IM/ansible_fencl
4
0
Fork 0
forked from jakub/ansible
Code Pull Requests Activity

Compare commits

merge into: IM/ansible_fencl:main
Branches Tags
IM/ansible_fencl:main IM/ansible_fencl:jakub-patch-1 jakub/ansible:main jakub/ansible:backup-systemd-units jakub/ansible:checkmk
..
pull from: IM/ansible_fencl:jakub-patch-1
Branches Tags
IM/ansible_fencl:main IM/ansible_fencl:jakub-patch-1 jakub/ansible:main jakub/ansible:backup-systemd-units jakub/ansible:checkmk

1 Commits
main .. jakub-patch-1

Author SHA1 Message Date
jakub 46955aea0d Update nextcloud/update_nextcloud_v2.yml 2026-01-23 16:21:41 +00:00
36 changed files with 1124 additions and 3098 deletions
Expand all files Collapse all files
check_raid.yml
+134 -390
View File
@@ -1,439 +1,183 @@
# check_raid.yml # check_raid.yml
--- - name: Check Linux MD RAID health on VM via Proxmox
- name: Check Linux MD RAID health on pve1 hosts: linux_servers
hosts: pve1_vm
gather_facts: false gather_facts: false
become: true
become_user: root
become_method: sudo
vars: vars:
# Semaphore Survey Variables are preferred. # VM connection (provided by Semaphore env vars)
# Environment variables are used only as a fallback. vm_ip: "{{ lookup('env', 'VM_IP') }}"
raid_md_raw: >- vm_user: "{{ lookup('env', 'VM_USER') }}"
{{ vm_pass: "{{ lookup('env', 'VM_PASS') }}"
RAID_MD use_sudo: false
| default(lookup('env', 'RAID_MD'), true)
| default('auto', true)
| string
| trim
| lower
}}
# RAID_MD can be md0, md1, /dev/md0, or auto # Debug mode
raid_md_device: "{{ raid_md_raw | regex_replace('^/dev/', '') }}" DEBUG: "{{ lookup('env', 'DEBUG') | default(0) | int }}"
RETRIES: "{{ lookup('env', 'RETRIES') | default(25) | int }}"
# Allow a healthy array to be checking, repairing, recovering, # RAID specifics
# resyncing, or reshaping # RAID_MD can be: md0 / md1 / ... OR "auto" to check all arrays found in /proc/mdstat
raid_allow_sync: >- raid_md_device: "{{ lookup('env', 'RAID_MD') | default('md0', true) }}"
{{ raid_allow_sync: "{{ lookup('env', 'RAID_ALLOW_SYNC') | default(1, true) | int }}"
RAID_ALLOW_SYNC raid_allow_no_array: "{{ lookup('env', 'RAID_ALLOW_NO_ARRAY') | default(0, true) | int }}"
| default(lookup('env', 'RAID_ALLOW_SYNC'), true)
| default('1', true)
| int
}}
# A server without Linux MD RAID is considered unhealthy by default raid_retries: "{{ RETRIES }}"
raid_allow_no_array: >- raid_delay: 2
{{ ssh_hard_timeout: 30
RAID_ALLOW_NO_ARRAY
| default(lookup('env', 'RAID_ALLOW_NO_ARRAY'), true)
| default('0', true)
| int
}}
# Enable raw diagnostic output # SSH options
raid_debug: >- ssh_opts:
{{ - "-o" # English comments
DEBUG - "StrictHostKeyChecking=no"
| default(lookup('env', 'DEBUG'), true) - "-o"
| default('0', true) - "UserKnownHostsFile=/dev/null"
| int - "-o"
}} - "GlobalKnownHostsFile=/dev/null"
- "-o"
- "LogLevel=ERROR"
- "-o"
- "ConnectTimeout=15"
- "-o"
- "PreferredAuthentications=password"
- "-o"
- "PubkeyAuthentication=no"
- "-o"
- "KbdInteractiveAuthentication=no"
- "-o"
- "NumberOfPasswordPrompts=1"
raid_check_script: | raid_check_cmd: |
import re python3 - <<'PY'
import sys # Print exactly one status line and exit with code:
# 0=OK, 1=FAIL (degraded/disallowed sync), 2=ERROR (unexpected/misconfig)
import re, sys
target = {{ raid_md_device | to_json }} target = "{{ raid_md_device }}"
allow_sync = bool({{ raid_allow_sync | int }}) allow_sync = int("{{ raid_allow_sync }}")
allow_no_array = bool({{ raid_allow_no_array | int }}) allow_no_array = int("{{ raid_allow_no_array }}")
try: try:
with open( txt = open("/proc/mdstat", "r", encoding="utf-8", errors="ignore").read()
"/proc/mdstat", except Exception as e:
"r", print(f"ERROR RAID read_mdstat err={e}")
encoding="utf-8",
errors="replace",
) as mdstat_file:
mdstat = mdstat_file.read()
except Exception as exc:
print(
"ERROR RAID "
f"read_mdstat_failed="
f"{type(exc).__name__}:{exc}"
)
sys.exit(2) sys.exit(2)
header_pattern = re.compile( arrays = {}
r"^(md\d+)\s*:\s*(.*)$", header_re = re.compile(r"^(md\d+)\s*:\s*active.*$", re.MULTILINE)
re.MULTILINE, token_re = re.compile(r"^\s*\d+\s+blocks.*\[\d+/\d+\]\s*\[([U_]+)\]\s*$", re.MULTILINE)
)
header_matches = list(header_pattern.finditer(mdstat)) for m in header_re.finditer(txt):
array_blocks = {} name = m.group(1)
chunk = txt[m.end():m.end() + 3000]
tm = token_re.search(chunk)
if tm:
arrays[name] = tm.group(1)
for index, match in enumerate(header_matches): if not arrays:
block_end = (
header_matches[index + 1].start()
if index + 1 < len(header_matches)
else len(mdstat)
)
array_blocks[match.group(1)] = mdstat[
match.start():block_end
]
def md_sort_key(name):
try:
return int(name[2:])
except ValueError:
return name
def parse_array(name, block):
lines = block.splitlines()
header = lines[0]
header_data = header.split(":", 1)[1].strip()
state_match = re.match(
r"^(active|inactive)\b",
header_data,
re.IGNORECASE,
)
state = (
state_match.group(1).lower()
if state_match
else "unknown"
)
remaining_header = (
header_data[state_match.end():].strip()
if state_match
else header_data
)
mode = "rw"
# Handle states such as "active (auto-read-only)"
if remaining_header.startswith("("):
closing_parenthesis = remaining_header.find(")")
if closing_parenthesis >= 0:
mode = remaining_header[
1:closing_parenthesis
]
remaining_header = remaining_header[
closing_parenthesis + 1:
].strip()
level = (
remaining_header.split()[0].lower()
if remaining_header
else "unknown"
)
status_match = re.search(
r"\[(\d+)\s*/\s*(\d+)\]"
r"\s*\[([U_]+)\]",
block,
)
active_members = None
total_members = None
member_status = None
if status_match:
active_members = int(status_match.group(1))
total_members = int(status_match.group(2))
member_status = status_match.group(3)
operation_match = re.search(
r"\b("
r"resync|"
r"recovery|"
r"reshape|"
r"check|"
r"repair"
r")\b",
block,
re.IGNORECASE,
)
operation = (
operation_match.group(1).lower()
if operation_match
else "none"
)
progress_match = re.search(
r"(?:"
r"resync|"
r"recovery|"
r"reshape|"
r"check|"
r"repair"
r")\s*=\s*([0-9.]+%)",
block,
re.IGNORECASE,
)
progress = (
progress_match.group(1)
if progress_match
else "none"
)
return {
"name": name,
"state": state,
"mode": mode,
"level": level,
"active_members": active_members,
"total_members": total_members,
"member_status": member_status,
"operation": operation,
"progress": progress,
"faulty_member": bool(
re.search(
r"\(F\)",
block,
re.IGNORECASE,
)
),
}
def format_array(array):
if array["member_status"] is None:
members = "n/a"
member_status = "n/a"
else:
members = (
f'{array["active_members"]}/'
f'{array["total_members"]}'
)
member_status = array["member_status"]
return (
f'{array["name"]}'
"{"
f'state={array["state"]},'
f'mode={array["mode"]},'
f'level={array["level"]},'
f'members={members},'
f'status={member_status},'
f'operation={array["operation"]},'
f'progress={array["progress"]}'
"}"
)
if not array_blocks:
if allow_no_array: if allow_no_array:
print("OK RAID none=no-md-arrays") print("OK RAID none=no-md-arrays")
sys.exit(0) sys.exit(0)
print("ERROR RAID none=no-md-arrays") print("ERROR RAID none=no-md-arrays")
sys.exit(2) sys.exit(2)
available_arrays = sorted( syncing = bool(re.search(r"\b(resync|recovery|reshape|check|repair)\b", txt))
array_blocks.keys(),
key=md_sort_key,
)
if target == "auto": if target == "auto":
selected_names = available_arrays to_check = sorted(arrays.keys())
elif target in array_blocks:
selected_names = [target]
else: else:
print( if target not in arrays:
"ERROR RAID " found = ",".join(sorted(arrays.keys()))
f"target_not_found={target} " print(f"ERROR RAID target_not_found target={target} found={found}")
f'found={",".join(available_arrays)}'
)
sys.exit(2) sys.exit(2)
to_check = [target]
selected_arrays = [ tokens_str = " ".join([f"{name}=[{arrays[name]}]" for name in to_check])
parse_array( degraded = any("_" in arrays[name] for name in to_check)
name,
array_blocks[name],
)
for name in selected_names
]
failures = [] if degraded:
errors = [] print(f"FAIL RAID {tokens_str} syncing={int(syncing)}")
# These RAID levels may not always provide a redundant-member token
tokenless_levels = {
"raid0",
"linear",
}
for array in selected_arrays:
name = array["name"]
if array["state"] != "active":
failures.append(
f'{name}:state={array["state"]}'
)
if array["faulty_member"]:
failures.append(
f"{name}:faulty-member"
)
if array["member_status"] is not None:
if "_" in array["member_status"]:
failures.append(
f'{name}:degraded='
f'[{array["member_status"]}]'
)
if (
array["active_members"]
!= array["total_members"]
):
failures.append(
f'{name}:members='
f'{array["active_members"]}/'
f'{array["total_members"]}'
)
elif array["level"] not in tokenless_levels:
errors.append(
f"{name}:member-status-not-found"
)
if (
array["operation"] != "none"
and not allow_sync
):
failures.append(
f'{name}:operation='
f'{array["operation"]}'
)
details = " ".join(
format_array(array)
for array in selected_arrays
)
if errors:
print(
f"ERROR RAID {details} "
f'reason={";".join(errors)}'
)
sys.exit(2)
if failures:
print(
f"FAIL RAID {details} "
f'reason={";".join(failures)}'
)
sys.exit(1) sys.exit(1)
print(f"OK RAID {details}") if syncing and not allow_sync:
print(f"FAIL RAID {tokens_str} syncing={int(syncing)} allow_sync={allow_sync}")
sys.exit(1)
print(f"OK RAID {tokens_str} syncing={int(syncing)}")
sys.exit(0) sys.exit(0)
PY
tasks: tasks:
- name: Validate RAID check configuration - name: Ensure sshpass is installed (for password-based SSH) # English comments
ansible.builtin.assert: ansible.builtin.apt:
that: name: sshpass
- (raid_allow_sync | int) in [0, 1] state: present
- (raid_allow_no_array | int) in [0, 1] update_cache: yes
- (raid_debug | int) in [0, 1] run_once: true
- >-
(
raid_md_device
| regex_search('^(auto|md[0-9]+)$')
) is not none
fail_msg: >-
ERROR RAID invalid-configuration.
RAID_MD must be auto, md0, md1, or /dev/md0.
DEBUG, RAID_ALLOW_SYNC, and RAID_ALLOW_NO_ARRAY
must be 0 or 1.
quiet: true
- name: Run Linux MD RAID health check - name: Run RAID check on VM (via SSH) # single command, no loop
ansible.builtin.command: ansible.builtin.command:
argv: argv: >-
- python3 {{
- "-" ['timeout', '-k', '5', (ssh_hard_timeout | string)]
stdin: "{{ raid_check_script }}" + ['sshpass', '-e', 'ssh']
stdin_add_newline: true + ssh_opts
+ [ vm_user ~ '@' ~ vm_ip,
'bash', '-lc',
('sudo ' if use_sudo else '') + raid_check_cmd
]
}}
environment:
SSHPASS: "{{ vm_pass }}"
register: raid_cmd register: raid_cmd
changed_when: false changed_when: false
failed_when: false failed_when: false # we decide via assert below
retries: "{{ raid_retries }}"
delay: "{{ raid_delay }}"
until: raid_cmd.rc not in [124, 255]
run_once: true
- name: Build one-line RAID result - name: Build one-line summary (always)
ansible.builtin.set_fact: ansible.builtin.set_fact:
raid_line: >- raid_line: >-
{%- set stdout = ( {{
raid_cmd.stdout (raid_cmd.stdout | default('') | trim)
| default('') if ((raid_cmd.stdout | default('') | trim) | length) > 0
| trim else ('ERROR RAID no-output rc=' ~ (raid_cmd.rc | string))
| regex_replace('[\r\n]+', ' ') }}
| regex_replace('\s+', ' ')
) -%}
{%- set stderr = (
raid_cmd.stderr
| default('')
| trim
| regex_replace('[\r\n]+', ' ')
| regex_replace('\s+', ' ')
) -%}
{%- if stdout | length > 0 -%}
{{ stdout }}
{%- elif stderr | length > 0 -%}
ERROR RAID command_failed rc={{ raid_cmd.rc }}
stderr={{ stderr[:500] }}
{%- else -%}
ERROR RAID no-output rc={{ raid_cmd.rc }}
{%- endif -%}
changed_when: false changed_when: false
run_once: true
- name: Show raw RAID command result - name: RAID result (always one line)
ansible.builtin.debug: ansible.builtin.assert:
msg: that:
rc: "{{ raid_cmd.rc }}" - raid_cmd.rc == 0
stdout: "{{ raid_cmd.stdout | default('') }}" success_msg: "{{ raid_line }}"
stderr: "{{ raid_cmd.stderr | default('') }}" fail_msg: "{{ raid_line }}"
when: (raid_debug | int) == 1 run_once: true
- name: Read raw mdstat in debug mode # Optional verbose debug
- name: Debug | /proc/mdstat (VM)
ansible.builtin.command: ansible.builtin.command:
argv: argv: >-
- cat {{
- /proc/mdstat ['timeout', '-k', '5', (ssh_hard_timeout | string)]
register: mdstat_debug + ['sshpass', '-e', 'ssh']
+ ssh_opts
+ [ vm_user ~ '@' ~ vm_ip, 'bash', '-lc', "cat /proc/mdstat" ]
}}
environment:
SSHPASS: "{{ vm_pass }}"
register: mdstat_dbg
changed_when: false changed_when: false
failed_when: false failed_when: false
when: (raid_debug | int) == 1 when: DEBUG == 1
run_once: true
- name: Show raw mdstat in debug mode - name: Debug | mdstat output
ansible.builtin.debug: ansible.builtin.debug:
msg: msg: "{{ mdstat_dbg.stdout | default('') }}"
rc: "{{ mdstat_debug.rc | default('undefined') }}" when: DEBUG == 1
stdout: "{{ mdstat_debug.stdout | default('') }}" run_once: true
stderr: "{{ mdstat_debug.stderr | default('') }}"
when: (raid_debug | int) == 1
- name: Show successful RAID result
ansible.builtin.debug:
msg: "{{ raid_line }}"
when: (raid_cmd.rc | int) == 0
- name: Fail when RAID is unhealthy
ansible.builtin.fail:
msg: "{{ raid_line }}"
when: (raid_cmd.rc | int) != 0
docker-compose/docker-compose-bettershift.yml
-27
View File
@@ -1,27 +0,0 @@
name: bettershift
services:
bettershift:
container_name: bettershift
image: ghcr.io/pantelx/bettershift:v2.2.1
restart: unless-stopped
ports:
- '0.0.0.0:3067:3000'
volumes:
- /data/compose/bettershift/data:/app/data
env_file:
- .env.bettershift
environment:
- TZ=Europe/Prague
networks:
backend:
driver: bridge
ipam:
config:
- subnet: 172.20.0.0/24
gateway: 172.20.0.1
docker-compose/docker-compose-collabora.yml
-23
View File
@@ -1,23 +0,0 @@
version: '3'
services:
collabora:
image: collabora/code:latest
container_name: collabora
restart: unless-stopped
networks:
- cloud
environment:
- TZ=Europe/Prague
- password=password
- username=nextcloud
- domain=cloud.martinfencl.eu
- extra_params=--o:ssl.enable=false --o:ssl.termination=true
- aliasgroup1=https://cloud.martinfencl.eu:443,https://collabora.martinfencl.eu:443
- dictionaries=de_DE en_GB en_US es_ES fr_FR it nl pt_BR pt_PT ru cs_CZ
ports:
- 9980:9980
networks:
cloud:
driver: bridge
docker-compose/docker-compose-homarr.yml
-13
View File
@@ -1,13 +0,0 @@
services:
homarr:
container_name: homarr
image: ghcr.io/homarr-labs/homarr:latest
restart: unless-stopped
volumes:
- /var/run/docker.sock:/var/run/docker.sock # Optional, only if you want docker integration
- /data/compose/homarr/appdata:/appdata
environment:
- SECRET_ENCRYPTION_KEY=4fb16028fa1788d9a24fa93a323aa4a278524bed177c8c38454f4c4068c1b9b6
ports:
- '7575:7575'
docker-compose/docker-compose-immich.override.yml
-5
View File
@@ -1,5 +0,0 @@
services:
immich-server:
volumes:
- /mnt/nextcloud-howard-photos:/mnt/nextcloud-howard-photos
- /mnt/nextcloud-kamilkaprdelka-photos:/mnt/nextcloud-kamilkaprdelka-photos
docker-compose/docker-compose-immich.yml
-77
View File
@@ -1,77 +0,0 @@
#
# WARNING: To install Immich, follow our guide: https://docs.immich.app/install/docker-compose
#
# Make sure to use the docker-compose.yml of the current release:
#
# https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml
#
# The compose file on main may not be compatible with the latest release.
name: immich
services:
immich-server:
container_name: immich_server
image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
# extends:
# file: hwaccel.transcoding.yml
# service: cpu # set to one of [nvenc, quicksync, rkmpp, vaapi, vaapi-wsl] for accelerated transcoding
volumes:
- ${UPLOAD_LOCATION}:/usr/src/app/upload
#- /mnt/nextcloud-howard-photos:/mnt/nextcloud-howard-photos:ro # read-only external library
#- /mnt/nextcloud-kamilkaprdelka-photos:/mnt/nextcloud-kamilkaprdelka-photos:ro # read-only external library
- /mnt/nextcloud-howard-photos:/mnt/nextcloud-howard-photos
- /mnt/nextcloud-kamilkaprdelka-photos:/mnt/nextcloud-kamilkaprdelka-photos
- /etc/localtime:/etc/localtime:ro
env_file:
- .env
ports:
- '2283:2283'
depends_on:
- redis
- database
restart: always
healthcheck:
disable: false
immich-machine-learning:
container_name: immich_machine_learning
# For hardware acceleration, add one of -[armnn, cuda, rocm, openvino, rknn] to the image tag.
# Example tag: ${IMMICH_VERSION:-release}-cuda
image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
# extends: # uncomment this section for hardware acceleration - see https://docs.immich.app/features/ml-hardware-acceleration
# file: hwaccel.ml.yml
# service: cpu # set to one of [armnn, cuda, rocm, openvino, openvino-wsl, rknn] for accelerated inference - use the `-wsl` version for WSL2 where applicable
volumes:
- model-cache:/cache
env_file:
- .env
restart: always
healthcheck:
disable: false
redis:
container_name: immich_redis
image: docker.io/valkey/valkey:8@sha256:81db6d39e1bba3b3ff32bd3a1b19a6d69690f94a3954ec131277b9a26b95b3aa
healthcheck:
test: redis-cli ping || exit 1
restart: always
database:
container_name: immich_postgres
image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357191b76a916ae5eb93464d65c07511da41e3bf7a8416db519b40b1c23
environment:
POSTGRES_PASSWORD: ${DB_PASSWORD}
POSTGRES_USER: ${DB_USERNAME}
POSTGRES_DB: ${DB_DATABASE_NAME}
POSTGRES_INITDB_ARGS: '--data-checksums'
# Uncomment the DB_STORAGE_TYPE: 'HDD' var if your database isn't stored on SSDs
# DB_STORAGE_TYPE: 'HDD'
volumes:
# Do not edit the next line. If you want to change the database storage location on your system, edit the value of DB_DATA_LOCATION in the .env file
- ${DB_DATA_LOCATION}:/var/lib/postgresql/data
shm_size: 128mb
restart: always
volumes:
model-cache:
docker-compose/docker-compose-jellyfin.yml
-33
View File
@@ -1,33 +0,0 @@
services:
jellyfin:
image: lscr.io/linuxserver/jellyfin:latest
container_name: jellyfin
restart: unless-stopped
ports:
- "8096:8096"
- "7359:7359/udp"
- "1900:1900/udp"
environment:
- TZ=Europe/Prague
- PUID=0
- PGID=0
volumes:
- /opt/jellyfin/config:/config
- /opt/jellyfin/cache:/cache
- /mnt/films:/media/films:ro
- /mnt/books:/media/books:ro
- /mnt/ondrulin:/media/ondrulin:ro
devices:
- /dev/dri:/dev/dri
group_add:
- "104"
- "44"
tmpfs:
- /transcode:rw,size=8g,mode=1777
docker-compose/docker-compose-minecraft.yml
-54
View File
@@ -1,54 +0,0 @@
services:
mc:
image: itzg/minecraft-server:2026.6.0-java17
container_name: mc-futurecraft
restart: unless-stopped
ports:
- "25565:25565"
environment:
EULA: "TRUE"
TYPE: "AUTO_CURSEFORGE"
CF_API_KEY: "${CF_API_KEY}"
CF_PAGE_URL: "https://www.curseforge.com/minecraft/modpacks/futurecraft-5-0"
CF_MODPACK_ZIP: "/modpacks/futurecraft-5.0.zip"
# mkdir -p /home/howard/.ansible-compose/docker-compose/modpacks && curl -L -o /home/howard/.ansible-compose/docker-compose/modpacks/futurecraft-5.0.zip "https://edge.forgecdn.net/files/6103/327/Futurecraft%205.0.zi>
#CF_SLUG: "futurecraft-5-0"
#CF_FILE_ID: "6103327"
JAVA_VERSION: "17"
MEMORY: "${MEMORY:-10G}"
LEVEL: "world"
DIFFICULTY: "normal"
VIEW_DISTANCE: "10"
SIMULATION_DISTANCE: "6"
MAX_PLAYERS: "5"
ENABLE_RCON: "true"
RCON_PASSWORD: "${RCON_PASSWORD}"
ONLINE_MODE: "FALSE"
ENABLE_WHITELIST: "TRUE"
volumes:
- mc_data:/data
- ./modpacks:/modpacks:ro
backup:
image: itzg/mc-backup:latest
container_name: mc-futurecraft-backup
restart: unless-stopped
depends_on:
- mc
environment:
SRC_DIR: /data
DEST_DIR: /data/backups
BACKUP_INTERVAL: "12h"
INITIAL_DELAY: "5m"
PRUNE_BACKUPS_DAYS: "14"
EXCLUDES: "backups,cache,logs"
RCON_HOST: mc
RCON_PASSWORD: "${RCON_PASSWORD}"
volumes:
- mc_data:/data
volumes:
mc_data:
docker-compose/docker-compose-minecraft_old1.yml
-49
View File
@@ -1,49 +0,0 @@
services:
mc:
image: itzg/minecraft-server:java17
container_name: mc-futurecraft
restart: unless-stopped
ports:
- "25565:25565"
environment:
EULA: "TRUE"
TYPE: "AUTO_CURSEFORGE"
CF_API_KEY: "${CF_API_KEY}"
CF_SLUG: "futurecraft-5-0"
JAVA_VERSION: "17"
MEMORY: "${MEMORY:-10G}"
LEVEL: "world"
DIFFICULTY: "normal"
VIEW_DISTANCE: "10"
SIMULATION_DISTANCE: "6"
MAX_PLAYERS: "5"
ENABLE_RCON: "true"
RCON_PASSWORD: "${RCON_PASSWORD}"
ONLINE_MODE: "FALSE"
ENABLE_WHITELIST: "TRUE"
volumes:
- mc_data:/data
backup:
image: itzg/mc-backup:latest
container_name: mc-futurecraft-backup
restart: unless-stopped
depends_on:
- mc
environment:
SRC_DIR: /data
DEST_DIR: /data/backups
BACKUP_INTERVAL: "12h"
INITIAL_DELAY: "5m"
PRUNE_BACKUPS_DAYS: "14"
EXCLUDES: "backups,cache,logs"
RCON_HOST: mc
RCON_PASSWORD: "${RCON_PASSWORD}"
volumes:
- mc_data:/data
volumes:
mc_data:
docker-compose/docker-compose-semaphore.yml
-22
View File
@@ -1,22 +0,0 @@
services:
semaphore:
image: git.internet-master.cz/jakub/semaphore:latest
container_name: semaphore
user: "0:0"
ports:
- "3008:3000"
environment:
SEMAPHORE_DB_DIALECT: bolt
SEMAPHORE_DB_PATH: /etc/semaphore/semaphore.db.bolt
SEMAPHORE_TMP_PATH: /var/lib/semaphore/projects
SEMAPHORE_ADMIN: admin
SEMAPHORE_ADMIN_NAME: admin
SEMAPHORE_ADMIN_EMAIL: admin@localhost
SEMAPHORE_ADMIN_PASSWORD: changeme
SEMAPHORE_ACCESS_KEY_ENCRYPTION: "rZffGjw4BGlwoM+66fStJ4Pg+ivLc5ghtty3yoscltY="
volumes:
- /data/compose/semaphore/db:/etc/semaphore
- /data/compose/semaphore/projects:/var/lib/semaphore/projects
- /data/compose/semaphore/backups:/opt/mikrotik_backups/
- /data/compose/semaphore/ansible.cfg:/etc/ansible/ansible.cfg:ro
restart: unless-stopped
docker-compose/docker-compose-semaphore_backup.yml
-26
View File
@@ -1,26 +0,0 @@
version: "3.8"
services:
semaphore:
image: semaphoreui/semaphore:latest
user: "0:0"
ports:
- "3000:3000"
environment:
SEMAPHORE_DB_DIALECT: bolt
SEMAPHORE_DB_PATH: /etc/semaphore/semaphore.db.bolt # full path to file!
SEMAPHORE_TMP_PATH: /var/lib/semaphore/projects
SEMAPHORE_ADMIN: admin
SEMAPHORE_ADMIN_NAME: admin
SEMAPHORE_ADMIN_EMAIL: admin@localhost
SEMAPHORE_ADMIN_PASSWORD: changeme
SEMAPHORE_ACCESS_KEY_ENCRYPTION: "rZffGjw4BGlwoM+66fStJ4Pg+ivLc5ghtty3yoscltY="
volumes:
- /data/compose/semaphore/db:/etc/semaphore
- /data/compose/semaphore/projects:/var/lib/semaphore/projects
- /data/compose/semaphore/backups:/opt/mikrotik_backups/
- /data/compose/semaphore/ansible.cfg:/etc/ansible.cfg:ro # mount as file, ne do /etc/ansible/ansible.cfg
restart: unless-stopped
docker-compose/docker-compose-uptimekuma.yml
-12
View File
@@ -1,12 +0,0 @@
version: '3.8'
services:
uptime-kuma:
container_name: uptime-kuma-dev
image: louislam/uptime-kuma:latest
volumes:
#- ./data:/app/data
- /data/compose/kuma/data:/app/data
ports:
- "3001:3001" # <Host Port>:<Container Port>
inv_mikrotiks
-5
View File
@@ -1,8 +1,3 @@
[mikrotiks] [mikrotiks]
mikrotik_fencl_server ansible_host=192.168.69.1 mikrotik_fencl_server ansible_host=192.168.69.1
mikrotik_fencl_5G ansible_host=192.168.68.1 mikrotik_fencl_5G ansible_host=192.168.68.1
[mikrotiks:vars]
ansible_connection=network_cli
ansible_network_os=community.routeros.routeros
ansible_command_timeout=15
inv_vm
-2
View File
@@ -1,5 +1,3 @@
[vm] [vm]
pve1_vm ansible_host=192.168.69.253 pve1_vm ansible_host=192.168.69.253
pve2_vm ansible_host=192.168.69.254 pve2_vm ansible_host=192.168.69.254
[lxc]
pve2_lxc_jellyfin ansible_host=192.168.69.252
old/mikrotikbackup.yml → mikrotikbackup.yml
View File
mikrotikbackup_clean.yml
-331
View File
@@ -1,331 +0,0 @@
# mikrotikbackup_clean.yml
---
- name: Backup and/or upgrade MikroTik
hosts: mikrotiks
gather_facts: false
vars:
# This directory is located on the Semaphore runner
backup_dir: /opt/mikrotik_backups
# Maximum time for a router to return after an upgrade
upgrade_wait_timeout: 900
tasks:
# -------------------------------------------------------------------------
# Common information
# -------------------------------------------------------------------------
- name: Get router identity
community.routeros.command:
commands:
- /system identity get name
register: identity_raw
changed_when: false
tags:
- always
- name: Build safe router name
ansible.builtin.set_fact:
router_name: >-
{{
(
identity_raw.stdout[0]
| default(inventory_hostname, true)
| trim
)
| regex_replace('[^A-Za-z0-9._-]+', '_')
| regex_replace('^_+|_+$', '')
}}
tags:
- always
- name: Validate router name
ansible.builtin.assert:
that:
- router_name | length > 0
fail_msg: >-
Could not determine RouterOS identity for
{{ inventory_hostname }}.
quiet: true
tags:
- always
- name: Generate backup timestamp
ansible.builtin.command:
argv:
- date
- --utc
- "+%Y-%m-%d_%H-%M-%S"
register: date_out
changed_when: false
delegate_to: localhost
tags:
- always
- name: Set timestamp fact
ansible.builtin.set_fact:
backup_timestamp: "{{ date_out.stdout | trim }}"
tags:
- always
# -------------------------------------------------------------------------
# Backup
# Run with: --tags backup
# -------------------------------------------------------------------------
- name: Ensure local backup directory exists
ansible.builtin.file:
path: "{{ backup_dir }}"
state: directory
mode: "0700"
delegate_to: localhost
run_once: true
tags:
- backup
- never
- name: Export RouterOS configuration
community.routeros.command:
commands:
- /export terse show-sensitive
register: export_cfg
changed_when: false
no_log: true
tags:
- backup
- never
- name: Validate exported configuration
ansible.builtin.assert:
that:
- export_cfg.stdout is defined
- export_cfg.stdout | length > 0
- export_cfg.stdout[0] | default('') | trim | length > 0
fail_msg: >-
RouterOS returned an empty configuration export
for {{ inventory_hostname }}.
quiet: true
no_log: true
tags:
- backup
- never
- name: Set backup filename
ansible.builtin.set_fact:
backup_file: >-
{{
backup_dir
~ '/'
~ router_name
~ '-'
~ backup_timestamp
~ '.rsc'
}}
tags:
- backup
- never
- name: Save RouterOS configuration locally
ansible.builtin.copy:
content: "{{ export_cfg.stdout[0] | trim }}\n"
dest: "{{ backup_file }}"
mode: "0600"
delegate_to: localhost
no_log: true
diff: false
tags:
- backup
- never
- name: Show backup result
ansible.builtin.debug:
msg: >-
MikroTik backup completed:
host={{ inventory_hostname }}
identity={{ router_name }}
file={{ backup_file }}
tags:
- backup
- never
# -------------------------------------------------------------------------
# Upgrade
# Run with: --tags upgrade
# Run with backup before upgrade: --tags backup,upgrade
# -------------------------------------------------------------------------
- name: Check current and latest RouterOS versions
community.routeros.command:
commands:
- /system package update check-for-updates
register: update_check
changed_when: false
tags:
- upgrade
- never
- name: Normalize update output
ansible.builtin.set_fact:
update_text: >-
{{
update_check.stdout[0]
| default('')
| replace('\r', '')
}}
tags:
- upgrade
- never
- name: Extract version matches
ansible.builtin.set_fact:
installed_version_matches: >-
{{
update_text
| regex_findall(
'(?im)^\\s*(?:installed|current)-version:\\s*(\\S+)\\s*$'
)
}}
latest_version_matches: >-
{{
update_text
| regex_findall(
'(?im)^\\s*(?:latest|newest)-version:\\s*(\\S+)\\s*$'
)
}}
tags:
- upgrade
- never
- name: Set installed and latest versions
ansible.builtin.set_fact:
installed_version: >-
{{
installed_version_matches[0]
if installed_version_matches | length > 0
else 'unknown'
}}
latest_version: >-
{{
latest_version_matches[0]
if latest_version_matches | length > 0
else 'unknown'
}}
tags:
- upgrade
- never
- name: Show raw update output
ansible.builtin.debug:
msg: "{{ update_text }}"
tags:
- upgrade
- never
- name: Validate parsed RouterOS versions
ansible.builtin.assert:
that:
- installed_version != 'unknown'
- latest_version != 'unknown'
fail_msg: >-
Could not parse RouterOS versions on
{{ inventory_hostname }}.
Raw output: {{ update_text }}
quiet: true
tags:
- upgrade
- never
- name: Show RouterOS versions
ansible.builtin.debug:
msg:
- "Router: {{ router_name }}"
- "Installed: {{ installed_version }}"
- "Latest: {{ latest_version }}"
tags:
- upgrade
- never
- name: Show already up-to-date result
ansible.builtin.debug:
msg: >-
Router {{ router_name }} is already running
RouterOS {{ installed_version }}.
when: installed_version == latest_version
tags:
- upgrade
- never
- name: Trigger RouterOS package installation
community.routeros.command:
commands:
- /system package update install
register: upgrade_result
changed_when: true
failed_when: false
when: installed_version != latest_version
tags:
- upgrade
- never
- name: Wait for router SSH service to stop
ansible.builtin.wait_for:
host: "{{ ansible_host | default(inventory_hostname) }}"
port: "{{ ansible_port | default(22) | int }}"
state: stopped
connect_timeout: 5
timeout: 180
delegate_to: localhost
failed_when: false
when: installed_version != latest_version
tags:
- upgrade
- never
- name: Wait for router SSH service to start
ansible.builtin.wait_for:
host: "{{ ansible_host | default(inventory_hostname) }}"
port: "{{ ansible_port | default(22) | int }}"
state: started
delay: 10
connect_timeout: 5
timeout: "{{ upgrade_wait_timeout }}"
delegate_to: localhost
when: installed_version != latest_version
tags:
- upgrade
- never
- name: Reset RouterOS connection
ansible.builtin.meta: reset_connection
when: installed_version != latest_version
tags:
- upgrade
- never
- name: Read RouterOS version after upgrade
community.routeros.command:
commands:
- /system resource get version
register: post_upgrade_version
retries: 20
delay: 15
until: post_upgrade_version is succeeded
changed_when: false
when: installed_version != latest_version
tags:
- upgrade
- never
- name: Show RouterOS version after upgrade
ansible.builtin.debug:
msg: >-
Router {{ router_name }} is online.
RouterOS version:
{{ post_upgrade_version.stdout[0] | default('unknown') | trim }}
when: installed_version != latest_version
tags:
- upgrade
- never
nextcloud/update_collabora.yml
+162 -80
View File
@@ -1,92 +1,174 @@
# nextcloud/update_collabora.yml # nextcloud/update_collabora.yml
- name: Update Collabora - name: Update Collabora CODE on VM via Proxmox
hosts: pve2_vm hosts: linux_servers
gather_facts: false gather_facts: false
become: true
become_user: root
become_method: sudo
vars: vars:
# Compose sync (controller -> target) # --- Connection to VM (provided by Semaphore env vars) ---
compose_local_dir: "{{ lookup('env','PWD') }}/docker-compose" vm_ip: "{{ lookup('env', 'VM_IP') }}"
compose_remote_base: "/home/{{ ansible_user }}/.ansible-compose" vm_user: "{{ lookup('env', 'VM_USER') }}"
compose_remote_dir: "{{ compose_remote_base }}/docker-compose" vm_pass: "{{ lookup('env', 'VM_PASS') }}"
compose_remote_archive: "{{ compose_remote_base }}/docker-compose.tar.gz" use_sudo: false
# Collabora settings # --- Debug mode (controlled via Semaphore variable) ---
collabora_project: collabora DEBUG: "{{ lookup('env', 'DEBUG') | default(0) | int }}"
collabora_compose_filename: "docker-compose-collabora.yml" RETRIES: "{{ lookup('env', 'RETRIES') | default(25) | int }}"
collabora_service: collabora
collabora_port: 9980 # --- Collabora specifics ---
collabora_debug_caps: true
collabora_caps_url: "https://collabora.martinfencl.eu/hosting/capabilities"
# Use the FULL Nextcloud stack compose file; only target the 'collabora' service inside it
collabora_project: "nextcloud-collabora"
collabora_compose_file: "/data/compose/nextcloud/nextcloud-collabora.yml"
collabora_service: "collabora"
# Docker command prefix (consistent behavior and quiet hints)
docker_prefix: "unalias docker 2>/dev/null || true; DOCKER_CLI_HINTS=0; command docker"
# Commands to run on the target VM (quiet outputs)
collabora_commands:
- "{{ docker_prefix }} pull -q collabora/code:latest >/dev/null"
- "{{ docker_prefix }} compose -p {{ collabora_project }} -f {{ collabora_compose_file }} pull {{ collabora_service }} >/dev/null"
- "{{ docker_prefix }} compose -p {{ collabora_project }} -f {{ collabora_compose_file }} up -d --no-deps --force-recreate {{ collabora_service }} >/dev/null"
tasks: tasks:
- name: Ensure remote base directory exists - name: Ensure sshpass is installed (for password-based SSH) # English comments
ansible.builtin.file: ansible.builtin.apt:
path: "{{ compose_remote_base }}" name: sshpass
state: directory state: present
mode: "0755" update_cache: yes
- name: Create local archive of docker-compose directory (controller) - name: Run Collabora update commands on VM (via SSH) # use SSHPASS env, hide item value
ansible.builtin.archive: ansible.builtin.command:
path: "{{ compose_local_dir }}/" argv:
dest: "/tmp/docker-compose.tar.gz" - sshpass
format: gz - -e
- ssh
- -o
- StrictHostKeyChecking=no
- -o
- ConnectTimeout=15
- "{{ vm_user }}@{{ vm_ip }}"
- bash
- -lc
- "{{ ('sudo ' if use_sudo else '') + item }}"
environment:
SSHPASS: "{{ vm_pass }}"
loop: "{{ collabora_commands }}"
loop_control:
index_var: idx # <-- capture loop index here
label: "cmd-{{ idx }}" # <-- use idx instead of loop.index
register: collab_cmds
changed_when: false
no_log: "{{ DEBUG == 0 }}"
- name: Show outputs for each Collabora command
ansible.builtin.debug:
msg: |
CMD: {{ item.item }}
RC: {{ item.rc }}
STDOUT:
{{ (item.stdout | default('')).strip() }}
STDERR:
{{ (item.stderr | default('')).strip() }}
loop: "{{ collab_cmds.results }}"
when: DEBUG == 1
- name: Fail play if any Collabora command failed # also hide item label
ansible.builtin.assert:
that: "item.rc == 0"
fail_msg: "Collabora update failed on VM: {{ item.item }} (rc={{ item.rc }})"
success_msg: "All Collabora update commands succeeded."
loop: "{{ collab_cmds.results }}"
loop_control:
index_var: idx
label: "cmd-{{ idx }}"
# -------------------------
# Readiness checks (controller first, then VM fallback)
# -------------------------
- name: Collabora | Wait for capabilities (controller first)
ansible.builtin.uri:
url: "{{ collabora_caps_url }}"
method: GET
return_content: true
validate_certs: true
status_code: 200
register: caps_controller
delegate_to: localhost delegate_to: localhost
run_once: true run_once: true
retries: "{{ RETRIES }}"
- name: Upload archive to remote host delay: 2
ansible.builtin.copy: until: caps_controller.status == 200
src: "/tmp/docker-compose.tar.gz" failed_when: false
dest: "{{ compose_remote_archive }}"
mode: "0644"
- name: Recreate remote compose directory
ansible.builtin.file:
path: "{{ compose_remote_dir }}"
state: absent
- name: Ensure remote compose directory exists
ansible.builtin.file:
path: "{{ compose_remote_dir }}"
state: directory
mode: "0755"
- name: Extract archive on remote host
ansible.builtin.unarchive:
src: "{{ compose_remote_archive }}"
dest: "{{ compose_remote_dir }}"
remote_src: true
- name: Pull latest Collabora image
community.docker.docker_compose_v2:
project_name: "{{ collabora_project }}"
project_src: "{{ compose_remote_dir }}"
files:
- "{{ collabora_compose_filename }}"
pull: always
- name: Recreate Collabora service
community.docker.docker_compose_v2:
project_name: "{{ collabora_project }}"
project_src: "{{ compose_remote_dir }}"
files:
- "{{ collabora_compose_filename }}"
services:
- "{{ collabora_service }}"
state: present
recreate: always
- name: Wait for Collabora port
ansible.builtin.wait_for:
host: 127.0.0.1
port: "{{ collabora_port }}"
timeout: 120
- name: Check Collabora discovery endpoint (retry until ready)
ansible.builtin.uri:
url: "http://127.0.0.1:{{ collabora_port }}/hosting/discovery"
status_code: 200
return_content: true
register: collabora_http
retries: 40
delay: 3
until: collabora_http.status == 200 and ('<wopi-discovery' in (collabora_http.content | default('')))
changed_when: false changed_when: false
- name: Collabora | VM-side fetch (pure JSON via Python) # use SSHPASS env here too
ansible.builtin.command:
argv:
- sshpass
- -e
- ssh
- -o
- StrictHostKeyChecking=no
- -o
- ConnectTimeout=15
- "{{ vm_user }}@{{ vm_ip }}"
- bash
- -lc
- |
python3 - <<'PY'
import json, urllib.request, sys
try:
with urllib.request.urlopen("{{ collabora_caps_url }}", timeout=15) as r:
sys.stdout.write(r.read().decode())
except Exception:
pass
PY
environment:
SSHPASS: "{{ vm_pass }}"
register: caps_vm
changed_when: false
failed_when: false
when: caps_controller.status | default(0) != 200 or caps_controller.json is not defined
no_log: "{{ DEBUG == 0 }}"
- name: Collabora | Choose JSON (controller wins, else VM)
ansible.builtin.set_fact:
collab_caps_json: >-
{{
(caps_controller.json
if (caps_controller.status|default(0))==200 and (caps_controller.json is defined)
else (
(caps_vm.stdout | default('') | trim | length > 0)
| ternary((caps_vm.stdout | trim | from_json), omit)
)
)
}}
failed_when: false
- name: Collabora | Print concise summary
ansible.builtin.debug:
msg: >-
Collabora {{ collab_caps_json.productVersion | default('?') }}
({{ collab_caps_json.productName | default('?') }}),
convert-to.available={{ collab_caps_json['convert-to']['available'] | default('n/a') }},
serverId={{ collab_caps_json.serverId | default('n/a') }}
when: collab_caps_json is defined and DEBUG == 1
- name: Collabora | Capabilities unavailable (after retries)
ansible.builtin.debug:
msg: "Capabilities endpoint není dostupný ani po pokusech."
when: collab_caps_json is not defined and DEBUG == 1
# Optional full JSON (debug)
- name: Collabora | Full JSON (debug)
ansible.builtin.debug:
var: collab_caps_json
when: collabora_debug_caps and (collab_caps_json is defined) and DEBUG == 1
old/update_nextcloud_mariadb_redis.yml → nextcloud/update_nextcloud_mariadb_redis.yml
View File
nextcloud/update_nextcloud_v2.yml
+78 -252
View File
@@ -1,287 +1,113 @@
# nextcloud/update_nextcloud.yml - name: Update Nextcloud (Ansible-native)
hosts: proxmox_nextcloud
- name: Update Nextcloud on VM via Proxmox
hosts: proxmox_nextcloud # linux_servers
gather_facts: false
become: true become: true
become_user: root gather_facts: false
become_method: sudo
vars: vars:
# --- Connection to VM (provided by Semaphore env vars) ---
vm_ip: "{{ lookup('env', 'VM_IP') }}"
vm_user: "{{ lookup('env', 'VM_USER') }}"
vm_pass: "{{ lookup('env', 'VM_PASS') }}"
use_sudo: false
# --- Debug / retries ---
DEBUG: "{{ lookup('env', 'DEBUG') | default(0) | int }}" DEBUG: "{{ lookup('env', 'DEBUG') | default(0) | int }}"
RETRIES: "{{ lookup('env', 'RETRIES') | default(25) | int }}" RETRIES: "{{ lookup('env', 'RETRIES') | default(25) | int }}"
# --- Nextcloud specifics ---
nextcloud_project: "nextcloud-collabora" nextcloud_project: "nextcloud-collabora"
nextcloud_compose_file: "/data/compose/nextcloud/docker-compose-nextcloud.yml" compose_file: "/data/compose/nextcloud/docker-compose-nextcloud.yml"
nextcloud_service: "nextcloud" backup_dir: "/data/compose/nextcloud/backup-{{ ansible_date_time.iso8601_basic_short }}"
# Backup directory on the VM (timestamped on controller)
backup_dir: "/data/compose/nextcloud/backup-{{ lookup('pipe', 'date +%F-%H%M%S') }}"
nextcloud_base_url: "https://cloud.martinfencl.eu" nextcloud_base_url: "https://cloud.martinfencl.eu"
nextcloud_status_url: "{{ nextcloud_base_url }}/status.php" nextcloud_status_url: "{{ nextcloud_base_url }}/status.php"
# Docker command prefix (consistent behavior and quiet hints)
docker_prefix: "unalias docker 2>/dev/null || true; DOCKER_CLI_HINTS=0; command docker"
# --- Backup phase commands (run on VM) ---
nextcloud_backup_commands:
- >-
mkdir -p "{{ backup_dir }}"
- >-
{{ docker_prefix }} exec -u www-data nextcloud php occ maintenance:mode --on
- >-
{{ docker_prefix }} exec nextcloud sh -c 'tar czf /tmp/nextcloud_conf.tgz -C /var/www/html config custom_apps'
- >-
{{ docker_prefix }} cp nextcloud:/tmp/nextcloud_conf.tgz "{{ backup_dir }}/nextcloud_conf.tgz"
- >-
{{ docker_prefix }} exec nextcloud rm /tmp/nextcloud_conf.tgz || true
- >-
{{ docker_prefix }} exec nextcloud-db sh -c 'command -v mariadb-dump >/dev/null && mariadb-dump -u"$MYSQL_USER" -p"$MYSQL_PASSWORD" "$MYSQL_DATABASE" || mysqldump -u"$MYSQL_USER" -p"$MYSQL_PASSWORD" "$MYSQL_DATABASE"' > "{{ backup_dir }}/db.sql"
# --- Upgrade phase commands (run on VM) ---
nextcloud_upgrade_commands:
- >-
{{ docker_prefix }} compose -p {{ nextcloud_project }} -f {{ nextcloud_compose_file }} pull {{ nextcloud_service }}
- >-
{{ docker_prefix }} compose -p {{ nextcloud_project }} -f {{ nextcloud_compose_file }} up -d --no-deps --force-recreate {{ nextcloud_service }}
- >-
{{ docker_prefix }} exec -u www-data nextcloud php occ maintenance:mode --off
- >-
{{ docker_prefix }} exec -u www-data nextcloud php occ upgrade
- >-
{{ docker_prefix }} exec -u www-data nextcloud php occ app:update --all || true
- >-
{{ docker_prefix }} exec -u www-data nextcloud php occ maintenance:repair --include-expensive || true
- >-
{{ docker_prefix }} exec -u www-data nextcloud php occ maintenance:mode --on
tasks: tasks:
- name: Ensure sshpass is installed (for password-based SSH) # -------------------------
ansible.builtin.apt: # Pre-check
name: sshpass # -------------------------
state: present - name: Show current Nextcloud version (DEBUG)
update_cache: yes command: docker exec -u www-data nextcloud php occ -V
register: nc_version
- name: Nextcloud | Show current version before upgrade (DEBUG)
ansible.builtin.command:
argv:
- sshpass
- -e
- ssh
- -o
- StrictHostKeyChecking=no
- -o
- ConnectTimeout=15
- "{{ vm_user }}@{{ vm_ip }}"
- bash
- -lc
- 'docker exec -u www-data nextcloud php occ -V || true'
environment:
SSHPASS: "{{ vm_pass }}"
register: nc_version_before
changed_when: false changed_when: false
failed_when: false failed_when: false
when: DEBUG == 1 when: DEBUG == 1
# ------------------------- - debug:
# Backup phase var: nc_version.stdout
# -------------------------
- name: Nextcloud | Run backup commands on VM (via SSH) # run plain commands via SSH
ansible.builtin.command:
argv:
- sshpass
- -e
- ssh
- -o
- StrictHostKeyChecking=no
- -o
- ConnectTimeout=15
- "{{ vm_user }}@{{ vm_ip }}"
- "{{ ('sudo ' if use_sudo else '') + item }}"
environment:
SSHPASS: "{{ vm_pass }}"
loop: "{{ nextcloud_backup_commands }}"
loop_control:
index_var: idx
label: "backup-cmd-{{ idx }}"
register: nc_backup_cmds
changed_when: false
no_log: "{{ DEBUG == 0 }}"
- name: Nextcloud | Show outputs of backup commands (DEBUG)
ansible.builtin.debug:
msg: |
CMD: {{ item.item }}
RC: {{ item.rc }}
STDOUT:
{{ (item.stdout | default('')).strip() }}
STDERR:
{{ (item.stderr | default('')).strip() }}
loop: "{{ nc_backup_cmds.results }}"
when: DEBUG == 1 when: DEBUG == 1
- name: Nextcloud | Fail play if any backup command failed # -------------------------
ansible.builtin.assert: # Backup
that: "item.rc == 0" # -------------------------
fail_msg: "Nextcloud backup step failed on VM: {{ item.item }} (rc={{ item.rc }})" - name: Enable maintenance mode
success_msg: "All Nextcloud backup commands succeeded." command: docker exec -u www-data nextcloud php occ maintenance:mode --on
loop: "{{ nc_backup_cmds.results }}"
loop_control: - name: Create backup directory
index_var: idx file:
label: "backup-cmd-{{ idx }}" path: "{{ backup_dir }}"
state: directory
- name: Backup config and custom_apps
command: >
docker exec nextcloud
tar czf /tmp/nextcloud_conf.tgz -C /var/www/html config custom_apps
- name: Copy config backup out of container
command: docker cp nextcloud:/tmp/nextcloud_conf.tgz {{ backup_dir }}/
- name: Remove temp archive from container
command: docker exec nextcloud rm -f /tmp/nextcloud_conf.tgz
- name: Backup database
shell: >
docker exec nextcloud-db sh -c
'command -v mariadb-dump >/dev/null &&
mariadb-dump -u"$MYSQL_USER" -p"$MYSQL_PASSWORD" "$MYSQL_DATABASE" ||
mysqldump -u"$MYSQL_USER" -p"$MYSQL_PASSWORD" "$MYSQL_DATABASE"'
register: db_dump
- name: Save database dump
copy:
content: "{{ db_dump.stdout }}"
dest: "{{ backup_dir }}/db.sql"
# ------------------------- # -------------------------
# Upgrade phase # Upgrade
# ------------------------- # -------------------------
- name: Pull new Nextcloud image
command: docker compose -p {{ nextcloud_project }} -f {{ compose_file }} pull nextcloud
- name: Nextcloud | Run upgrade commands on VM (via SSH) - name: Recreate Nextcloud container
ansible.builtin.command: command: docker compose -p {{ nextcloud_project }} -f {{ compose_file }}
argv: up -d --no-deps --force-recreate nextcloud
- sshpass
- -e - name: Run Nextcloud upgrade
- ssh command: docker exec -u www-data nextcloud php occ upgrade
- -o
- StrictHostKeyChecking=no - name: Update apps
- -o command: docker exec -u www-data nextcloud php occ app:update --all
- ConnectTimeout=15
- "{{ vm_user }}@{{ vm_ip }}"
- bash
- -lc
- "{{ ('sudo ' if use_sudo else '') + item }}"
environment:
SSHPASS: "{{ vm_pass }}"
loop: "{{ nextcloud_upgrade_commands }}"
loop_control:
index_var: idx
label: "upgrade-cmd-{{ idx }}"
register: nc_upgrade_cmds
changed_when: false
failed_when: false failed_when: false
no_log: "{{ DEBUG == 0 }}"
- name: Nextcloud | Show outputs of upgrade commands (DEBUG) - name: Run maintenance repair
ansible.builtin.debug: command: docker exec -u www-data nextcloud php occ maintenance:repair --include-expensive
msg: | failed_when: false
CMD: {{ item.item }}
RC: {{ item.rc }}
STDOUT:
{{ (item.stdout | default('')).strip() }}
STDERR:
{{ (item.stderr | default('')).strip() }}
loop: "{{ nc_upgrade_cmds.results }}"
when: DEBUG == 1
- name: Nextcloud | Fail play if any upgrade command failed - name: Disable maintenance mode
ansible.builtin.assert: command: docker exec -u www-data nextcloud php occ maintenance:mode --off
that: "item.rc == 0"
fail_msg: "Nextcloud upgrade step failed on VM: {{ item.item }} (rc={{ item.rc }})"
success_msg: "All Nextcloud upgrade commands succeeded."
loop: "{{ nc_upgrade_cmds.results }}"
loop_control:
index_var: idx
label: "upgrade-cmd-{{ idx }}"
- name: Nextcloud | Disable maintenance mode (only after successful upgrade)
ansible.builtin.command:
argv:
- sshpass
- -e
- ssh
- -o
- StrictHostKeyChecking=no
- -o
- ConnectTimeout=15
- "{{ vm_user }}@{{ vm_ip }}"
- "{{ ('sudo ' if use_sudo else '') }}docker exec -u www-data nextcloud php occ maintenance:mode --off"
environment:
SSHPASS: "{{ vm_pass }}"
register: nc_maint_off
changed_when: false
no_log: "{{ DEBUG == 0 }}"
# ------------------------- # -------------------------
# Readiness check (status.php) # Readiness check
# ------------------------- # -------------------------
- name: Wait for status.php
- name: Nextcloud | Wait for status.php (controller first) uri:
ansible.builtin.uri:
url: "{{ nextcloud_status_url }}" url: "{{ nextcloud_status_url }}"
method: GET status_code: 200
return_content: true return_content: true
validate_certs: true validate_certs: true
status_code: 200 register: nc_status
register: nc_status_controller
delegate_to: localhost
run_once: true
retries: "{{ RETRIES }}" retries: "{{ RETRIES }}"
delay: 4 delay: 4
until: nc_status_controller.status == 200 until: nc_status.status == 200
failed_when: false
changed_when: false changed_when: false
- name: Nextcloud | VM-side fetch status.php (JSON via Python) - name: Print status summary (DEBUG)
ansible.builtin.command: debug:
argv: msg: >
- sshpass Nextcloud {{ nc_status.json.version }}
- -e (installed={{ nc_status.json.installed }},
- ssh maintenance={{ nc_status.json.maintenance }},
- -o needsDbUpgrade={{ nc_status.json.needsDbUpgrade }})
- StrictHostKeyChecking=no when: DEBUG == 1
- -o
- ConnectTimeout=15
- "{{ vm_user }}@{{ vm_ip }}"
- bash
- -lc
- |
python3 - <<'PY'
import json, urllib.request, sys
try:
with urllib.request.urlopen("{{ nextcloud_status_url }}", timeout=15) as r:
sys.stdout.write(r.read().decode())
except Exception:
pass
PY
environment:
SSHPASS: "{{ vm_pass }}"
register: nc_status_vm
changed_when: false
failed_when: false
when: nc_status_controller.status | default(0) != 200 or nc_status_controller.json is not defined
no_log: "{{ DEBUG == 0 }}"
- name: Nextcloud | Choose status JSON (controller wins, else VM)
ansible.builtin.set_fact:
nextcloud_status_json: >-
{{
(nc_status_controller.json
if (nc_status_controller.status | default(0)) == 200 and (nc_status_controller.json is defined)
else (
(nc_status_vm.stdout | default('') | trim | length > 0)
| ternary((nc_status_vm.stdout | trim | from_json), omit)
)
)
}}
failed_when: false
- name: Nextcloud | Print concise status summary (DEBUG)
ansible.builtin.debug:
msg: >-
Nextcloud {{ nextcloud_status_json.version | default('?') }}
(installed={{ nextcloud_status_json.installed | default('?') }},
maintenance={{ nextcloud_status_json.maintenance | default('?') }},
needsDbUpgrade={{ nextcloud_status_json.needsDbUpgrade | default('?') }})
when: nextcloud_status_json is defined and DEBUG == 1
- name: Nextcloud | Status JSON not available (DEBUG)
ansible.builtin.debug:
msg: "status.php is not reachable or did not return JSON."
when: nextcloud_status_json is not defined and DEBUG == 1
old/update_collabora.yml
-174
View File
@@ -1,174 +0,0 @@
# nextcloud/update_collabora.yml
- name: Update Collabora CODE on VM via Proxmox
hosts: linux_servers
gather_facts: false
become: true
become_user: root
become_method: sudo
vars:
# --- Connection to VM (provided by Semaphore env vars) ---
vm_ip: "{{ lookup('env', 'VM_IP') }}"
vm_user: "{{ lookup('env', 'VM_USER') }}"
vm_pass: "{{ lookup('env', 'VM_PASS') }}"
use_sudo: false
# --- Debug mode (controlled via Semaphore variable) ---
DEBUG: "{{ lookup('env', 'DEBUG') | default(0) | int }}"
RETRIES: "{{ lookup('env', 'RETRIES') | default(25) | int }}"
# --- Collabora specifics ---
collabora_debug_caps: true
collabora_caps_url: "https://collabora.martinfencl.eu/hosting/capabilities"
# Use the FULL Nextcloud stack compose file; only target the 'collabora' service inside it
collabora_project: "nextcloud-collabora"
collabora_compose_file: "/data/compose/nextcloud/nextcloud-collabora.yml"
collabora_service: "collabora"
# Docker command prefix (consistent behavior and quiet hints)
docker_prefix: "unalias docker 2>/dev/null || true; DOCKER_CLI_HINTS=0; command docker"
# Commands to run on the target VM (quiet outputs)
collabora_commands:
- "{{ docker_prefix }} pull -q collabora/code:latest >/dev/null"
- "{{ docker_prefix }} compose -p {{ collabora_project }} -f {{ collabora_compose_file }} pull {{ collabora_service }} >/dev/null"
- "{{ docker_prefix }} compose -p {{ collabora_project }} -f {{ collabora_compose_file }} up -d --no-deps --force-recreate {{ collabora_service }} >/dev/null"
tasks:
- name: Ensure sshpass is installed (for password-based SSH) # English comments
ansible.builtin.apt:
name: sshpass
state: present
update_cache: yes
- name: Run Collabora update commands on VM (via SSH) # use SSHPASS env, hide item value
ansible.builtin.command:
argv:
- sshpass
- -e
- ssh
- -o
- StrictHostKeyChecking=no
- -o
- ConnectTimeout=15
- "{{ vm_user }}@{{ vm_ip }}"
- bash
- -lc
- "{{ ('sudo ' if use_sudo else '') + item }}"
environment:
SSHPASS: "{{ vm_pass }}"
loop: "{{ collabora_commands }}"
loop_control:
index_var: idx # <-- capture loop index here
label: "cmd-{{ idx }}" # <-- use idx instead of loop.index
register: collab_cmds
changed_when: false
no_log: "{{ DEBUG == 0 }}"
- name: Show outputs for each Collabora command
ansible.builtin.debug:
msg: |
CMD: {{ item.item }}
RC: {{ item.rc }}
STDOUT:
{{ (item.stdout | default('')).strip() }}
STDERR:
{{ (item.stderr | default('')).strip() }}
loop: "{{ collab_cmds.results }}"
when: DEBUG == 1
- name: Fail play if any Collabora command failed # also hide item label
ansible.builtin.assert:
that: "item.rc == 0"
fail_msg: "Collabora update failed on VM: {{ item.item }} (rc={{ item.rc }})"
success_msg: "All Collabora update commands succeeded."
loop: "{{ collab_cmds.results }}"
loop_control:
index_var: idx
label: "cmd-{{ idx }}"
# -------------------------
# Readiness checks (controller first, then VM fallback)
# -------------------------
- name: Collabora | Wait for capabilities (controller first)
ansible.builtin.uri:
url: "{{ collabora_caps_url }}"
method: GET
return_content: true
validate_certs: true
status_code: 200
register: caps_controller
delegate_to: localhost
run_once: true
retries: "{{ RETRIES }}"
delay: 2
until: caps_controller.status == 200
failed_when: false
changed_when: false
- name: Collabora | VM-side fetch (pure JSON via Python) # use SSHPASS env here too
ansible.builtin.command:
argv:
- sshpass
- -e
- ssh
- -o
- StrictHostKeyChecking=no
- -o
- ConnectTimeout=15
- "{{ vm_user }}@{{ vm_ip }}"
- bash
- -lc
- |
python3 - <<'PY'
import json, urllib.request, sys
try:
with urllib.request.urlopen("{{ collabora_caps_url }}", timeout=15) as r:
sys.stdout.write(r.read().decode())
except Exception:
pass
PY
environment:
SSHPASS: "{{ vm_pass }}"
register: caps_vm
changed_when: false
failed_when: false
when: caps_controller.status | default(0) != 200 or caps_controller.json is not defined
no_log: "{{ DEBUG == 0 }}"
- name: Collabora | Choose JSON (controller wins, else VM)
ansible.builtin.set_fact:
collab_caps_json: >-
{{
(caps_controller.json
if (caps_controller.status|default(0))==200 and (caps_controller.json is defined)
else (
(caps_vm.stdout | default('') | trim | length > 0)
| ternary((caps_vm.stdout | trim | from_json), omit)
)
)
}}
failed_when: false
- name: Collabora | Print concise summary
ansible.builtin.debug:
msg: >-
Collabora {{ collab_caps_json.productVersion | default('?') }}
({{ collab_caps_json.productName | default('?') }}),
convert-to.available={{ collab_caps_json['convert-to']['available'] | default('n/a') }},
serverId={{ collab_caps_json.serverId | default('n/a') }}
when: collab_caps_json is defined and DEBUG == 1
- name: Collabora | Capabilities unavailable (after retries)
ansible.builtin.debug:
msg: "Capabilities endpoint není dostupný ani po pokusech."
when: collab_caps_json is not defined and DEBUG == 1
# Optional full JSON (debug)
- name: Collabora | Full JSON (debug)
ansible.builtin.debug:
var: collab_caps_json
when: collabora_debug_caps and (collab_caps_json is defined) and DEBUG == 1
old/update_homarr.yml
-194
View File
@@ -1,194 +0,0 @@
# update_homarr.yml
- name: Update Homarr on VM via Proxmox
hosts: linux_servers
gather_facts: false
become: true
become_user: root
become_method: sudo
vars:
# VM connection (provided by Semaphore env vars)
vm_ip: "{{ lookup('env', 'VM_IP') }}"
vm_user: "{{ lookup('env', 'VM_USER') }}"
vm_pass: "{{ lookup('env', 'VM_PASS') }}"
use_sudo: false
# --- Debug mode (controlled via Semaphore variable) ---
DEBUG: "{{ lookup('env', 'DEBUG') | default(0) | int }}"
RETRIES: "{{ lookup('env', 'RETRIES') | default(25) | int }}"
# Homarr specifics
homarr_project: "homarr"
homarr_compose_file: "/data/compose/homarr/docker-compose-homarr.yml"
homarr_service: "homarr"
homarr_image: "ghcr.io/homarr-labs/homarr:latest"
homarr_port: 7575
# Optional external URL for controller-side readiness check (e.g., https://homarr.example.com)
# If empty/undefined, controller check is skipped and we only probe from the VM.
homarr_url: "{{ lookup('env', 'HOMARR_URL') | default('', true) }}"
# Fixed container name used in your compose (avoid conflicts with any leftover container)
homarr_container_name: "homarr"
# Retry policy (same pattern as Kuma): 25x with 2s delay
homarr_retries: "{{ RETRIES }}"
homarr_delay: 2
# Docker command prefix (consistent behavior)
docker_prefix: "unalias docker 2>/dev/null || true; DOCKER_CLI_HINTS=0; command docker"
# Commands to run on the target VM (quiet outputs)
homarr_commands:
- "{{ docker_prefix }} pull -q {{ homarr_image }} >/dev/null"
- "{{ docker_prefix }} compose -p {{ homarr_project }} -f {{ homarr_compose_file }} pull {{ homarr_service }} >/dev/null"
# remove conflicting container name before compose up (silently)
- "{{ docker_prefix }} rm -f {{ homarr_container_name }} >/dev/null 2>&1 || true"
- "{{ docker_prefix }} compose -p {{ homarr_project }} -f {{ homarr_compose_file }} up -d --no-deps --force-recreate {{ homarr_service }} >/dev/null"
tasks:
- name: Ensure sshpass is installed (for password-based SSH) # English comments
ansible.builtin.apt:
name: sshpass
state: present
update_cache: yes
- name: Run Homarr update commands on VM (via SSH) # use SSHPASS env, hide item label
ansible.builtin.command:
argv:
- sshpass
- -e # read password from SSHPASS environment
- ssh
- -o
- StrictHostKeyChecking=no
- -o
- ConnectTimeout=15
- "{{ vm_user }}@{{ vm_ip }}"
- bash
- -lc
- "{{ ('sudo ' if use_sudo else '') + item }}"
environment:
SSHPASS: "{{ vm_pass }}" # supply password via environment
loop: "{{ homarr_commands }}"
loop_control:
index_var: idx # capture loop index
label: "cmd-{{ idx }}" # avoid printing full command in (item=...) line
register: homarr_cmds
changed_when: false
no_log: "{{ DEBUG == 0 }}" # hide outputs and env when not debugging
- name: Show outputs for each Homarr command
ansible.builtin.debug:
msg: |
CMD: {{ item.item }}
RC: {{ item.rc }}
STDOUT:
{{ (item.stdout | default('')).strip() }}
STDERR:
{{ (item.stderr | default('')).strip() }}
loop: "{{ homarr_cmds.results }}"
when: DEBUG == 1
- name: Fail play if any Homarr command failed # also hide item label
ansible.builtin.assert:
that: "item.rc == 0"
fail_msg: "Homarr update failed on VM: {{ item.item }} (rc={{ item.rc }})"
success_msg: "All Homarr update commands succeeded."
loop: "{{ homarr_cmds.results }}"
loop_control:
index_var: idx
label: "cmd-{{ idx }}"
# -------------------------
# Readiness checks (controller first, then VM fallback)
# -------------------------
- name: Homarr | Wait for homepage (controller first, with retries)
ansible.builtin.uri:
url: "{{ (homarr_url | regex_replace('/$','')) + '/' }}"
method: GET
return_content: true
# Validate TLS only when using https://
validate_certs: "{{ (homarr_url | default('')) is match('^https://') }}"
status_code: 200
register: homarr_controller
delegate_to: localhost
run_once: true
when: homarr_url is defined and (homarr_url | length) > 0
retries: "{{ homarr_retries }}"
delay: "{{ homarr_delay }}"
until: homarr_controller.status == 200
failed_when: false
changed_when: false
- name: Homarr | VM-side fetch (HTML via Python, with retries) # use SSHPASS env here too
ansible.builtin.command:
argv:
- sshpass
- -e
- ssh
- -o
- StrictHostKeyChecking=no
- -o
- ConnectTimeout=15
- "{{ vm_user }}@{{ vm_ip }}"
- bash
- -lc
- |
python3 - <<'PY'
# Fetch Homarr homepage from localhost and print HTML to stdout
import urllib.request, sys
try:
with urllib.request.urlopen("http://127.0.0.1:{{ homarr_port }}/", timeout=15) as r:
sys.stdout.write(r.read().decode(errors='ignore'))
except Exception:
pass
PY
environment:
SSHPASS: "{{ vm_pass }}"
register: homarr_vm
changed_when: false
failed_when: false
when: homarr_controller.status | default(0) != 200 or homarr_controller.content is not defined
retries: "{{ homarr_retries }}"
delay: "{{ homarr_delay }}"
until: (homarr_vm.stdout | default('') | trim | length) > 0 and ('Homarr' in (homarr_vm.stdout | default('')))
no_log: "{{ DEBUG == 0 }}"
- name: Homarr | Choose homepage HTML (controller wins, else VM) # safe guard against empty result
ansible.builtin.set_fact:
homarr_home_html: >-
{{
(
homarr_controller.content
if (homarr_controller is defined)
and ((homarr_controller.status|default(0))==200)
and (homarr_controller.content is defined)
else
(homarr_vm.stdout | default('') | trim)
)
}}
when:
- (homarr_controller is defined and (homarr_controller.status|default(0))==200 and (homarr_controller.content is defined))
or ((homarr_vm.stdout | default('') | trim | length) > 0)
- name: Homarr | Print concise summary
ansible.builtin.debug:
msg: >-
Homarr homepage {{ 'reachable' if (homarr_home_html is defined) else 'NOT reachable' }}.
Source={{ 'controller' if ((homarr_controller is defined) and (homarr_controller.status|default(0))==200 and (homarr_controller.content is defined)) else 'vm' if (homarr_vm.stdout|default('')|trim|length>0) else 'n/a' }};
length={{ (homarr_home_html | default('')) | length }};
contains('Homarr')={{ (homarr_home_html is defined) and ('Homarr' in homarr_home_html) }}
when: DEBUG == 1
- name: Homarr | Homepage unavailable (after retries)
ansible.builtin.debug:
msg: "Homarr web není dostupný ani po pokusech."
when: homarr_home_html is not defined and DEBUG == 1
# Optional detailed dump (short excerpt only)
- name: Homarr | HTML excerpt (debug)
ansible.builtin.debug:
msg: "{{ (homarr_home_html | default(''))[:500] }}"
when: homarr_home_html is defined and DEBUG == 1
old/update_immich.yml
-313
View File
@@ -1,313 +0,0 @@
# update_immich.yml
- name: Update Immich on VM via Proxmox
hosts: linux_servers
gather_facts: false
become: true
become_user: root
become_method: sudo
vars:
# VM connection (provided by Semaphore env vars)
vm_ip: "{{ lookup('env', 'VM_IP') }}"
vm_user: "{{ lookup('env', 'VM_USER') }}"
vm_pass: "{{ lookup('env', 'VM_PASS') }}"
use_sudo: false
# --- Debug mode (controlled via Semaphore variable) ---
DEBUG: "{{ lookup('env', 'DEBUG') | default(0) | int }}"
RETRIES: "{{ lookup('env', 'RETRIES') | default(25) | int }}"
# Immich specifics
immich_dir: "/opt/immich"
immich_project: "immich"
immich_compose_url: "https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml"
immich_compose_file: "/opt/immich/docker-compose.yml"
immich_override_file: "/opt/immich/docker-compose.override.yml"
immich_port: 2283
# Optional external URL for controller-side readiness check (e.g., https://photos.example.com)
immich_url: "{{ lookup('env', 'IMMICH_URL') | default('', true) }}"
# Retry policy
immich_retries: "{{ RETRIES }}"
immich_delay: 2
# Docker command prefix (consistent behavior)
docker_prefix: "unalias docker 2>/dev/null || true; DOCKER_CLI_HINTS=0; command docker"
# Compose command (always include override to keep local mounts separate from upstream compose)
immich_compose_cmd: >-
{{ docker_prefix }} compose
-p {{ immich_project }}
-f {{ immich_compose_file }}
-f {{ immich_override_file }}
# Commands to run on the target VM
immich_commands:
- "cd {{ immich_dir }}"
- |
cd {{ immich_dir }}
mkdir -p backups
if [ -f docker-compose.yml ]; then
cp -a docker-compose.yml "backups/docker-compose.yml.$(date +%F_%H%M%S).bak"
fi
if [ -f .env ]; then
cp -a .env "backups/.env.$(date +%F_%H%M%S).bak"
fi
if [ -f docker-compose.override.yml ]; then
cp -a docker-compose.override.yml "backups/docker-compose.override.yml.$(date +%F_%H%M%S).bak"
fi
- |
cd {{ immich_dir }}
# Download latest compose from Immich releases (requires curl or wget)
if command -v curl >/dev/null 2>&1; then
curl -fsSL -o docker-compose.yml "{{ immich_compose_url }}"
elif command -v wget >/dev/null 2>&1; then
wget -qO docker-compose.yml "{{ immich_compose_url }}"
else
echo "Neither curl nor wget is available on the VM."
exit 1
fi
- |
cd {{ immich_dir }}
# Ensure override compose exists (create if missing)
if [ ! -f "{{ immich_override_file }}" ]; then
printf '%s\n' \
'services:' \
' immich-server:' \
' volumes:' \
' - /mnt/nextcloud-howard-photos:/mnt/nextcloud-howard-photos' \
' - /mnt/nextcloud-kamilkaprdelka-photos:/mnt/nextcloud-kamilkaprdelka-photos' \
> "{{ immich_override_file }}"
fi
# Fail early if override is still missing/empty
test -s "{{ immich_override_file }}"
- |
cd {{ immich_dir }}
# Ensure .env exists. If missing, try to reconstruct it from running containers to avoid breaking DB creds.
python3 - <<'PY'
import json
import subprocess
from pathlib import Path
env_path = Path(".env")
if env_path.exists():
raise SystemExit(0)
def run(cmd):
p = subprocess.run(cmd, capture_output=True, text=True)
return p.returncode, p.stdout, p.stderr
rc, out, err = run(["bash", "-lc", "command docker inspect immich_postgres immich_server"])
if rc != 0 or not out.strip():
print("ERROR: .env is missing and cannot inspect running containers (immich_postgres/immich_server).", flush=True)
print("Create /opt/immich/.env manually or ensure the containers exist.", flush=True)
raise SystemExit(1)
data = json.loads(out)
by_name = {}
for c in data:
name = (c.get("Name") or "").lstrip("/")
by_name[name] = c
pg = by_name.get("immich_postgres")
srv = by_name.get("immich_server")
if not pg or not srv:
print("ERROR: Could not find immich_postgres and immich_server in docker inspect output.", flush=True)
raise SystemExit(1)
def env_map(container):
m = {}
for kv in (container.get("Config", {}).get("Env") or []):
if "=" in kv:
k, v = kv.split("=", 1)
m[k] = v
return m
def find_mount_source(container, dest):
for m in (container.get("Mounts") or []):
if m.get("Destination") == dest:
return m.get("Source")
return ""
pg_env = env_map(pg)
db_user = pg_env.get("POSTGRES_USER", "")
db_pass = pg_env.get("POSTGRES_PASSWORD", "")
db_name = pg_env.get("POSTGRES_DB", "")
db_data = find_mount_source(pg, "/var/lib/postgresql/data")
upload_loc = find_mount_source(srv, "/usr/src/app/upload")
# Try to preserve the currently used image tag as IMMICH_VERSION (optional but safer)
immich_version = ""
image = (srv.get("Config", {}).get("Image") or "")
if ":" in image and "@" not in image:
immich_version = image.rsplit(":", 1)[-1]
elif ":" in image and "@" in image:
# image like repo:tag@sha256:...
immich_version = image.split("@", 1)[0].rsplit(":", 1)[-1]
missing = []
for k, v in [
("DB_USERNAME", db_user),
("DB_PASSWORD", db_pass),
("DB_DATABASE_NAME", db_name),
("DB_DATA_LOCATION", db_data),
("UPLOAD_LOCATION", upload_loc),
]:
if not v:
missing.append(k)
if missing:
print("ERROR: Could not reconstruct these .env values from containers: " + ", ".join(missing), flush=True)
raise SystemExit(1)
lines = [
f"UPLOAD_LOCATION={upload_loc}",
f"DB_DATA_LOCATION={db_data}",
f"DB_USERNAME={db_user}",
f"DB_PASSWORD={db_pass}",
f"DB_DATABASE_NAME={db_name}",
]
if immich_version:
lines.append(f"IMMICH_VERSION={immich_version}")
env_path.write_text("\n".join(lines) + "\n", encoding="utf-8")
print("Created .env from running containers.", flush=True)
PY
- |
cd {{ immich_dir }}
# Comment out healthcheck.start_interval if present (safe no-op if missing)
sed -i -E 's/^([[:space:]]*)start_interval:/\1# start_interval:/' docker-compose.yml || true
- "cd {{ immich_dir }} && {{ immich_compose_cmd }} config >/dev/null"
- "cd {{ immich_dir }} && {{ immich_compose_cmd }} pull >/dev/null"
- "cd {{ immich_dir }} && {{ immich_compose_cmd }} up -d --remove-orphans --force-recreate >/dev/null"
tasks:
- name: Ensure sshpass is installed (for password-based SSH) # English comments
ansible.builtin.apt:
name: sshpass
state: present
update_cache: yes
- name: Run Immich update commands on VM (via SSH) # use SSHPASS env, hide item label
ansible.builtin.command:
argv:
- sshpass
- -e
- ssh
- -o
- StrictHostKeyChecking=no
- -o
- ConnectTimeout=15
- "{{ vm_user }}@{{ vm_ip }}"
- bash
- -lc
- "{{ ('sudo ' if use_sudo else '') + item }}"
environment:
SSHPASS: "{{ vm_pass }}"
loop: "{{ immich_commands }}"
loop_control:
index_var: idx
label: "cmd-{{ idx }}"
register: immich_cmds
changed_when: false
no_log: "{{ DEBUG == 0 }}"
run_once: true
- name: Show outputs for each Immich command
ansible.builtin.debug:
msg: |
CMD: {{ item.item }}
RC: {{ item.rc }}
STDOUT:
{{ (item.stdout | default('')).strip() }}
STDERR:
{{ (item.stderr | default('')).strip() }}
loop: "{{ immich_cmds.results }}"
when: DEBUG == 1
run_once: true
- name: Fail play if any Immich command failed
ansible.builtin.assert:
that: "item.rc == 0"
fail_msg: "Immich update failed on VM: {{ item.item }} (rc={{ item.rc }})"
success_msg: "All Immich update commands succeeded."
loop: "{{ immich_cmds.results }}"
loop_control:
index_var: idx
label: "cmd-{{ idx }}"
run_once: true
# -------------------------
# Readiness checks (controller first, then VM fallback)
# -------------------------
- name: Immich | Wait for API ping (controller first, with retries)
ansible.builtin.uri:
url: "{{ (immich_url | regex_replace('/$','')) + '/api/server/ping' }}"
method: GET
return_content: true
validate_certs: "{{ (immich_url | default('')) is match('^https://') }}"
status_code: 200
register: immich_controller
delegate_to: localhost
run_once: true
when: immich_url is defined and (immich_url | length) > 0
retries: "{{ immich_retries }}"
delay: "{{ immich_delay }}"
until: immich_controller.status == 200 and ('pong' in (immich_controller.content | default('')))
failed_when: false
changed_when: false
- name: Immich | VM-side ping (JSON via Python, with retries)
ansible.builtin.command:
argv:
- sshpass
- -e
- ssh
- -o
- StrictHostKeyChecking=no
- -o
- ConnectTimeout=15
- "{{ vm_user }}@{{ vm_ip }}"
- bash
- -lc
- |
python3 - <<'PY'
# Ping Immich API from localhost and print response to stdout
import urllib.request, sys
try:
with urllib.request.urlopen("http://127.0.0.1:{{ immich_port }}/api/server/ping", timeout=15) as r:
sys.stdout.write(r.read().decode(errors='ignore'))
except Exception:
pass
PY
environment:
SSHPASS: "{{ vm_pass }}"
register: immich_vm
changed_when: false
failed_when: false
when: immich_controller.status | default(0) != 200
retries: "{{ immich_retries }}"
delay: "{{ immich_delay }}"
until: (immich_vm.stdout | default('') | trim | length) > 0 and ('pong' in (immich_vm.stdout | default('')))
no_log: "{{ DEBUG == 0 }}"
run_once: true
- name: Immich | Print concise summary
ansible.builtin.debug:
msg: >-
Immich API ping {{ 'OK' if (('pong' in (immich_controller.content|default(''))) or ('pong' in (immich_vm.stdout|default('')))) else 'NOT OK' }}.
Source={{ 'controller' if (immich_controller.status|default(0))==200 else 'vm' if (immich_vm.stdout|default('')|trim|length>0) else 'n/a' }}.
when: DEBUG == 1
run_once: true
old/update_semaphore.yml
-65
View File
@@ -1,65 +0,0 @@
# update_semaphore.yml
- name: Update Semaphore on VM via Proxmox
hosts: linux_servers
gather_facts: false
become: true
become_user: root
become_method: sudo
vars:
# --- Connection to VM (provided by Semaphore env vars) ---
vm_ip: "{{ lookup('env', 'VM_IP') }}" # IP vm-portainer
vm_user: "{{ lookup('env', 'VM_USER') }}"
vm_pass: "{{ lookup('env', 'VM_PASS') }}"
use_sudo: false
# --- Debug mode (controlled via Semaphore variable) ---
DEBUG: "{{ lookup('env', 'DEBUG') | default(0) | int }}"
# --- Semaphore specifics ---
semaphore_project: "semaphore"
semaphore_compose_file: "/data/compose/semaphore/docker-compose.yml"
semaphore_service: "semaphore"
tasks:
- name: Ensure sshpass is installed (for password-based SSH) # English comments
ansible.builtin.apt:
name: sshpass
state: present
update_cache: yes
- name: Run Semaphore self-update on VM in background (nohup)
ansible.builtin.command:
argv:
- sshpass
- -e
- ssh
- -o
- StrictHostKeyChecking=no
- -o
- ConnectTimeout=15
- "{{ vm_user }}@{{ vm_ip }}"
- bash
- -lc
- |
nohup bash -c '
unalias docker 2>/dev/null || true
DOCKER_CLI_HINTS=0 docker compose \
-p {{ semaphore_project }} \
-f {{ semaphore_compose_file }} \
up -d --no-deps --force-recreate --pull always {{ semaphore_service }}
' >/dev/null 2>&1 &
environment:
SSHPASS: "{{ vm_pass }}"
register: semaphore_update
changed_when: false
no_log: "{{ DEBUG == 0 }}"
- name: Show result of Semaphore self-update (debug)
ansible.builtin.debug:
msg: |
RC: {{ semaphore_update.rc }}
STDOUT: {{ (semaphore_update.stdout | default('')).strip() }}
STDERR: {{ (semaphore_update.stderr | default('')).strip() }}
when: DEBUG == 1
old/update_uptime_kuma.yml
-194
View File
@@ -1,194 +0,0 @@
# nextcloud/update_uptime_kuma.yml
- name: Update Uptime Kuma on VM via Proxmox
hosts: linux_servers
gather_facts: false
become: true
become_user: root
become_method: sudo
vars:
# VM connection (provided by Semaphore env vars)
vm_ip: "{{ lookup('env', 'VM_IP') }}"
vm_user: "{{ lookup('env', 'VM_USER') }}"
vm_pass: "{{ lookup('env', 'VM_PASS') }}"
use_sudo: false
# --- Debug mode (controlled via Semaphore variable) ---
DEBUG: "{{ lookup('env', 'DEBUG') | default(0) | int }}"
RETRIES: "{{ lookup('env', 'RETRIES') | default(25) | int }}"
# Uptime Kuma specifics
kuma_project: "uptime-kuma"
kuma_compose_file: "/data/compose/uptime-kuma/docker-compose-uptime-kuma.yml"
kuma_service: "uptime-kuma"
kuma_image: "louislam/uptime-kuma:latest"
kuma_port: 3001
# Optional external URL for controller-side readiness check (e.g., https://kuma.example.com)
# If empty/undefined, controller check is skipped and we only probe from the VM.
kuma_url: "{{ lookup('env', 'KUMA_URL') | default('', true) }}"
# Fixed container name used in your compose (conflicts with previous/Portainer-run container)
kuma_container_name: "uptime-kuma-dev"
# Retry policy
kuma_retries: "{{ RETRIES }}"
kuma_delay: 2
# Docker command prefix (consistent behavior)
docker_prefix: "unalias docker 2>/dev/null || true; DOCKER_CLI_HINTS=0; command docker"
# Commands to run on the target VM (quiet outputs like in Collabora play)
kuma_commands:
- "{{ docker_prefix }} pull -q {{ kuma_image }} >/dev/null"
- "{{ docker_prefix }} compose -p {{ kuma_project }} -f {{ kuma_compose_file }} pull {{ kuma_service }} >/dev/null"
# remove conflicting container name before compose up (silently)
- "{{ docker_prefix }} rm -f {{ kuma_container_name }} >/dev/null 2>&1 || true"
- "{{ docker_prefix }} compose -p {{ kuma_project }} -f {{ kuma_compose_file }} up -d --no-deps --force-recreate {{ kuma_service }} >/dev/null"
tasks:
- name: Ensure sshpass is installed (for password-based SSH) # English comments
ansible.builtin.apt:
name: sshpass
state: present
update_cache: yes
- name: Run Uptime Kuma update commands on VM (via SSH) # use SSHPASS env, hide item label
ansible.builtin.command:
argv:
- sshpass
- -e # read password from SSHPASS environment
- ssh
- -o
- StrictHostKeyChecking=no
- -o
- ConnectTimeout=15
- "{{ vm_user }}@{{ vm_ip }}"
- bash
- -lc
- "{{ ('sudo ' if use_sudo else '') + item }}"
environment:
SSHPASS: "{{ vm_pass }}" # supply password via environment
loop: "{{ kuma_commands }}"
loop_control:
index_var: idx # capture loop index
label: "cmd-{{ idx }}" # avoid printing full command in (item=...) line
register: kuma_cmds
changed_when: false
no_log: "{{ DEBUG == 0 }}" # hide outputs and env when not debugging
- name: Show outputs for each Uptime Kuma command
ansible.builtin.debug:
msg: |
CMD: {{ item.item }}
RC: {{ item.rc }}
STDOUT:
{{ (item.stdout | default('')).strip() }}
STDERR:
{{ (item.stderr | default('')).strip() }}
loop: "{{ kuma_cmds.results }}"
when: DEBUG == 1
- name: Fail play if any Uptime Kuma command failed # also hide item label
ansible.builtin.assert:
that: "item.rc == 0"
fail_msg: "Uptime Kuma update failed on VM: {{ item.item }} (rc={{ item.rc }})"
success_msg: "All Uptime Kuma update commands succeeded."
loop: "{{ kuma_cmds.results }}"
loop_control:
index_var: idx
label: "cmd-{{ idx }}"
# -------------------------
# Readiness checks (controller first, then VM fallback)
# -------------------------
- name: Kuma | Wait for homepage (controller first, with retries)
ansible.builtin.uri:
url: "{{ (kuma_url | regex_replace('/$','')) + '/' }}"
method: GET
return_content: true
# Validate TLS only when using https://
validate_certs: "{{ (kuma_url | default('')) is match('^https://') }}"
status_code: 200
register: kuma_controller
delegate_to: localhost
run_once: true
when: kuma_url is defined and (kuma_url | length) > 0
retries: "{{ kuma_retries }}"
delay: "{{ kuma_delay }}"
until: kuma_controller.status == 200
failed_when: false
changed_when: false
- name: Kuma | VM-side fetch (HTML via Python, with retries) # use SSHPASS env here too
ansible.builtin.command:
argv:
- sshpass
- -e
- ssh
- -o
- StrictHostKeyChecking=no
- -o
- ConnectTimeout=15
- "{{ vm_user }}@{{ vm_ip }}"
- bash
- -lc
- |
python3 - <<'PY'
# Fetch Kuma homepage from localhost and print HTML to stdout
import urllib.request, sys
try:
with urllib.request.urlopen("http://127.0.0.1:{{ kuma_port }}/", timeout=15) as r:
sys.stdout.write(r.read().decode(errors='ignore'))
except Exception:
pass
PY
environment:
SSHPASS: "{{ vm_pass }}"
register: kuma_vm
changed_when: false
failed_when: false
when: kuma_controller.status | default(0) != 200 or kuma_controller.content is not defined
retries: "{{ kuma_retries }}"
delay: "{{ kuma_delay }}"
until: (kuma_vm.stdout | default('') | trim | length) > 0 and ('Uptime Kuma' in (kuma_vm.stdout | default('')))
no_log: "{{ DEBUG == 0 }}" # hide command and output when not debugging
- name: Kuma | Choose homepage HTML (controller wins, else VM) # safe guard against empty result
ansible.builtin.set_fact:
kuma_home_html: >-
{{
(
kuma_controller.content
if (kuma_controller is defined)
and ((kuma_controller.status|default(0))==200)
and (kuma_controller.content is defined)
else
(kuma_vm.stdout | default('') | trim)
)
}}
when:
- (kuma_controller is defined and (kuma_controller.status|default(0))==200 and (kuma_controller.content is defined))
or ((kuma_vm.stdout | default('') | trim | length) > 0)
- name: Kuma | Print concise summary
ansible.builtin.debug:
msg: >-
Uptime Kuma homepage {{ 'reachable' if (kuma_home_html is defined) else 'NOT reachable' }}.
Source={{ 'controller' if ((kuma_controller is defined) and (kuma_controller.status|default(0))==200 and (kuma_controller.content is defined)) else 'vm' if (kuma_vm.stdout|default('')|trim|length>0) else 'n/a' }};
length={{ (kuma_home_html | default('')) | length }};
contains('Uptime Kuma')={{ (kuma_home_html is defined) and ('Uptime Kuma' in kuma_home_html) }}
when: DEBUG == 1
- name: Kuma | Homepage unavailable (after retries)
ansible.builtin.debug:
msg: "Kuma web není dostupná ani po pokusech."
when: kuma_home_html is not defined and DEBUG == 1
# Optional detailed dump (short excerpt only)
- name: Kuma | HTML excerpt (debug)
ansible.builtin.debug:
msg: "{{ (kuma_home_html | default(''))[:500] }}"
when: kuma_home_html is defined and DEBUG == 1
old/update_portainer_agent.yml → portainer/update_portainer_agent.yml
View File
portainer/update_portainer_agent_lxc.yml
-69
View File
@@ -1,69 +0,0 @@
# update_portainer_agent_lxc.yml
- name: Update Portainer Agent (LXC, no compose)
hosts: pve2_lxc_jellyfin
gather_facts: false
vars:
agent_container_name: portainer_agent
agent_port: 9001
tasks:
- name: Check if agent container exists
ansible.builtin.command:
argv:
- bash
- -lc
- "docker ps -a --format '{{ \"{{\" }}.Names{{ \"}}\" }}' | grep -x '{{ agent_container_name }}'"
register: agent_exists
changed_when: false
failed_when: false
- name: Abort if agent container is missing
ansible.builtin.fail:
msg: "Container '{{ agent_container_name }}' not found."
when: agent_exists.rc != 0
- name: Read current agent image
ansible.builtin.command:
argv:
- bash
- -lc
- "docker inspect -f '{{ \"{{\" }}.Config.Image{{ \"}}\" }}' {{ agent_container_name }}"
register: agent_image
changed_when: false
- name: Pull latest image tag for current agent image
ansible.builtin.command:
argv:
- bash
- -lc
- "docker pull {{ agent_image.stdout | trim }}"
changed_when: true
- name: Recreate agent container with standard Portainer Agent args
ansible.builtin.command:
argv:
- bash
- -lc
- |
set -euo pipefail
# Stop/remove old container
docker rm -f "{{ agent_container_name }}" >/dev/null 2>&1 || true
# Run Portainer Agent with common, safe defaults
docker run -d \
--name "{{ agent_container_name }}" \
--restart=always \
-p {{ agent_port }}:9001 \
-v /var/run/docker.sock:/var/run/docker.sock \
-v /var/lib/docker/volumes:/var/lib/docker/volumes \
"{{ agent_image.stdout | trim }}"
changed_when: true
- name: Wait for agent port
ansible.builtin.wait_for:
host: 127.0.0.1
port: "{{ agent_port }}"
timeout: 60
portainer/update_portainer_agent_vm.yml
-69
View File
@@ -1,69 +0,0 @@
# update_portainer_agent_vm.yml
- name: Update Portainer Agent (VM, no compose)
hosts: pve2_vm
gather_facts: false
vars:
agent_container_name: portainer_agent
agent_port: 9001
tasks:
- name: Check if agent container exists
ansible.builtin.command:
argv:
- bash
- -lc
- "docker ps -a --format '{{ \"{{\" }}.Names{{ \"}}\" }}' | grep -x '{{ agent_container_name }}'"
register: agent_exists
changed_when: false
failed_when: false
- name: Abort if agent container is missing
ansible.builtin.fail:
msg: "Container '{{ agent_container_name }}' not found."
when: agent_exists.rc != 0
- name: Read current agent image
ansible.builtin.command:
argv:
- bash
- -lc
- "docker inspect -f '{{ \"{{\" }}.Config.Image{{ \"}}\" }}' {{ agent_container_name }}"
register: agent_image
changed_when: false
- name: Pull latest image tag for current agent image
ansible.builtin.command:
argv:
- bash
- -lc
- "docker pull {{ agent_image.stdout | trim }}"
changed_when: true
- name: Recreate agent container with standard Portainer Agent args
ansible.builtin.command:
argv:
- bash
- -lc
- |
set -euo pipefail
# Stop/remove old container
docker rm -f "{{ agent_container_name }}" >/dev/null 2>&1 || true
# Run Portainer Agent with common, safe defaults
docker run -d \
--name "{{ agent_container_name }}" \
--restart=always \
-p {{ agent_port }}:9001 \
-v /var/run/docker.sock:/var/run/docker.sock \
-v /var/lib/docker/volumes:/var/lib/docker/volumes \
"{{ agent_image.stdout | trim }}"
changed_when: true
- name: Wait for agent port
ansible.builtin.wait_for:
host: 127.0.0.1
port: "{{ agent_port }}"
timeout: 60
update_bettershift.yml
-85
View File
@@ -1,85 +0,0 @@
# update_bettershift.yml
- name: Update BetterShift
hosts: pve2_vm
gather_facts: false
vars:
compose_local_dir: "{{ playbook_dir }}/docker-compose"
compose_remote_base: "/home/{{ ansible_user }}/.ansible-compose/docker-compose"
bettershift_project: bettershift
bettershift_compose_filename: "docker-compose-bettershift.yml"
bettershift_service: bettershift
bettershift_port: 3067
bettershift_data_dir: "/data/compose/bettershift/data"
tasks:
- name: Ensure remote compose directory exists
ansible.builtin.file:
path: "{{ compose_remote_base }}"
state: directory
mode: "0755"
- name: Ensure BetterShift data directory exists
ansible.builtin.file:
path: "{{ bettershift_data_dir }}"
state: directory
mode: "0755"
- name: Upload BetterShift compose file to remote host
ansible.builtin.copy:
src: "{{ compose_local_dir }}/{{ bettershift_compose_filename }}"
dest: "{{ compose_remote_base }}/{{ bettershift_compose_filename }}"
mode: "0644"
- name: Check BetterShift env file exists on remote host
ansible.builtin.stat:
path: "{{ compose_remote_base }}/.env.bettershift"
register: bettershift_env_file
- name: Fail if BetterShift env file is missing
ansible.builtin.fail:
msg: >-
Missing {{ compose_remote_base }}/.env.bettershift on remote host.
Create it manually because it contains secrets.
when: not bettershift_env_file.stat.exists
- name: Pull latest BetterShift image
community.docker.docker_compose_v2:
project_name: "{{ bettershift_project }}"
project_src: "{{ compose_remote_base }}"
files:
- "{{ bettershift_compose_filename }}"
pull: always
- name: Recreate BetterShift service
community.docker.docker_compose_v2:
project_name: "{{ bettershift_project }}"
project_src: "{{ compose_remote_base }}"
files:
- "{{ bettershift_compose_filename }}"
services:
- "{{ bettershift_service }}"
state: present
recreate: always
- name: Wait for BetterShift port
ansible.builtin.wait_for:
host: 127.0.0.1
port: "{{ bettershift_port }}"
timeout: 60
- name: Check BetterShift HTTP endpoint
ansible.builtin.uri:
url: "http://127.0.0.1:{{ bettershift_port }}/"
status_code:
- 200
- 307
- 308
follow_redirects: none
register: bettershift_http
retries: 30
delay: 3
until: bettershift_http.status in [200, 307, 308]
changed_when: false
old/update_broker_kafka-ui.yml → update_broker_kafka-ui.yml
View File
update_homarr.yml
+182 -52
View File
@@ -1,64 +1,194 @@
# update_homarr.yml # update_homarr.yml
- name: Update Homarr - name: Update Homarr on VM via Proxmox
hosts: pve2_vm hosts: linux_servers
gather_facts: false gather_facts: false
become: true
become_user: root
become_method: sudo
vars: vars:
# Compose sync (controller -> target) # VM connection (provided by Semaphore env vars)
compose_local_dir: "{{ playbook_dir }}/docker-compose" vm_ip: "{{ lookup('env', 'VM_IP') }}"
compose_remote_base: "/home/{{ ansible_user }}/.ansible-compose" vm_user: "{{ lookup('env', 'VM_USER') }}"
vm_pass: "{{ lookup('env', 'VM_PASS') }}"
use_sudo: false
# Homarr settings # --- Debug mode (controlled via Semaphore variable) ---
homarr_project: homarr DEBUG: "{{ lookup('env', 'DEBUG') | default(0) | int }}"
homarr_compose_filename: "docker-compose-homarr.yml" RETRIES: "{{ lookup('env', 'RETRIES') | default(25) | int }}"
homarr_service: homarr
# Homarr specifics
homarr_project: "homarr"
homarr_compose_file: "/data/compose/homarr/docker-compose-homarr.yml"
homarr_service: "homarr"
homarr_image: "ghcr.io/homarr-labs/homarr:latest"
homarr_port: 7575 homarr_port: 7575
# Optional external URL for controller-side readiness check (e.g., https://homarr.example.com)
# If empty/undefined, controller check is skipped and we only probe from the VM.
homarr_url: "{{ lookup('env', 'HOMARR_URL') | default('', true) }}"
# Fixed container name used in your compose (avoid conflicts with any leftover container)
homarr_container_name: "homarr"
# Retry policy (same pattern as Kuma): 25x with 2s delay
homarr_retries: "{{ RETRIES }}"
homarr_delay: 2
# Docker command prefix (consistent behavior)
docker_prefix: "unalias docker 2>/dev/null || true; DOCKER_CLI_HINTS=0; command docker"
# Commands to run on the target VM (quiet outputs)
homarr_commands:
- "{{ docker_prefix }} pull -q {{ homarr_image }} >/dev/null"
- "{{ docker_prefix }} compose -p {{ homarr_project }} -f {{ homarr_compose_file }} pull {{ homarr_service }} >/dev/null"
# remove conflicting container name before compose up (silently)
- "{{ docker_prefix }} rm -f {{ homarr_container_name }} >/dev/null 2>&1 || true"
- "{{ docker_prefix }} compose -p {{ homarr_project }} -f {{ homarr_compose_file }} up -d --no-deps --force-recreate {{ homarr_service }} >/dev/null"
tasks: tasks:
- name: Ensure remote compose directory exists - name: Ensure sshpass is installed (for password-based SSH) # English comments
ansible.builtin.file: ansible.builtin.apt:
path: "{{ compose_remote_base }}" name: sshpass
state: directory
mode: "0755"
- name: Upload Homarr compose file to remote host
ansible.builtin.copy:
src: "{{ compose_local_dir }}/{{ homarr_compose_filename }}"
dest: "{{ compose_remote_base }}/{{ homarr_compose_filename }}"
mode: "0644"
- name: Pull latest Homarr image
community.docker.docker_compose_v2:
project_name: "{{ homarr_project }}"
project_src: "{{ compose_remote_base }}"
files:
- "{{ homarr_compose_filename }}"
pull: always
- name: Recreate Homarr service
community.docker.docker_compose_v2:
project_name: "{{ homarr_project }}"
project_src: "{{ compose_remote_base }}"
files:
- "{{ homarr_compose_filename }}"
services:
- "{{ homarr_service }}"
state: present state: present
recreate: always update_cache: yes
- name: Wait for Homarr port - name: Run Homarr update commands on VM (via SSH) # use SSHPASS env, hide item label
ansible.builtin.wait_for: ansible.builtin.command:
host: 127.0.0.1 argv:
port: "{{ homarr_port }}" - sshpass
timeout: 60 - -e # read password from SSHPASS environment
- ssh
- name: Check Homarr HTTP endpoint - -o
ansible.builtin.uri: - StrictHostKeyChecking=no
url: "http://127.0.0.1:{{ homarr_port }}/" - -o
status_code: 200 - ConnectTimeout=15
register: homarr_http - "{{ vm_user }}@{{ vm_ip }}"
retries: 30 - bash
delay: 3 - -lc
until: homarr_http.status == 200 - "{{ ('sudo ' if use_sudo else '') + item }}"
environment:
SSHPASS: "{{ vm_pass }}" # supply password via environment
loop: "{{ homarr_commands }}"
loop_control:
index_var: idx # capture loop index
label: "cmd-{{ idx }}" # avoid printing full command in (item=...) line
register: homarr_cmds
changed_when: false changed_when: false
no_log: "{{ DEBUG == 0 }}" # hide outputs and env when not debugging
- name: Show outputs for each Homarr command
ansible.builtin.debug:
msg: |
CMD: {{ item.item }}
RC: {{ item.rc }}
STDOUT:
{{ (item.stdout | default('')).strip() }}
STDERR:
{{ (item.stderr | default('')).strip() }}
loop: "{{ homarr_cmds.results }}"
when: DEBUG == 1
- name: Fail play if any Homarr command failed # also hide item label
ansible.builtin.assert:
that: "item.rc == 0"
fail_msg: "Homarr update failed on VM: {{ item.item }} (rc={{ item.rc }})"
success_msg: "All Homarr update commands succeeded."
loop: "{{ homarr_cmds.results }}"
loop_control:
index_var: idx
label: "cmd-{{ idx }}"
# -------------------------
# Readiness checks (controller first, then VM fallback)
# -------------------------
- name: Homarr | Wait for homepage (controller first, with retries)
ansible.builtin.uri:
url: "{{ (homarr_url | regex_replace('/$','')) + '/' }}"
method: GET
return_content: true
# Validate TLS only when using https://
validate_certs: "{{ (homarr_url | default('')) is match('^https://') }}"
status_code: 200
register: homarr_controller
delegate_to: localhost
run_once: true
when: homarr_url is defined and (homarr_url | length) > 0
retries: "{{ homarr_retries }}"
delay: "{{ homarr_delay }}"
until: homarr_controller.status == 200
failed_when: false
changed_when: false
- name: Homarr | VM-side fetch (HTML via Python, with retries) # use SSHPASS env here too
ansible.builtin.command:
argv:
- sshpass
- -e
- ssh
- -o
- StrictHostKeyChecking=no
- -o
- ConnectTimeout=15
- "{{ vm_user }}@{{ vm_ip }}"
- bash
- -lc
- |
python3 - <<'PY'
# Fetch Homarr homepage from localhost and print HTML to stdout
import urllib.request, sys
try:
with urllib.request.urlopen("http://127.0.0.1:{{ homarr_port }}/", timeout=15) as r:
sys.stdout.write(r.read().decode(errors='ignore'))
except Exception:
pass
PY
environment:
SSHPASS: "{{ vm_pass }}"
register: homarr_vm
changed_when: false
failed_when: false
when: homarr_controller.status | default(0) != 200 or homarr_controller.content is not defined
retries: "{{ homarr_retries }}"
delay: "{{ homarr_delay }}"
until: (homarr_vm.stdout | default('') | trim | length) > 0 and ('Homarr' in (homarr_vm.stdout | default('')))
no_log: "{{ DEBUG == 0 }}"
- name: Homarr | Choose homepage HTML (controller wins, else VM) # safe guard against empty result
ansible.builtin.set_fact:
homarr_home_html: >-
{{
(
homarr_controller.content
if (homarr_controller is defined)
and ((homarr_controller.status|default(0))==200)
and (homarr_controller.content is defined)
else
(homarr_vm.stdout | default('') | trim)
)
}}
when:
- (homarr_controller is defined and (homarr_controller.status|default(0))==200 and (homarr_controller.content is defined))
or ((homarr_vm.stdout | default('') | trim | length) > 0)
- name: Homarr | Print concise summary
ansible.builtin.debug:
msg: >-
Homarr homepage {{ 'reachable' if (homarr_home_html is defined) else 'NOT reachable' }}.
Source={{ 'controller' if ((homarr_controller is defined) and (homarr_controller.status|default(0))==200 and (homarr_controller.content is defined)) else 'vm' if (homarr_vm.stdout|default('')|trim|length>0) else 'n/a' }};
length={{ (homarr_home_html | default('')) | length }};
contains('Homarr')={{ (homarr_home_html is defined) and ('Homarr' in homarr_home_html) }}
when: DEBUG == 1
- name: Homarr | Homepage unavailable (after retries)
ansible.builtin.debug:
msg: "Homarr web není dostupný ani po pokusech."
when: homarr_home_html is not defined and DEBUG == 1
# Optional detailed dump (short excerpt only)
- name: Homarr | HTML excerpt (debug)
ansible.builtin.debug:
msg: "{{ (homarr_home_html | default(''))[:500] }}"
when: homarr_home_html is defined and DEBUG == 1
update_homarr2.yml
+40
View File
@@ -0,0 +1,40 @@
# update_homarr2.yml
- name: Update Homarr
hosts: pve2_vm
gather_facts: false
vars:
homarr_project: homarr
homarr_compose_file: /data/compose/homarr/docker-compose-homarr.yml
homarr_service: homarr
homarr_port: 7575
tasks:
- name: Pull latest Homarr image
community.docker.docker_compose_v2:
project_src: "{{ homarr_compose_file | dirname }}"
files:
- "{{ homarr_compose_file | basename }}"
pull: always
- name: Recreate Homarr service
community.docker.docker_compose_v2:
project_src: "{{ homarr_compose_file | dirname }}"
files:
- "{{ homarr_compose_file | basename }}"
services:
- "{{ homarr_service }}"
state: present
recreate: always
- name: Wait for Homarr port
ansible.builtin.wait_for:
host: 127.0.0.1
port: "{{ homarr_port }}"
timeout: 60
- name: Check Homarr HTTP endpoint
ansible.builtin.uri:
url: "http://127.0.0.1:{{ homarr_port }}/"
status_code: 200
update_immich.yml
+294 -97
View File
@@ -1,116 +1,313 @@
# update_immich.yml # update_immich.yml
- name: Update Immich - name: Update Immich on VM via Proxmox
hosts: pve2_vm hosts: linux_servers
gather_facts: false gather_facts: false
become: true
become_user: root
become_method: sudo
vars: vars:
# Compose sync (controller -> target) # VM connection (provided by Semaphore env vars)
compose_local_dir: "{{ playbook_dir }}/docker-compose" vm_ip: "{{ lookup('env', 'VM_IP') }}"
compose_remote_base: "/home/{{ ansible_user }}/.ansible-compose" vm_user: "{{ lookup('env', 'VM_USER') }}"
compose_remote_dir: "{{ compose_remote_base }}/docker-compose" vm_pass: "{{ lookup('env', 'VM_PASS') }}"
compose_remote_archive: "{{ compose_remote_base }}/docker-compose.tar.gz" use_sudo: false
# Immich settings # --- Debug mode (controlled via Semaphore variable) ---
immich_project: immich DEBUG: "{{ lookup('env', 'DEBUG') | default(0) | int }}"
RETRIES: "{{ lookup('env', 'RETRIES') | default(25) | int }}"
# Immich specifics
immich_dir: "/opt/immich"
immich_project: "immich"
immich_compose_url: "https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml"
immich_compose_file: "/opt/immich/docker-compose.yml"
immich_override_file: "/opt/immich/docker-compose.override.yml"
immich_port: 2283 immich_port: 2283
immich_compose_files:
- docker-compose-immich.yml
- docker-compose-immich.override.yml
# Persistent env file on the VM (NOT in git) # Optional external URL for controller-side readiness check (e.g., https://photos.example.com)
immich_env_persistent: "{{ compose_remote_base }}/env/immich.env" immich_url: "{{ lookup('env', 'IMMICH_URL') | default('', true) }}"
# Retry policy
immich_retries: "{{ RETRIES }}"
immich_delay: 2
# Docker command prefix (consistent behavior)
docker_prefix: "unalias docker 2>/dev/null || true; DOCKER_CLI_HINTS=0; command docker"
# Compose command (always include override to keep local mounts separate from upstream compose)
immich_compose_cmd: >-
{{ docker_prefix }} compose
-p {{ immich_project }}
-f {{ immich_compose_file }}
-f {{ immich_override_file }}
# Commands to run on the target VM
immich_commands:
- "cd {{ immich_dir }}"
- |
cd {{ immich_dir }}
mkdir -p backups
if [ -f docker-compose.yml ]; then
cp -a docker-compose.yml "backups/docker-compose.yml.$(date +%F_%H%M%S).bak"
fi
if [ -f .env ]; then
cp -a .env "backups/.env.$(date +%F_%H%M%S).bak"
fi
if [ -f docker-compose.override.yml ]; then
cp -a docker-compose.override.yml "backups/docker-compose.override.yml.$(date +%F_%H%M%S).bak"
fi
- |
cd {{ immich_dir }}
# Download latest compose from Immich releases (requires curl or wget)
if command -v curl >/dev/null 2>&1; then
curl -fsSL -o docker-compose.yml "{{ immich_compose_url }}"
elif command -v wget >/dev/null 2>&1; then
wget -qO docker-compose.yml "{{ immich_compose_url }}"
else
echo "Neither curl nor wget is available on the VM."
exit 1
fi
- |
cd {{ immich_dir }}
# Ensure override compose exists (create if missing)
if [ ! -f "{{ immich_override_file }}" ]; then
printf '%s\n' \
'services:' \
' immich-server:' \
' volumes:' \
' - /mnt/nextcloud-howard-photos:/mnt/nextcloud-howard-photos' \
' - /mnt/nextcloud-kamilkaprdelka-photos:/mnt/nextcloud-kamilkaprdelka-photos' \
> "{{ immich_override_file }}"
fi
# Fail early if override is still missing/empty
test -s "{{ immich_override_file }}"
- |
cd {{ immich_dir }}
# Ensure .env exists. If missing, try to reconstruct it from running containers to avoid breaking DB creds.
python3 - <<'PY'
import json
import subprocess
from pathlib import Path
env_path = Path(".env")
if env_path.exists():
raise SystemExit(0)
def run(cmd):
p = subprocess.run(cmd, capture_output=True, text=True)
return p.returncode, p.stdout, p.stderr
rc, out, err = run(["bash", "-lc", "command docker inspect immich_postgres immich_server"])
if rc != 0 or not out.strip():
print("ERROR: .env is missing and cannot inspect running containers (immich_postgres/immich_server).", flush=True)
print("Create /opt/immich/.env manually or ensure the containers exist.", flush=True)
raise SystemExit(1)
data = json.loads(out)
by_name = {}
for c in data:
name = (c.get("Name") or "").lstrip("/")
by_name[name] = c
pg = by_name.get("immich_postgres")
srv = by_name.get("immich_server")
if not pg or not srv:
print("ERROR: Could not find immich_postgres and immich_server in docker inspect output.", flush=True)
raise SystemExit(1)
def env_map(container):
m = {}
for kv in (container.get("Config", {}).get("Env") or []):
if "=" in kv:
k, v = kv.split("=", 1)
m[k] = v
return m
def find_mount_source(container, dest):
for m in (container.get("Mounts") or []):
if m.get("Destination") == dest:
return m.get("Source")
return ""
pg_env = env_map(pg)
db_user = pg_env.get("POSTGRES_USER", "")
db_pass = pg_env.get("POSTGRES_PASSWORD", "")
db_name = pg_env.get("POSTGRES_DB", "")
db_data = find_mount_source(pg, "/var/lib/postgresql/data")
upload_loc = find_mount_source(srv, "/usr/src/app/upload")
# Try to preserve the currently used image tag as IMMICH_VERSION (optional but safer)
immich_version = ""
image = (srv.get("Config", {}).get("Image") or "")
if ":" in image and "@" not in image:
immich_version = image.rsplit(":", 1)[-1]
elif ":" in image and "@" in image:
# image like repo:tag@sha256:...
immich_version = image.split("@", 1)[0].rsplit(":", 1)[-1]
missing = []
for k, v in [
("DB_USERNAME", db_user),
("DB_PASSWORD", db_pass),
("DB_DATABASE_NAME", db_name),
("DB_DATA_LOCATION", db_data),
("UPLOAD_LOCATION", upload_loc),
]:
if not v:
missing.append(k)
if missing:
print("ERROR: Could not reconstruct these .env values from containers: " + ", ".join(missing), flush=True)
raise SystemExit(1)
lines = [
f"UPLOAD_LOCATION={upload_loc}",
f"DB_DATA_LOCATION={db_data}",
f"DB_USERNAME={db_user}",
f"DB_PASSWORD={db_pass}",
f"DB_DATABASE_NAME={db_name}",
]
if immich_version:
lines.append(f"IMMICH_VERSION={immich_version}")
env_path.write_text("\n".join(lines) + "\n", encoding="utf-8")
print("Created .env from running containers.", flush=True)
PY
- |
cd {{ immich_dir }}
# Comment out healthcheck.start_interval if present (safe no-op if missing)
sed -i -E 's/^([[:space:]]*)start_interval:/\1# start_interval:/' docker-compose.yml || true
- "cd {{ immich_dir }} && {{ immich_compose_cmd }} config >/dev/null"
- "cd {{ immich_dir }} && {{ immich_compose_cmd }} pull >/dev/null"
- "cd {{ immich_dir }} && {{ immich_compose_cmd }} up -d --remove-orphans --force-recreate >/dev/null"
tasks: tasks:
- name: Ensure remote base directory exists - name: Ensure sshpass is installed (for password-based SSH) # English comments
ansible.builtin.file: ansible.builtin.apt:
path: "{{ compose_remote_base }}" name: sshpass
state: directory state: present
mode: "0755" update_cache: yes
- name: Ensure remote env directory exists - name: Run Immich update commands on VM (via SSH) # use SSHPASS env, hide item label
ansible.builtin.file: ansible.builtin.command:
path: "{{ compose_remote_base }}/env" argv:
state: directory - sshpass
- -e
- name: Fail if persistent Immich env file is missing - ssh
ansible.builtin.stat: - -o
path: "{{ immich_env_persistent }}" - StrictHostKeyChecking=no
register: immich_env_stat - -o
- ConnectTimeout=15
- name: Abort when Immich env is missing - "{{ vm_user }}@{{ vm_ip }}"
ansible.builtin.fail: - bash
msg: >- - -lc
Missing persistent env file: {{ immich_env_persistent }}. - "{{ ('sudo ' if use_sudo else '') + item }}"
Create it on the VM with DB_* and UPLOAD_LOCATION variables. environment:
when: not immich_env_stat.stat.exists SSHPASS: "{{ vm_pass }}"
loop: "{{ immich_commands }}"
- name: Create local archive of docker-compose directory (controller) loop_control:
ansible.builtin.archive: index_var: idx
path: "{{ compose_local_dir }}/" label: "cmd-{{ idx }}"
dest: "/tmp/docker-compose.tar.gz" register: immich_cmds
format: gz changed_when: false
delegate_to: localhost no_log: "{{ DEBUG == 0 }}"
run_once: true run_once: true
- name: Upload archive to remote host - name: Show outputs for each Immich command
ansible.builtin.copy: ansible.builtin.debug:
src: "/tmp/docker-compose.tar.gz" msg: |
dest: "{{ compose_remote_archive }}" CMD: {{ item.item }}
mode: "0644" RC: {{ item.rc }}
STDOUT:
{{ (item.stdout | default('')).strip() }}
STDERR:
{{ (item.stderr | default('')).strip() }}
loop: "{{ immich_cmds.results }}"
when: DEBUG == 1
run_once: true
- name: Recreate remote compose directory - name: Fail play if any Immich command failed
ansible.builtin.file: ansible.builtin.assert:
path: "{{ compose_remote_dir }}" that: "item.rc == 0"
state: absent fail_msg: "Immich update failed on VM: {{ item.item }} (rc={{ item.rc }})"
success_msg: "All Immich update commands succeeded."
loop: "{{ immich_cmds.results }}"
loop_control:
index_var: idx
label: "cmd-{{ idx }}"
run_once: true
- name: Ensure remote compose directory exists # -------------------------
ansible.builtin.file: # Readiness checks (controller first, then VM fallback)
path: "{{ compose_remote_dir }}" # -------------------------
state: directory
mode: "0755"
- name: Extract archive on remote host - name: Immich | Wait for API ping (controller first, with retries)
ansible.builtin.unarchive:
src: "{{ compose_remote_archive }}"
dest: "{{ compose_remote_dir }}"
remote_src: true
- name: Deploy Immich .env into compose directory
ansible.builtin.copy:
src: "{{ immich_env_persistent }}"
dest: "{{ compose_remote_dir }}/.env"
remote_src: true
mode: "0600"
- name: Pull latest Immich images
community.docker.docker_compose_v2:
project_name: "{{ immich_project }}"
project_src: "{{ compose_remote_dir }}"
files: "{{ immich_compose_files }}"
pull: always
- name: Recreate Immich stack
community.docker.docker_compose_v2:
project_name: "{{ immich_project }}"
project_src: "{{ compose_remote_dir }}"
files: "{{ immich_compose_files }}"
state: present
recreate: always
- name: Wait for Immich port
ansible.builtin.wait_for:
host: 127.0.0.1
port: "{{ immich_port }}"
timeout: 120
- name: Check Immich API ping (retry until ready)
ansible.builtin.uri: ansible.builtin.uri:
url: "http://127.0.0.1:{{ immich_port }}/api/server/ping" url: "{{ (immich_url | regex_replace('/$','')) + '/api/server/ping' }}"
status_code: 200 method: GET
return_content: true return_content: true
register: immich_ping validate_certs: "{{ (immich_url | default('')) is match('^https://') }}"
retries: 40 status_code: 200
delay: 3 register: immich_controller
until: immich_ping.status == 200 and ('pong' in (immich_ping.content | default(''))) delegate_to: localhost
run_once: true
when: immich_url is defined and (immich_url | length) > 0
retries: "{{ immich_retries }}"
delay: "{{ immich_delay }}"
until: immich_controller.status == 200 and ('pong' in (immich_controller.content | default('')))
failed_when: false
changed_when: false changed_when: false
- name: Immich | VM-side ping (JSON via Python, with retries)
ansible.builtin.command:
argv:
- sshpass
- -e
- ssh
- -o
- StrictHostKeyChecking=no
- -o
- ConnectTimeout=15
- "{{ vm_user }}@{{ vm_ip }}"
- bash
- -lc
- |
python3 - <<'PY'
# Ping Immich API from localhost and print response to stdout
import urllib.request, sys
try:
with urllib.request.urlopen("http://127.0.0.1:{{ immich_port }}/api/server/ping", timeout=15) as r:
sys.stdout.write(r.read().decode(errors='ignore'))
except Exception:
pass
PY
environment:
SSHPASS: "{{ vm_pass }}"
register: immich_vm
changed_when: false
failed_when: false
when: immich_controller.status | default(0) != 200
retries: "{{ immich_retries }}"
delay: "{{ immich_delay }}"
until: (immich_vm.stdout | default('') | trim | length) > 0 and ('pong' in (immich_vm.stdout | default('')))
no_log: "{{ DEBUG == 0 }}"
run_once: true
- name: Immich | Print concise summary
ansible.builtin.debug:
msg: >-
Immich API ping {{ 'OK' if (('pong' in (immich_controller.content|default(''))) or ('pong' in (immich_vm.stdout|default('')))) else 'NOT OK' }}.
Source={{ 'controller' if (immich_controller.status|default(0))==200 else 'vm' if (immich_vm.stdout|default('')|trim|length>0) else 'n/a' }}.
when: DEBUG == 1
run_once: true
update_jellyfin.yml
-94
View File
@@ -1,94 +0,0 @@
# update_jellyfin.yml
- name: Update Jellyfin
hosts: pve2_lxc_jellyfin
gather_facts: false
vars:
# Compose sync (controller -> target)
compose_local_dir: "{{ playbook_dir }}/docker-compose"
compose_remote_base: "/home/{{ ansible_user }}/.ansible-compose"
compose_remote_dir: "{{ compose_remote_base }}/docker-compose"
compose_remote_archive: "{{ compose_remote_base }}/docker-compose.tar.gz"
# Jellyfin settings
jellyfin_compose_filename: "docker-compose-jellyfin.yml"
jellyfin_service: jellyfin
jellyfin_port: 8096
tasks:
- name: Ensure remote base directory exists
ansible.builtin.file:
path: "{{ compose_remote_base }}"
state: directory
mode: "0755"
- name: Create local archive of docker-compose directory (controller)
ansible.builtin.archive:
path: "{{ compose_local_dir }}/"
dest: "/tmp/docker-compose.tar.gz"
format: gz
delegate_to: localhost
run_once: true
- name: Upload archive to remote host
ansible.builtin.copy:
src: "/tmp/docker-compose.tar.gz"
dest: "{{ compose_remote_archive }}"
mode: "0644"
- name: Recreate remote compose directory
ansible.builtin.file:
path: "{{ compose_remote_dir }}"
state: absent
- name: Ensure remote compose directory exists
ansible.builtin.file:
path: "{{ compose_remote_dir }}"
state: directory
mode: "0755"
- name: Extract archive on remote host
ansible.builtin.unarchive:
src: "{{ compose_remote_archive }}"
dest: "{{ compose_remote_dir }}"
remote_src: true
- name: Pull latest Jellyfin image (docker-compose v1)
ansible.builtin.command:
argv:
- bash
- -lc
- >
cd "{{ compose_remote_dir }}"
&& docker-compose -f "{{ jellyfin_compose_filename }}" pull
changed_when: true
- name: Recreate Jellyfin service (docker-compose v1)
ansible.builtin.command:
argv:
- bash
- -lc
- >
cd "{{ compose_remote_dir }}"
&& docker-compose -f "{{ jellyfin_compose_filename }}"
up -d --force-recreate --remove-orphans "{{ jellyfin_service }}"
changed_when: true
- name: Wait for Jellyfin port
ansible.builtin.wait_for:
host: 127.0.0.1
port: "{{ jellyfin_port }}"
timeout: 180
- name: Check Jellyfin HTTP endpoint (retry until ready)
ansible.builtin.uri:
url: "http://127.0.0.1:{{ jellyfin_port }}/"
status_code:
- 200
- 302
register: jellyfin_http
retries: 40
delay: 3
until: jellyfin_http.status in [200, 302]
changed_when: false
update_minecraft.yml
-132
View File
@@ -1,132 +0,0 @@
# update_minecraft.yml
- name: Update Minecraft (Futurecraft)
hosts: pve2_vm
gather_facts: false
vars:
# Compose sync (controller -> target)
compose_local_dir: "{{ playbook_dir }}/docker-compose"
compose_remote_base: "/home/{{ ansible_user }}/.ansible-compose"
compose_remote_dir: "{{ compose_remote_base }}/docker-compose"
compose_remote_archive: "{{ compose_remote_base }}/docker-compose.tar.gz"
# Minecraft settings
mc_project: minecraft
mc_compose_filename: "docker-compose-minecraft.yml"
mc_port: 25565
# Persistent env file on the VM (NOT in git)
# Must contain: CF_API_KEY, RCON_PASSWORD, optionally MEMORY
mc_env_persistent: "{{ compose_remote_base }}/env/minecraft.env"
# Container name from your compose file (used for log readiness check)
mc_container_name: "mc-futurecraft"
tasks:
- name: Ensure remote base directory exists
ansible.builtin.file:
path: "{{ compose_remote_base }}"
state: directory
mode: "0755"
- name: Ensure remote env directory exists
ansible.builtin.file:
path: "{{ compose_remote_base }}/env"
state: directory
mode: "0755"
- name: Fail if persistent Minecraft env file is missing
ansible.builtin.stat:
path: "{{ mc_env_persistent }}"
register: mc_env_stat
- name: Abort when Minecraft env is missing
ansible.builtin.fail:
msg: >-
Missing persistent env file: {{ mc_env_persistent }}.
Create it on the VM with at least:
CF_API_KEY=...
RCON_PASSWORD=...
Optional:
MEMORY=10G
when: not mc_env_stat.stat.exists
- name: Create local archive of docker-compose directory (controller)
ansible.builtin.archive:
path: "{{ compose_local_dir }}/"
dest: "/tmp/docker-compose.tar.gz"
format: gz
delegate_to: localhost
run_once: true
- name: Upload archive to remote host
ansible.builtin.copy:
src: "/tmp/docker-compose.tar.gz"
dest: "{{ compose_remote_archive }}"
mode: "0644"
- name: Recreate remote compose directory
ansible.builtin.file:
path: "{{ compose_remote_dir }}"
state: absent
- name: Ensure remote compose directory exists
ansible.builtin.file:
path: "{{ compose_remote_dir }}"
state: directory
mode: "0755"
- name: Extract archive on remote host
ansible.builtin.unarchive:
src: "{{ compose_remote_archive }}"
dest: "{{ compose_remote_dir }}"
remote_src: true
- name: Deploy Minecraft .env into compose directory
ansible.builtin.copy:
src: "{{ mc_env_persistent }}"
dest: "{{ compose_remote_dir }}/.env"
remote_src: true
mode: "0600"
- name: Pull latest Minecraft images (docker compose)
ansible.builtin.command: >
docker compose
-p {{ mc_project }}
-f {{ compose_remote_dir }}/{{ mc_compose_filename }}
pull
changed_when: false
- name: Recreate Minecraft stack (docker compose up)
ansible.builtin.command: >
docker compose
-p {{ mc_project }}
-f {{ compose_remote_dir }}/{{ mc_compose_filename }}
up -d --remove-orphans --force-recreate
changed_when: false
- name: Show last container logs after start (quick diagnostics)
ansible.builtin.command: >
docker logs --tail 60 {{ mc_container_name }}
register: mc_start_logs
changed_when: false
- name: Print last logs (for debugging)
ansible.builtin.debug:
var: mc_start_logs.stdout_lines
- name: Wait for Minecraft port
ansible.builtin.wait_for:
host: 127.0.0.1
port: "{{ mc_port }}"
timeout: 180
- name: Wait until server reports "Done" in docker logs (ready)
ansible.builtin.command: >
docker logs --tail 200 {{ mc_container_name }}
register: mc_docker_logs
retries: 60
delay: 5
until: "'Done (' in mc_docker_logs.stdout"
changed_when: false
update_semaphore.yml
+51 -79
View File
@@ -1,93 +1,65 @@
# update_semaphore.yml # update_semaphore.yml
- name: Update Semaphore (self-update safe) - name: Update Semaphore on VM via Proxmox
hosts: pve2_vm hosts: linux_servers
gather_facts: false gather_facts: false
become: true
become_user: root
become_method: sudo
vars: vars:
compose_local_dir: "{{ playbook_dir }}/docker-compose" # --- Connection to VM (provided by Semaphore env vars) ---
compose_remote_base: "/home/{{ ansible_user }}/.ansible-compose" vm_ip: "{{ lookup('env', 'VM_IP') }}" # IP vm-portainer
compose_remote_dir: "{{ compose_remote_base }}/docker-compose" vm_user: "{{ lookup('env', 'VM_USER') }}"
compose_remote_archive: "{{ compose_remote_base }}/docker-compose.tar.gz" vm_pass: "{{ lookup('env', 'VM_PASS') }}"
use_sudo: false
semaphore_project: semaphore # --- Debug mode (controlled via Semaphore variable) ---
semaphore_compose_filename: "docker-compose-semaphore.yml" DEBUG: "{{ lookup('env', 'DEBUG') | default(0) | int }}"
semaphore_port: 3000
# --- Semaphore specifics ---
semaphore_project: "semaphore"
semaphore_compose_file: "/data/compose/semaphore/docker-compose.yml"
semaphore_service: "semaphore"
tasks: tasks:
- name: Ensure remote base directory exists - name: Ensure sshpass is installed (for password-based SSH) # English comments
ansible.builtin.file: ansible.builtin.apt:
path: "{{ compose_remote_base }}" name: sshpass
state: directory state: present
update_cache: yes
- name: Create local archive of docker-compose directory (controller) - name: Run Semaphore self-update on VM in background (nohup)
ansible.builtin.archive:
path: "{{ compose_local_dir }}/"
dest: "/tmp/docker-compose.tar.gz"
format: gz
delegate_to: localhost
run_once: true
- name: Upload archive to remote host
ansible.builtin.copy:
src: "/tmp/docker-compose.tar.gz"
dest: "{{ compose_remote_archive }}"
- name: Recreate remote compose directory
ansible.builtin.file:
path: "{{ compose_remote_dir }}"
state: absent
- name: Ensure remote compose directory exists
ansible.builtin.file:
path: "{{ compose_remote_dir }}"
state: directory
- name: Extract archive on remote host
ansible.builtin.unarchive:
src: "{{ compose_remote_archive }}"
dest: "{{ compose_remote_dir }}"
remote_src: true
- name: Pull latest Semaphore image(s)
ansible.builtin.command: ansible.builtin.command:
argv: argv:
- sshpass
- -e
- ssh
- -o
- StrictHostKeyChecking=no
- -o
- ConnectTimeout=15
- "{{ vm_user }}@{{ vm_ip }}"
- bash - bash
- -lc - -lc
- > - |
cd "{{ compose_remote_dir }}" nohup bash -c '
&& docker compose -p "{{ semaphore_project }}" unalias docker 2>/dev/null || true
-f "{{ semaphore_compose_filename }}" DOCKER_CLI_HINTS=0 docker compose \
pull -p {{ semaphore_project }} \
changed_when: true -f {{ semaphore_compose_file }} \
up -d --no-deps --force-recreate --pull always {{ semaphore_service }}
- name: Start Semaphore update in background (avoid killing this job) ' >/dev/null 2>&1 &
ansible.builtin.command: environment:
argv: SSHPASS: "{{ vm_pass }}"
- bash register: semaphore_update
- -lc
- >
cd "{{ compose_remote_dir }}"
&& nohup docker compose -p "{{ semaphore_project }}"
-f "{{ semaphore_compose_filename }}"
up -d --remove-orphans --force-recreate
> "{{ compose_remote_base }}/semaphore-update.log" 2>&1 &
async: 1
poll: 0
changed_when: true
- name: Wait for Semaphore port
ansible.builtin.wait_for:
host: 127.0.0.1
port: "{{ semaphore_port }}"
timeout: 300
- name: Check Semaphore HTTP endpoint (retry)
ansible.builtin.uri:
url: "http://127.0.0.1:{{ semaphore_port }}/"
status_code: 200
register: sem_http
retries: 30
delay: 5
until: sem_http.status == 200
changed_when: false changed_when: false
no_log: "{{ DEBUG == 0 }}"
- name: Show result of Semaphore self-update (debug)
ansible.builtin.debug:
msg: |
RC: {{ semaphore_update.rc }}
STDOUT: {{ (semaphore_update.stdout | default('')).strip() }}
STDERR: {{ (semaphore_update.stderr | default('')).strip() }}
when: DEBUG == 1
update_uptime_kuma.yml
+183 -80
View File
@@ -1,91 +1,194 @@
# update_uptimekuma.yml # nextcloud/update_uptime_kuma.yml
- name: Update Uptime Kuma - name: Update Uptime Kuma on VM via Proxmox
hosts: pve1_vm hosts: linux_servers
gather_facts: false gather_facts: false
become: true
become_user: root
become_method: sudo
vars: vars:
# Compose sync (controller -> target) # VM connection (provided by Semaphore env vars)
compose_local_dir: "{{ playbook_dir }}/docker-compose" vm_ip: "{{ lookup('env', 'VM_IP') }}"
compose_remote_base: "/home/{{ ansible_user }}/.ansible-compose" vm_user: "{{ lookup('env', 'VM_USER') }}"
compose_remote_dir: "{{ compose_remote_base }}/docker-compose" vm_pass: "{{ lookup('env', 'VM_PASS') }}"
compose_remote_archive: "{{ compose_remote_base }}/docker-compose.tar.gz" use_sudo: false
# Uptime Kuma settings # --- Debug mode (controlled via Semaphore variable) ---
uptimekuma_project: uptimekuma DEBUG: "{{ lookup('env', 'DEBUG') | default(0) | int }}"
uptimekuma_compose_filename: "docker-compose-uptimekuma.yml" RETRIES: "{{ lookup('env', 'RETRIES') | default(25) | int }}"
uptimekuma_service: uptime-kuma
uptimekuma_port: 3001 # Uptime Kuma specifics
kuma_project: "uptime-kuma"
kuma_compose_file: "/data/compose/uptime-kuma/docker-compose-uptime-kuma.yml"
kuma_service: "uptime-kuma"
kuma_image: "louislam/uptime-kuma:latest"
kuma_port: 3001
# Optional external URL for controller-side readiness check (e.g., https://kuma.example.com)
# If empty/undefined, controller check is skipped and we only probe from the VM.
kuma_url: "{{ lookup('env', 'KUMA_URL') | default('', true) }}"
# Fixed container name used in your compose (conflicts with previous/Portainer-run container)
kuma_container_name: "uptime-kuma-dev"
# Retry policy
kuma_retries: "{{ RETRIES }}"
kuma_delay: 2
# Docker command prefix (consistent behavior)
docker_prefix: "unalias docker 2>/dev/null || true; DOCKER_CLI_HINTS=0; command docker"
# Commands to run on the target VM (quiet outputs like in Collabora play)
kuma_commands:
- "{{ docker_prefix }} pull -q {{ kuma_image }} >/dev/null"
- "{{ docker_prefix }} compose -p {{ kuma_project }} -f {{ kuma_compose_file }} pull {{ kuma_service }} >/dev/null"
# remove conflicting container name before compose up (silently)
- "{{ docker_prefix }} rm -f {{ kuma_container_name }} >/dev/null 2>&1 || true"
- "{{ docker_prefix }} compose -p {{ kuma_project }} -f {{ kuma_compose_file }} up -d --no-deps --force-recreate {{ kuma_service }} >/dev/null"
tasks: tasks:
- name: Ensure remote base directory exists - name: Ensure sshpass is installed (for password-based SSH) # English comments
ansible.builtin.file: ansible.builtin.apt:
path: "{{ compose_remote_base }}" name: sshpass
state: directory state: present
mode: "0755" update_cache: yes
- name: Create local archive of docker-compose directory (controller) - name: Run Uptime Kuma update commands on VM (via SSH) # use SSHPASS env, hide item label
ansible.builtin.archive: ansible.builtin.command:
path: "{{ compose_local_dir }}/" argv:
dest: "/tmp/docker-compose.tar.gz" - sshpass
format: gz - -e # read password from SSHPASS environment
- ssh
- -o
- StrictHostKeyChecking=no
- -o
- ConnectTimeout=15
- "{{ vm_user }}@{{ vm_ip }}"
- bash
- -lc
- "{{ ('sudo ' if use_sudo else '') + item }}"
environment:
SSHPASS: "{{ vm_pass }}" # supply password via environment
loop: "{{ kuma_commands }}"
loop_control:
index_var: idx # capture loop index
label: "cmd-{{ idx }}" # avoid printing full command in (item=...) line
register: kuma_cmds
changed_when: false
no_log: "{{ DEBUG == 0 }}" # hide outputs and env when not debugging
- name: Show outputs for each Uptime Kuma command
ansible.builtin.debug:
msg: |
CMD: {{ item.item }}
RC: {{ item.rc }}
STDOUT:
{{ (item.stdout | default('')).strip() }}
STDERR:
{{ (item.stderr | default('')).strip() }}
loop: "{{ kuma_cmds.results }}"
when: DEBUG == 1
- name: Fail play if any Uptime Kuma command failed # also hide item label
ansible.builtin.assert:
that: "item.rc == 0"
fail_msg: "Uptime Kuma update failed on VM: {{ item.item }} (rc={{ item.rc }})"
success_msg: "All Uptime Kuma update commands succeeded."
loop: "{{ kuma_cmds.results }}"
loop_control:
index_var: idx
label: "cmd-{{ idx }}"
# -------------------------
# Readiness checks (controller first, then VM fallback)
# -------------------------
- name: Kuma | Wait for homepage (controller first, with retries)
ansible.builtin.uri:
url: "{{ (kuma_url | regex_replace('/$','')) + '/' }}"
method: GET
return_content: true
# Validate TLS only when using https://
validate_certs: "{{ (kuma_url | default('')) is match('^https://') }}"
status_code: 200
register: kuma_controller
delegate_to: localhost delegate_to: localhost
run_once: true run_once: true
when: kuma_url is defined and (kuma_url | length) > 0
- name: Upload archive to remote host retries: "{{ kuma_retries }}"
ansible.builtin.copy: delay: "{{ kuma_delay }}"
src: "/tmp/docker-compose.tar.gz" until: kuma_controller.status == 200
dest: "{{ compose_remote_archive }}" failed_when: false
mode: "0644"
- name: Recreate remote compose directory
ansible.builtin.file:
path: "{{ compose_remote_dir }}"
state: absent
- name: Ensure remote compose directory exists
ansible.builtin.file:
path: "{{ compose_remote_dir }}"
state: directory
mode: "0755"
- name: Extract archive on remote host
ansible.builtin.unarchive:
src: "{{ compose_remote_archive }}"
dest: "{{ compose_remote_dir }}"
remote_src: true
- name: Pull latest Uptime Kuma image
community.docker.docker_compose_v2:
project_name: "{{ uptimekuma_project }}"
project_src: "{{ compose_remote_dir }}"
files:
- "{{ uptimekuma_compose_filename }}"
pull: always
- name: Recreate Uptime Kuma service
community.docker.docker_compose_v2:
project_name: "{{ uptimekuma_project }}"
project_src: "{{ compose_remote_dir }}"
files:
- "{{ uptimekuma_compose_filename }}"
services:
- "{{ uptimekuma_service }}"
state: present
recreate: always
- name: Wait for Uptime Kuma port
ansible.builtin.wait_for:
host: 127.0.0.1
port: "{{ uptimekuma_port }}"
timeout: 120
- name: Check Uptime Kuma HTTP endpoint (retry until ready)
ansible.builtin.uri:
url: "http://127.0.0.1:{{ uptimekuma_port }}/"
status_code: 200
register: kuma_http
retries: 30
delay: 3
until: kuma_http.status == 200
changed_when: false changed_when: false
- name: Kuma | VM-side fetch (HTML via Python, with retries) # use SSHPASS env here too
ansible.builtin.command:
argv:
- sshpass
- -e
- ssh
- -o
- StrictHostKeyChecking=no
- -o
- ConnectTimeout=15
- "{{ vm_user }}@{{ vm_ip }}"
- bash
- -lc
- |
python3 - <<'PY'
# Fetch Kuma homepage from localhost and print HTML to stdout
import urllib.request, sys
try:
with urllib.request.urlopen("http://127.0.0.1:{{ kuma_port }}/", timeout=15) as r:
sys.stdout.write(r.read().decode(errors='ignore'))
except Exception:
pass
PY
environment:
SSHPASS: "{{ vm_pass }}"
register: kuma_vm
changed_when: false
failed_when: false
when: kuma_controller.status | default(0) != 200 or kuma_controller.content is not defined
retries: "{{ kuma_retries }}"
delay: "{{ kuma_delay }}"
until: (kuma_vm.stdout | default('') | trim | length) > 0 and ('Uptime Kuma' in (kuma_vm.stdout | default('')))
no_log: "{{ DEBUG == 0 }}" # hide command and output when not debugging
- name: Kuma | Choose homepage HTML (controller wins, else VM) # safe guard against empty result
ansible.builtin.set_fact:
kuma_home_html: >-
{{
(
kuma_controller.content
if (kuma_controller is defined)
and ((kuma_controller.status|default(0))==200)
and (kuma_controller.content is defined)
else
(kuma_vm.stdout | default('') | trim)
)
}}
when:
- (kuma_controller is defined and (kuma_controller.status|default(0))==200 and (kuma_controller.content is defined))
or ((kuma_vm.stdout | default('') | trim | length) > 0)
- name: Kuma | Print concise summary
ansible.builtin.debug:
msg: >-
Uptime Kuma homepage {{ 'reachable' if (kuma_home_html is defined) else 'NOT reachable' }}.
Source={{ 'controller' if ((kuma_controller is defined) and (kuma_controller.status|default(0))==200 and (kuma_controller.content is defined)) else 'vm' if (kuma_vm.stdout|default('')|trim|length>0) else 'n/a' }};
length={{ (kuma_home_html | default('')) | length }};
contains('Uptime Kuma')={{ (kuma_home_html is defined) and ('Uptime Kuma' in kuma_home_html) }}
when: DEBUG == 1
- name: Kuma | Homepage unavailable (after retries)
ansible.builtin.debug:
msg: "Kuma web není dostupná ani po pokusech."
when: kuma_home_html is not defined and DEBUG == 1
# Optional detailed dump (short excerpt only)
- name: Kuma | HTML excerpt (debug)
ansible.builtin.debug:
msg: "{{ (kuma_home_html | default(''))[:500] }}"
when: kuma_home_html is defined and DEBUG == 1