: "All Immich update commands succeeded."
+      loop: "{{ immich_cmds.results }}"
+      loop_control:
+        index_var: idx
+        label: "cmd-{{ idx }}"
+      run_once: true
 
-    - name: Ensure remote compose directory exists
-      ansible.builtin.file:
-        path: "{{ compose_remote_dir }}"
-        state: directory
-        mode: "0755"
+    # -------------------------
+    # Readiness checks (controller first, then VM fallback)
+    # -------------------------
 
-    - name: Extract archive on remote host
-      ansible.builtin.unarchive:
-        src: "{{ compose_remote_archive }}"
-        dest: "{{ compose_remote_dir }}"
-        remote_src: true
-
-    - name: Deploy Immich .env into compose directory
-      ansible.builtin.copy:
-        src: "{{ immich_env_persistent }}"
-        dest: "{{ compose_remote_dir }}/.env"
-        remote_src: true
-        mode: "0600"
-
-    - name: Pull latest Immich images
-      community.docker.docker_compose_v2:
-        project_name: "{{ immich_project }}"
-        project_src: "{{ compose_remote_dir }}"
-        files: "{{ immich_compose_files }}"
-        pull: always
-
-    - name: Recreate Immich stack
-      community.docker.docker_compose_v2:
-        project_name: "{{ immich_project }}"
-        project_src: "{{ compose_remote_dir }}"
-        files: "{{ immich_compose_files }}"
-        state: present
-        recreate: always
-
-    - name: Wait for Immich port
-      ansible.builtin.wait_for:
-        host: 127.0.0.1
-        port: "{{ immich_port }}"
-        timeout: 120
-
-    - name: Check Immich API ping (retry until ready)
+    - name: Immich | Wait for API ping (controller first, with retries)
       ansible.builtin.uri:
-        url: "http://127.0.0.1:{{ immich_port }}/api/server/ping"
-        status_code: 200
+        url: "{{ (immich_url | regex_replace('/$','')) + '/api/server/ping' }}"
+        method: GET
         return_content: true
-      register: immich_ping
-      retries: 40
-      delay: 3
-      until: immich_ping.status == 200 and ('pong' in (immich_ping.content | default('')))
-      changed_when: false
+        validate_certs: "{{ (immich_url | default('')) is match('^https://') }}"
+        status_code: 200
+      register: immich_controller
+      delegate_to: localhost
+      run_once: true
+      when: immich_url is defined and (immich_url | length) > 0
+      retries: "{{ immich_retries }}"
+      delay: "{{ immich_delay }}"
+      until: immich_controller.status == 200 and ('pong' in (immich_controller.content | default('')))
+      failed_when: false
+      changed_when: false
+
+    - name: Immich | VM-side ping (JSON via Python, with retries)
+      ansible.builtin.command:
+        argv:
+          - sshpass
+          - -e
+          - ssh
+          - -o
+          - StrictHostKeyChecking=no
+          - -o
+          - ConnectTimeout=15
+          - "{{ vm_user }}@{{ vm_ip }}"
+          - bash
+          - -lc
+          - |
+            python3 - <<'PY'
+            # Ping Immich API from localhost and print response to stdout
+            import urllib.request, sys
+            try:
+                with urllib.request.urlopen("http://127.0.0.1:{{ immich_port }}/api/server/ping", timeout=15) as r:
+                    sys.stdout.write(r.read().decode(errors='ignore'))
+            except Exception:
+                pass
+            PY
+      environment:
+        SSHPASS: "{{ vm_pass }}"
+      register: immich_vm
+      changed_when: false
+      failed_when: false
+      when: immich_controller.status | default(0) != 200
+      retries: "{{ immich_retries }}"
+      delay: "{{ immich_delay }}"
+      until: (immich_vm.stdout | default('') | trim | length) > 0 and ('pong' in (immich_vm.stdout | default('')))
+      no_log: "{{ DEBUG == 0 }}"
+      run_once: true
+
+    - name: Immich | Print concise summary
+      ansible.builtin.debug:
+        msg: >-
+          Immich API ping {{ 'OK' if (('pong' in (immich_controller.content|default(''))) or ('pong' in (immich_vm.stdout|default('')))) else 'NOT OK' }}.
+          Source={{ 'controller' if (immich_controller.status|default(0))==200 else 'vm' if (immich_vm.stdout|default('')|trim|length>0) else 'n/a' }}.
+      when: DEBUG == 1
+      run_once: true

update_jellyfin.yml

@@ -1,94 +0,0 @@
-# update_jellyfin.yml
-
-- name: Update Jellyfin
-  hosts: pve2_lxc_jellyfin
-  gather_facts: false
-
-  vars:
-    # Compose sync (controller -> target)
-    compose_local_dir: "{{ playbook_dir }}/docker-compose"
-    compose_remote_base: "/home/{{ ansible_user }}/.ansible-compose"
-    compose_remote_dir: "{{ compose_remote_base }}/docker-compose"
-    compose_remote_archive: "{{ compose_remote_base }}/docker-compose.tar.gz"
-
-    # Jellyfin settings
-    jellyfin_compose_filename: "docker-compose-jellyfin.yml"
-    jellyfin_service: jellyfin
-    jellyfin_port: 8096
-
-  tasks:
-    - name: Ensure remote base directory exists
-      ansible.builtin.file:
-        path: "{{ compose_remote_base }}"
-        state: directory
-        mode: "0755"
-
-    - name: Create local archive of docker-compose directory (controller)
-      ansible.builtin.archive:
-        path: "{{ compose_local_dir }}/"
-        dest: "/tmp/docker-compose.tar.gz"
-        format: gz
-      delegate_to: localhost
-      run_once: true
-
-    - name: Upload archive to remote host
-      ansible.builtin.copy:
-        src: "/tmp/docker-compose.tar.gz"
-        dest: "{{ compose_remote_archive }}"
-        mode: "0644"
-
-    - name: Recreate remote compose directory
-      ansible.builtin.file:
-        path: "{{ compose_remote_dir }}"
-        state: absent
-
-    - name: Ensure remote compose directory exists
-      ansible.builtin.file:
-        path: "{{ compose_remote_dir }}"
-        state: directory
-        mode: "0755"
-
-    - name: Extract archive on remote host
-      ansible.builtin.unarchive:
-        src: "{{ compose_remote_archive }}"
-        dest: "{{ compose_remote_dir }}"
-        remote_src: true
-
-    - name: Pull latest Jellyfin image (docker-compose v1)
-      ansible.builtin.command:
-        argv:
-          - bash
-          - -lc
-          - >
-            cd "{{ compose_remote_dir }}"
-            && docker-compose -f "{{ jellyfin_compose_filename }}" pull
-      changed_when: true
-
-    - name: Recreate Jellyfin service (docker-compose v1)
-      ansible.builtin.command:
-        argv:
-          - bash
-          - -lc
-          - >
-            cd "{{ compose_remote_dir }}"
-            && docker-compose -f "{{ jellyfin_compose_filename }}"
-            up -d --force-recreate --remove-orphans "{{ jellyfin_service }}"
-      changed_when: true
-
-    - name: Wait for Jellyfin port
-      ansible.builtin.wait_for:
-        host: 127.0.0.1
-        port: "{{ jellyfin_port }}"
-        timeout: 180
-
-    - name: Check Jellyfin HTTP endpoint (retry until ready)
-      ansible.builtin.uri:
-        url: "http://127.0.0.1:{{ jellyfin_port }}/"
-        status_code:
-          - 200
-          - 302
-      register: jellyfin_http
-      retries: 40
-      delay: 3
-      until: jellyfin_http.status in [200, 302]
-      changed_when: false

update_minecraft.yml

@@ -1,132 +0,0 @@
-# update_minecraft.yml
-
-- name: Update Minecraft (Futurecraft)
-  hosts: pve2_vm
-  gather_facts: false
-
-  vars:
-    # Compose sync (controller -> target)
-    compose_local_dir: "{{ playbook_dir }}/docker-compose"
-    compose_remote_base: "/home/{{ ansible_user }}/.ansible-compose"
-    compose_remote_dir: "{{ compose_remote_base }}/docker-compose"
-    compose_remote_archive: "{{ compose_remote_base }}/docker-compose.tar.gz"
-
-    # Minecraft settings
-    mc_project: minecraft
-    mc_compose_filename: "docker-compose-minecraft.yml"
-    mc_port: 25565
-
-    # Persistent env file on the VM (NOT in git)
-    # Must contain: CF_API_KEY, RCON_PASSWORD, optionally MEMORY
-    mc_env_persistent: "{{ compose_remote_base }}/env/minecraft.env"
-
-    # Container name from your compose file (used for log readiness check)
-    mc_container_name: "mc-futurecraft"
-
-  tasks:
-    - name: Ensure remote base directory exists
-      ansible.builtin.file:
-        path: "{{ compose_remote_base }}"
-        state: directory
-        mode: "0755"
-
-    - name: Ensure remote env directory exists
-      ansible.builtin.file:
-        path: "{{ compose_remote_base }}/env"
-        state: directory
-        mode: "0755"
-
-    - name: Fail if persistent Minecraft env file is missing
-      ansible.builtin.stat:
-        path: "{{ mc_env_persistent }}"
-      register: mc_env_stat
-
-    - name: Abort when Minecraft env is missing
-      ansible.builtin.fail:
-        msg: >-
-          Missing persistent env file: {{ mc_env_persistent }}.
-          Create it on the VM with at least:
-            CF_API_KEY=...
-            RCON_PASSWORD=...
-          Optional:
-            MEMORY=10G
-      when: not mc_env_stat.stat.exists
-
-    - name: Create local archive of docker-compose directory (controller)
-      ansible.builtin.archive:
-        path: "{{ compose_local_dir }}/"
-        dest: "/tmp/docker-compose.tar.gz"
-        format: gz
-      delegate_to: localhost
-      run_once: true
-
-    - name: Upload archive to remote host
-      ansible.builtin.copy:
-        src: "/tmp/docker-compose.tar.gz"
-        dest: "{{ compose_remote_archive }}"
-        mode: "0644"
-
-    - name: Recreate remote compose directory
-      ansible.builtin.file:
-        path: "{{ compose_remote_dir }}"
-        state: absent
-
-    - name: Ensure remote compose directory exists
-      ansible.builtin.file:
-        path: "{{ compose_remote_dir }}"
-        state: directory
-        mode: "0755"
-
-    - name: Extract archive on remote host
-      ansible.builtin.unarchive:
-        src: "{{ compose_remote_archive }}"
-        dest: "{{ compose_remote_dir }}"
-        remote_src: true
-
-    - name: Deploy Minecraft .env into compose directory
-      ansible.builtin.copy:
-        src: "{{ mc_env_persistent }}"
-        dest: "{{ compose_remote_dir }}/.env"
-        remote_src: true
-        mode: "0600"
-
-    - name: Pull latest Minecraft images (docker compose)
-      ansible.builtin.command: >
-        docker compose
-        -p {{ mc_project }}
-        -f {{ compose_remote_dir }}/{{ mc_compose_filename }}
-        pull
-      changed_when: false
-
-    - name: Recreate Minecraft stack (docker compose up)
-      ansible.builtin.command: >
-        docker compose
-        -p {{ mc_project }}
-        -f {{ compose_remote_dir }}/{{ mc_compose_filename }}
-        up -d --remove-orphans --force-recreate
-      changed_when: false
-
-    - name: Show last container logs after start (quick diagnostics)
-      ansible.builtin.command: >
-        docker logs --tail 60 {{ mc_container_name }}
-      register: mc_start_logs
-      changed_when: false
-
-    - name: Print last logs (for debugging)
-      ansible.builtin.debug:
-        var: mc_start_logs.stdout_lines
-
-    - name: Wait for Minecraft port
-      ansible.builtin.wait_for:
-        host: 127.0.0.1
-        port: "{{ mc_port }}"
-        timeout: 180
-
-    - name: Wait until server reports "Done" in docker logs (ready)
-      ansible.builtin.command: >
-        docker logs --tail 200 {{ mc_container_name }}
-      register: mc_docker_logs
-      retries: 60
-      delay: 5
-      until: "'Done (' in mc_docker_logs.stdout"
-      changed_when: false

update_semaphore.yml

@@ -1,93 +1,65 @@
 # update_semaphore.yml
 
-- name: Update Semaphore (self-update safe)
-  hosts: pve2_vm
+- name: Update Semaphore on VM via Proxmox
+  hosts: linux_servers
   gather_facts: false
+  become: true
+  become_user: root
+  become_method: sudo
 
   vars:
-    compose_local_dir: "{{ playbook_dir }}/docker-compose"
-    compose_remote_base: "/home/{{ ansible_user }}/.ansible-compose"
-    compose_remote_dir: "{{ compose_remote_base }}/docker-compose"
-    compose_remote_archive: "{{ compose_remote_base }}/docker-compose.tar.gz"
+    # --- Connection to VM (provided by Semaphore env vars) ---
+    vm_ip:   "{{ lookup('env', 'VM_IP') }}"      # IP vm-portainer
+    vm_user: "{{ lookup('env', 'VM_USER') }}"
+    vm_pass: "{{ lookup('env', 'VM_PASS') }}"
+    use_sudo: false
 
-    semaphore_project: semaphore
-    semaphore_compose_filename: "docker-compose-semaphore.yml"
-    semaphore_port: 3000
+    # --- Debug mode (controlled via Semaphore variable) ---
+    DEBUG: "{{ lookup('env', 'DEBUG') | default(0) | int }}"
+
+    # --- Semaphore specifics ---
+    semaphore_project: "semaphore"
+    semaphore_compose_file: "/data/compose/semaphore/docker-compose.yml"
+    semaphore_service: "semaphore"
 
   tasks:
-    - name: Ensure remote base directory exists
-      ansible.builtin.file:
-        path: "{{ compose_remote_base }}"
-        state: directory
+    - name: Ensure sshpass is installed (for password-based SSH)  # English comments
+      ansible.builtin.apt:
+        name: sshpass
+        state: present
+        update_cache: yes
 
-    - name: Create local archive of docker-compose directory (controller)
-      ansible.builtin.archive:
-        path: "{{ compose_local_dir }}/"
-        dest: "/tmp/docker-compose.tar.gz"
-        format: gz
-      delegate_to: localhost
-      run_once: true
-
-    - name: Upload archive to remote host
-      ansible.builtin.copy:
-        src: "/tmp/docker-compose.tar.gz"
-        dest: "{{ compose_remote_archive }}"
-
-    - name: Recreate remote compose directory
-      ansible.builtin.file:
-        path: "{{ compose_remote_dir }}"
-        state: absent
-
-    - name: Ensure remote compose directory exists
-      ansible.builtin.file:
-        path: "{{ compose_remote_dir }}"
-        state: directory
-
-    - name: Extract archive on remote host
-      ansible.builtin.unarchive:
-        src: "{{ compose_remote_archive }}"
-        dest: "{{ compose_remote_dir }}"
-        remote_src: true
-
-    - name: Pull latest Semaphore image(s)
+    - name: Run Semaphore self-update on VM in background (nohup)
       ansible.builtin.command:
         argv:
+          - sshpass
+          - -e
+          - ssh
+          - -o
+          - StrictHostKeyChecking=no
+          - -o
+          - ConnectTimeout=15
+          - "{{ vm_user }}@{{ vm_ip }}"
           - bash
           - -lc
-          - >
-            cd "{{ compose_remote_dir }}"
-            && docker compose -p "{{ semaphore_project }}"
-            -f "{{ semaphore_compose_filename }}"
-            pull
-      changed_when: true
-
-    - name: Start Semaphore update in background (avoid killing this job)
-      ansible.builtin.command:
-        argv:
-          - bash
-          - -lc
-          - >
-            cd "{{ compose_remote_dir }}"
-            && nohup docker compose -p "{{ semaphore_project }}"
-            -f "{{ semaphore_compose_filename }}"
-            up -d --remove-orphans --force-recreate
-            > "{{ compose_remote_base }}/semaphore-update.log" 2>&1 &
-      async: 1
-      poll: 0
-      changed_when: true
-
-    - name: Wait for Semaphore port
-      ansible.builtin.wait_for:
-        host: 127.0.0.1
-        port: "{{ semaphore_port }}"
-        timeout: 300
-
-    - name: Check Semaphore HTTP endpoint (retry)
-      ansible.builtin.uri:
-        url: "http://127.0.0.1:{{ semaphore_port }}/"
-        status_code: 200
-      register: sem_http
-      retries: 30
-      delay: 5
-      until: sem_http.status == 200
+          - |
+            nohup bash -c '
+              unalias docker 2>/dev/null || true
+              DOCKER_CLI_HINTS=0 docker compose \
+                -p {{ semaphore_project }} \
+                -f {{ semaphore_compose_file }} \
+                up -d --no-deps --force-recreate --pull always {{ semaphore_service }}
+            ' >/dev/null 2>&1 &
+      environment:
+        SSHPASS: "{{ vm_pass }}"
+      register: semaphore_update
       changed_when: false
+      no_log: "{{ DEBUG == 0 }}"
+
+    - name: Show result of Semaphore self-update (debug)
+      ansible.builtin.debug:
+        msg: |
+          RC:      {{ semaphore_update.rc }}
+          STDOUT:  {{ (semaphore_update.stdout | default('')).strip() }}
+          STDERR:  {{ (semaphore_update.stderr | default('')).strip() }}
+      when: DEBUG == 1

update_uptime_kuma.yml

@@ -1,91 +1,194 @@
-# update_uptimekuma.yml
+# nextcloud/update_uptime_kuma.yml
 
-- name: Update Uptime Kuma
-  hosts: pve1_vm
+- name: Update Uptime Kuma on VM via Proxmox
+  hosts: linux_servers
   gather_facts: false
+  become: true
+  become_user: root
+  become_method: sudo
 
   vars:
-    # Compose sync (controller -> target)
-    compose_local_dir: "{{ playbook_dir }}/docker-compose"
-    compose_remote_base: "/home/{{ ansible_user }}/.ansible-compose"
-    compose_remote_dir: "{{ compose_remote_base }}/docker-compose"
-    compose_remote_archive: "{{ compose_remote_base }}/docker-compose.tar.gz"
+    # VM connection (provided by Semaphore env vars)
+    vm_ip:   "{{ lookup('env', 'VM_IP') }}"
+    vm_user: "{{ lookup('env', 'VM_USER') }}"
+    vm_pass: "{{ lookup('env', 'VM_PASS') }}"
+    use_sudo: false
 
-    # Uptime Kuma settings
-    uptimekuma_project: uptimekuma
-    uptimekuma_compose_filename: "docker-compose-uptimekuma.yml"
-    uptimekuma_service: uptime-kuma
-    uptimekuma_port: 3001
+    # --- Debug mode (controlled via Semaphore variable) ---
+    DEBUG: "{{ lookup('env', 'DEBUG') | default(0) | int }}"
+    RETRIES: "{{ lookup('env', 'RETRIES') | default(25) | int }}"
+
+    # Uptime Kuma specifics
+    kuma_project: "uptime-kuma"
+    kuma_compose_file: "/data/compose/uptime-kuma/docker-compose-uptime-kuma.yml"
+    kuma_service: "uptime-kuma"
+    kuma_image: "louislam/uptime-kuma:latest"
+    kuma_port: 3001
+
+    # Optional external URL for controller-side readiness check (e.g., https://kuma.example.com)
+    # If empty/undefined, controller check is skipped and we only probe from the VM.
+    kuma_url: "{{ lookup('env', 'KUMA_URL') | default('', true) }}"
+
+    # Fixed container name used in your compose (conflicts with previous/Portainer-run container)
+    kuma_container_name: "uptime-kuma-dev"
+
+    # Retry policy
+    kuma_retries: "{{ RETRIES }}"
+    kuma_delay: 2
+
+    # Docker command prefix (consistent behavior)
+    docker_prefix: "unalias docker 2>/dev/null || true; DOCKER_CLI_HINTS=0; command docker"
+
+    # Commands to run on the target VM (quiet outputs like in Collabora play)
+    kuma_commands:
+      - "{{ docker_prefix }} pull -q {{ kuma_image }} >/dev/null"
+      - "{{ docker_prefix }} compose -p {{ kuma_project }} -f {{ kuma_compose_file }} pull {{ kuma_service }} >/dev/null"
+      # remove conflicting container name before compose up (silently)
+      - "{{ docker_prefix }} rm -f {{ kuma_container_name }} >/dev/null 2>&1 || true"
+      - "{{ docker_prefix }} compose -p {{ kuma_project }} -f {{ kuma_compose_file }} up -d --no-deps --force-recreate {{ kuma_service }} >/dev/null"
 
   tasks:
-    - name: Ensure remote base directory exists
-      ansible.builtin.file:
-        path: "{{ compose_remote_base }}"
-        state: directory
-        mode: "0755"
+    - name: Ensure sshpass is installed (for password-based SSH)  # English comments
+      ansible.builtin.apt:
+        name: sshpass
+        state: present
+        update_cache: yes
 
-    - name: Create local archive of docker-compose directory (controller)
-      ansible.builtin.archive:
-        path: "{{ compose_local_dir }}/"
-        dest: "/tmp/docker-compose.tar.gz"
-        format: gz
+    - name: Run Uptime Kuma update commands on VM (via SSH)  # use SSHPASS env, hide item label
+      ansible.builtin.command:
+        argv:
+          - sshpass
+          - -e                     # read password from SSHPASS environment
+          - ssh
+          - -o
+          - StrictHostKeyChecking=no
+          - -o
+          - ConnectTimeout=15
+          - "{{ vm_user }}@{{ vm_ip }}"
+          - bash
+          - -lc
+          - "{{ ('sudo ' if use_sudo else '') + item }}"
+      environment:
+        SSHPASS: "{{ vm_pass }}"    # supply password via environment
+      loop: "{{ kuma_commands }}"
+      loop_control:
+        index_var: idx              # capture loop index
+        label: "cmd-{{ idx }}"      # avoid printing full command in (item=...) line
+      register: kuma_cmds
+      changed_when: false
+      no_log: "{{ DEBUG == 0 }}"    # hide outputs and env when not debugging
+
+    - name: Show outputs for each Uptime Kuma command
+      ansible.builtin.debug:
+        msg: |
+          CMD: {{ item.item }}
+          RC:  {{ item.rc }}
+          STDOUT:
+          {{ (item.stdout | default('')).strip() }}
+          STDERR:
+          {{ (item.stderr | default('')).strip() }}
+      loop: "{{ kuma_cmds.results }}"
+      when: DEBUG == 1
+
+    - name: Fail play if any Uptime Kuma command failed  # also hide item label
+      ansible.builtin.assert:
+        that: "item.rc == 0"
+        fail_msg: "Uptime Kuma update failed on VM: {{ item.item }} (rc={{ item.rc }})"
+        success_msg: "All Uptime Kuma update commands succeeded."
+      loop: "{{ kuma_cmds.results }}"
+      loop_control:
+        index_var: idx
+        label: "cmd-{{ idx }}"
+
+    # -------------------------
+    # Readiness checks (controller first, then VM fallback)
+    # -------------------------
+
+    - name: Kuma | Wait for homepage (controller first, with retries)
+      ansible.builtin.uri:
+        url: "{{ (kuma_url | regex_replace('/$','')) + '/' }}"
+        method: GET
+        return_content: true
+        # Validate TLS only when using https://
+        validate_certs: "{{ (kuma_url | default('')) is match('^https://') }}"
+        status_code: 200
+      register: kuma_controller
       delegate_to: localhost
       run_once: true
+      when: kuma_url is defined and (kuma_url | length) > 0
+      retries: "{{ kuma_retries }}"
+      delay: "{{ kuma_delay }}"
+      until: kuma_controller.status == 200
+      failed_when: false
+      changed_when: false
 
-    - name: Upload archive to remote host
-      ansible.builtin.copy:
-        src: "/tmp/docker-compose.tar.gz"
-        dest: "{{ compose_remote_archive }}"
-        mode: "0644"
+    - name: Kuma | VM-side fetch (HTML via Python, with retries)  # use SSHPASS env here too
+      ansible.builtin.command:
+        argv:
+          - sshpass
+          - -e
+          - ssh
+          - -o
+          - StrictHostKeyChecking=no
+          - -o
+          - ConnectTimeout=15
+          - "{{ vm_user }}@{{ vm_ip }}"
+          - bash
+          - -lc
+          - |
+            python3 - <<'PY'
+            # Fetch Kuma homepage from localhost and print HTML to stdout
+            import urllib.request, sys
+            try:
+                with urllib.request.urlopen("http://127.0.0.1:{{ kuma_port }}/", timeout=15) as r:
+                    sys.stdout.write(r.read().decode(errors='ignore'))
+            except Exception:
+                pass
+            PY
+      environment:
+        SSHPASS: "{{ vm_pass }}"
+      register: kuma_vm
+      changed_when: false
+      failed_when: false
+      when: kuma_controller.status | default(0) != 200 or kuma_controller.content is not defined
+      retries: "{{ kuma_retries }}"
+      delay: "{{ kuma_delay }}"
+      until: (kuma_vm.stdout | default('') | trim | length) > 0 and ('Uptime Kuma' in (kuma_vm.stdout | default('')))
+      no_log: "{{ DEBUG == 0 }}"   # hide command and output when not debugging
 
-    - name: Recreate remote compose directory
-      ansible.builtin.file:
-        path: "{{ compose_remote_dir }}"
-        state: absent
+    - name: Kuma | Choose homepage HTML (controller wins, else VM)  # safe guard against empty result
+      ansible.builtin.set_fact:
+        kuma_home_html: >-
+          {{
+            (
+              kuma_controller.content
+              if (kuma_controller is defined)
+                 and ((kuma_controller.status|default(0))==200)
+                 and (kuma_controller.content is defined)
+              else
+                 (kuma_vm.stdout | default('') | trim)
+            )
+          }}
+      when:
+        - (kuma_controller is defined and (kuma_controller.status|default(0))==200 and (kuma_controller.content is defined))
+          or ((kuma_vm.stdout | default('') | trim | length) > 0)
 
-    - name: Ensure remote compose directory exists
-      ansible.builtin.file:
-        path: "{{ compose_remote_dir }}"
-        state: directory
-        mode: "0755"
+    - name: Kuma | Print concise summary
+      ansible.builtin.debug:
+        msg: >-
+          Uptime Kuma homepage {{ 'reachable' if (kuma_home_html is defined) else 'NOT reachable' }}.
+          Source={{ 'controller' if ((kuma_controller is defined) and (kuma_controller.status|default(0))==200 and (kuma_controller.content is defined)) else 'vm' if (kuma_vm.stdout|default('')|trim|length>0) else 'n/a' }};
+          length={{ (kuma_home_html | default('')) | length }};
+          contains('Uptime Kuma')={{ (kuma_home_html is defined) and ('Uptime Kuma' in kuma_home_html) }}
+      when: DEBUG == 1
 
-    - name: Extract archive on remote host
-      ansible.builtin.unarchive:
-        src: "{{ compose_remote_archive }}"
-        dest: "{{ compose_remote_dir }}"
-        remote_src: true
+    - name: Kuma | Homepage unavailable (after retries)
+      ansible.builtin.debug:
+        msg: "Kuma web není dostupná ani po pokusech."
+      when: kuma_home_html is not defined and DEBUG == 1
 
-    - name: Pull latest Uptime Kuma image
-      community.docker.docker_compose_v2:
-        project_name: "{{ uptimekuma_project }}"
-        project_src: "{{ compose_remote_dir }}"
-        files:
-          - "{{ uptimekuma_compose_filename }}"
-        pull: always
-
-    - name: Recreate Uptime Kuma service
-      community.docker.docker_compose_v2:
-        project_name: "{{ uptimekuma_project }}"
-        project_src: "{{ compose_remote_dir }}"
-        files:
-          - "{{ uptimekuma_compose_filename }}"
-        services:
-          - "{{ uptimekuma_service }}"
-        state: present
-        recreate: always
-
-    - name: Wait for Uptime Kuma port
-      ansible.builtin.wait_for:
-        host: 127.0.0.1
-        port: "{{ uptimekuma_port }}"
-        timeout: 120
-
-    - name: Check Uptime Kuma HTTP endpoint (retry until ready)
-      ansible.builtin.uri:
-        url: "http://127.0.0.1:{{ uptimekuma_port }}/"
-        status_code: 200
-      register: kuma_http
-      retries: 30
-      delay: 3
-      until: kuma_http.status == 200
-      changed_when: false
+    # Optional detailed dump (short excerpt only)
+    - name: Kuma | HTML excerpt (debug)
+      ansible.builtin.debug:
+        msg: "{{ (kuma_home_html | default(''))[:500] }}"
+      when: kuma_home_html is defined and DEBUG == 1