Update mikrotikbackup_clean.yml

2026-03-21 09:25:13 +00:00 · 2026-03-21 09:21:51 +00:00 · 2026-03-21 09:19:01 +00:00 · 2026-03-21 08:49:35 +00:00 · 2026-03-21 08:46:08 +00:00 · 2026-03-21 08:40:46 +00:00
50 changed files with 574 additions and 6087 deletions
@@ -1,439 +0,0 @@
 # check_raid.yml
 ---
 - name: Check Linux MD RAID health on pve1
  hosts: pve1_vm
  gather_facts: false
  vars:
    # Semaphore Survey Variables are preferred.
    # Environment variables are used only as a fallback.
    raid_md_raw: >-
      {{
        RAID_MD
        | default(lookup('env', 'RAID_MD'), true)
        | default('auto', true)
        | string
        | trim
        | lower
      }}
    # RAID_MD can be md0, md1, /dev/md0, or auto
    raid_md_device: "{{ raid_md_raw | regex_replace('^/dev/', '') }}"
    # Allow a healthy array to be checking, repairing, recovering,
    # resyncing, or reshaping
    raid_allow_sync: >-
      {{
        RAID_ALLOW_SYNC
        | default(lookup('env', 'RAID_ALLOW_SYNC'), true)
        | default('1', true)
        | int
      }}
    # A server without Linux MD RAID is considered unhealthy by default
    raid_allow_no_array: >-
      {{
        RAID_ALLOW_NO_ARRAY
        | default(lookup('env', 'RAID_ALLOW_NO_ARRAY'), true)
        | default('0', true)
        | int
      }}
    # Enable raw diagnostic output
    raid_debug: >-
      {{
        DEBUG
        | default(lookup('env', 'DEBUG'), true)
        | default('0', true)
        | int
      }}
    raid_check_script: |
      import re
      import sys
      target = {{ raid_md_device | to_json }}
      allow_sync = bool({{ raid_allow_sync | int }})
      allow_no_array = bool({{ raid_allow_no_array | int }})
      try:
          with open(
              "/proc/mdstat",
              "r",
              encoding="utf-8",
              errors="replace",
          ) as mdstat_file:
              mdstat = mdstat_file.read()
      except Exception as exc:
          print(
              "ERROR RAID "
              f"read_mdstat_failed="
              f"{type(exc).__name__}:{exc}"
          )
          sys.exit(2)
      header_pattern = re.compile(
          r"^(md\d+)\s*:\s*(.*)$",
          re.MULTILINE,
      )
      header_matches = list(header_pattern.finditer(mdstat))
      array_blocks = {}
      for index, match in enumerate(header_matches):
          block_end = (
              header_matches[index + 1].start()
              if index + 1 < len(header_matches)
              else len(mdstat)
          )
          array_blocks[match.group(1)] = mdstat[
              match.start():block_end
          ]
      def md_sort_key(name):
          try:
              return int(name[2:])
          except ValueError:
              return name
      def parse_array(name, block):
          lines = block.splitlines()
          header = lines[0]
          header_data = header.split(":", 1)[1].strip()
          state_match = re.match(
              r"^(active|inactive)\b",
              header_data,
              re.IGNORECASE,
          )
          state = (
              state_match.group(1).lower()
              if state_match
              else "unknown"
          )
          remaining_header = (
              header_data[state_match.end():].strip()
              if state_match
              else header_data
          )
          mode = "rw"
          # Handle states such as "active (auto-read-only)"
          if remaining_header.startswith("("):
              closing_parenthesis = remaining_header.find(")")
              if closing_parenthesis >= 0:
                  mode = remaining_header[
                      1:closing_parenthesis
                  ]
                  remaining_header = remaining_header[
                      closing_parenthesis + 1:
                  ].strip()
          level = (
              remaining_header.split()[0].lower()
              if remaining_header
              else "unknown"
          )
          status_match = re.search(
              r"\[(\d+)\s*/\s*(\d+)\]"
              r"\s*\[([U_]+)\]",
              block,
          )
          active_members = None
          total_members = None
          member_status = None
          if status_match:
              active_members = int(status_match.group(1))
              total_members = int(status_match.group(2))
              member_status = status_match.group(3)
          operation_match = re.search(
              r"\b("
              r"resync|"
              r"recovery|"
              r"reshape|"
              r"check|"
              r"repair"
              r")\b",
              block,
              re.IGNORECASE,
          )
          operation = (
              operation_match.group(1).lower()
              if operation_match
              else "none"
          )
          progress_match = re.search(
              r"(?:"
              r"resync|"
              r"recovery|"
              r"reshape|"
              r"check|"
              r"repair"
              r")\s*=\s*([0-9.]+%)",
              block,
              re.IGNORECASE,
          )
          progress = (
              progress_match.group(1)
              if progress_match
              else "none"
          )
          return {
              "name": name,
              "state": state,
              "mode": mode,
              "level": level,
              "active_members": active_members,
              "total_members": total_members,
              "member_status": member_status,
              "operation": operation,
              "progress": progress,
              "faulty_member": bool(
                  re.search(
                      r"\(F\)",
                      block,
                      re.IGNORECASE,
                  )
              ),
          }
      def format_array(array):
          if array["member_status"] is None:
              members = "n/a"
              member_status = "n/a"
          else:
              members = (
                  f'{array["active_members"]}/'
                  f'{array["total_members"]}'
              )
              member_status = array["member_status"]
          return (
              f'{array["name"]}'
              "{"
              f'state={array["state"]},'
              f'mode={array["mode"]},'
              f'level={array["level"]},'
              f'members={members},'
              f'status={member_status},'
              f'operation={array["operation"]},'
              f'progress={array["progress"]}'
              "}"
          )
      if not array_blocks:
          if allow_no_array:
              print("OK RAID none=no-md-arrays")
              sys.exit(0)
          print("ERROR RAID none=no-md-arrays")
          sys.exit(2)
      available_arrays = sorted(
          array_blocks.keys(),
          key=md_sort_key,
      )
      if target == "auto":
          selected_names = available_arrays
      elif target in array_blocks:
          selected_names = [target]
      else:
          print(
              "ERROR RAID "
              f"target_not_found={target} "
              f'found={",".join(available_arrays)}'
          )
          sys.exit(2)
      selected_arrays = [
          parse_array(
              name,
              array_blocks[name],
          )
          for name in selected_names
      ]
      failures = []
      errors = []
      # These RAID levels may not always provide a redundant-member token
      tokenless_levels = {
          "raid0",
          "linear",
      }
      for array in selected_arrays:
          name = array["name"]
          if array["state"] != "active":
              failures.append(
                  f'{name}:state={array["state"]}'
              )
          if array["faulty_member"]:
              failures.append(
                  f"{name}:faulty-member"
              )
          if array["member_status"] is not None:
              if "_" in array["member_status"]:
                  failures.append(
                      f'{name}:degraded='
                      f'[{array["member_status"]}]'
                  )
              if (
                  array["active_members"]
                  != array["total_members"]
              ):
                  failures.append(
                      f'{name}:members='
                      f'{array["active_members"]}/'
                      f'{array["total_members"]}'
                  )
          elif array["level"] not in tokenless_levels:
              errors.append(
                  f"{name}:member-status-not-found"
              )
          if (
              array["operation"] != "none"
              and not allow_sync
          ):
              failures.append(
                  f'{name}:operation='
                  f'{array["operation"]}'
              )
      details = " ".join(
          format_array(array)
          for array in selected_arrays
      )
      if errors:
          print(
              f"ERROR RAID {details} "
              f'reason={";".join(errors)}'
          )
          sys.exit(2)
      if failures:
          print(
              f"FAIL RAID {details} "
              f'reason={";".join(failures)}'
          )
          sys.exit(1)
      print(f"OK RAID {details}")
      sys.exit(0)
  tasks:
    - name: Validate RAID check configuration
      ansible.builtin.assert:
        that:
          - (raid_allow_sync | int) in [0, 1]
          - (raid_allow_no_array | int) in [0, 1]
          - (raid_debug | int) in [0, 1]
          - >-
            (
              raid_md_device
              | regex_search('^(auto|md[0-9]+)$')
            ) is not none
        fail_msg: >-
          ERROR RAID invalid-configuration.
          RAID_MD must be auto, md0, md1, or /dev/md0.
          DEBUG, RAID_ALLOW_SYNC, and RAID_ALLOW_NO_ARRAY
          must be 0 or 1.
        quiet: true
    - name: Run Linux MD RAID health check
      ansible.builtin.command:
        argv:
          - python3
          - "-"
        stdin: "{{ raid_check_script }}"
        stdin_add_newline: true
      register: raid_cmd
      changed_when: false
      failed_when: false
    - name: Build one-line RAID result
      ansible.builtin.set_fact:
        raid_line: >-
          {%- set stdout = (
            raid_cmd.stdout
            | default('')
            | trim
            | regex_replace('[\r\n]+', ' ')
            | regex_replace('\s+', ' ')
          ) -%}
          {%- set stderr = (
            raid_cmd.stderr
            | default('')
            | trim
            | regex_replace('[\r\n]+', ' ')
            | regex_replace('\s+', ' ')
          ) -%}
          {%- if stdout | length > 0 -%}
          {{ stdout }}
          {%- elif stderr | length > 0 -%}
          ERROR RAID command_failed rc={{ raid_cmd.rc }}
          stderr={{ stderr[:500] }}
          {%- else -%}
          ERROR RAID no-output rc={{ raid_cmd.rc }}
          {%- endif -%}
      changed_when: false
    - name: Show raw RAID command result
      ansible.builtin.debug:
        msg:
          rc: "{{ raid_cmd.rc }}"
          stdout: "{{ raid_cmd.stdout | default('') }}"
          stderr: "{{ raid_cmd.stderr | default('') }}"
      when: (raid_debug | int) == 1
    - name: Read raw mdstat in debug mode
      ansible.builtin.command:
        argv:
          - cat
          - /proc/mdstat
      register: mdstat_debug
      changed_when: false
      failed_when: false
      when: (raid_debug | int) == 1
    - name: Show raw mdstat in debug mode
      ansible.builtin.debug:
        msg:
          rc: "{{ mdstat_debug.rc | default('undefined') }}"
          stdout: "{{ mdstat_debug.stdout | default('') }}"
          stderr: "{{ mdstat_debug.stderr | default('') }}"
      when: (raid_debug | int) == 1
    - name: Show successful RAID result
      ansible.builtin.debug:
        msg: "{{ raid_line }}"
      when: (raid_cmd.rc | int) == 0
    - name: Fail when RAID is unhealthy
      ansible.builtin.fail:
        msg: "{{ raid_line }}"
      when: (raid_cmd.rc | int) != 0
@@ -1,27 +0,0 @@
 name: bettershift
 services:
  bettershift:
    container_name: bettershift
    image: ghcr.io/pantelx/bettershift:v2.2.1
    restart: unless-stopped
    ports:
      - '0.0.0.0:3067:3000'
    volumes:
      - /data/compose/bettershift/data:/app/data
    env_file:
      - .env.bettershift
    environment:
      - TZ=Europe/Prague
 networks:
  backend:
    driver: bridge
    ipam:
      config:
        - subnet: 172.20.0.0/24
          gateway: 172.20.0.1
@@ -1,23 +0,0 @@
 version: '3'
 services:
  collabora:
    image: collabora/code:latest
    container_name: collabora
    restart: unless-stopped
    networks:
      - cloud
    environment:
      - TZ=Europe/Prague
      - password=password
      - username=nextcloud
      - domain=cloud.martinfencl.eu
      - extra_params=--o:ssl.enable=false --o:ssl.termination=true
      - aliasgroup1=https://cloud.martinfencl.eu:443,https://collabora.martinfencl.eu:443
      - dictionaries=de_DE en_GB en_US es_ES fr_FR it nl pt_BR pt_PT ru cs_CZ
    ports:
      - 9980:9980
 networks:
  cloud:
    driver: bridge
@@ -1,25 +0,0 @@
 # docker-compose-glance.yml
 name: glance
 services:
  glance:
    container_name: glance
    image: glanceapp/glance:latest
    restart: unless-stopped
    volumes:
      # Relative to project_src (~/.ansible-compose/glance), so no username is
      # hardcoded. The playbook creates this directory and uploads glance.yml.
      # The image entrypoint is /app/glance --config /app/config/glance.yml,
      # so the file must be named exactly glance.yml.
      - ./config:/app/config
      - /etc/localtime:/etc/localtime:ro
    environment:
      # Used by the calendar widget and by relative timestamps
      - TZ=Europe/Prague
    env_file:
      # Deployed by the playbook from the persistent env file on the VM.
      # Provides GITHUB_TOKEN, referenced from glance.yml as ${GITHUB_TOKEN}.
      - .env
    ports:
      - '9445:8080'
@@ -1,13 +0,0 @@
 services:
  homarr:
    container_name: homarr
    image: ghcr.io/homarr-labs/homarr:latest
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock # Optional, only if you want docker integration
      - /data/compose/homarr/appdata:/appdata
    environment:
      - SECRET_ENCRYPTION_KEY=4fb16028fa1788d9a24fa93a323aa4a278524bed177c8c38454f4c4068c1b9b6
    ports:
      - '7575:7575'
@@ -1,5 +0,0 @@
 services:
  immich-server:
    volumes:
      - /mnt/nextcloud-howard-photos:/mnt/nextcloud-howard-photos
      - /mnt/nextcloud-kamilkaprdelka-photos:/mnt/nextcloud-kamilkaprdelka-photos
@@ -1,77 +0,0 @@
 #
 # WARNING: To install Immich, follow our guide: https://docs.immich.app/install/docker-compose
 #
 # Make sure to use the docker-compose.yml of the current release:
 #
 # https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml
 #
 # The compose file on main may not be compatible with the latest release.
 name: immich
 services:
  immich-server:
    container_name: immich_server
    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
    # extends:
    #   file: hwaccel.transcoding.yml
    #   service: cpu # set to one of [nvenc, quicksync, rkmpp, vaapi, vaapi-wsl] for accelerated transcoding
    volumes:
      - ${UPLOAD_LOCATION}:/usr/src/app/upload
      #- /mnt/nextcloud-howard-photos:/mnt/nextcloud-howard-photos:ro  # read-only external library
      #- /mnt/nextcloud-kamilkaprdelka-photos:/mnt/nextcloud-kamilkaprdelka-photos:ro  # read-only external library
      - /mnt/nextcloud-howard-photos:/mnt/nextcloud-howard-photos
      - /mnt/nextcloud-kamilkaprdelka-photos:/mnt/nextcloud-kamilkaprdelka-photos
      - /etc/localtime:/etc/localtime:ro
    env_file:
      - .env
    ports:
      - '2283:2283'
    depends_on:
      - redis
      - database
    restart: always
    healthcheck:
      disable: false
  immich-machine-learning:
    container_name: immich_machine_learning
    # For hardware acceleration, add one of -[armnn, cuda, rocm, openvino, rknn] to the image tag.
    # Example tag: ${IMMICH_VERSION:-release}-cuda
    image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
    # extends: # uncomment this section for hardware acceleration - see https://docs.immich.app/features/ml-hardware-acceleration
    #   file: hwaccel.ml.yml
    #   service: cpu # set to one of [armnn, cuda, rocm, openvino, openvino-wsl, rknn] for accelerated inference - use the `-wsl` version for WSL2 where applicable
    volumes:
      - model-cache:/cache
    env_file:
      - .env
    restart: always
    healthcheck:
      disable: false
  redis:
    container_name: immich_redis
    image: docker.io/valkey/valkey:8@sha256:81db6d39e1bba3b3ff32bd3a1b19a6d69690f94a3954ec131277b9a26b95b3aa
    healthcheck:
      test: redis-cli ping || exit 1
    restart: always
  database:
    container_name: immich_postgres
    image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357191b76a916ae5eb93464d65c07511da41e3bf7a8416db519b40b1c23
    environment:
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_USER: ${DB_USERNAME}
      POSTGRES_DB: ${DB_DATABASE_NAME}
      POSTGRES_INITDB_ARGS: '--data-checksums'
      # Uncomment the DB_STORAGE_TYPE: 'HDD' var if your database isn't stored on SSDs
      # DB_STORAGE_TYPE: 'HDD'
    volumes:
      # Do not edit the next line. If you want to change the database storage location on your system, edit the value of DB_DATA_LOCATION in the .env file
      - ${DB_DATA_LOCATION}:/var/lib/postgresql/data
    shm_size: 128mb
    restart: always
 volumes:
  model-cache:
@@ -1,33 +0,0 @@
 services:
  jellyfin:
    image: lscr.io/linuxserver/jellyfin:latest
    container_name: jellyfin
    restart: unless-stopped
    ports:
      - "8096:8096"
      - "7359:7359/udp"
      - "1900:1900/udp"
    environment:
      - TZ=Europe/Prague
      - PUID=0
      - PGID=0
    volumes:
      - /opt/jellyfin/config:/config
      - /opt/jellyfin/cache:/cache
      - /mnt/films:/media/films:ro
      - /mnt/books:/media/books:ro
      - /mnt/ondrulin:/media/ondrulin:ro
    devices:
      - /dev/dri:/dev/dri
    group_add:
      - "104"
      - "44"
    tmpfs:
      - /transcode:rw,size=8g,mode=1777
@@ -1,71 +0,0 @@
 services:
  mc:
    image: itzg/minecraft-server:2026.6.0-java17
    container_name: mc-futurecraft
    restart: unless-stopped
    ports:
      - "25565:25565"
    environment:
      EULA: "TRUE"
      # CurseForge
      TYPE: "AUTO_CURSEFORGE"
      CF_API_KEY: "${CF_API_KEY}"
      # Slug is still required as an identifier,
      # but modpack itself is loaded from the supplied ZIP
      CF_SLUG: "futurecraft-5-0"
      CF_MODPACK_ZIP: "/modpacks/futurecraft-5.0.zip"
      # Server
      MEMORY: "${MEMORY:-10G}"
      LEVEL: "world"
      DIFFICULTY: "normal"
      VIEW_DISTANCE: "10"
      SIMULATION_DISTANCE: "6"
      MAX_PLAYERS: "5"
      # RCON
      ENABLE_RCON: "true"
      RCON_PASSWORD: "${RCON_PASSWORD}"
      ONLINE_MODE: "FALSE"
      ENABLE_WHITELIST: "TRUE"
    volumes:
      - mc_data:/data
      - /home/howard/.ansible-compose/modpacks:/modpacks:ro
  backup:
    image: itzg/mc-backup:latest
    container_name: mc-futurecraft-backup
    restart: unless-stopped
    depends_on:
      - mc
    environment:
      SRC_DIR: "/data"
      DEST_DIR: "/backups"
      BACKUP_INTERVAL: "12h"
      INITIAL_DELAY: "5m"
      PRUNE_BACKUPS_DAYS: "5"
      EXCLUDES: "backups,cache,logs"
      RCON_HOST: "mc"
      RCON_PASSWORD: "${RCON_PASSWORD}"
    volumes:
      - mc_data:/data:ro
      - /backups/minecraft-futurecraft:/backups
 volumes:
  mc_data:
    external: true
    name: minecraft_mc_data
@@ -1,49 +0,0 @@
 services:
  mc:
    image: itzg/minecraft-server:java17
    container_name: mc-futurecraft
    restart: unless-stopped
    ports:
      - "25565:25565"
    environment:
      EULA: "TRUE"
      TYPE: "AUTO_CURSEFORGE"
      CF_API_KEY: "${CF_API_KEY}"
      CF_SLUG: "futurecraft-5-0"
      JAVA_VERSION: "17"
      MEMORY: "${MEMORY:-10G}"
      LEVEL: "world"
      DIFFICULTY: "normal"
      VIEW_DISTANCE: "10"
      SIMULATION_DISTANCE: "6"
      MAX_PLAYERS: "5"
      ENABLE_RCON: "true"
      RCON_PASSWORD: "${RCON_PASSWORD}"
      ONLINE_MODE: "FALSE"
      ENABLE_WHITELIST: "TRUE"
    volumes:
      - mc_data:/data
  backup:
    image: itzg/mc-backup:latest
    container_name: mc-futurecraft-backup
    restart: unless-stopped
    depends_on:
      - mc
    environment:
      SRC_DIR: /data
      DEST_DIR: /data/backups
      BACKUP_INTERVAL: "12h"
      INITIAL_DELAY: "5m"
      PRUNE_BACKUPS_DAYS: "14"
      EXCLUDES: "backups,cache,logs"
      RCON_HOST: mc
      RCON_PASSWORD: "${RCON_PASSWORD}"
    volumes:
      - mc_data:/data
 volumes:
  mc_data:
@@ -1,75 +0,0 @@
 services:
  nextcloud:
    image: nextcloud:34.0.2-apache
    container_name: nextcloud
    restart: unless-stopped
    networks:
      - cloud
    depends_on:
      - nextclouddb
      - redis
    ports:
      - 8080:80
    volumes:
      - /data/compose/nextcloud/config:/var/www/html/config
      - /data/compose/nextcloud/data:/var/www/html/data
      - /data/compose/nextcloud/custom_apps:/var/www/html/custom_apps
    environment:
      - TZ=Europe/Prague
      - MYSQL_DATABASE=nextcloud
      - MYSQL_USER=nextcloud
      - MYSQL_PASSWORD=dbpassword
      - MYSQL_HOST=nextclouddb
      - REDIS_HOST=redis
      - NEXTCLOUD_ADMIN_USER=root
      - NEXTCLOUD_ADMIN_PASSWORD=1234SilneHeslo.-.
      - PHP_MEMORY_LIMIT=2048M
  nextclouddb:
    image: mariadb
    container_name: nextcloud-db
    restart: unless-stopped
    command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW
    networks:
      - cloud
    volumes:
      - /data/compose/nextcloud/nextclouddb:/var/lib/mysql
    environment:
      - TZ=Europe/Prague
      - MYSQL_RANDOM_ROOT_PASSWORD=true
      - MYSQL_DATABASE=nextcloud
      - MYSQL_USER=nextcloud
      - MYSQL_PASSWORD=dbpassword
      - MARIADB_AUTO_UPGRADE=1
  redis:
    image: redis:alpine
    container_name: redis
    restart: unless-stopped
    command: redis-server --save "" --appendonly no    # cache only, no persistence
    networks:
      - cloud
    volumes:
      - /data/compose/nextcloud/redis:/data
  #collabora:
  #  image: collabora/code
  #  container_name: collabora
  #  restart: unless-stopped
  #  networks:
  #    - cloud
  #  environment:
  #    - TZ=Europe/Prague
  #    - password=password
  #    - username=nextcloud
  #    - domain=cloud.martinfencl.eu
  #    - extra_params=--o:ssl.enable=false --o:ssl.termination=true
  #    - aliasgroup1=https://cloud.martinfencl.eu:443,https://collabora.martinfencl.eu:443
  #    - dictionaries=de_DE en_GB en_US es_ES fr_FR it nl pt_BR pt_PT ru cs_CZ
  #  ports:
  #    - 9980:9980
 networks:
  cloud:
    driver: bridge
@@ -1,74 +0,0 @@
 services:
  nextcloud:
    image: "nextcloud:{{ nextcloud_version }}-apache"
    container_name: nextcloud
    restart: unless-stopped
    networks:
      - cloud
    depends_on:
      - nextclouddb
      - redis
    ports:
      - 8080:80
    volumes:
      - /data/compose/nextcloud/config:/var/www/html/config
      - /data/compose/nextcloud/data:/var/www/html/data
      - /data/compose/nextcloud/custom_apps:/var/www/html/custom_apps
    environment:
      - TZ=Europe/Prague
      - MYSQL_DATABASE=nextcloud
      - MYSQL_USER=nextcloud
      - MYSQL_PASSWORD=dbpassword
      - MYSQL_HOST=nextclouddb
      - REDIS_HOST=redis
      - NEXTCLOUD_ADMIN_USER=root
      - NEXTCLOUD_ADMIN_PASSWORD=1234SilneHeslo.-.
      - PHP_MEMORY_LIMIT=2048M
  nextclouddb:
    image: mariadb
    container_name: nextcloud-db
    restart: unless-stopped
    command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW
    networks:
      - cloud
    volumes:
      - /data/compose/nextcloud/nextclouddb:/var/lib/mysql
    environment:
      - TZ=Europe/Prague
      - MYSQL_RANDOM_ROOT_PASSWORD=true
      - MYSQL_DATABASE=nextcloud
      - MYSQL_USER=nextcloud
      - MYSQL_PASSWORD=dbpassword
      - MARIADB_AUTO_UPGRADE=1
  redis:
    image: redis:alpine
    container_name: redis
    restart: unless-stopped
    networks:
      - cloud
    volumes:
      - /data/compose/nextcloud/redis:/data
  #collabora:
  #  image: collabora/code
  #  container_name: collabora
  #  restart: unless-stopped
  #  networks:
  #    - cloud
  #  environment:
  #    - TZ=Europe/Prague
  #    - password=password
  #    - username=nextcloud
  #    - domain=cloud.martinfencl.eu
  #    - extra_params=--o:ssl.enable=false --o:ssl.termination=true
  #    - aliasgroup1=https://cloud.martinfencl.eu:443,https://collabora.martinfencl.eu:443
  #    - dictionaries=de_DE en_GB en_US es_ES fr_FR it nl pt_BR pt_PT ru cs_CZ
  #  ports:
  #    - 9980:9980
 networks:
  cloud:
    driver: bridge
@@ -1,28 +0,0 @@
 # docker-compose/docker-compose-semaphore.yml
 services:
  semaphore:
    image: semaphoreui/semaphore:v2.19.6
    container_name: semaphore
    user: "0:0"
    ports:
      - "3000:3000"
    environment:
      SEMAPHORE_TMP_PATH: /var/lib/semaphore/projects
      SEMAPHORE_ADMIN: admin
      SEMAPHORE_ADMIN_NAME: admin
      SEMAPHORE_ADMIN_EMAIL: admin@localhost
    env_file:
      - /data/compose/semaphore/semaphore.env
    volumes:
      - /data/compose/semaphore/db:/etc/semaphore
      - /data/compose/semaphore/projects:/var/lib/semaphore/projects
      - /data/compose/semaphore/backups:/opt/mikrotik_backups/
      - /data/compose/semaphore/ansible.cfg:/etc/ansible/ansible.cfg:ro
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:3000/api/ping >/dev/null || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 12
      start_period: 20s
    restart: unless-stopped
@@ -1,26 +0,0 @@
 version: "3.8"
 services:
  semaphore:
    image: semaphoreui/semaphore:latest
    user: "0:0"
    ports:
      - "3000:3000"
    environment:
      SEMAPHORE_DB_DIALECT: bolt
      SEMAPHORE_DB_PATH: /etc/semaphore/semaphore.db.bolt  # full path to file!
      SEMAPHORE_TMP_PATH: /var/lib/semaphore/projects
      SEMAPHORE_ADMIN: admin
      SEMAPHORE_ADMIN_NAME: admin
      SEMAPHORE_ADMIN_EMAIL: admin@localhost
      SEMAPHORE_ADMIN_PASSWORD: changeme
      SEMAPHORE_ACCESS_KEY_ENCRYPTION: "rZffGjw4BGlwoM+66fStJ4Pg+ivLc5ghtty3yoscltY="
    volumes:
      - /data/compose/semaphore/db:/etc/semaphore
      - /data/compose/semaphore/projects:/var/lib/semaphore/projects
      - /data/compose/semaphore/backups:/opt/mikrotik_backups/
      - /data/compose/semaphore/ansible.cfg:/etc/ansible.cfg:ro  # mount as file, ne do /etc/ansible/ansible.cfg
    restart: unless-stopped
@@ -1,12 +0,0 @@
 version: '3.8'
 services:
  uptime-kuma:
    container_name: uptime-kuma-dev
    image: louislam/uptime-kuma:latest
    volumes:
      #- ./data:/app/data
      - /data/compose/kuma/data:/app/data
    ports:
      - "3001:3001"  # <Host Port>:<Container Port>
@@ -1,89 +0,0 @@
 # glance.yml - source of truth lives in git, deployed by update_glance.yml
 # GITHUB_TOKEN comes from the persistent env file on the VM, never from git.
 pages:
  - name: Home
    # Optionally, if you only have a single page you can hide the desktop navigation for a cleaner look
    # hide-desktop-navigation: true
    columns:
      - size: small
        widgets:
          - type: calendar
            first-day-of-week: monday
          - type: rss
            limit: 10
            collapse-after: 3
            cache: 12h
            feeds:
              - url: https://www.root.cz/rss/clanky/
                title: root clanky
                limit: 6
              - url: https://www.root.cz/rss/zpravicky/
                title: root zpravy
                limit: 6
          - type: twitch-channels
            channels:
              - theprimeagen
              - j_blow
              - piratesoftware
              - cohhcarnage
              - christitustech
              - EJ_SA
      - size: full
        widgets:
          - type: group
            widgets:
              - type: hacker-news
              - type: lobsters
          - type: videos
            channels:
              - UCXuqSBlHAE6Xw-yeJA0Tunw # Linus Tech Tips
              - UCR-DXc1voovS8nhAvccRZhg # Jeff Geerling
              - UCsBjURrPoezykLs9EqgamOA # Fireship
              - UCBJycsmduvYEL83R_U4JriQ # Marques Brownlee
              - UCHnyfMqiRRG1u-2MsSQLbXA # Veritasium
          - type: group
            widgets:
              - type: reddit
                subreddit: technology
                show-thumbnails: true
              - type: reddit
                subreddit: selfhosted
                show-thumbnails: true
      - size: small
        widgets:
          - type: weather
            location: Ceske Budejovice, Czechia
            units: metric # alternatively "imperial"
            hour-format: 24h # alternatively "12h"
            # Optionally hide the location from being displayed in the widget
            # hide-location: true
          - type: markets
            markets:
              - symbol: SPY
                name: S&P 500
              - symbol: BTC-USD
                name: Bitcoin
              - symbol: BTC-EUR
                name: Bitcoin
              - symbol: CZK=X
                name: USD/CZK
          - type: releases
            cache: 1d
            # Without a token the GitHub API allows up to 60 requests per hour.
            # A read-only token with no scopes raises this to 5000.
            token: ${GITHUB_TOKEN}
            repositories:
              - trezor/trezor-firmware
              - glanceapp/glance
              - go-gitea/gitea
              - immich-app/immich
              - syncthing/syncthing
@@ -0,0 +1,39 @@
 - name: Update Homarr
  hosts: linux_servers
  become: true
  gather_facts: false
  vars:
    homarr_project: homarr
    homarr_compose_file: /data/compose/homarr/docker-compose-homarr.yml
    homarr_service: homarr
    homarr_port: 7575
  tasks:
    - name: Pull latest Homarr image
      community.docker.docker_compose_v2:
        project_src: "{{ homarr_compose_file | dirname }}"
        files:
          - "{{ homarr_compose_file | basename }}"
        pull: always
    - name: Recreate Homarr service
      community.docker.docker_compose_v2:
        project_src: "{{ homarr_compose_file | dirname }}"
        files:
          - "{{ homarr_compose_file | basename }}"
        services:
          - "{{ homarr_service }}"
        state: present
        recreate: always
    - name: Wait for Homarr port
      ansible.builtin.wait_for:
        host: 127.0.0.1
        port: "{{ homarr_port }}"
        timeout: 60
    - name: Check Homarr HTTP endpoint
      ansible.builtin.uri:
        url: "http://127.0.0.1:{{ homarr_port }}/"
        status_code: 200
@@ -0,0 +1,111 @@
 ---
 - name: Baseline user setup
  hosts: all
  become: true
  vars:
    users:
      - name: automation
        shell: /bin/bash
        groups: []
        sudo_nopasswd: true
        ssh_keys:
          - "ssh-ed25519 AAAAC3..."
      - name: hellsos
        shell: /bin/bash
        groups: []
        sudo_nopasswd: true
        ssh_keys:
          - "ssh-ed25519 AAAAC3..."
      - name: jim
        shell: /bin/bash
        groups: []
        sudo_nopasswd: true
        ssh_keys:
          - "ssh-ed25519 AAAAC3..."
  tasks:
    - name: Pick sudo group per distro
      set_fact:
        sudo_group: >-
          {{ 'wheel'
             if ansible_facts.os_family in
             ['RedHat','Rocky','AlmaLinux','Fedora','OracleLinux','Suse']
             else 'sudo' }}
    - name: Ensure user exists
      ansible.builtin.user:
        name: "{{ item.name }}"
        shell: "{{ item.shell }}"
        groups: "{{ sudo_group }}"
        append: true
        create_home: true
      loop: "{{ users }}"
    - name: Enforce authorized SSH keys
      ansible.builtin.authorized_key:
        user: "{{ item.name }}"
        key: "{{ item.ssh_keys | join('\n') }}"
        exclusive: true
      loop: "{{ users }}"
    - name: Grant passwordless sudo
      ansible.builtin.copy:
        dest: "/etc/sudoers.d/{{ item.name }}"
        mode: '0440'
        content: "{{ item.name }} ALL=(ALL) NOPASSWD:ALL\n"
        validate: 'visudo -cf %s'
      loop: "{{ users }}"
      when: item.sudo_nopasswd
 # ==============================
 # SECOND PLAY: SSH HARDENING
 # ==============================
 - name: SSH Hardening
  hosts: all
  become: true
  tags: never,hardening
  tasks:
    - name: Detect if system is Proxmox
      ansible.builtin.stat:
        path: /usr/bin/pveversion
      register: proxmox_check
    - name: Ensure sshd_config.d directory exists
      ansible.builtin.file:
        path: /etc/ssh/sshd_config.d
        state: directory
    - name: Deploy SSH hardening config
      ansible.builtin.copy:
        dest: /etc/ssh/sshd_config.d/99-ansible-hardening.conf
        mode: '0644'
        content: |
          PasswordAuthentication no
          ChallengeResponseAuthentication no
          PubkeyAuthentication yes
          AuthenticationMethods publickey
          UsePAM yes
          {% if not proxmox_check.stat.exists %}
          PermitRootLogin no
          {% else %}
          PermitRootLogin prohibit-password
          {% endif %}
        validate: 'sshd -t -f %s'
      notify: Restart SSH
  handlers:
    - name: Restart SSH
      ansible.builtin.service:
        name: "{{ 'sshd'
                  if ansible_facts.os_family in
                  ['RedHat','Rocky','AlmaLinux','Fedora','OracleLinux','Suse']
                  else 'ssh' }}"
        state: restarted
@@ -1,3 +1,9 @@
 [linux_servers]
-proxmox_nextcloud ansible_host=192.168.69.2
+jimbuntu ansible_host=192.168.19.4
-proxmox_services ansible_host=192.168.69.3
+jim_storage ansible_host=192.168.19.7
 portainer2_hellsos ansible_host=192.168.52.9
 portainernode_hellsos ansible_host=192.168.52.21
 portainernode2_jim ansible_host=192.168.19.8
 [local]
 localhost ansible_connection=local
@@ -1,8 +1,16 @@
-[mikrotiks]
+[mikrotik_routers]
-mikrotik_fencl_server ansible_host=192.168.69.1
+jim_main ansible_host=192.168.19.2
-mikrotik_fencl_5G    ansible_host=192.168.68.1
+jim_gw2 ansible_host=192.168.19.3
 hellsos ansible_host=192.168.40.1
 ewolet ansible_host=192.168.90.1
 Poli ansible_host=192.168.2.1
 Schmid ansible_host=192.168.177.1
 #Volf ansible_host=192.168.88.1
 fencl_home ansible_host=192.168.68.1
 fencl_tata ansible_host=192.168.69.1
-[mikrotiks:vars]
+
 [mikrotik_routers:vars]
 ansible_connection=network_cli
 ansible_network_os=community.routeros.routeros
 ansible_command_timeout=15
@@ -1,5 +0,0 @@
 [vm]
 pve1_vm ansible_host=192.168.69.253
 pve2_vm ansible_host=192.168.69.254
 [lxc]
 pve2_lxc_jellyfin ansible_host=192.168.69.252
@@ -33,7 +33,7 @@
        current_date: "{{ date_output.stdout }}"
    - name: Export router config
-      shell: timeout 15 ssh -o StrictHostKeyChecking=no {{ ansible_user }}@{{ ansible_host }} -p {{ ansible_port }} "/export"
+      shell: timeout 15 ssh -o StrictHostKeyChecking=no {{ ansible_user }}@{{ ansible_host }} -p {{ ansible_port }} "/export show-sensitive"
      register: export_output
      delegate_to: localhost
      when: system_identity.rc == 0
@@ -1,331 +1,251 @@
 # mikrotikbackup_clean.yml
 ---
- name: Backup and/or upgrade MikroTik
+- name: Backup and/or Upgrade MikroTik
-  hosts: mikrotiks
+  hosts: mikrotik_routers
-  gather_facts: false
+  gather_facts: no
  serial: 10
  vars:
-    # This directory is located on the Semaphore runner
+    backup_dir: /opt/mikrotik_backups/
-    backup_dir: /opt/mikrotik_backups
+    checkmk_url: "http://192.168.19.8:8080/cmk/check_mk/api/1.0/domain-types/host_service_passive_check/actions/set/invoke"
-
+    checkmk_user: "apitoken"
-    # Maximum time for a router to return after an upgrade
+    checkmk_token: "YXBpdG9rZW46TkVXX1NFQ1JFVA=="
-    upgrade_wait_timeout: 900
+    checkmk_service_description: "MikroTik Backup/Upgrade"
  tasks:
    # -------------------------------------------------------------------------
    # Common information
    # -------------------------------------------------------------------------
    # ----------------------------
    # Identity + timestamp
    # ----------------------------
    - name: Get router identity
      community.routeros.command:
-        commands:
+        commands: /system identity print
          - /system identity get name
      register: identity_raw
      changed_when: false
      tags:
        - always
-    - name: Build safe router name
+    - name: Parse router name
-      ansible.builtin.set_fact:
+      set_fact:
-        router_name: >-
+        router_name: "{{ identity_raw.stdout[0].split(': ')[1] | trim }}"
          {{
            (
              identity_raw.stdout[0]
              | default(inventory_hostname, true)
              | trim
            )
            | regex_replace('[^A-Za-z0-9._-]+', '_')
            | regex_replace('^_+|_+$', '')
          }}
      tags:
        - always
-    - name: Validate router name
+    - name: Get timestamp
-      ansible.builtin.assert:
+      command: date +%Y-%m-%d_%H-%M-%S
        that:
          - router_name | length > 0
        fail_msg: >-
          Could not determine RouterOS identity for
          {{ inventory_hostname }}.
        quiet: true
      tags:
        - always
    - name: Generate backup timestamp
      ansible.builtin.command:
        argv:
          - date
          - --utc
          - "+%Y-%m-%d_%H-%M-%S"
      register: date_out
      changed_when: false
      delegate_to: localhost
-      tags:
+      changed_when: false
        - always
-    - name: Set timestamp fact
+    - name: Set timestamp
-      ansible.builtin.set_fact:
+      set_fact:
-        backup_timestamp: "{{ date_out.stdout | trim }}"
+        ts: "{{ date_out.stdout }}"
      tags:
        - always
-    # -------------------------------------------------------------------------
+    # ----------------------------
    # Backup
-    # Run with: --tags backup
+    # ----------------------------
-    # -------------------------------------------------------------------------
+    - name: Ensure backup directory exists
-
+      file:
    - name: Ensure local backup directory exists
      ansible.builtin.file:
        path: "{{ backup_dir }}"
        state: directory
-        mode: "0700"
+        mode: "0755"
      delegate_to: localhost
      run_once: true
      tags:
        - backup
        - never
-    - name: Export RouterOS configuration
+    - name: Export router config
      community.routeros.command:
-        commands:
+        commands: /export terse show-sensitive
          - /export terse show-sensitive
      register: export_cfg
      changed_when: false
      no_log: true
      tags:
        - backup
        - never
-    - name: Validate exported configuration
+    - name: Save export locally
-      ansible.builtin.assert:
+      copy:
-        that:
+        content: "{{ export_cfg.stdout[0] }}"
-          - export_cfg.stdout is defined
+        dest: "{{ backup_dir }}/{{ router_name }}-{{ ts }}.rsc"
          - export_cfg.stdout | length > 0
          - export_cfg.stdout[0] | default('') | trim | length > 0
        fail_msg: >-
          RouterOS returned an empty configuration export
          for {{ inventory_hostname }}.
        quiet: true
      no_log: true
      tags:
        - backup
        - never
    - name: Set backup filename
      ansible.builtin.set_fact:
        backup_file: >-
          {{
            backup_dir
            ~ '/'
            ~ router_name
            ~ '-'
            ~ backup_timestamp
            ~ '.rsc'
          }}
      tags:
        - backup
        - never
    - name: Save RouterOS configuration locally
      ansible.builtin.copy:
        content: "{{ export_cfg.stdout[0] | trim }}\n"
        dest: "{{ backup_file }}"
        mode: "0600"
      delegate_to: localhost
      no_log: true
      diff: false
      tags:
        - backup
        - never
-    - name: Show backup result
+    - name: Mark backup success
-      ansible.builtin.debug:
+      set_fact:
-        msg: >-
+        backup_file: "{{ backup_dir }}/{{ router_name }}-{{ ts }}.rsc"
          MikroTik backup completed:
          host={{ inventory_hostname }}
          identity={{ router_name }}
          file={{ backup_file }}
      tags:
        - backup
        - never
-    # -------------------------------------------------------------------------
+    # ----------------------------
-    # Upgrade
+    # Update check
-    # Run with: --tags upgrade
+    # ----------------------------
-    # Run with backup before upgrade: --tags backup,upgrade
+    - name: Trigger update check
    # -------------------------------------------------------------------------
    - name: Check current and latest RouterOS versions
      community.routeros.command:
-        commands:
+        commands: /system package update check-for-updates once
          - /system package update check-for-updates
      register: update_check
      changed_when: false
      tags:
        - upgrade
        - never
-    - name: Normalize update output
+    - name: Wait for MikroTik
-      ansible.builtin.set_fact:
+      pause:
-        update_text: >-
+        seconds: 5
          {{
            update_check.stdout[0]
            | default('')
            | replace('\r', '')
          }}
      tags:
        - upgrade
        - never
-    - name: Extract version matches
+    - name: Get update info
-      ansible.builtin.set_fact:
+      community.routeros.command:
-        installed_version_matches: >-
+        commands: /system package update print
-          {{
+      register: update_info
            update_text
            | regex_findall(
                '(?im)^\\s*(?:installed|current)-version:\\s*(\\S+)\\s*$'
              )
          }}
        latest_version_matches: >-
          {{
            update_text
            | regex_findall(
                '(?im)^\\s*(?:latest|newest)-version:\\s*(\\S+)\\s*$'
              )
          }}
      tags:
        - upgrade
        - never
-    - name: Set installed and latest versions
+    # ----------------------------
-      ansible.builtin.set_fact:
+    # Parsing
    # ----------------------------
    - name: Extract installed version
      set_fact:
        installed_version: >-
          {{
-            installed_version_matches[0]
+            update_info.stdout[0]
-            if installed_version_matches | length > 0
+            | regex_search('installed-version:\s*(\S+)', '\1')
-            else 'unknown'
+            | first
            | default('unknown')
            | trim
          }}
    - name: Extract latest version
      set_fact:
        latest_version: >-
          {{
-            latest_version_matches[0]
+            update_info.stdout[0]
-            if latest_version_matches | length > 0
+            | regex_search('latest-version:\s*(\S+)', '\1')
-            else 'unknown'
+            | first
            | default('unknown')
            | trim
          }}
      tags:
        - upgrade
        - never
-    - name: Show raw update output
+    - name: Extract status
-      ansible.builtin.debug:
+      set_fact:
-        msg: "{{ update_text }}"
+        update_status: >-
-      tags:
+          {{
-        - upgrade
+            update_info.stdout[0]
-        - never
+            | regex_search('status:\s*(.+)', '\1')
            | first
            | default('unknown')
            | trim
          }}
-    - name: Validate parsed RouterOS versions
+    - name: Extract channel
-      ansible.builtin.assert:
+      set_fact:
-        that:
+        update_channel: >-
-          - installed_version != 'unknown'
+          {{
-          - latest_version != 'unknown'
+            update_info.stdout[0]
-        fail_msg: >-
+            | regex_search('channel:\s*(\S+)', '\1')
-          Could not parse RouterOS versions on
+            | first
-          {{ inventory_hostname }}.
+            | default('unknown')
-          Raw output: {{ update_text }}
+            | trim
-        quiet: true
+          }}
      tags:
        - upgrade
        - never
-    - name: Show RouterOS versions
+    - name: Debug parsed values
-      ansible.builtin.debug:
+      debug:
-        msg:
+        msg: >
-          - "Router: {{ router_name }}"
+          router={{ router_name }}
-          - "Installed: {{ installed_version }}"
+          channel={{ update_channel }}
-          - "Latest: {{ latest_version }}"
+          installed={{ installed_version }}
-      tags:
+          latest={{ latest_version }}
-        - upgrade
+          status={{ update_status }}
        - never
-    - name: Show already up-to-date result
+    # ----------------------------
-      ansible.builtin.debug:
+    # Logic
-        msg: >-
+    # ----------------------------
-          Router {{ router_name }} is already running
+    - name: Detect update failure
-          RouterOS {{ installed_version }}.
+      set_fact:
-      when: installed_version == latest_version
+        update_failed: "{{ 'error' in (update_status | lower) or 'failed' in (update_status | lower) }}"
      tags:
        - upgrade
        - never
-    - name: Trigger RouterOS package installation
+    - name: Decide upgrade
      set_fact:
        upgrade_needed: >-
          {{
            not update_failed | bool and
            installed_version != 'unknown' and
            latest_version != 'unknown' and
            installed_version != latest_version
          }}
    - name: Show decision
      debug:
        msg: "Router={{ router_name }} installed={{ installed_version }} latest={{ latest_version }} upgrade_needed={{ upgrade_needed }}"
    - name: Skip upgrade (already up to date)
      debug:
        msg: "Router {{ router_name }} is already up to date ({{ installed_version }})"
      when: not upgrade_needed | bool
    # ----------------------------
    # Upgrade
    # ----------------------------
    - name: Install update
      community.routeros.command:
-        commands:
+        commands: /system package update install
-          - /system package update install
+      when: upgrade_needed | bool
      register: upgrade_result
      changed_when: true
      failed_when: false
      when: installed_version != latest_version
      tags:
        - upgrade
        - never
-    - name: Wait for router SSH service to stop
+    - name: Wait for reboot
-      ansible.builtin.wait_for:
+      wait_for_connection:
-        host: "{{ ansible_host | default(inventory_hostname) }}"
+        delay: 180
-        port: "{{ ansible_port | default(22) | int }}"
+        timeout: 600
-        state: stopped
+        sleep: 10
-        connect_timeout: 5
+      when:
-        timeout: 180
+        - upgrade_needed | bool
-      delegate_to: localhost
+        - upgrade_result is succeeded
      failed_when: false
      when: installed_version != latest_version
      tags:
        - upgrade
        - never
-    - name: Wait for router SSH service to start
+    - name: Confirm version after upgrade
      ansible.builtin.wait_for:
        host: "{{ ansible_host | default(inventory_hostname) }}"
        port: "{{ ansible_port | default(22) | int }}"
        state: started
        delay: 10
        connect_timeout: 5
        timeout: "{{ upgrade_wait_timeout }}"
      delegate_to: localhost
      when: installed_version != latest_version
      tags:
        - upgrade
        - never
    - name: Reset RouterOS connection
      ansible.builtin.meta: reset_connection
      when: installed_version != latest_version
      tags:
        - upgrade
        - never
    - name: Read RouterOS version after upgrade
      community.routeros.command:
-        commands:
+        commands: /system resource print
-          - /system resource get version
+      register: post_upgrade_info
-      register: post_upgrade_version
+      when: upgrade_needed | bool
-      retries: 20
+ 
-      delay: 15
+    - name: Parse new version
-      until: post_upgrade_version is succeeded
+      set_fact:
-      changed_when: false
+        post_upgrade_version: >-
-      when: installed_version != latest_version
+          {{
-      tags:
+            post_upgrade_info.stdout[0]
-        - upgrade
+            | regex_search('version:\s*(\S+)', '\1')
-        - never
+            | first
            | default('unknown')
            | trim
          }}
      when: upgrade_needed | bool
    # ----------------------------
    # Checkmk
    # ----------------------------
    - name: Result when no upgrade needed
      set_fact:
        cmk_state: "{{ 2 if update_failed | bool else 0 }}"
        cmk_output: >-
          {{ 'CRIT' if update_failed | bool else 'OK' }} -
          router={{ router_name }}
          installed={{ installed_version }}
          latest={{ latest_version }}
          status="{{ update_status }}"
          upgrade_needed=no
      when: not upgrade_needed | bool
    - name: Result when upgrade happened
      set_fact:
        cmk_state: "{{ 0 if post_upgrade_version == latest_version else 2 }}"
        cmk_output: >-
          {{ 'OK' if post_upgrade_version == latest_version else 'CRIT' }} -
          router={{ router_name }}
          upgraded_from={{ installed_version }}
          upgraded_to={{ post_upgrade_version }}
          latest={{ latest_version }}
      when: upgrade_needed | bool
    - name: Send result to Checkmk
      delegate_to: localhost
      uri:
        url: "{{ checkmk_url }}"
        method: POST
        url_username: "{{ checkmk_user }}"
        url_password: "{{ checkmk_token }}"
        force_basic_auth: yes
        headers:
          Content-Type: "application/json"
          Accept: "application/json"
        body_format: json
        body:
          host_name: "mikrotiks"
          service_description: "{{ checkmk_service_description }}"
          state: "{{ cmk_state | int }}"
          output: "{{ cmk_output }}"
      failed_when: false
      register: cmk_result
    - name: Debug Checkmk response
      debug:
        msg: "status={{ cmk_result.status }} body={{ cmk_result.json | default(cmk_result.msg) }}"
    - name: Show Checkmk output
      debug:
        var: cmk_output
    - name: Show RouterOS version after upgrade
      ansible.builtin.debug:
        msg: >-
          Router {{ router_name }} is online.
          RouterOS version:
          {{ post_upgrade_version.stdout[0] | default('unknown') | trim }}
      when: installed_version != latest_version
      tags:
        - upgrade
        - never
@@ -1,236 +0,0 @@
 # nextcloud/check_stack_nextcloud.yml
 - name: Run Nextcloud maintenance on VM via Proxmox
  hosts: proxmox_nextcloud
  gather_facts: false
  become: true
  become_user: root
  become_method: sudo
  vars:
    # vm_pass is stored in Semaphore as a secret environment variable.
    vm_password: "{{ lookup('ansible.builtin.env', 'vm_pass') }}"
    # Other values are loaded directly from Semaphore Extra variables.
    vm_use_sudo: "{{ use_sudo | default(false) | bool }}"
    nextcloud_container: "nextcloud"
    nextcloud_db_container: "nextcloud-db"
    redis_container: "redis"
    nextcloud_local_status_url: "http://127.0.0.1:8080/status.php"
    collabora_url: "https://collabora.martinfencl.eu/"
    collabora_discovery_url: "https://collabora.martinfencl.eu/hosting/discovery"
    vm_commands:
      - name: Run Nextcloud cron
        command: >-
          docker exec -u www-data
          {{ nextcloud_container | quote }}
          php -f /var/www/html/cron.php
      - name: Update Nextcloud applications
        command: >-
          docker exec -u www-data
          {{ nextcloud_container | quote }}
          php occ app:update --all
      - name: Run Nextcloud maintenance repair
        command: >-
          docker exec -u www-data
          {{ nextcloud_container | quote }}
          php occ maintenance:repair --include-expensive
      - name: Read Nextcloud status
        command: >-
          docker exec -u www-data
          {{ nextcloud_container | quote }}
          php occ status
      - name: Check required containers
        command: >-
          for container in
          {{ nextcloud_container | quote }}
          {{ nextcloud_db_container | quote }}
          {{ redis_container | quote }};
          do
            state="$(docker inspect --format '{% raw %}{{.State.Running}}{% endraw %}' "${container}" 2>/dev/null)";
            if [ "${state}" != "true" ]; then
              echo "Container ${container} is not running" >&2;
              exit 1;
            fi;
          done
      - name: Check MariaDB readiness
        command: >-
          docker exec
          {{ nextcloud_db_container | quote }}
          sh -c
          'mariadb-admin ping -h 127.0.0.1 --silent 2>/dev/null
          || mysqladmin ping -h 127.0.0.1 --silent 2>/dev/null'
      - name: Check Redis readiness
        command: >-
          set -o pipefail;
          docker exec
          {{ redis_container | quote }}
          redis-cli -h 127.0.0.1 ping
          | grep -qx PONG
      - name: Check Nextcloud local status endpoint
        command: >-
          set -o pipefail;
          curl
          --fail
          --silent
          --show-error
          --max-time 15
          {{ nextcloud_local_status_url | quote }}
          | grep -q '"installed":true'
  pre_tasks:
    - name: Validate VM connection variables
      ansible.builtin.assert:
        that:
          - vm_ip is defined
          - vm_ip | string | trim | length > 0
          - vm_user is defined
          - vm_user | string | trim | length > 0
          - vm_password | string | length > 0
        fail_msg: >-
          Missing vm_ip, vm_user or vm_pass.
          Check the attached Semaphore Variable Group.
        quiet: true
      no_log: true
  tasks:
    - name: Ensure sshpass is installed
      ansible.builtin.apt:
        name: sshpass
        state: present
        update_cache: true
    - name: Run Nextcloud checks on VM
      ansible.builtin.command:
        argv:
          - sshpass
          - -e
          - ssh
          - -o
          - StrictHostKeyChecking=no
          - -o
          - UserKnownHostsFile=/dev/null
          - -o
          - LogLevel=ERROR
          - -o
          - ConnectTimeout=15
          - -o
          - ServerAliveInterval=10
          - -o
          - ServerAliveCountMax=3
          - "{{ vm_user }}@{{ vm_ip }}"
          - >-
            {{
              ('sudo -n bash -lc ' ~ (item.command | quote))
              if vm_use_sudo
              else
              ('bash -lc ' ~ (item.command | quote))
            }}
      environment:
        SSHPASS: "{{ vm_password }}"
      loop: "{{ vm_commands }}"
      loop_control:
        label: "{{ item.name }}"
      register: vm_cmds
      changed_when: false
      failed_when: false
      no_log: true
    - name: Show outputs for each VM command
      ansible.builtin.debug:
        msg: |
          CHECK: {{ item.item.name }}
          CMD:   {{ item.item.command }}
          RC:    {{ item.rc }}
          STDOUT:
          {{ item.stdout | default('') | trim }}
          STDERR:
          {{ item.stderr | default('') | trim }}
      loop: "{{ vm_cmds.results }}"
      loop_control:
        label: "{{ item.item.name }}"
    - name: Fail if any Nextcloud VM command failed
      ansible.builtin.assert:
        that:
          - item.rc == 0
        fail_msg: |
          Nextcloud check failed: {{ item.item.name }}
          Command: {{ item.item.command }}
          RC: {{ item.rc }}
          STDOUT:
          {{ item.stdout | default('') | trim }}
          STDERR:
          {{ item.stderr | default('') | trim }}
        quiet: true
      loop: "{{ vm_cmds.results }}"
      loop_control:
        label: "{{ item.item.name }}"
    - name: Check external Collabora root endpoint
      ansible.builtin.uri:
        url: "{{ collabora_url }}"
        method: GET
        return_content: true
        validate_certs: true
        status_code: 200
        timeout: 20
      register: collabora_root
      delegate_to: localhost
      run_once: true
      changed_when: false
      failed_when: >-
        (collabora_root.status | default(0) | int != 200)
        or
        ('OK' not in (collabora_root.content | default('')))
    - name: Check external Collabora discovery endpoint
      ansible.builtin.uri:
        url: "{{ collabora_discovery_url }}"
        method: GET
        return_content: true
        validate_certs: true
        status_code: 200
        timeout: 20
      register: collabora_discovery
      delegate_to: localhost
      run_once: true
      changed_when: false
      failed_when: >-
        (collabora_discovery.status | default(0) | int != 200)
        or
        ('<wopi-discovery' not in
        (collabora_discovery.content | default('')))
    - name: Show final health summary
      ansible.builtin.debug:
        msg: |
          Nextcloud VM connection: OK
          Nextcloud cron: OK
          Nextcloud applications: OK
          Nextcloud maintenance repair: OK
          Nextcloud status: OK
          Nextcloud container: OK
          MariaDB container: OK
          Redis container: OK
          MariaDB readiness: OK
          Redis readiness: OK
          Nextcloud local HTTP endpoint: OK
          Collabora root endpoint: OK
          Collabora discovery endpoint: OK
      run_once: true
@@ -1,92 +0,0 @@
 # nextcloud/update_collabora.yml
 - name: Update Collabora
  hosts: pve2_vm
  gather_facts: false
  vars:
    # Compose sync (controller -> target)
    compose_local_dir: "{{ lookup('env','PWD') }}/docker-compose"
    compose_remote_base: "/home/{{ ansible_user }}/.ansible-compose"
    compose_remote_dir: "{{ compose_remote_base }}/docker-compose"
    compose_remote_archive: "{{ compose_remote_base }}/docker-compose.tar.gz"
    # Collabora settings
    collabora_project: collabora
    collabora_compose_filename: "docker-compose-collabora.yml"
    collabora_service: collabora
    collabora_port: 9980
  tasks:
    - name: Ensure remote base directory exists
      ansible.builtin.file:
        path: "{{ compose_remote_base }}"
        state: directory
        mode: "0755"
    - name: Create local archive of docker-compose directory (controller)
      ansible.builtin.archive:
        path: "{{ compose_local_dir }}/"
        dest: "/tmp/docker-compose.tar.gz"
        format: gz
      delegate_to: localhost
      run_once: true
    - name: Upload archive to remote host
      ansible.builtin.copy:
        src: "/tmp/docker-compose.tar.gz"
        dest: "{{ compose_remote_archive }}"
        mode: "0644"
    - name: Recreate remote compose directory
      ansible.builtin.file:
        path: "{{ compose_remote_dir }}"
        state: absent
    - name: Ensure remote compose directory exists
      ansible.builtin.file:
        path: "{{ compose_remote_dir }}"
        state: directory
        mode: "0755"
    - name: Extract archive on remote host
      ansible.builtin.unarchive:
        src: "{{ compose_remote_archive }}"
        dest: "{{ compose_remote_dir }}"
        remote_src: true
    - name: Pull latest Collabora image
      community.docker.docker_compose_v2:
        project_name: "{{ collabora_project }}"
        project_src: "{{ compose_remote_dir }}"
        files:
          - "{{ collabora_compose_filename }}"
        pull: always
    - name: Recreate Collabora service
      community.docker.docker_compose_v2:
        project_name: "{{ collabora_project }}"
        project_src: "{{ compose_remote_dir }}"
        files:
          - "{{ collabora_compose_filename }}"
        services:
          - "{{ collabora_service }}"
        state: present
        recreate: always
    - name: Wait for Collabora port
      ansible.builtin.wait_for:
        host: 127.0.0.1
        port: "{{ collabora_port }}"
        timeout: 120
    - name: Check Collabora discovery endpoint (retry until ready)
      ansible.builtin.uri:
        url: "http://127.0.0.1:{{ collabora_port }}/hosting/discovery"
        status_code: 200
        return_content: true
      register: collabora_http
      retries: 40
      delay: 3
      until: collabora_http.status == 200 and ('<wopi-discovery' in (collabora_http.content | default('')))
      changed_when: false
@@ -1,287 +0,0 @@
 # nextcloud/update_nextcloud.yml
 - name: Update Nextcloud on VM via Proxmox
  hosts: proxmox_nextcloud  # linux_servers
  gather_facts: false
  become: true
  become_user: root
  become_method: sudo
  vars:
    # --- Connection to VM (provided by Semaphore env vars) ---
    vm_ip:   "{{ lookup('env', 'VM_IP') }}"
    vm_user: "{{ lookup('env', 'VM_USER') }}"
    vm_pass: "{{ lookup('env', 'VM_PASS') }}"
    use_sudo: false
    # --- Debug / retries ---
    DEBUG: "{{ lookup('env', 'DEBUG') | default(0) | int }}"
    RETRIES: "{{ lookup('env', 'RETRIES') | default(25) | int }}"
    # --- Nextcloud specifics ---
    nextcloud_project: "nextcloud-collabora"
    nextcloud_compose_file: "/data/compose/nextcloud/docker-compose-nextcloud.yml"
    nextcloud_service: "nextcloud"
    # Backup directory on the VM (timestamped on controller)
    backup_dir: "/data/compose/nextcloud/backup-{{ lookup('pipe', 'date +%F-%H%M%S') }}"
    nextcloud_base_url: "https://cloud.martinfencl.eu"
    nextcloud_status_url: "{{ nextcloud_base_url }}/status.php"
    # Docker command prefix (consistent behavior and quiet hints)
    docker_prefix: "unalias docker 2>/dev/null || true; DOCKER_CLI_HINTS=0; command docker"
    # --- Backup phase commands (run on VM) ---
    nextcloud_backup_commands:
      - >
        mkdir -p "{{ backup_dir }}"
      - >
        docker exec -u www-data nextcloud php occ maintenance:mode --on
      # Create tarball of config + custom_apps inside the container
      - >
        docker exec nextcloud sh -c 'tar czf /tmp/nextcloud_conf.tgz -C /var/www/html config custom_apps'
      # Copy that tarball to the host backup directory
      - >
        docker cp nextcloud:/tmp/nextcloud_conf.tgz "{{ backup_dir }}/nextcloud_conf.tgz"
      # Remove temporary file inside the container
      - >
        docker exec nextcloud rm /tmp/nextcloud_conf.tgz || true
      # Database dump from DB container (unchanged)
      - >
        docker exec nextcloud-db sh -c 'command -v mariadb-dump >/dev/null && mariadb-dump -u"$MYSQL_USER" -p"$MYSQL_PASSWORD" "$MYSQL_DATABASE" || mysqldump -u"$MYSQL_USER" -p"$MYSQL_PASSWORD" "$MYSQL_DATABASE"' > "{{ backup_dir }}/db.sql"
    # --- Upgrade phase commands (run on VM) ---
    nextcloud_upgrade_commands:
      - >
        {{ docker_prefix }} compose -p {{ nextcloud_project }} -f {{ nextcloud_compose_file }} pull {{ nextcloud_service }}
      - >
        {{ docker_prefix }} compose -p {{ nextcloud_project }} -f {{ nextcloud_compose_file }} up -d --no-deps --force-recreate {{ nextcloud_service }}
      - >
        docker exec -u www-data nextcloud php occ upgrade
      - >
        docker exec -u www-data nextcloud php occ app:update --all || true
      - >
        docker exec -u www-data nextcloud php occ maintenance:repair --include-expensive || true
  tasks:
    - name: Ensure sshpass is installed (for password-based SSH)
      ansible.builtin.apt:
        name: sshpass
        state: present
        update_cache: yes
    - name: Nextcloud | Show current version before upgrade (DEBUG)
      ansible.builtin.command:
        argv:
          - sshpass
          - -e
          - ssh
          - -o
          - StrictHostKeyChecking=no
          - -o
          - ConnectTimeout=15
          - "{{ vm_user }}@{{ vm_ip }}"
          - bash
          - -lc
          - 'docker exec -u www-data nextcloud php occ -V || true'
      environment:
        SSHPASS: "{{ vm_pass }}"
      register: nc_version_before
      changed_when: false
      failed_when: false
      when: DEBUG == 1
    # -------------------------
    # Backup phase
    # -------------------------
    - name: Nextcloud | Run backup commands on VM (via SSH)  # run plain commands via SSH
      ansible.builtin.command:
        argv:
          - sshpass
          - -e
          - ssh
          - -o
          - StrictHostKeyChecking=no
          - -o
          - ConnectTimeout=15
          - "{{ vm_user }}@{{ vm_ip }}"
          - "{{ ('sudo ' if use_sudo else '') + item }}"
      environment:
        SSHPASS: "{{ vm_pass }}"
      loop: "{{ nextcloud_backup_commands }}"
      loop_control:
        index_var: idx
        label: "backup-cmd-{{ idx }}"
      register: nc_backup_cmds
      changed_when: false
      no_log: "{{ DEBUG == 0 }}"
    - name: Nextcloud | Show outputs of backup commands (DEBUG)
      ansible.builtin.debug:
        msg: |
          CMD: {{ item.item }}
          RC:  {{ item.rc }}
          STDOUT:
          {{ (item.stdout | default('')).strip() }}
          STDERR:
          {{ (item.stderr | default('')).strip() }}
      loop: "{{ nc_backup_cmds.results }}"
      when: DEBUG == 1
    - name: Nextcloud | Fail play if any backup command failed
      ansible.builtin.assert:
        that: "item.rc == 0"
        fail_msg: "Nextcloud backup step failed on VM: {{ item.item }} (rc={{ item.rc }})"
        success_msg: "All Nextcloud backup commands succeeded."
      loop: "{{ nc_backup_cmds.results }}"
      loop_control:
        index_var: idx
        label: "backup-cmd-{{ idx }}"
    # -------------------------
    # Upgrade phase
    # -------------------------
    - name: Nextcloud | Run upgrade commands on VM (via SSH)
      ansible.builtin.command:
        argv:
          - sshpass
          - -e
          - ssh
          - -o
          - StrictHostKeyChecking=no
          - -o
          - ConnectTimeout=15
          - "{{ vm_user }}@{{ vm_ip }}"
          - bash
          - -lc
          - "{{ ('sudo ' if use_sudo else '') + item }}"
      environment:
        SSHPASS: "{{ vm_pass }}"
      loop: "{{ nextcloud_upgrade_commands }}"
      loop_control:
        index_var: idx
        label: "upgrade-cmd-{{ idx }}"
      register: nc_upgrade_cmds
      changed_when: false
      failed_when: false
      no_log: "{{ DEBUG == 0 }}"
    - name: Nextcloud | Show outputs of upgrade commands (DEBUG)
      ansible.builtin.debug:
        msg: |
          CMD: {{ item.item }}
          RC:  {{ item.rc }}
          STDOUT:
          {{ (item.stdout | default('')).strip() }}
          STDERR:
          {{ (item.stderr | default('')).strip() }}
      loop: "{{ nc_upgrade_cmds.results }}"
      when: DEBUG == 1
    - name: Nextcloud | Fail play if any upgrade command failed
      ansible.builtin.assert:
        that: "item.rc == 0"
        fail_msg: "Nextcloud upgrade step failed on VM: {{ item.item }} (rc={{ item.rc }})"
        success_msg: "All Nextcloud upgrade commands succeeded."
      loop: "{{ nc_upgrade_cmds.results }}"
      loop_control:
        index_var: idx
        label: "upgrade-cmd-{{ idx }}"
    - name: Nextcloud | Disable maintenance mode (only after successful upgrade)
      ansible.builtin.command:
        argv:
          - sshpass
          - -e
          - ssh
          - -o
          - StrictHostKeyChecking=no
          - -o
          - ConnectTimeout=15
          - "{{ vm_user }}@{{ vm_ip }}"
          - "{{ ('sudo ' if use_sudo else '') }}docker exec -u www-data nextcloud php occ maintenance:mode --off"
      environment:
        SSHPASS: "{{ vm_pass }}"
      register: nc_maint_off
      changed_when: false
      no_log: "{{ DEBUG == 0 }}"
    # -------------------------
    # Readiness check (status.php)
    # -------------------------
    - name: Nextcloud | Wait for status.php (controller first)
      ansible.builtin.uri:
        url: "{{ nextcloud_status_url }}"
        method: GET
        return_content: true
        validate_certs: true
        status_code: 200
      register: nc_status_controller
      delegate_to: localhost
      run_once: true
      retries: "{{ RETRIES }}"
      delay: 4
      until: nc_status_controller.status == 200
      failed_when: false
      changed_when: false
    - name: Nextcloud | VM-side fetch status.php (JSON via Python)
      ansible.builtin.command:
        argv:
          - sshpass
          - -e
          - ssh
          - -o
          - StrictHostKeyChecking=no
          - -o
          - ConnectTimeout=15
          - "{{ vm_user }}@{{ vm_ip }}"
          - bash
          - -lc
          - |
            python3 - <<'PY'
            import json, urllib.request, sys
            try:
                with urllib.request.urlopen("{{ nextcloud_status_url }}", timeout=15) as r:
                    sys.stdout.write(r.read().decode())
            except Exception:
                pass
            PY
      environment:
        SSHPASS: "{{ vm_pass }}"
      register: nc_status_vm
      changed_when: false
      failed_when: false
      when: nc_status_controller.status | default(0) != 200 or nc_status_controller.json is not defined
      no_log: "{{ DEBUG == 0 }}"
    - name: Nextcloud | Choose status JSON (controller wins, else VM)
      ansible.builtin.set_fact:
        nextcloud_status_json: >-
          {{
            (nc_status_controller.json
              if (nc_status_controller.status | default(0)) == 200 and (nc_status_controller.json is defined)
              else (
                (nc_status_vm.stdout | default('') | trim | length > 0)
                | ternary((nc_status_vm.stdout | trim | from_json), omit)
              )
            )
          }}
      failed_when: false
    - name: Nextcloud | Print concise status summary (DEBUG)
      ansible.builtin.debug:
        msg: >-
          Nextcloud {{ nextcloud_status_json.version | default('?') }}
          (installed={{ nextcloud_status_json.installed | default('?') }},
          maintenance={{ nextcloud_status_json.maintenance | default('?') }},
          needsDbUpgrade={{ nextcloud_status_json.needsDbUpgrade | default('?') }})
      when: nextcloud_status_json is defined and DEBUG == 1
    - name: Nextcloud | Status JSON not available (DEBUG)
      ansible.builtin.debug:
        msg: "status.php is not reachable or did not return JSON."
      when: nextcloud_status_json is not defined and DEBUG == 1
@@ -1,155 +0,0 @@
 # update_broker_kafka-ui.yml
 - name: Update Kafka broker3 and Redpanda Console on VM via Proxmox
  hosts: linux_servers
  gather_facts: false
  become: true
  become_user: root
  become_method: sudo
  vars:
    # --- Connection to VM (provided by Semaphore env vars) ---
    vm_ip:   "{{ lookup('env', 'VM_IP') }}"
    vm_user: "{{ lookup('env', 'VM_USER') }}"
    vm_pass: "{{ lookup('env', 'VM_PASS') }}"
    use_sudo: false
    # --- Debug mode (controlled via Semaphore variable) ---
    DEBUG: "{{ lookup('env', 'DEBUG') | default(0) | int }}"
    RETRIES: "{{ lookup('env', 'RETRIES') | default(25) | int }}"
    # --- Kafka / Redpanda Console specifics ---
    kafka_project: "kafka"
    # Adjusted to match your actual compose file location
    kafka_compose_file: "/data/compose/docker-compose.yml"
    kafka_services:
      - broker3
      - kafka-ui
    redpanda_console_port: 8084
    # Controller-side URL (default to direct VM IP/port or external URL)
    redpanda_console_url: "{{ lookup('env', 'REDPANDA_CONSOLE_URL') | default('http://192.168.69.254:8084/overview', true) }}"
    redpanda_retries: "{{ RETRIES }}"
    redpanda_delay: 2
    # Docker command prefix (consistent behavior and quiet hints)
    docker_prefix: "unalias docker 2>/dev/null || true; DOCKER_CLI_HINTS=0; command docker"
    # Commands to run on the target VM (quiet outputs)
    # 1) Pull latest images for broker3 + kafka-ui
    # 2) Stop any running containers with these names (legacy or compose-managed)
    # 3) Remove any containers with these names to avoid name conflicts
    # 4) Recreate services via docker compose
    kafka_commands:
      - "{{ docker_prefix }} compose -p {{ kafka_project }} -f {{ kafka_compose_file }} pull {{ kafka_services | join(' ') }} >/dev/null"
      - "{{ docker_prefix }} stop {{ kafka_services | join(' ') }} >/dev/null 2>&1 || true"
      - "{{ docker_prefix }} rm -f {{ kafka_services | join(' ') }} >/dev/null 2>&1 || true"
      - "{{ docker_prefix }} compose -p {{ kafka_project }} -f {{ kafka_compose_file }} up -d --no-deps --force-recreate {{ kafka_services | join(' ') }} >/dev/null"
  tasks:
    - name: Ensure sshpass is installed (for password-based SSH)  # English comments
      ansible.builtin.apt:
        name: sshpass
        state: present
        update_cache: yes
    - name: Run Kafka update commands on VM (via SSH)  # use SSHPASS env, hide item value
      ansible.builtin.command:
        argv:
          - sshpass
          - -e                     # read password from SSHPASS environment
          - ssh
          - -o
          - StrictHostKeyChecking=no
          - -o
          - ConnectTimeout=15
          - "{{ vm_user }}@{{ vm_ip }}"
          - bash
          - -lc
          - "{{ ('sudo ' if use_sudo else '') + item }}"
      environment:
        SSHPASS: "{{ vm_pass }}"    # supply password via environment
      loop: "{{ kafka_commands }}"
      loop_control:
        index_var: idx              # capture loop index
        label: "cmd-{{ idx }}"      # avoid printing full command in (item=...) line
      register: kafka_cmds
      changed_when: false
      no_log: "{{ DEBUG == 0 }}"    # hide outputs and env when not debugging
    - name: Show outputs for each Kafka command
      ansible.builtin.debug:
        msg: |
          CMD: {{ item.item }}
          RC:  {{ item.rc }}
          STDOUT:
          {{ (item.stdout | default('')).strip() }}
          STDERR:
          {{ (item.stderr | default('')).strip() }}
      loop: "{{ kafka_cmds.results }}"
      when: DEBUG == 1
    - name: Fail play if any Kafka command failed  # also hide item label
      ansible.builtin.assert:
        that: "item.rc == 0"
        fail_msg: "Kafka/Redpanda Console update failed on VM: {{ item.item }} (rc={{ item.rc }})"
        success_msg: "All Kafka/Redpanda Console update commands succeeded."
      loop: "{{ kafka_cmds.results }}"
      loop_control:
        index_var: idx
        label: "cmd-{{ idx }}"
    # -------------------------
    # Readiness check – Redpanda Console UI
    # -------------------------
    - name: Redpanda Console | Wait for overview page (controller, with retries)
      ansible.builtin.uri:
        url: "{{ redpanda_console_url }}"
        method: GET
        return_content: true
        validate_certs: false           # plain HTTP on 192.168.69.254 (or as configured)
        status_code: 200
      register: redpanda_controller
      delegate_to: localhost
      run_once: true
      when: redpanda_console_url is defined and (redpanda_console_url | length) > 0
      retries: "{{ redpanda_retries }}"
      delay: "{{ redpanda_delay }}"
      until: redpanda_controller.status == 200
      failed_when: false
      changed_when: false
    - name: Redpanda Console | Print concise summary
      ansible.builtin.debug:
        msg: >-
          Redpanda Console overview {{ 'reachable' if (redpanda_controller is defined and (redpanda_controller.status|default(0))==200) else 'NOT reachable' }}.
          status={{ redpanda_controller.status | default('n/a') }};
          length={{ (redpanda_controller.content | default('')) | length }};
      when: DEBUG == 1 and (redpanda_controller is defined)
    # Optional detailed dump (short excerpt only)
    - name: Redpanda Console | HTML excerpt (debug)
      ansible.builtin.debug:
        msg: "{{ (redpanda_controller.content | default(''))[:500] }}"
      when: DEBUG == 1 and (redpanda_controller is defined) and (redpanda_controller.content is defined)
    # -------------------------
    # Final assertion: Console URL must be reachable
    # -------------------------
    - name: Redpanda Console | Assert overview reachable (if URL configured)
      ansible.builtin.assert:
        that:
          - >
            not (redpanda_console_url is defined and (redpanda_console_url | length) > 0)
            or
            (
              redpanda_controller is defined
              and (redpanda_controller.status | default(0)) == 200
            )
        fail_msg: "Redpanda Console URL {{ redpanda_console_url }} is NOT reachable with HTTP 200 after retries."
        success_msg: "Redpanda Console URL {{ redpanda_console_url }} is reachable with HTTP 200."
@@ -1,174 +0,0 @@
 # nextcloud/update_collabora.yml
 - name: Update Collabora CODE on VM via Proxmox
  hosts: linux_servers
  gather_facts: false
  become: true
  become_user: root
  become_method: sudo
  vars:
    # --- Connection to VM (provided by Semaphore env vars) ---
    vm_ip:   "{{ lookup('env', 'VM_IP') }}"
    vm_user: "{{ lookup('env', 'VM_USER') }}"
    vm_pass: "{{ lookup('env', 'VM_PASS') }}"
    use_sudo: false
    # --- Debug mode (controlled via Semaphore variable) ---
    DEBUG: "{{ lookup('env', 'DEBUG') | default(0) | int }}"
    RETRIES: "{{ lookup('env', 'RETRIES') | default(25) | int }}"
    # --- Collabora specifics ---
    collabora_debug_caps: true
    collabora_caps_url: "https://collabora.martinfencl.eu/hosting/capabilities"
    # Use the FULL Nextcloud stack compose file; only target the 'collabora' service inside it
    collabora_project: "nextcloud-collabora"
    collabora_compose_file: "/data/compose/nextcloud/nextcloud-collabora.yml"
    collabora_service: "collabora"
    # Docker command prefix (consistent behavior and quiet hints)
    docker_prefix: "unalias docker 2>/dev/null || true; DOCKER_CLI_HINTS=0; command docker"
    # Commands to run on the target VM (quiet outputs)
    collabora_commands:
      - "{{ docker_prefix }} pull -q collabora/code:latest >/dev/null"
      - "{{ docker_prefix }} compose -p {{ collabora_project }} -f {{ collabora_compose_file }} pull {{ collabora_service }} >/dev/null"
      - "{{ docker_prefix }} compose -p {{ collabora_project }} -f {{ collabora_compose_file }} up -d --no-deps --force-recreate {{ collabora_service }} >/dev/null"
  tasks:
    - name: Ensure sshpass is installed (for password-based SSH)  # English comments
      ansible.builtin.apt:
        name: sshpass
        state: present
        update_cache: yes
    - name: Run Collabora update commands on VM (via SSH)  # use SSHPASS env, hide item value
      ansible.builtin.command:
        argv:
          - sshpass
          - -e
          - ssh
          - -o
          - StrictHostKeyChecking=no
          - -o
          - ConnectTimeout=15
          - "{{ vm_user }}@{{ vm_ip }}"
          - bash
          - -lc
          - "{{ ('sudo ' if use_sudo else '') + item }}"
      environment:
        SSHPASS: "{{ vm_pass }}"
      loop: "{{ collabora_commands }}"
      loop_control:
        index_var: idx              # <-- capture loop index here
        label: "cmd-{{ idx }}"      # <-- use idx instead of loop.index
      register: collab_cmds
      changed_when: false
      no_log: "{{ DEBUG == 0 }}"
    - name: Show outputs for each Collabora command
      ansible.builtin.debug:
        msg: |
          CMD: {{ item.item }}
          RC:  {{ item.rc }}
          STDOUT:
          {{ (item.stdout | default('')).strip() }}
          STDERR:
          {{ (item.stderr | default('')).strip() }}
      loop: "{{ collab_cmds.results }}"
      when: DEBUG == 1
    - name: Fail play if any Collabora command failed  # also hide item label
      ansible.builtin.assert:
        that: "item.rc == 0"
        fail_msg: "Collabora update failed on VM: {{ item.item }} (rc={{ item.rc }})"
        success_msg: "All Collabora update commands succeeded."
      loop: "{{ collab_cmds.results }}"
      loop_control:
        index_var: idx
        label: "cmd-{{ idx }}"
    # -------------------------
    # Readiness checks (controller first, then VM fallback)
    # -------------------------
    - name: Collabora | Wait for capabilities (controller first)
      ansible.builtin.uri:
        url: "{{ collabora_caps_url }}"
        method: GET
        return_content: true
        validate_certs: true
        status_code: 200
      register: caps_controller
      delegate_to: localhost
      run_once: true
      retries: "{{ RETRIES }}"
      delay: 2
      until: caps_controller.status == 200
      failed_when: false
      changed_when: false
    - name: Collabora | VM-side fetch (pure JSON via Python)  # use SSHPASS env here too
      ansible.builtin.command:
        argv:
          - sshpass
          - -e
          - ssh
          - -o
          - StrictHostKeyChecking=no
          - -o
          - ConnectTimeout=15
          - "{{ vm_user }}@{{ vm_ip }}"
          - bash
          - -lc
          - |
            python3 - <<'PY'
            import json, urllib.request, sys
            try:
                with urllib.request.urlopen("{{ collabora_caps_url }}", timeout=15) as r:
                    sys.stdout.write(r.read().decode())
            except Exception:
                pass
            PY
      environment:
        SSHPASS: "{{ vm_pass }}"
      register: caps_vm
      changed_when: false
      failed_when: false
      when: caps_controller.status | default(0) != 200 or caps_controller.json is not defined
      no_log: "{{ DEBUG == 0 }}"
    - name: Collabora | Choose JSON (controller wins, else VM)
      ansible.builtin.set_fact:
        collab_caps_json: >-
          {{
            (caps_controller.json
              if (caps_controller.status|default(0))==200 and (caps_controller.json is defined)
              else (
                (caps_vm.stdout | default('') | trim | length > 0)
                | ternary((caps_vm.stdout | trim | from_json), omit)
              )
            )
          }}
      failed_when: false
    - name: Collabora | Print concise summary
      ansible.builtin.debug:
        msg: >-
          Collabora {{ collab_caps_json.productVersion | default('?') }}
          ({{ collab_caps_json.productName | default('?') }}),
          convert-to.available={{ collab_caps_json['convert-to']['available'] | default('n/a') }},
          serverId={{ collab_caps_json.serverId | default('n/a') }}
      when: collab_caps_json is defined and DEBUG == 1
    - name: Collabora | Capabilities unavailable (after retries)
      ansible.builtin.debug:
        msg: "Capabilities endpoint není dostupný ani po pokusech."
      when: collab_caps_json is not defined and DEBUG == 1
    # Optional full JSON (debug)
    - name: Collabora | Full JSON (debug)
      ansible.builtin.debug:
        var: collab_caps_json
      when: collabora_debug_caps and (collab_caps_json is defined) and DEBUG == 1
@@ -1,194 +0,0 @@
 # update_homarr.yml
 - name: Update Homarr on VM via Proxmox
  hosts: linux_servers
  gather_facts: false
  become: true
  become_user: root
  become_method: sudo
  vars:
    # VM connection (provided by Semaphore env vars)
    vm_ip:   "{{ lookup('env', 'VM_IP') }}"
    vm_user: "{{ lookup('env', 'VM_USER') }}"
    vm_pass: "{{ lookup('env', 'VM_PASS') }}"
    use_sudo: false
    # --- Debug mode (controlled via Semaphore variable) ---
    DEBUG: "{{ lookup('env', 'DEBUG') | default(0) | int }}"
    RETRIES: "{{ lookup('env', 'RETRIES') | default(25) | int }}"
    # Homarr specifics
    homarr_project: "homarr"
    homarr_compose_file: "/data/compose/homarr/docker-compose-homarr.yml"
    homarr_service: "homarr"
    homarr_image: "ghcr.io/homarr-labs/homarr:latest"
    homarr_port: 7575
    # Optional external URL for controller-side readiness check (e.g., https://homarr.example.com)
    # If empty/undefined, controller check is skipped and we only probe from the VM.
    homarr_url: "{{ lookup('env', 'HOMARR_URL') | default('', true) }}"
    # Fixed container name used in your compose (avoid conflicts with any leftover container)
    homarr_container_name: "homarr"
    # Retry policy (same pattern as Kuma): 25x with 2s delay
    homarr_retries: "{{ RETRIES }}"
    homarr_delay: 2
    # Docker command prefix (consistent behavior)
    docker_prefix: "unalias docker 2>/dev/null || true; DOCKER_CLI_HINTS=0; command docker"
    # Commands to run on the target VM (quiet outputs)
    homarr_commands:
      - "{{ docker_prefix }} pull -q {{ homarr_image }} >/dev/null"
      - "{{ docker_prefix }} compose -p {{ homarr_project }} -f {{ homarr_compose_file }} pull {{ homarr_service }} >/dev/null"
      # remove conflicting container name before compose up (silently)
      - "{{ docker_prefix }} rm -f {{ homarr_container_name }} >/dev/null 2>&1 || true"
      - "{{ docker_prefix }} compose -p {{ homarr_project }} -f {{ homarr_compose_file }} up -d --no-deps --force-recreate {{ homarr_service }} >/dev/null"
  tasks:
    - name: Ensure sshpass is installed (for password-based SSH)  # English comments
      ansible.builtin.apt:
        name: sshpass
        state: present
        update_cache: yes
    - name: Run Homarr update commands on VM (via SSH)  # use SSHPASS env, hide item label
      ansible.builtin.command:
        argv:
          - sshpass
          - -e                     # read password from SSHPASS environment
          - ssh
          - -o
          - StrictHostKeyChecking=no
          - -o
          - ConnectTimeout=15
          - "{{ vm_user }}@{{ vm_ip }}"
          - bash
          - -lc
          - "{{ ('sudo ' if use_sudo else '') + item }}"
      environment:
        SSHPASS: "{{ vm_pass }}"    # supply password via environment
      loop: "{{ homarr_commands }}"
      loop_control:
        index_var: idx              # capture loop index
        label: "cmd-{{ idx }}"      # avoid printing full command in (item=...) line
      register: homarr_cmds
      changed_when: false
      no_log: "{{ DEBUG == 0 }}"    # hide outputs and env when not debugging
    - name: Show outputs for each Homarr command
      ansible.builtin.debug:
        msg: |
          CMD: {{ item.item }}
          RC:  {{ item.rc }}
          STDOUT:
          {{ (item.stdout | default('')).strip() }}
          STDERR:
          {{ (item.stderr | default('')).strip() }}
      loop: "{{ homarr_cmds.results }}"
      when: DEBUG == 1
    - name: Fail play if any Homarr command failed  # also hide item label
      ansible.builtin.assert:
        that: "item.rc == 0"
        fail_msg: "Homarr update failed on VM: {{ item.item }} (rc={{ item.rc }})"
        success_msg: "All Homarr update commands succeeded."
      loop: "{{ homarr_cmds.results }}"
      loop_control:
        index_var: idx
        label: "cmd-{{ idx }}"
    # -------------------------
    # Readiness checks (controller first, then VM fallback)
    # -------------------------
    - name: Homarr | Wait for homepage (controller first, with retries)
      ansible.builtin.uri:
        url: "{{ (homarr_url | regex_replace('/$','')) + '/' }}"
        method: GET
        return_content: true
        # Validate TLS only when using https://
        validate_certs: "{{ (homarr_url | default('')) is match('^https://') }}"
        status_code: 200
      register: homarr_controller
      delegate_to: localhost
      run_once: true
      when: homarr_url is defined and (homarr_url | length) > 0
      retries: "{{ homarr_retries }}"
      delay: "{{ homarr_delay }}"
      until: homarr_controller.status == 200
      failed_when: false
      changed_when: false
    - name: Homarr | VM-side fetch (HTML via Python, with retries)  # use SSHPASS env here too
      ansible.builtin.command:
        argv:
          - sshpass
          - -e
          - ssh
          - -o
          - StrictHostKeyChecking=no
          - -o
          - ConnectTimeout=15
          - "{{ vm_user }}@{{ vm_ip }}"
          - bash
          - -lc
          - |
            python3 - <<'PY'
            # Fetch Homarr homepage from localhost and print HTML to stdout
            import urllib.request, sys
            try:
                with urllib.request.urlopen("http://127.0.0.1:{{ homarr_port }}/", timeout=15) as r:
                    sys.stdout.write(r.read().decode(errors='ignore'))
            except Exception:
                pass
            PY
      environment:
        SSHPASS: "{{ vm_pass }}"
      register: homarr_vm
      changed_when: false
      failed_when: false
      when: homarr_controller.status | default(0) != 200 or homarr_controller.content is not defined
      retries: "{{ homarr_retries }}"
      delay: "{{ homarr_delay }}"
      until: (homarr_vm.stdout | default('') | trim | length) > 0 and ('Homarr' in (homarr_vm.stdout | default('')))
      no_log: "{{ DEBUG == 0 }}"
    - name: Homarr | Choose homepage HTML (controller wins, else VM)  # safe guard against empty result
      ansible.builtin.set_fact:
        homarr_home_html: >-
          {{
            (
              homarr_controller.content
              if (homarr_controller is defined)
                 and ((homarr_controller.status|default(0))==200)
                 and (homarr_controller.content is defined)
              else
                 (homarr_vm.stdout | default('') | trim)
            )
          }}
      when:
        - (homarr_controller is defined and (homarr_controller.status|default(0))==200 and (homarr_controller.content is defined))
          or ((homarr_vm.stdout | default('') | trim | length) > 0)
    - name: Homarr | Print concise summary
      ansible.builtin.debug:
        msg: >-
          Homarr homepage {{ 'reachable' if (homarr_home_html is defined) else 'NOT reachable' }}.
          Source={{ 'controller' if ((homarr_controller is defined) and (homarr_controller.status|default(0))==200 and (homarr_controller.content is defined)) else 'vm' if (homarr_vm.stdout|default('')|trim|length>0) else 'n/a' }};
          length={{ (homarr_home_html | default('')) | length }};
          contains('Homarr')={{ (homarr_home_html is defined) and ('Homarr' in homarr_home_html) }}
      when: DEBUG == 1
    - name: Homarr | Homepage unavailable (after retries)
      ansible.builtin.debug:
        msg: "Homarr web není dostupný ani po pokusech."
      when: homarr_home_html is not defined and DEBUG == 1
    # Optional detailed dump (short excerpt only)
    - name: Homarr | HTML excerpt (debug)
      ansible.builtin.debug:
        msg: "{{ (homarr_home_html | default(''))[:500] }}"
      when: homarr_home_html is defined and DEBUG == 1
@@ -1,313 +0,0 @@
 # update_immich.yml
 - name: Update Immich on VM via Proxmox
  hosts: linux_servers
  gather_facts: false
  become: true
  become_user: root
  become_method: sudo
  vars:
    # VM connection (provided by Semaphore env vars)
    vm_ip:   "{{ lookup('env', 'VM_IP') }}"
    vm_user: "{{ lookup('env', 'VM_USER') }}"
    vm_pass: "{{ lookup('env', 'VM_PASS') }}"
    use_sudo: false
    # --- Debug mode (controlled via Semaphore variable) ---
    DEBUG: "{{ lookup('env', 'DEBUG') | default(0) | int }}"
    RETRIES: "{{ lookup('env', 'RETRIES') | default(25) | int }}"
    # Immich specifics
    immich_dir: "/opt/immich"
    immich_project: "immich"
    immich_compose_url: "https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml"
    immich_compose_file: "/opt/immich/docker-compose.yml"
    immich_override_file: "/opt/immich/docker-compose.override.yml"
    immich_port: 2283
    # Optional external URL for controller-side readiness check (e.g., https://photos.example.com)
    immich_url: "{{ lookup('env', 'IMMICH_URL') | default('', true) }}"
    # Retry policy
    immich_retries: "{{ RETRIES }}"
    immich_delay: 2
    # Docker command prefix (consistent behavior)
    docker_prefix: "unalias docker 2>/dev/null || true; DOCKER_CLI_HINTS=0; command docker"
    # Compose command (always include override to keep local mounts separate from upstream compose)
    immich_compose_cmd: >-
      {{ docker_prefix }} compose
      -p {{ immich_project }}
      -f {{ immich_compose_file }}
      -f {{ immich_override_file }}
    # Commands to run on the target VM
    immich_commands:
      - "cd {{ immich_dir }}"
      - |
        cd {{ immich_dir }}
        mkdir -p backups
        if [ -f docker-compose.yml ]; then
          cp -a docker-compose.yml "backups/docker-compose.yml.$(date +%F_%H%M%S).bak"
        fi
        if [ -f .env ]; then
          cp -a .env "backups/.env.$(date +%F_%H%M%S).bak"
        fi
        if [ -f docker-compose.override.yml ]; then
          cp -a docker-compose.override.yml "backups/docker-compose.override.yml.$(date +%F_%H%M%S).bak"
        fi
      - |
        cd {{ immich_dir }}
        # Download latest compose from Immich releases (requires curl or wget)
        if command -v curl >/dev/null 2>&1; then
          curl -fsSL -o docker-compose.yml "{{ immich_compose_url }}"
        elif command -v wget >/dev/null 2>&1; then
          wget -qO docker-compose.yml "{{ immich_compose_url }}"
        else
          echo "Neither curl nor wget is available on the VM."
          exit 1
        fi
      - |
        cd {{ immich_dir }}
        # Ensure override compose exists (create if missing)
        if [ ! -f "{{ immich_override_file }}" ]; then
          printf '%s\n' \
            'services:' \
            '  immich-server:' \
            '    volumes:' \
            '      - /mnt/nextcloud-howard-photos:/mnt/nextcloud-howard-photos' \
            '      - /mnt/nextcloud-kamilkaprdelka-photos:/mnt/nextcloud-kamilkaprdelka-photos' \
            > "{{ immich_override_file }}"
        fi
        # Fail early if override is still missing/empty
        test -s "{{ immich_override_file }}"
      - |
        cd {{ immich_dir }}
        # Ensure .env exists. If missing, try to reconstruct it from running containers to avoid breaking DB creds.
        python3 - <<'PY'
        import json
        import subprocess
        from pathlib import Path
        env_path = Path(".env")
        if env_path.exists():
            raise SystemExit(0)
        def run(cmd):
            p = subprocess.run(cmd, capture_output=True, text=True)
            return p.returncode, p.stdout, p.stderr
        rc, out, err = run(["bash", "-lc", "command docker inspect immich_postgres immich_server"])
        if rc != 0 or not out.strip():
            print("ERROR: .env is missing and cannot inspect running containers (immich_postgres/immich_server).", flush=True)
            print("Create /opt/immich/.env manually or ensure the containers exist.", flush=True)
            raise SystemExit(1)
        data = json.loads(out)
        by_name = {}
        for c in data:
            name = (c.get("Name") or "").lstrip("/")
            by_name[name] = c
        pg = by_name.get("immich_postgres")
        srv = by_name.get("immich_server")
        if not pg or not srv:
            print("ERROR: Could not find immich_postgres and immich_server in docker inspect output.", flush=True)
            raise SystemExit(1)
        def env_map(container):
            m = {}
            for kv in (container.get("Config", {}).get("Env") or []):
                if "=" in kv:
                    k, v = kv.split("=", 1)
                    m[k] = v
            return m
        def find_mount_source(container, dest):
            for m in (container.get("Mounts") or []):
                if m.get("Destination") == dest:
                    return m.get("Source")
            return ""
        pg_env = env_map(pg)
        db_user = pg_env.get("POSTGRES_USER", "")
        db_pass = pg_env.get("POSTGRES_PASSWORD", "")
        db_name = pg_env.get("POSTGRES_DB", "")
        db_data = find_mount_source(pg, "/var/lib/postgresql/data")
        upload_loc = find_mount_source(srv, "/usr/src/app/upload")
        # Try to preserve the currently used image tag as IMMICH_VERSION (optional but safer)
        immich_version = ""
        image = (srv.get("Config", {}).get("Image") or "")
        if ":" in image and "@" not in image:
            immich_version = image.rsplit(":", 1)[-1]
        elif ":" in image and "@" in image:
            # image like repo:tag@sha256:...
            immich_version = image.split("@", 1)[0].rsplit(":", 1)[-1]
        missing = []
        for k, v in [
            ("DB_USERNAME", db_user),
            ("DB_PASSWORD", db_pass),
            ("DB_DATABASE_NAME", db_name),
            ("DB_DATA_LOCATION", db_data),
            ("UPLOAD_LOCATION", upload_loc),
        ]:
            if not v:
                missing.append(k)
        if missing:
            print("ERROR: Could not reconstruct these .env values from containers: " + ", ".join(missing), flush=True)
            raise SystemExit(1)
        lines = [
            f"UPLOAD_LOCATION={upload_loc}",
            f"DB_DATA_LOCATION={db_data}",
            f"DB_USERNAME={db_user}",
            f"DB_PASSWORD={db_pass}",
            f"DB_DATABASE_NAME={db_name}",
        ]
        if immich_version:
            lines.append(f"IMMICH_VERSION={immich_version}")
        env_path.write_text("\n".join(lines) + "\n", encoding="utf-8")
        print("Created .env from running containers.", flush=True)
        PY
      - |
        cd {{ immich_dir }}
        # Comment out healthcheck.start_interval if present (safe no-op if missing)
        sed -i -E 's/^([[:space:]]*)start_interval:/\1# start_interval:/' docker-compose.yml || true
      - "cd {{ immich_dir }} && {{ immich_compose_cmd }} config >/dev/null"
      - "cd {{ immich_dir }} && {{ immich_compose_cmd }} pull >/dev/null"
      - "cd {{ immich_dir }} && {{ immich_compose_cmd }} up -d --remove-orphans --force-recreate >/dev/null"
  tasks:
    - name: Ensure sshpass is installed (for password-based SSH)  # English comments
      ansible.builtin.apt:
        name: sshpass
        state: present
        update_cache: yes
    - name: Run Immich update commands on VM (via SSH)  # use SSHPASS env, hide item label
      ansible.builtin.command:
        argv:
          - sshpass
          - -e
          - ssh
          - -o
          - StrictHostKeyChecking=no
          - -o
          - ConnectTimeout=15
          - "{{ vm_user }}@{{ vm_ip }}"
          - bash
          - -lc
          - "{{ ('sudo ' if use_sudo else '') + item }}"
      environment:
        SSHPASS: "{{ vm_pass }}"
      loop: "{{ immich_commands }}"
      loop_control:
        index_var: idx
        label: "cmd-{{ idx }}"
      register: immich_cmds
      changed_when: false
      no_log: "{{ DEBUG == 0 }}"
      run_once: true
    - name: Show outputs for each Immich command
      ansible.builtin.debug:
        msg: |
          CMD: {{ item.item }}
          RC:  {{ item.rc }}
          STDOUT:
          {{ (item.stdout | default('')).strip() }}
          STDERR:
          {{ (item.stderr | default('')).strip() }}
      loop: "{{ immich_cmds.results }}"
      when: DEBUG == 1
      run_once: true
    - name: Fail play if any Immich command failed
      ansible.builtin.assert:
        that: "item.rc == 0"
        fail_msg: "Immich update failed on VM: {{ item.item }} (rc={{ item.rc }})"
        success_msg: "All Immich update commands succeeded."
      loop: "{{ immich_cmds.results }}"
      loop_control:
        index_var: idx
        label: "cmd-{{ idx }}"
      run_once: true
    # -------------------------
    # Readiness checks (controller first, then VM fallback)
    # -------------------------
    - name: Immich | Wait for API ping (controller first, with retries)
      ansible.builtin.uri:
        url: "{{ (immich_url | regex_replace('/$','')) + '/api/server/ping' }}"
        method: GET
        return_content: true
        validate_certs: "{{ (immich_url | default('')) is match('^https://') }}"
        status_code: 200
      register: immich_controller
      delegate_to: localhost
      run_once: true
      when: immich_url is defined and (immich_url | length) > 0
      retries: "{{ immich_retries }}"
      delay: "{{ immich_delay }}"
      until: immich_controller.status == 200 and ('pong' in (immich_controller.content | default('')))
      failed_when: false
      changed_when: false
    - name: Immich | VM-side ping (JSON via Python, with retries)
      ansible.builtin.command:
        argv:
          - sshpass
          - -e
          - ssh
          - -o
          - StrictHostKeyChecking=no
          - -o
          - ConnectTimeout=15
          - "{{ vm_user }}@{{ vm_ip }}"
          - bash
          - -lc
          - |
            python3 - <<'PY'
            # Ping Immich API from localhost and print response to stdout
            import urllib.request, sys
            try:
                with urllib.request.urlopen("http://127.0.0.1:{{ immich_port }}/api/server/ping", timeout=15) as r:
                    sys.stdout.write(r.read().decode(errors='ignore'))
            except Exception:
                pass
            PY
      environment:
        SSHPASS: "{{ vm_pass }}"
      register: immich_vm
      changed_when: false
      failed_when: false
      when: immich_controller.status | default(0) != 200
      retries: "{{ immich_retries }}"
      delay: "{{ immich_delay }}"
      until: (immich_vm.stdout | default('') | trim | length) > 0 and ('pong' in (immich_vm.stdout | default('')))
      no_log: "{{ DEBUG == 0 }}"
      run_once: true
    - name: Immich | Print concise summary
      ansible.builtin.debug:
        msg: >-
          Immich API ping {{ 'OK' if (('pong' in (immich_controller.content|default(''))) or ('pong' in (immich_vm.stdout|default('')))) else 'NOT OK' }}.
          Source={{ 'controller' if (immich_controller.status|default(0))==200 else 'vm' if (immich_vm.stdout|default('')|trim|length>0) else 'n/a' }}.
      when: DEBUG == 1
      run_once: true
@@ -1,293 +0,0 @@
 # nextcloud/update_nextcloud_db_redis.yml
 - name: Update Nextcloud DB and Redis on VM via Proxmox
  hosts: linux_servers
  gather_facts: false
  become: true
  become_user: root
  become_method: sudo
  vars:
    # --- Connection to VM (provided by Semaphore env vars) ---
    vm_ip:   "{{ lookup('env', 'VM_IP') }}"
    vm_user: "{{ lookup('env', 'VM_USER') }}"
    vm_pass: "{{ lookup('env', 'VM_PASS') }}"
    use_sudo: false
    # --- Debug / retries ---
    DEBUG: "{{ lookup('env', 'DEBUG') | default(0) | int }}"
    RETRIES: "{{ lookup('env', 'RETRIES') | default(25) | int }}"
    # --- Nextcloud specifics ---
    nextcloud_project: "nextcloud-collabora"
    nextcloud_compose_file: "/data/compose/nextcloud/docker-compose-nextcloud.yml"
    # Service names from docker-compose file
    nextcloud_web_service: "nextcloud"
    nextcloud_db_service: "nextclouddb"
    redis_service: "redis"
    # Backup directory on the VM (timestamped on controller)
    backup_dir: "/data/compose/nextcloud/backup-db-redis-{{ lookup('pipe', 'date +%F-%H%M%S') }}"
    nextcloud_base_url: "https://cloud.martinfencl.eu"
    nextcloud_status_url: "{{ nextcloud_base_url }}/status.php"
    # Docker command prefix (consistent behavior and quiet hints)
    docker_prefix: "unalias docker 2>/dev/null || true; DOCKER_CLI_HINTS=0; command docker"
    # --- Backup phase commands (run on VM) ---
    # Same idea as in update_nextcloud.yml: maintenance on + config/custom_apps + DB dump
    nextcloud_backup_commands:
      - >
        mkdir -p "{{ backup_dir }}"
      - >
        docker exec -u www-data nextcloud php occ maintenance:mode --on
      - >
        docker exec nextcloud sh -c 'tar czf /tmp/nextcloud_conf.tgz -C /var/www/html config custom_apps'
      - >
        docker cp nextcloud:/tmp/nextcloud_conf.tgz "{{ backup_dir }}/nextcloud_conf.tgz"
      - >
        docker exec nextcloud rm /tmp/nextcloud_conf.tgz || true
      - >
        docker exec nextcloud-db sh -c 'command -v mariadb-dump >/dev/null && mariadb-dump -u"$MYSQL_USER" -p"$MYSQL_PASSWORD" "$MYSQL_DATABASE" || mysqldump -u"$MYSQL_USER" -p"$MYSQL_PASSWORD" "$MYSQL_DATABASE"' > "{{ backup_dir }}/db.sql"
    # --- DB + Redis upgrade commands (run on VM) ---
    db_redis_upgrade_commands:
      # Update MariaDB service
      - >
        {{ docker_prefix }} compose -p {{ nextcloud_project }} -f {{ nextcloud_compose_file }} pull {{ nextcloud_db_service }}
      - >
        {{ docker_prefix }} compose -p {{ nextcloud_project }} -f {{ nextcloud_compose_file }} up -d --no-deps --force-recreate {{ nextcloud_db_service }}
      # Simple DB health check (non-fatal)
      - >
        docker exec nextcloud-db sh -c 'mysqladmin ping -u"$MYSQL_USER" -p"$MYSQL_PASSWORD" "$MYSQL_DATABASE"' || true
      # Update Redis service
      - >
        {{ docker_prefix }} compose -p {{ nextcloud_project }} -f {{ nextcloud_compose_file }} pull {{ redis_service }}
      - >
        {{ docker_prefix }} compose -p {{ nextcloud_project }} -f {{ nextcloud_compose_file }} up -d --no-deps --force-recreate {{ redis_service }}
      # Simple Redis health check (non-fatal)
      - >
        docker exec redis redis-cli PING || true
  tasks:
    - name: Ensure sshpass is installed (for password-based SSH)
      ansible.builtin.apt:
        name: sshpass
        state: present
        update_cache: yes
    - name: Nextcloud | Show current version before DB/Redis upgrade (DEBUG)
      ansible.builtin.command:
        argv:
          - sshpass
          - -e
          - ssh
          - -o
          - StrictHostKeyChecking=no
          - -o
          - ConnectTimeout=15
          - "{{ vm_user }}@{{ vm_ip }}"
          - bash
          - -lc
          - 'docker exec -u www-data nextcloud php occ -V || true'
      environment:
        SSHPASS: "{{ vm_pass }}"
      register: nc_version_before
      changed_when: false
      failed_when: false
      when: DEBUG == 1
    # -------------------------
    # Backup phase
    # -------------------------
    - name: Nextcloud | Run backup commands on VM (via SSH)
      ansible.builtin.command:
        argv:
          - sshpass
          - -e
          - ssh
          - -o
          - StrictHostKeyChecking=no
          - -o
          - ConnectTimeout=15
          - "{{ vm_user }}@{{ vm_ip }}"
          - "{{ ('sudo ' if use_sudo else '') + item }}"
      environment:
        SSHPASS: "{{ vm_pass }}"
      loop: "{{ nextcloud_backup_commands }}"
      loop_control:
        index_var: idx
        label: "backup-cmd-{{ idx }}"
      register: nc_backup_cmds
      changed_when: false
      no_log: "{{ DEBUG == 0 }}"
    - name: Nextcloud | Show outputs of backup commands (DEBUG)
      ansible.builtin.debug:
        msg: |
          CMD: {{ item.item }}
          RC:  {{ item.rc }}
          STDOUT:
          {{ (item.stdout | default('')).strip() }}
          STDERR:
          {{ (item.stderr | default('')).strip() }}
      loop: "{{ nc_backup_cmds.results }}"
      when: DEBUG == 1
    - name: Nextcloud | Fail play if any backup command failed
      ansible.builtin.assert:
        that: "item.rc == 0"
        fail_msg: "Nextcloud DB/Redis backup step failed on VM: {{ item.item }} (rc={{ item.rc }})"
        success_msg: "All Nextcloud DB/Redis backup commands succeeded."
      loop: "{{ nc_backup_cmds.results }}"
      loop_control:
        index_var: idx
        label: "backup-cmd-{{ idx }}"
    # -------------------------
    # DB + Redis upgrade phase
    # -------------------------
    - name: Nextcloud | Run DB/Redis upgrade commands on VM (via SSH)
      ansible.builtin.command:
        argv:
          - sshpass
          - -e
          - ssh
          - -o
          - StrictHostKeyChecking=no
          - -o
          - ConnectTimeout=15
          - "{{ vm_user }}@{{ vm_ip }}"
          - bash
          - -lc
          - "{{ ('sudo ' if use_sudo else '') + item }}"
      environment:
        SSHPASS: "{{ vm_pass }}"
      loop: "{{ db_redis_upgrade_commands }}"
      loop_control:
        index_var: idx
        label: "db-redis-cmd-{{ idx }}"
      register: nc_db_redis_cmds
      changed_when: false
      failed_when: false
      no_log: "{{ DEBUG == 0 }}"
    - name: Nextcloud | Show outputs of DB/Redis upgrade commands (DEBUG)
      ansible.builtin.debug:
        msg: |
          CMD: {{ item.item }}
          RC:  {{ item.rc }}
          STDOUT:
          {{ (item.stdout | default('')).strip() }}
          STDERR:
          {{ (item.stderr | default('')).strip() }}
      loop: "{{ nc_db_redis_cmds.results }}"
      when: DEBUG == 1
    - name: Nextcloud | Fail play if any DB/Redis upgrade command failed
      ansible.builtin.assert:
        that: "item.rc == 0"
        fail_msg: "Nextcloud DB/Redis upgrade step failed on VM: {{ item.item }} (rc={{ item.rc }})"
        success_msg: "All Nextcloud DB/Redis upgrade commands succeeded."
      loop: "{{ nc_db_redis_cmds.results }}"
      loop_control:
        index_var: idx
        label: "db-redis-cmd-{{ idx }}"
    # -------------------------
    # Disable maintenance + readiness check
    # -------------------------
    - name: Nextcloud | Disable maintenance mode after DB/Redis upgrade
      ansible.builtin.command:
        argv:
          - sshpass
          - -e
          - ssh
          - -o
          - StrictHostKeyChecking=no
          - -o
          - ConnectTimeout=15
          - "{{ vm_user }}@{{ vm_ip }}"
          - "{{ ('sudo ' if use_sudo else '') }}docker exec -u www-data nextcloud php occ maintenance:mode --off"
      environment:
        SSHPASS: "{{ vm_pass }}"
      register: nc_maint_off
      changed_when: false
      no_log: "{{ DEBUG == 0 }}"
    - name: Nextcloud | Wait for status.php (controller first)
      ansible.builtin.uri:
        url: "{{ nextcloud_status_url }}"
        method: GET
        return_content: true
        validate_certs: true
        status_code: 200
      register: nc_status_controller
      delegate_to: localhost
      run_once: true
      retries: "{{ RETRIES }}"
      delay: 4
      failed_when: false
      changed_when: false
    - name: Nextcloud | VM-side fetch status.php (JSON via Python)
      ansible.builtin.command:
        argv:
          - sshpass
          - -e
          - ssh
          - -o
          - StrictHostKeyChecking=no
          - -o
          - ConnectTimeout=15
          - "{{ vm_user }}@{{ vm_ip }}"
          - bash
          - -lc
          - |
            python3 - <<'PY'
            import json, urllib.request, sys
            try:
                with urllib.request.urlopen("{{ nextcloud_status_url }}", timeout=15) as r:
                    sys.stdout.write(r.read().decode())
            except Exception:
                pass
            PY
      environment:
        SSHPASS: "{{ vm_pass }}"
      register: nc_status_vm
      changed_when: false
      failed_when: false
      when: nc_status_controller.status | default(0) != 200 or nc_status_controller.json is not defined
      no_log: "{{ DEBUG == 0 }}"
    - name: Nextcloud | Choose status JSON (controller wins, else VM)
      ansible.builtin.set_fact:
        nextcloud_status_json: >-
          {{
            (nc_status_controller.json
              if (nc_status_controller.status | default(0)) == 200 and (nc_status_controller.json is defined)
              else (
                (nc_status_vm.stdout | default('') | trim | length > 0)
                | ternary((nc_status_vm.stdout | trim | from_json), omit)
              )
            )
          }}
      failed_when: false
    - name: Nextcloud | Print concise status summary (DEBUG)
      ansible.builtin.debug:
        msg: >-
          Nextcloud {{ nextcloud_status_json.version | default('?') }}
          (installed={{ nextcloud_status_json.installed | default('?') }},
          maintenance={{ nextcloud_status_json.maintenance | default('?') }},
          needsDbUpgrade={{ nextcloud_status_json.needsDbUpgrade | default('?') }})
      when: nextcloud_status_json is defined and DEBUG == 1
    - name: Nextcloud | Status JSON not available (DEBUG)
      ansible.builtin.debug:
        msg: "status.php is not reachable or did not return JSON."
      when: nextcloud_status_json is not defined and DEBUG == 1
@@ -1,118 +0,0 @@
 # update_portainer_agent.yml
 - name: Update Portainer Agent on VM via Proxmox
  hosts: linux_servers
  gather_facts: false
  become: true
  become_user: root
  become_method: sudo
  vars:
    # --- Connection to VM (provided by Semaphore env vars) ---
    vm_ip:   "{{ lookup('env', 'VM_IP') }}"
    vm_user: "{{ lookup('env', 'VM_USER') }}"
    vm_pass: "{{ lookup('env', 'VM_PASS') }}"
    use_sudo: false
    # --- Debug mode (controlled via Semaphore variable) ---
    DEBUG: "{{ lookup('env', 'DEBUG') | default(0) | int }}"
    RETRIES: "{{ lookup('env', 'RETRIES') | default(25) | int }}"
    # --- Portainer Agent specifics ---
    portainer_agent_image: "portainer/agent:latest"
    portainer_agent_container: "portainer_agent"
    portainer_agent_port: 9001
    # Docker command prefix (consistent behavior and quiet hints)
    docker_prefix: "unalias docker 2>/dev/null || true; DOCKER_CLI_HINTS=0; command docker"
    # Commands to run on the target VM (quiet outputs)
    portainer_commands:
      - "{{ docker_prefix }} pull -q {{ portainer_agent_image }} >/dev/null"
      - "{{ docker_prefix }} stop {{ portainer_agent_container }} >/dev/null 2>&1 || true"
      - "{{ docker_prefix }} rm {{ portainer_agent_container }} >/dev/null 2>&1 || true"
      - >
        {{ docker_prefix }} run -d
        --name {{ portainer_agent_container }}
        --restart=always
        -p {{ portainer_agent_port }}:9001
        -v /var/run/docker.sock:/var/run/docker.sock
        -v /var/lib/docker/volumes:/var/lib/docker/volumes
        {{ portainer_agent_image }} >/dev/null
  tasks:
    - name: Ensure sshpass is installed (for password-based SSH)  # English comments
      ansible.builtin.apt:
        name: sshpass
        state: present
        update_cache: yes
    - name: Run Portainer Agent update commands on VM (via SSH)  # run all commands via sshpass
      ansible.builtin.command:
        argv:
          - sshpass
          - -e
          - ssh
          - -o
          - StrictHostKeyChecking=no
          - -o
          - ConnectTimeout=15
          - "{{ vm_user }}@{{ vm_ip }}"
          - bash
          - -lc
          - "{{ ('sudo ' if use_sudo else '') + item }}"
      environment:
        SSHPASS: "{{ vm_pass }}"
      loop: "{{ portainer_commands }}"
      loop_control:
        index_var: idx              # capture loop index
        label: "cmd-{{ idx }}"      # avoid printing full command in (item=...) line
      register: portainer_cmds
      changed_when: false
      no_log: "{{ DEBUG == 0 }}"    # hide outputs and env when not debugging
    - name: Show outputs for each Portainer command
      ansible.builtin.debug:
        msg: |
          CMD: {{ item.item }}
          RC:  {{ item.rc }}
          STDOUT:
          {{ (item.stdout | default('')).strip() }}
          STDERR:
          {{ (item.stderr | default('')).strip() }}
      loop: "{{ portainer_cmds.results }}"
      when: DEBUG == 1
    - name: Fail play if any Portainer command failed
      ansible.builtin.assert:
        that: "item.rc == 0"
        fail_msg: "Portainer Agent update failed on VM: {{ item.item }} (rc={{ item.rc }})"
        success_msg: "All Portainer Agent update commands succeeded."
      loop: "{{ portainer_cmds.results }}"
      loop_control:
        index_var: idx
        label: "cmd-{{ idx }}"
    # -------------------------
    # Readiness check (TCP port)
    # -------------------------
    - name: Portainer Agent | Wait for TCP port to be open from controller
      ansible.builtin.wait_for:
        host: "{{ vm_ip }}"
        port: "{{ portainer_agent_port }}"
        delay: 2                    # initial delay before first check
        timeout: "{{ RETRIES * 2 }}" # total timeout in seconds
        state: started
      register: portainer_wait
      delegate_to: localhost
      run_once: true
      changed_when: false
    - name: Portainer Agent | Print concise summary
      ansible.builtin.debug:
        msg: >-
          Portainer Agent TCP {{ vm_ip }}:{{ portainer_agent_port }}
          reachable={{ (portainer_wait is defined) and (not portainer_wait.failed | default(false)) }}
          elapsed={{ portainer_wait.elapsed | default('n/a') }}s
      when: DEBUG == 1
@@ -1,65 +0,0 @@
 # update_semaphore.yml
 - name: Update Semaphore on VM via Proxmox
  hosts: linux_servers
  gather_facts: false
  become: true
  become_user: root
  become_method: sudo
  vars:
    # --- Connection to VM (provided by Semaphore env vars) ---
    vm_ip:   "{{ lookup('env', 'VM_IP') }}"      # IP vm-portainer
    vm_user: "{{ lookup('env', 'VM_USER') }}"
    vm_pass: "{{ lookup('env', 'VM_PASS') }}"
    use_sudo: false
    # --- Debug mode (controlled via Semaphore variable) ---
    DEBUG: "{{ lookup('env', 'DEBUG') | default(0) | int }}"
    # --- Semaphore specifics ---
    semaphore_project: "semaphore"
    semaphore_compose_file: "/data/compose/semaphore/docker-compose.yml"
    semaphore_service: "semaphore"
  tasks:
    - name: Ensure sshpass is installed (for password-based SSH)  # English comments
      ansible.builtin.apt:
        name: sshpass
        state: present
        update_cache: yes
    - name: Run Semaphore self-update on VM in background (nohup)
      ansible.builtin.command:
        argv:
          - sshpass
          - -e
          - ssh
          - -o
          - StrictHostKeyChecking=no
          - -o
          - ConnectTimeout=15
          - "{{ vm_user }}@{{ vm_ip }}"
          - bash
          - -lc
          - |
            nohup bash -c '
              unalias docker 2>/dev/null || true
              DOCKER_CLI_HINTS=0 docker compose \
                -p {{ semaphore_project }} \
                -f {{ semaphore_compose_file }} \
                up -d --no-deps --force-recreate --pull always {{ semaphore_service }}
            ' >/dev/null 2>&1 &
      environment:
        SSHPASS: "{{ vm_pass }}"
      register: semaphore_update
      changed_when: false
      no_log: "{{ DEBUG == 0 }}"
    - name: Show result of Semaphore self-update (debug)
      ansible.builtin.debug:
        msg: |
          RC:      {{ semaphore_update.rc }}
          STDOUT:  {{ (semaphore_update.stdout | default('')).strip() }}
          STDERR:  {{ (semaphore_update.stderr | default('')).strip() }}
      when: DEBUG == 1
@@ -1,194 +0,0 @@
 # nextcloud/update_uptime_kuma.yml
 - name: Update Uptime Kuma on VM via Proxmox
  hosts: linux_servers
  gather_facts: false
  become: true
  become_user: root
  become_method: sudo
  vars:
    # VM connection (provided by Semaphore env vars)
    vm_ip:   "{{ lookup('env', 'VM_IP') }}"
    vm_user: "{{ lookup('env', 'VM_USER') }}"
    vm_pass: "{{ lookup('env', 'VM_PASS') }}"
    use_sudo: false
    # --- Debug mode (controlled via Semaphore variable) ---
    DEBUG: "{{ lookup('env', 'DEBUG') | default(0) | int }}"
    RETRIES: "{{ lookup('env', 'RETRIES') | default(25) | int }}"
    # Uptime Kuma specifics
    kuma_project: "uptime-kuma"
    kuma_compose_file: "/data/compose/uptime-kuma/docker-compose-uptime-kuma.yml"
    kuma_service: "uptime-kuma"
    kuma_image: "louislam/uptime-kuma:latest"
    kuma_port: 3001
    # Optional external URL for controller-side readiness check (e.g., https://kuma.example.com)
    # If empty/undefined, controller check is skipped and we only probe from the VM.
    kuma_url: "{{ lookup('env', 'KUMA_URL') | default('', true) }}"
    # Fixed container name used in your compose (conflicts with previous/Portainer-run container)
    kuma_container_name: "uptime-kuma-dev"
    # Retry policy
    kuma_retries: "{{ RETRIES }}"
    kuma_delay: 2
    # Docker command prefix (consistent behavior)
    docker_prefix: "unalias docker 2>/dev/null || true; DOCKER_CLI_HINTS=0; command docker"
    # Commands to run on the target VM (quiet outputs like in Collabora play)
    kuma_commands:
      - "{{ docker_prefix }} pull -q {{ kuma_image }} >/dev/null"
      - "{{ docker_prefix }} compose -p {{ kuma_project }} -f {{ kuma_compose_file }} pull {{ kuma_service }} >/dev/null"
      # remove conflicting container name before compose up (silently)
      - "{{ docker_prefix }} rm -f {{ kuma_container_name }} >/dev/null 2>&1 || true"
      - "{{ docker_prefix }} compose -p {{ kuma_project }} -f {{ kuma_compose_file }} up -d --no-deps --force-recreate {{ kuma_service }} >/dev/null"
  tasks:
    - name: Ensure sshpass is installed (for password-based SSH)  # English comments
      ansible.builtin.apt:
        name: sshpass
        state: present
        update_cache: yes
    - name: Run Uptime Kuma update commands on VM (via SSH)  # use SSHPASS env, hide item label
      ansible.builtin.command:
        argv:
          - sshpass
          - -e                     # read password from SSHPASS environment
          - ssh
          - -o
          - StrictHostKeyChecking=no
          - -o
          - ConnectTimeout=15
          - "{{ vm_user }}@{{ vm_ip }}"
          - bash
          - -lc
          - "{{ ('sudo ' if use_sudo else '') + item }}"
      environment:
        SSHPASS: "{{ vm_pass }}"    # supply password via environment
      loop: "{{ kuma_commands }}"
      loop_control:
        index_var: idx              # capture loop index
        label: "cmd-{{ idx }}"      # avoid printing full command in (item=...) line
      register: kuma_cmds
      changed_when: false
      no_log: "{{ DEBUG == 0 }}"    # hide outputs and env when not debugging
    - name: Show outputs for each Uptime Kuma command
      ansible.builtin.debug:
        msg: |
          CMD: {{ item.item }}
          RC:  {{ item.rc }}
          STDOUT:
          {{ (item.stdout | default('')).strip() }}
          STDERR:
          {{ (item.stderr | default('')).strip() }}
      loop: "{{ kuma_cmds.results }}"
      when: DEBUG == 1
    - name: Fail play if any Uptime Kuma command failed  # also hide item label
      ansible.builtin.assert:
        that: "item.rc == 0"
        fail_msg: "Uptime Kuma update failed on VM: {{ item.item }} (rc={{ item.rc }})"
        success_msg: "All Uptime Kuma update commands succeeded."
      loop: "{{ kuma_cmds.results }}"
      loop_control:
        index_var: idx
        label: "cmd-{{ idx }}"
    # -------------------------
    # Readiness checks (controller first, then VM fallback)
    # -------------------------
    - name: Kuma | Wait for homepage (controller first, with retries)
      ansible.builtin.uri:
        url: "{{ (kuma_url | regex_replace('/$','')) + '/' }}"
        method: GET
        return_content: true
        # Validate TLS only when using https://
        validate_certs: "{{ (kuma_url | default('')) is match('^https://') }}"
        status_code: 200
      register: kuma_controller
      delegate_to: localhost
      run_once: true
      when: kuma_url is defined and (kuma_url | length) > 0
      retries: "{{ kuma_retries }}"
      delay: "{{ kuma_delay }}"
      until: kuma_controller.status == 200
      failed_when: false
      changed_when: false
    - name: Kuma | VM-side fetch (HTML via Python, with retries)  # use SSHPASS env here too
      ansible.builtin.command:
        argv:
          - sshpass
          - -e
          - ssh
          - -o
          - StrictHostKeyChecking=no
          - -o
          - ConnectTimeout=15
          - "{{ vm_user }}@{{ vm_ip }}"
          - bash
          - -lc
          - |
            python3 - <<'PY'
            # Fetch Kuma homepage from localhost and print HTML to stdout
            import urllib.request, sys
            try:
                with urllib.request.urlopen("http://127.0.0.1:{{ kuma_port }}/", timeout=15) as r:
                    sys.stdout.write(r.read().decode(errors='ignore'))
            except Exception:
                pass
            PY
      environment:
        SSHPASS: "{{ vm_pass }}"
      register: kuma_vm
      changed_when: false
      failed_when: false
      when: kuma_controller.status | default(0) != 200 or kuma_controller.content is not defined
      retries: "{{ kuma_retries }}"
      delay: "{{ kuma_delay }}"
      until: (kuma_vm.stdout | default('') | trim | length) > 0 and ('Uptime Kuma' in (kuma_vm.stdout | default('')))
      no_log: "{{ DEBUG == 0 }}"   # hide command and output when not debugging
    - name: Kuma | Choose homepage HTML (controller wins, else VM)  # safe guard against empty result
      ansible.builtin.set_fact:
        kuma_home_html: >-
          {{
            (
              kuma_controller.content
              if (kuma_controller is defined)
                 and ((kuma_controller.status|default(0))==200)
                 and (kuma_controller.content is defined)
              else
                 (kuma_vm.stdout | default('') | trim)
            )
          }}
      when:
        - (kuma_controller is defined and (kuma_controller.status|default(0))==200 and (kuma_controller.content is defined))
          or ((kuma_vm.stdout | default('') | trim | length) > 0)
    - name: Kuma | Print concise summary
      ansible.builtin.debug:
        msg: >-
          Uptime Kuma homepage {{ 'reachable' if (kuma_home_html is defined) else 'NOT reachable' }}.
          Source={{ 'controller' if ((kuma_controller is defined) and (kuma_controller.status|default(0))==200 and (kuma_controller.content is defined)) else 'vm' if (kuma_vm.stdout|default('')|trim|length>0) else 'n/a' }};
          length={{ (kuma_home_html | default('')) | length }};
          contains('Uptime Kuma')={{ (kuma_home_html is defined) and ('Uptime Kuma' in kuma_home_html) }}
      when: DEBUG == 1
    - name: Kuma | Homepage unavailable (after retries)
      ansible.builtin.debug:
        msg: "Kuma web není dostupná ani po pokusech."
      when: kuma_home_html is not defined and DEBUG == 1
    # Optional detailed dump (short excerpt only)
    - name: Kuma | HTML excerpt (debug)
      ansible.builtin.debug:
        msg: "{{ (kuma_home_html | default(''))[:500] }}"
      when: kuma_home_html is defined and DEBUG == 1
@@ -1,69 +0,0 @@
 # update_portainer_agent_lxc.yml
 - name: Update Portainer Agent (LXC, no compose)
  hosts: pve2_lxc_jellyfin
  gather_facts: false
  vars:
    agent_container_name: portainer_agent
    agent_port: 9001
  tasks:
    - name: Check if agent container exists
      ansible.builtin.command:
        argv:
          - bash
          - -lc
          - "docker ps -a --format '{{ \"{{\" }}.Names{{ \"}}\" }}' | grep -x '{{ agent_container_name }}'"
      register: agent_exists
      changed_when: false
      failed_when: false
    - name: Abort if agent container is missing
      ansible.builtin.fail:
        msg: "Container '{{ agent_container_name }}' not found."
      when: agent_exists.rc != 0
    - name: Read current agent image
      ansible.builtin.command:
        argv:
          - bash
          - -lc
          - "docker inspect -f '{{ \"{{\" }}.Config.Image{{ \"}}\" }}' {{ agent_container_name }}"
      register: agent_image
      changed_when: false
    - name: Pull latest image tag for current agent image
      ansible.builtin.command:
        argv:
          - bash
          - -lc
          - "docker pull {{ agent_image.stdout | trim }}"
      changed_when: true
    - name: Recreate agent container with standard Portainer Agent args
      ansible.builtin.command:
        argv:
          - bash
          - -lc
          - |
            set -euo pipefail
            # Stop/remove old container
            docker rm -f "{{ agent_container_name }}" >/dev/null 2>&1 || true
            # Run Portainer Agent with common, safe defaults
            docker run -d \
              --name "{{ agent_container_name }}" \
              --restart=always \
              -p {{ agent_port }}:9001 \
              -v /var/run/docker.sock:/var/run/docker.sock \
              -v /var/lib/docker/volumes:/var/lib/docker/volumes \
              "{{ agent_image.stdout | trim }}"
      changed_when: true
    - name: Wait for agent port
      ansible.builtin.wait_for:
        host: 127.0.0.1
        port: "{{ agent_port }}"
        timeout: 60
@@ -1,69 +0,0 @@
 # update_portainer_agent_vm.yml
 - name: Update Portainer Agent (VM, no compose)
  hosts: pve2_vm
  gather_facts: false
  vars:
    agent_container_name: portainer_agent
    agent_port: 9001
  tasks:
    - name: Check if agent container exists
      ansible.builtin.command:
        argv:
          - bash
          - -lc
          - "docker ps -a --format '{{ \"{{\" }}.Names{{ \"}}\" }}' | grep -x '{{ agent_container_name }}'"
      register: agent_exists
      changed_when: false
      failed_when: false
    - name: Abort if agent container is missing
      ansible.builtin.fail:
        msg: "Container '{{ agent_container_name }}' not found."
      when: agent_exists.rc != 0
    - name: Read current agent image
      ansible.builtin.command:
        argv:
          - bash
          - -lc
          - "docker inspect -f '{{ \"{{\" }}.Config.Image{{ \"}}\" }}' {{ agent_container_name }}"
      register: agent_image
      changed_when: false
    - name: Pull latest image tag for current agent image
      ansible.builtin.command:
        argv:
          - bash
          - -lc
          - "docker pull {{ agent_image.stdout | trim }}"
      changed_when: true
    - name: Recreate agent container with standard Portainer Agent args
      ansible.builtin.command:
        argv:
          - bash
          - -lc
          - |
            set -euo pipefail
            # Stop/remove old container
            docker rm -f "{{ agent_container_name }}" >/dev/null 2>&1 || true
            # Run Portainer Agent with common, safe defaults
            docker run -d \
              --name "{{ agent_container_name }}" \
              --restart=always \
              -p {{ agent_port }}:9001 \
              -v /var/run/docker.sock:/var/run/docker.sock \
              -v /var/lib/docker/volumes:/var/lib/docker/volumes \
              "{{ agent_image.stdout | trim }}"
      changed_when: true
    - name: Wait for agent port
      ansible.builtin.wait_for:
        host: 127.0.0.1
        port: "{{ agent_port }}"
        timeout: 60
@@ -0,0 +1,2 @@
 collections:
  - name: community.routeros
@@ -0,0 +1,57 @@
 ---
 - name: Send and verify SMS delivery via internet-master.cz
  hosts: localhost
  gather_facts: false
  vars:
    sms_number: "601358865"
    sms_username: "mikrotik"
    sms_password_send: "jdkotzHJIOPWhjtr32D"
    sms_password_recv: "jdkotzHJIOPWhjtr32D"
    sms_wait_seconds: 120   # Wait 2 minutes for delivery
  tasks:
    - name: Generate random test string
      set_fact:
        random_string: "mikrotik_{{ lookup('password', '/dev/null length=8 chars=ascii_letters') }}"
    - name: Send SMS message
      uri:
        url: "https://sms.internet-master.cz/send/?number={{ sms_number }}&message=@mikrotik@{{ random_string | urlencode }}&type=class-1&username={{ sms_username }}&password={{ sms_password_send }}"
        method: GET
        return_content: true
      register: send_result
    - name: Show send API response
      debug:
        var: send_result.content
    - name: Wait for SMS to be delivered
      pause:
        seconds: "{{ sms_wait_seconds }}"
    - name: Fetch received messages
      uri:
        url: "https://sms.internet-master.cz/receive/?username={{ sms_username }}&password={{ sms_password_recv }}"
        method: GET
        return_content: true
      register: recv_result
    - name: Parse received JSON
      set_fact:
        inbox: "{{ recv_result.json.inbox | default([]) }}"
    - name: Check if random string message was received
      set_fact:
        message_found: "{{ inbox | selectattr('message', 'equalto', random_string) | list | length > 0 }}"
    - name: Report result
      debug:
        msg: >
          SMS with message '{{ random_string }}' was {{
            'delivered ✅' if message_found else 'NOT delivered ❌'
          }}.
    - name: Fail if not delivered
      fail:
        msg: "Message '{{ random_string }}' not found in received inbox!"
      when: not message_found
@@ -0,0 +1,91 @@
 ---
 - name: Update system (APT + Flatpak)
  hosts: all
  become: yes
  gather_facts: yes
  serial: 5
  tasks:
    - name: Ensure SSH is reachable (skip host if not)
      delegate_to: localhost
      wait_for:
        host: "{{ ansible_host | default(inventory_hostname) }}"
        port: 22
        timeout: 5
      register: ssh_check
      ignore_errors: yes
    - meta: end_host
      when: ssh_check is failed
    - name: Ping with retries (handle intermittent flaps)
      ping:
      register: ping_result
      retries: 5
      delay: 5
      until: ping_result is success
    - name: Wait for apt lock to be released
      shell: |
        while fuser /var/lib/dpkg/lock-frontend >/dev/null 2>&1; do
          echo "Waiting for apt lock..."
          sleep 5
        done
      changed_when: false
    - name: Update apt cache
      apt:
        update_cache: yes
    - name: Perform full upgrade
      apt:
        upgrade: full
        autoremove: yes
        autoclean: yes
      register: apt_upgrade
      retries: 3
      delay: 10
      until: apt_upgrade is succeeded
    - name: Fix broken packages
      command: apt-get -f install -y
      register: fix_result
      failed_when: false
      changed_when: "'Setting up' in fix_result.stdout"
    - name: Check if Flatpak is installed
      command: which flatpak
      register: flatpak_check
      changed_when: false
      failed_when: false
    - name: Update system Flatpaks
      command: flatpak update -y --noninteractive --system
      when: flatpak_check.rc == 0
      failed_when: false
    - name: Update user Flatpaks
      command: flatpak update -y --noninteractive --user
      become: false
      when: flatpak_check.rc == 0
      failed_when: false
    - name: Remove unused Flatpaks
      command: flatpak uninstall -y --noninteractive --unused
      when: flatpak_check.rc == 0
      failed_when: false
    - name: Update snap packages
      command: snap refresh
      failed_when: false
    - name: Check if reboot is required
      stat:
        path: /var/run/reboot-required
      register: reboot_required
    - name: Notify if reboot required
      debug:
        msg: "Reboot required on {{ inventory_hostname }}"
      when: reboot_required.stat.exists
@@ -1,85 +0,0 @@
 # update_bettershift.yml
 - name: Update BetterShift
  hosts: pve2_vm
  gather_facts: false
  vars:
    compose_local_dir: "{{ playbook_dir }}/docker-compose"
    compose_remote_base: "/home/{{ ansible_user }}/.ansible-compose/docker-compose"
    bettershift_project: bettershift
    bettershift_compose_filename: "docker-compose-bettershift.yml"
    bettershift_service: bettershift
    bettershift_port: 3067
    bettershift_data_dir: "/data/compose/bettershift/data"
  tasks:
    - name: Ensure remote compose directory exists
      ansible.builtin.file:
        path: "{{ compose_remote_base }}"
        state: directory
        mode: "0755"
    - name: Ensure BetterShift data directory exists
      ansible.builtin.file:
        path: "{{ bettershift_data_dir }}"
        state: directory
        mode: "0755"
    - name: Upload BetterShift compose file to remote host
      ansible.builtin.copy:
        src: "{{ compose_local_dir }}/{{ bettershift_compose_filename }}"
        dest: "{{ compose_remote_base }}/{{ bettershift_compose_filename }}"
        mode: "0644"
    - name: Check BetterShift env file exists on remote host
      ansible.builtin.stat:
        path: "{{ compose_remote_base }}/.env.bettershift"
      register: bettershift_env_file
    - name: Fail if BetterShift env file is missing
      ansible.builtin.fail:
        msg: >-
          Missing {{ compose_remote_base }}/.env.bettershift on remote host.
          Create it manually because it contains secrets.
      when: not bettershift_env_file.stat.exists
    - name: Pull latest BetterShift image
      community.docker.docker_compose_v2:
        project_name: "{{ bettershift_project }}"
        project_src: "{{ compose_remote_base }}"
        files:
          - "{{ bettershift_compose_filename }}"
        pull: always
    - name: Recreate BetterShift service
      community.docker.docker_compose_v2:
        project_name: "{{ bettershift_project }}"
        project_src: "{{ compose_remote_base }}"
        files:
          - "{{ bettershift_compose_filename }}"
        services:
          - "{{ bettershift_service }}"
        state: present
        recreate: always
    - name: Wait for BetterShift port
      ansible.builtin.wait_for:
        host: 127.0.0.1
        port: "{{ bettershift_port }}"
        timeout: 60
    - name: Check BetterShift HTTP endpoint
      ansible.builtin.uri:
        url: "http://127.0.0.1:{{ bettershift_port }}/"
        status_code:
          - 200
          - 307
          - 308
        follow_redirects: none
      register: bettershift_http
      retries: 30
      delay: 3
      until: bettershift_http.status in [200, 307, 308]
      changed_when: false
@@ -1,139 +0,0 @@
 # update_glance.yml
 - name: Update Glance
  hosts: pve2_vm
  gather_facts: false
  vars:
    # Compose sync (controller -> target)
    compose_local_dir: "{{ playbook_dir }}/docker-compose"
    compose_remote_base: "/home/{{ ansible_user }}/.ansible-compose"
    # Glance settings
    glance_project: glance
    glance_port: 9445
    glance_compose_filename: "docker-compose-glance.yml"
    glance_service: glance
    # Own project directory, so .env does not collide with other stacks
    glance_remote_dir: "{{ compose_remote_base }}/glance"
    glance_config_remote_dir: "{{ compose_remote_base }}/glance/config"
    # Config delivery (git -> controller -> target)
    glance_config_local: "{{ playbook_dir }}/files/glance/glance.yml"
    # Persistent env file on the VM (NOT in git)
    glance_env_persistent: "{{ compose_remote_base }}/env/glance.env"
  tasks:
    - name: Ensure remote base directory exists
      ansible.builtin.file:
        path: "{{ compose_remote_base }}"
        state: directory
        mode: "0755"
    - name: Ensure remote env directory exists
      ansible.builtin.file:
        path: "{{ compose_remote_base }}/env"
        state: directory
    - name: Check for persistent Glance env file
      ansible.builtin.stat:
        path: "{{ glance_env_persistent }}"
      register: glance_env_stat
    - name: Abort when Glance env is missing
      ansible.builtin.fail:
        msg: >-
          Missing persistent env file: {{ glance_env_persistent }}.
          Create it on the VM with a GITHUB_TOKEN variable.
      when: not glance_env_stat.stat.exists
    - name: Ensure Glance project directory exists
      ansible.builtin.file:
        path: "{{ glance_remote_dir }}"
        state: directory
        mode: "0755"
    - name: Ensure Glance config directory exists
      ansible.builtin.file:
        path: "{{ glance_config_remote_dir }}"
        state: directory
        mode: "0755"
    - name: Upload Glance compose file to remote host
      ansible.builtin.copy:
        src: "{{ compose_local_dir }}/{{ glance_compose_filename }}"
        dest: "{{ glance_remote_dir }}/{{ glance_compose_filename }}"
        mode: "0644"
    - name: Upload Glance configuration
      ansible.builtin.copy:
        src: "{{ glance_config_local }}"
        dest: "{{ glance_config_remote_dir }}/glance.yml"
        mode: "0644"
    - name: Deploy Glance .env into compose directory
      ansible.builtin.copy:
        src: "{{ glance_env_persistent }}"
        dest: "{{ glance_remote_dir }}/.env"
        remote_src: true
        mode: "0600"
    - name: Pull latest Glance image
      community.docker.docker_compose_v2:
        project_name: "{{ glance_project }}"
        project_src: "{{ glance_remote_dir }}"
        files:
          - "{{ glance_compose_filename }}"
        pull: always
    - name: Recreate Glance service
      community.docker.docker_compose_v2:
        project_name: "{{ glance_project }}"
        project_src: "{{ glance_remote_dir }}"
        files:
          - "{{ glance_compose_filename }}"
        services:
          - "{{ glance_service }}"
        state: present
        recreate: always
    - name: Verify Glance is serving
      block:
        - name: Wait for Glance port
          ansible.builtin.wait_for:
            host: 127.0.0.1
            port: "{{ glance_port }}"
            timeout: 60
        - name: Check Glance HTTP endpoint (retry until ready)
          ansible.builtin.uri:
            url: "http://127.0.0.1:{{ glance_port }}/"
            status_code: 200
          register: glance_http
          retries: 30
          delay: 3
          until: glance_http.status == 200
          changed_when: false
      rescue:
        - name: Collect Glance container logs
          ansible.builtin.command:
            cmd: "docker logs --tail 50 glance"
          register: glance_logs
          changed_when: false
          failed_when: false
        - name: Show Glance container logs
          ansible.builtin.debug:
            msg: "{{ glance_logs.stderr_lines | default([]) + glance_logs.stdout_lines | default([]) }}"
        - name: Fail after showing logs
          ansible.builtin.fail:
            msg: "Glance did not become healthy on port {{ glance_port }}. See container logs above."
    - name: Clean up legacy compose file from shared base directory
      ansible.builtin.file:
        path: "{{ compose_remote_base }}/{{ glance_compose_filename }}"
        state: absent
@@ -1,64 +0,0 @@
 # update_homarr.yml
 - name: Update Homarr
  hosts: pve2_vm
  gather_facts: false
  vars:
    # Compose sync (controller -> target)
    compose_local_dir: "{{ playbook_dir }}/docker-compose"
    compose_remote_base: "/home/{{ ansible_user }}/.ansible-compose"
    # Homarr settings
    homarr_project: homarr
    homarr_compose_filename: "docker-compose-homarr.yml"
    homarr_service: homarr
    homarr_port: 7575
  tasks:
    - name: Ensure remote compose directory exists
      ansible.builtin.file:
        path: "{{ compose_remote_base }}"
        state: directory
        mode: "0755"
    - name: Upload Homarr compose file to remote host
      ansible.builtin.copy:
        src: "{{ compose_local_dir }}/{{ homarr_compose_filename }}"
        dest: "{{ compose_remote_base }}/{{ homarr_compose_filename }}"
        mode: "0644"
    - name: Pull latest Homarr image
      community.docker.docker_compose_v2:
        project_name: "{{ homarr_project }}"
        project_src: "{{ compose_remote_base }}"
        files:
          - "{{ homarr_compose_filename }}"
        pull: always
    - name: Recreate Homarr service
      community.docker.docker_compose_v2:
        project_name: "{{ homarr_project }}"
        project_src: "{{ compose_remote_base }}"
        files:
          - "{{ homarr_compose_filename }}"
        services:
          - "{{ homarr_service }}"
        state: present
        recreate: always
    - name: Wait for Homarr port
      ansible.builtin.wait_for:
        host: 127.0.0.1
        port: "{{ homarr_port }}"
        timeout: 60
    - name: Check Homarr HTTP endpoint
      ansible.builtin.uri:
        url: "http://127.0.0.1:{{ homarr_port }}/"
        status_code: 200
      register: homarr_http
      retries: 30
      delay: 3
      until: homarr_http.status == 200
      changed_when: false
@@ -1,116 +0,0 @@
 # update_immich.yml
 - name: Update Immich
  hosts: pve2_vm
  gather_facts: false
  vars:
    # Compose sync (controller -> target)
    compose_local_dir: "{{ playbook_dir }}/docker-compose"
    compose_remote_base: "/home/{{ ansible_user }}/.ansible-compose"
    compose_remote_dir: "{{ compose_remote_base }}/docker-compose"
    compose_remote_archive: "{{ compose_remote_base }}/docker-compose.tar.gz"
    # Immich settings
    immich_project: immich
    immich_port: 2283
    immich_compose_files:
      - docker-compose-immich.yml
      - docker-compose-immich.override.yml
    # Persistent env file on the VM (NOT in git)
    immich_env_persistent: "{{ compose_remote_base }}/env/immich.env"
  tasks:
    - name: Ensure remote base directory exists
      ansible.builtin.file:
        path: "{{ compose_remote_base }}"
        state: directory
        mode: "0755"
    - name: Ensure remote env directory exists
      ansible.builtin.file:
        path: "{{ compose_remote_base }}/env"
        state: directory
    - name: Fail if persistent Immich env file is missing
      ansible.builtin.stat:
        path: "{{ immich_env_persistent }}"
      register: immich_env_stat
    - name: Abort when Immich env is missing
      ansible.builtin.fail:
        msg: >-
          Missing persistent env file: {{ immich_env_persistent }}.
          Create it on the VM with DB_* and UPLOAD_LOCATION variables.
      when: not immich_env_stat.stat.exists
    - name: Create local archive of docker-compose directory (controller)
      ansible.builtin.archive:
        path: "{{ compose_local_dir }}/"
        dest: "/tmp/docker-compose.tar.gz"
        format: gz
      delegate_to: localhost
      run_once: true
    - name: Upload archive to remote host
      ansible.builtin.copy:
        src: "/tmp/docker-compose.tar.gz"
        dest: "{{ compose_remote_archive }}"
        mode: "0644"
    - name: Recreate remote compose directory
      ansible.builtin.file:
        path: "{{ compose_remote_dir }}"
        state: absent
    - name: Ensure remote compose directory exists
      ansible.builtin.file:
        path: "{{ compose_remote_dir }}"
        state: directory
        mode: "0755"
    - name: Extract archive on remote host
      ansible.builtin.unarchive:
        src: "{{ compose_remote_archive }}"
        dest: "{{ compose_remote_dir }}"
        remote_src: true
    - name: Deploy Immich .env into compose directory
      ansible.builtin.copy:
        src: "{{ immich_env_persistent }}"
        dest: "{{ compose_remote_dir }}/.env"
        remote_src: true
        mode: "0600"
    - name: Pull latest Immich images
      community.docker.docker_compose_v2:
        project_name: "{{ immich_project }}"
        project_src: "{{ compose_remote_dir }}"
        files: "{{ immich_compose_files }}"
        pull: always
    - name: Recreate Immich stack
      community.docker.docker_compose_v2:
        project_name: "{{ immich_project }}"
        project_src: "{{ compose_remote_dir }}"
        files: "{{ immich_compose_files }}"
        state: present
        recreate: always
    - name: Wait for Immich port
      ansible.builtin.wait_for:
        host: 127.0.0.1
        port: "{{ immich_port }}"
        timeout: 120
    - name: Check Immich API ping (retry until ready)
      ansible.builtin.uri:
        url: "http://127.0.0.1:{{ immich_port }}/api/server/ping"
        status_code: 200
        return_content: true
      register: immich_ping
      retries: 40
      delay: 3
      until: immich_ping.status == 200 and ('pong' in (immich_ping.content | default('')))
      changed_when: false
@@ -1,94 +0,0 @@
 # update_jellyfin.yml
 - name: Update Jellyfin
  hosts: pve2_lxc_jellyfin
  gather_facts: false
  vars:
    # Compose sync (controller -> target)
    compose_local_dir: "{{ playbook_dir }}/docker-compose"
    compose_remote_base: "/home/{{ ansible_user }}/.ansible-compose"
    compose_remote_dir: "{{ compose_remote_base }}/docker-compose"
    compose_remote_archive: "{{ compose_remote_base }}/docker-compose.tar.gz"
    # Jellyfin settings
    jellyfin_compose_filename: "docker-compose-jellyfin.yml"
    jellyfin_service: jellyfin
    jellyfin_port: 8096
  tasks:
    - name: Ensure remote base directory exists
      ansible.builtin.file:
        path: "{{ compose_remote_base }}"
        state: directory
        mode: "0755"
    - name: Create local archive of docker-compose directory (controller)
      ansible.builtin.archive:
        path: "{{ compose_local_dir }}/"
        dest: "/tmp/docker-compose.tar.gz"
        format: gz
      delegate_to: localhost
      run_once: true
    - name: Upload archive to remote host
      ansible.builtin.copy:
        src: "/tmp/docker-compose.tar.gz"
        dest: "{{ compose_remote_archive }}"
        mode: "0644"
    - name: Recreate remote compose directory
      ansible.builtin.file:
        path: "{{ compose_remote_dir }}"
        state: absent
    - name: Ensure remote compose directory exists
      ansible.builtin.file:
        path: "{{ compose_remote_dir }}"
        state: directory
        mode: "0755"
    - name: Extract archive on remote host
      ansible.builtin.unarchive:
        src: "{{ compose_remote_archive }}"
        dest: "{{ compose_remote_dir }}"
        remote_src: true
    - name: Pull latest Jellyfin image (docker-compose v1)
      ansible.builtin.command:
        argv:
          - bash
          - -lc
          - >
            cd "{{ compose_remote_dir }}"
            && docker-compose -f "{{ jellyfin_compose_filename }}" pull
      changed_when: true
    - name: Recreate Jellyfin service (docker-compose v1)
      ansible.builtin.command:
        argv:
          - bash
          - -lc
          - >
            cd "{{ compose_remote_dir }}"
            && docker-compose -f "{{ jellyfin_compose_filename }}"
            up -d --force-recreate --remove-orphans "{{ jellyfin_service }}"
      changed_when: true
    - name: Wait for Jellyfin port
      ansible.builtin.wait_for:
        host: 127.0.0.1
        port: "{{ jellyfin_port }}"
        timeout: 180
    - name: Check Jellyfin HTTP endpoint (retry until ready)
      ansible.builtin.uri:
        url: "http://127.0.0.1:{{ jellyfin_port }}/"
        status_code:
          - 200
          - 302
      register: jellyfin_http
      retries: 40
      delay: 3
      until: jellyfin_http.status in [200, 302]
      changed_when: false
@@ -1,142 +0,0 @@
 # update_minecraft.yml
 - name: Update Minecraft (Futurecraft)
  hosts: pve2_vm
  gather_facts: false
  vars:
    # Compose sync (controller -> target)
    compose_local_dir: "{{ playbook_dir }}/docker-compose"
    compose_remote_base: "/home/{{ ansible_user }}/.ansible-compose"
    compose_remote_dir: "{{ compose_remote_base }}/docker-compose"
    compose_remote_archive: "{{ compose_remote_base }}/docker-compose.tar.gz"
    # Minecraft settings
    mc_project: minecraft
    mc_compose_filename: "docker-compose-minecraft.yml"
    mc_port: 25565
    # Persistent env file on the VM (NOT in git)
    # Must contain: CF_API_KEY, RCON_PASSWORD, optionally MEMORY
    mc_env_persistent: "{{ compose_remote_base }}/env/minecraft.env"
    # Container name from your compose file (used for log readiness check)
    mc_container_name: "mc-futurecraft"
  tasks:
    - name: Ensure remote base directory exists
      become: true
      ansible.builtin.file:
        path: "{{ compose_remote_base }}"
        state: directory
        owner: "{{ ansible_user }}"
        group: "{{ ansible_user }}"
        mode: "0755"
    - name: Ensure remote env directory exists
      become: true
      ansible.builtin.file:
        path: "{{ compose_remote_base }}/env"
        state: directory
        owner: "{{ ansible_user }}"
        group: "{{ ansible_user }}"
        mode: "0755"
    - name: Fail if persistent Minecraft env file is missing
      ansible.builtin.stat:
        path: "{{ mc_env_persistent }}"
      register: mc_env_stat
    - name: Abort when Minecraft env is missing
      ansible.builtin.fail:
        msg: >-
          Missing persistent env file: {{ mc_env_persistent }}.
          Create it on the VM with at least:
            CF_API_KEY=...
            RCON_PASSWORD=...
          Optional:
            MEMORY=10G
      when: not mc_env_stat.stat.exists
    - name: Create local archive of docker-compose directory (controller)
      ansible.builtin.archive:
        path: "{{ compose_local_dir }}/"
        dest: "/tmp/docker-compose.tar.gz"
        format: gz
      delegate_to: localhost
      run_once: true
    - name: Upload archive to remote host
      ansible.builtin.copy:
        src: "/tmp/docker-compose.tar.gz"
        dest: "{{ compose_remote_archive }}"
        mode: "0644"
    - name: Recreate remote compose directory
      become: true
      ansible.builtin.file:
        path: "{{ compose_remote_dir }}"
        state: absent
    - name: Ensure remote compose directory exists
      become: true
      ansible.builtin.file:
        path: "{{ compose_remote_dir }}"
        state: directory
        owner: "{{ ansible_user }}"
        group: "{{ ansible_user }}"
        mode: "0755"
    - name: Extract archive on remote host
      ansible.builtin.unarchive:
        src: "{{ compose_remote_archive }}"
        dest: "{{ compose_remote_dir }}"
        remote_src: true
    - name: Deploy Minecraft .env into compose directory
      ansible.builtin.copy:
        src: "{{ mc_env_persistent }}"
        dest: "{{ compose_remote_dir }}/.env"
        remote_src: true
        mode: "0600"
    - name: Pull latest Minecraft images (docker compose)
      ansible.builtin.command: >
        docker compose
        -p {{ mc_project }}
        -f {{ compose_remote_dir }}/{{ mc_compose_filename }}
        pull
      changed_when: false
    - name: Recreate Minecraft stack (docker compose up)
      ansible.builtin.command: >
        docker compose
        -p {{ mc_project }}
        -f {{ compose_remote_dir }}/{{ mc_compose_filename }}
        up -d --remove-orphans --force-recreate
      changed_when: false
    - name: Show last container logs after start (quick diagnostics)
      ansible.builtin.command: >
        docker logs --tail 60 {{ mc_container_name }}
      register: mc_start_logs
      changed_when: false
    - name: Print last logs (for debugging)
      ansible.builtin.debug:
        var: mc_start_logs.stdout_lines
    - name: Wait for Minecraft port
      ansible.builtin.wait_for:
        host: 127.0.0.1
        port: "{{ mc_port }}"
        timeout: 600
    - name: Wait until server reports "Done" in docker logs (ready)
      ansible.builtin.command: >
        docker logs --tail 200 {{ mc_container_name }}
      register: mc_docker_logs
      retries: 60
      delay: 5
      until: "'Done (' in mc_docker_logs.stdout"
      changed_when: false
@@ -1,172 +0,0 @@
 # update_semaphore.yml
 - name: Update Semaphore (self-update safe)
  hosts: pve2_vm
  gather_facts: false
  vars:
    # Compose sync (controller -> target)
    compose_local_dir: "{{ playbook_dir }}/docker-compose"
    compose_remote_base: "/home/{{ ansible_user }}/.ansible-compose"
    compose_remote_dir: "{{ compose_remote_base }}/docker-compose"
    compose_remote_archive: "{{ compose_remote_base }}/docker-compose.tar.gz"
    # Semaphore settings
    semaphore_project: semaphore
    semaphore_container: semaphore
    semaphore_compose_filename: "docker-compose-semaphore.yml"
    semaphore_port: 3000
    semaphore_update_log: "{{ compose_remote_base }}/semaphore-update.log"
    semaphore_update_delay: 20
  tasks:
    - name: Show result of the previous update
      ansible.builtin.command:
        argv: [tail, -n, "12", "{{ semaphore_update_log }}"]
      register: prev_log
      changed_when: false
      failed_when: false
    - name: Previous update result
      ansible.builtin.debug:
        var: prev_log.stdout_lines
    - name: Refuse compose that overrides DB or encryption config
      ansible.builtin.assert:
        that:
          - forbidden | length == 0
        fail_msg: "Compose sets forbidden env vars: {{ forbidden }}. Remove them."
        success_msg: "Compose does not override DB or encryption config."
      vars:
        forbidden: >-
          {{ lookup('file', compose_local_dir ~ '/' ~ semaphore_compose_filename)
             | regex_findall('(?m)^\s*(SEMAPHORE_DB_\w+|SEMAPHORE_ACCESS_KEY_ENCRYPTION)\s*:') }}
      delegate_to: localhost
      run_once: true
    - name: Ensure remote base directory exists
      ansible.builtin.file:
        path: "{{ compose_remote_base }}"
        state: directory
        mode: "0755"
    - name: Create local archive of docker-compose directory (controller)
      ansible.builtin.archive:
        path: "{{ compose_local_dir }}/"
        dest: "/tmp/docker-compose.tar.gz"
        format: gz
      delegate_to: localhost
      run_once: true
    - name: Upload archive to remote host
      ansible.builtin.copy:
        src: "/tmp/docker-compose.tar.gz"
        dest: "{{ compose_remote_archive }}"
        mode: "0644"
    - name: Recreate remote compose directory
      ansible.builtin.file:
        path: "{{ compose_remote_dir }}"
        state: absent
    - name: Ensure remote compose directory exists
      ansible.builtin.file:
        path: "{{ compose_remote_dir }}"
        state: directory
        mode: "0755"
    - name: Extract archive on remote host
      ansible.builtin.unarchive:
        src: "{{ compose_remote_archive }}"
        dest: "{{ compose_remote_dir }}"
        remote_src: true
    - name: Back up Semaphore database
      ansible.builtin.command:
        argv:
          - docker
          - exec
          - "{{ semaphore_container }}"
          - python3
          - -c
          - |
            import json, os, sqlite3, datetime, glob
            cfg = json.load(open('/etc/semaphore/config.json'))
            out = '/etc/semaphore/backups'
            os.makedirs(out, exist_ok=True)
            ts = datetime.datetime.now(datetime.timezone.utc).strftime('%Y%m%d-%H%M%S')
            dst = f'{out}/database-{ts}.sqlite'
            a = sqlite3.connect('file:' + cfg['sqlite']['host'] + '?mode=ro', uri=True)
            b = sqlite3.connect(dst)
            with b:
                a.backup(b)
            b.close(); a.close()
            json.dump(cfg, open(f'{out}/config-{ts}.json', 'w'), indent=2)
            print(dst, os.path.getsize(dst), 'bytes')
            for old in sorted(glob.glob(f'{out}/database-*.sqlite'), reverse=True)[10:]:
                os.remove(old)
                stale = f"{out}/config-{os.path.basename(old)[9:-7]}.json"
                if os.path.exists(stale):
                    os.remove(stale)
                print('pruned', old)
      register: sem_db_backup
      changed_when: true
    - name: Database backup result
      ansible.builtin.debug:
        var: sem_db_backup.stdout_lines
    - name: Recreate Semaphore in the background
      ansible.builtin.shell: |
        cat > "{{ compose_remote_base }}/semaphore-selfupdate.sh" <<'SH'
        #!/usr/bin/env bash
        set -uo pipefail
        exec 2>&1
        cd "{{ compose_remote_dir }}" || exit 1
        COMPOSE=(docker compose -p "{{ semaphore_project }}" -f "{{ semaphore_compose_filename }}")
        # Let the calling job finish and its status get written to the DB
        # before we potentially replace the container running it.
        sleep {{ semaphore_update_delay }}
        echo "=== $(date -Is) update starting ==="
        "${COMPOSE[@]}" pull || { echo "FAIL: pull failed" >&2; exit 1; }
        # No --force-recreate: compose replaces the container only when the
        # image or the resolved config (including env_file) actually changed,
        # so unchanged runs cause no downtime.
        "${COMPOSE[@]}" up -d --remove-orphans --wait --wait-timeout 300
        for _ in $(seq 1 60); do
          code=$(curl -s -o /dev/null -w '%{http_code}' \
            "http://127.0.0.1:{{ semaphore_port }}/api/ping" || true)
          if [ "$code" = "200" ]; then
            echo "image: $(docker inspect "{{ semaphore_container }}" \
              --format '{{ '{{' }}.Config.Image{{ '}}' }}')"
            # Grep the whole log: when the container was not replaced, the
            # startup line is far outside the last few lines.
            docker logs "{{ semaphore_container }}" 2>&1 \
              | grep -m1 'SQLite @' || echo "WARN: no 'SQLite @' line"
            echo "OK: semaphore healthy at $(date -Is)"
            exit 0
          fi
          sleep 5
        done
        echo "FAIL: no 200 from /api/ping after 300s" >&2
        exit 1
        SH
        chmod +x "{{ compose_remote_base }}/semaphore-selfupdate.sh"
        setsid nohup "{{ compose_remote_base }}/semaphore-selfupdate.sh" \
          > "{{ semaphore_update_log }}" 2>&1 < /dev/null &
        echo launched
      args:
        executable: /bin/bash
      changed_when: true
    - name: What happens next
      ansible.builtin.debug:
        msg:
          - "Update starts in {{ semaphore_update_delay }}s, after this job ends."
          - "If the image changed, the container is replaced — expected."
          - "The log is the success signal: tail -n 20 {{ semaphore_update_log }}"
@@ -1,34 +0,0 @@
 - name: Update system (APT + Flatpak)
  hosts: all
  become: true
  become_user: root
  become_method: sudo
  tasks:
    - name: Update APT cache
      apt:
        update_cache: yes
    - name: Upgrade all APT packages
      apt:
        upgrade: dist
    - name: Check if flatpak binary exists
      stat:
        path: /usr/bin/flatpak
      register: flatpak_bin
    - name: Update system Flatpaks
      shell: timeout 300 flatpak update -y
      register: flatpak_sys
      failed_when: flatpak_sys.rc != 0 and flatpak_sys.rc != 124
      when: flatpak_bin.stat.exists
    - name: Update user Flatpaks
      become_user: jakub
      environment:
        XDG_RUNTIME_DIR: /run/user/1000
      shell: timeout 300 flatpak update -y
      register: flatpak_user
      failed_when: flatpak_user.rc != 0 and flatpak_user.rc != 124
      when: flatpak_bin.stat.exists
@@ -1,91 +0,0 @@
 # update_uptimekuma.yml
 - name: Update Uptime Kuma
  hosts: pve1_vm
  gather_facts: false
  vars:
    # Compose sync (controller -> target)
    compose_local_dir: "{{ playbook_dir }}/docker-compose"
    compose_remote_base: "/home/{{ ansible_user }}/.ansible-compose"
    compose_remote_dir: "{{ compose_remote_base }}/docker-compose"
    compose_remote_archive: "{{ compose_remote_base }}/docker-compose.tar.gz"
    # Uptime Kuma settings
    uptimekuma_project: uptimekuma
    uptimekuma_compose_filename: "docker-compose-uptimekuma.yml"
    uptimekuma_service: uptime-kuma
    uptimekuma_port: 3001
  tasks:
    - name: Ensure remote base directory exists
      ansible.builtin.file:
        path: "{{ compose_remote_base }}"
        state: directory
        mode: "0755"
    - name: Create local archive of docker-compose directory (controller)
      ansible.builtin.archive:
        path: "{{ compose_local_dir }}/"
        dest: "/tmp/docker-compose.tar.gz"
        format: gz
      delegate_to: localhost
      run_once: true
    - name: Upload archive to remote host
      ansible.builtin.copy:
        src: "/tmp/docker-compose.tar.gz"
        dest: "{{ compose_remote_archive }}"
        mode: "0644"
    - name: Recreate remote compose directory
      ansible.builtin.file:
        path: "{{ compose_remote_dir }}"
        state: absent
    - name: Ensure remote compose directory exists
      ansible.builtin.file:
        path: "{{ compose_remote_dir }}"
        state: directory
        mode: "0755"
    - name: Extract archive on remote host
      ansible.builtin.unarchive:
        src: "{{ compose_remote_archive }}"
        dest: "{{ compose_remote_dir }}"
        remote_src: true
    - name: Pull latest Uptime Kuma image
      community.docker.docker_compose_v2:
        project_name: "{{ uptimekuma_project }}"
        project_src: "{{ compose_remote_dir }}"
        files:
          - "{{ uptimekuma_compose_filename }}"
        pull: always
    - name: Recreate Uptime Kuma service
      community.docker.docker_compose_v2:
        project_name: "{{ uptimekuma_project }}"
        project_src: "{{ compose_remote_dir }}"
        files:
          - "{{ uptimekuma_compose_filename }}"
        services:
          - "{{ uptimekuma_service }}"
        state: present
        recreate: always
    - name: Wait for Uptime Kuma port
      ansible.builtin.wait_for:
        host: 127.0.0.1
        port: "{{ uptimekuma_port }}"
        timeout: 120
    - name: Check Uptime Kuma HTTP endpoint (retry until ready)
      ansible.builtin.uri:
        url: "http://127.0.0.1:{{ uptimekuma_port }}/"
        status_code: 200
      register: kuma_http
      retries: 30
      delay: 3
      until: kuma_http.status == 200
      changed_when: false
@@ -1,15 +1,12 @@
-# users-ssh-nopasswd.yml
+---
 - name: Ensure users, SSH keys, and passwordless sudo
  hosts: all
  become: true
  become_user: root
  become_method: sudo
  vars:
    users:
      - name: automation
        shell: /bin/bash
        # optional extra groups besides sudo/wheel
        groups: []
        sudo_nopasswd: true
        keys:
@@ -30,33 +27,43 @@
          - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPFS4fsqMjMMu/Bi/884bw7yJBqvWusDRESvanH6Owco jakub@jimbuntu"
  tasks:
    - name: Pick sudo group per distro
      ansible.builtin.set_fact:
-        sudo_group: "{{ 'wheel' if ansible_facts.os_family in ['RedHat','Rocky','AlmaLinux','Fedora','OracleLinux','Suse'] else 'sudo' }}"
+        sudo_group: >-
          {{ 'wheel'
             if ansible_facts.os_family in
             ['RedHat','Rocky','AlmaLinux','Fedora','OracleLinux','Suse']
             else 'sudo' }}
    - name: Ensure user exists (creates home)
      ansible.builtin.user:
        name: "{{ item.name }}"
-        shell: "{{ item.shell | default('/bin/bash') }}"
+        shell: "{{ item.shell | default(omit) }}"
        groups: >-
          {{ (
               (item.groups | default([]))
               + ([sudo_group] if item.sudo_nopasswd | default(false) else [])
-              ) | unique | join(',') if
+             ) | unique | join(',')
-              ((item.groups | default([])) | length > 0) or (item.sudo_nopasswd | default(false))
+             if (
               (item.groups | default([]) | length > 0)
               or item.sudo_nopasswd | default(false)
             )
             else omit }}
        append: true
        create_home: true
        state: present
      loop: "{{ users }}"
-    - name: Install authorized SSH keys
+    - name: Enforce authorized SSH keys
      ansible.builtin.authorized_key:
-        user: "{{ item.0.name }}"
+        user: "{{ item.name }}"
-        key: "{{ item.1 }}"
+        key: "{{ item.keys | join('\n') }}"
        state: present
        manage_dir: true
-      loop: "{{ users | subelements('keys', skip_missing=True) }}"
+        exclusive: true
      loop: "{{ users }}"
      when: item.keys is defined
    - name: Grant passwordless sudo via sudoers.d
      ansible.builtin.copy:
@@ -64,7 +71,9 @@
        owner: root
        group: root
        mode: '0440'
-        content: "{{ item.name }} ALL=(ALL) NOPASSWD:ALL"
+        content: |
          # Managed by Ansible
          {{ item.name }} ALL=(ALL) NOPASSWD:ALL
        validate: 'visudo -cf %s'
      when: item.sudo_nopasswd | default(false)
      loop: "{{ users }}"
Author	SHA1	Message	Date
jakub	32b81131db	Update mikrotikbackup_clean.yml	2026-03-21 09:25:13 +00:00
jakub	dc54737878	Update mikrotikbackup_clean.yml	2026-03-21 09:21:51 +00:00
jakub	9002c65487	Update mikrotikbackup_clean.yml	2026-03-21 09:19:01 +00:00
jakub	3920664747	Update mikrotikbackup_clean.yml	2026-03-21 08:49:35 +00:00
jakub	02bfde0fac	Update mikrotikbackup_clean.yml	2026-03-21 08:46:08 +00:00
jakub	534f002f5b	Update mikrotikbackup_clean.yml	2026-03-21 08:40:46 +00:00
jakub	e6c7b06d73	Update mikrotikbackup_clean.yml	2026-03-21 08:36:47 +00:00
jakub	0d1a9f8138	Update mikrotikbackup_clean.yml	2026-03-21 08:34:16 +00:00
jakub	3d09af19d0	Update mikrotikbackup_clean.yml	2026-03-21 08:31:48 +00:00
jakub	2c61021830	Update mikrotikbackup_clean.yml	2026-03-21 08:28:39 +00:00
jakub	172d758bac	Update mikrotikbackup_clean.yml	2026-03-21 08:26:35 +00:00
jakub	18e10f6aed	Update mikrotikbackup_clean.yml	2026-03-21 08:21:38 +00:00
jakub	65775107d4	Update mikrotikbackup_clean.yml	2026-03-21 08:16:22 +00:00
jakub	388be8ed4c	Update mikrotikbackup_clean.yml	2026-03-21 08:12:42 +00:00
jakub	ab15e3c889	Update mikrotikbackup_clean.yml	2026-03-21 08:07:34 +00:00
jakub	e25e6eebcf	Update mikrotikbackup_clean.yml	2026-03-21 08:03:48 +00:00
jakub	f1607fad65	Update mikrotikbackup_clean.yml	2026-03-21 07:56:36 +00:00
jakub	75f2f20531	Update mikrotikbackup_clean.yml	2026-03-18 16:03:10 +00:00
jakub	8e5c1377eb	Update mikrotikbackup_clean.yml	2026-03-18 15:49:20 +00:00
jakub	5ac5e82b16	Update mikrotikbackup_clean.yml	2026-03-18 15:26:08 +00:00
jakub	b95bdf0b3a	Update mikrotikbackup_clean.yml	2026-03-18 15:24:05 +00:00
jakub	3464fe007a	Update mikrotikbackup_clean.yml	2026-03-18 15:20:54 +00:00
jakub	62d64b0411	Update update.yml	2026-03-11 16:35:49 +00:00
jakub	1bad80c04d	Update update.yml	2026-03-11 16:33:58 +00:00
jakub	f46ab32d7c	Update update.yml	2026-03-11 16:12:30 +00:00
jakub	bd775c5163	Update update.yml	2026-03-11 16:04:55 +00:00
jakub	ad318c50fd	Update update.yml	2026-03-11 16:02:07 +00:00
jakub	fdc61bd22e	Add initial_setup.yml	2026-02-20 18:17:06 +00:00
jakub	3238ad0a5e	Update inv_linuxes	2026-02-20 18:15:08 +00:00
jakub	b1a849824f	Update users-ssh.yml	2026-02-20 14:10:11 +00:00
jakub	11a48e4ccb	Update inv_mikrotiks	2026-02-14 00:01:21 +00:00
jakub	e42363aaec	Update mikrotikbackup_clean.yml	2026-02-13 23:45:02 +00:00
jakub	79ee0ecd46	Update inv_mikrotiks	2026-02-13 22:51:37 +00:00
jakub	8fd180ab11	Add requirements.yml	2026-02-13 22:47:42 +00:00
jakub	07bc4693e3	Update inv_mikrotiks	2026-02-13 22:37:37 +00:00
jakub	8ea60d9e15	Add mikrotikbackup_clean.yml	2026-02-13 22:36:29 +00:00
jakub	4eb25cb78b	Update mikrotikbackup.yml	2026-02-13 14:38:51 +00:00
jakub	4de04d0d3a	Add homarr.yml	2026-01-09 18:23:56 +00:00
jakub	f4262bcb27	Update test_sms.yml	2025-10-14 12:49:40 +00:00
jakub	5c69d3a03f	Update test_sms.yml	2025-10-14 12:35:33 +00:00
jakub	547c9fadc5	Update test_sms.yml	2025-10-14 11:57:23 +00:00
jakub	c07181291c	Update test_sms.yml	2025-10-14 11:55:48 +00:00
jakub	1a0ce36efe	Update test_sms.yml	2025-10-13 12:39:59 +00:00
jakub	8b57f27ec6	Update test_sms.yml	2025-10-13 09:56:02 +00:00
jakub	085e7177f4	Update test_sms.yml	2025-10-13 09:47:28 +00:00
jakub	3099a0b2b8	Update test_sms.yml	2025-10-13 09:45:40 +00:00
jakub	3d89bc523e	Update test_sms.yml	2025-10-13 09:43:52 +00:00
jakub	61d288f92a	Update test_sms.yml	2025-10-12 19:00:20 +00:00
jakub	61beedd023	Update test_sms.yml	2025-10-12 18:59:20 +00:00
jakub	bb37cdaa53	Update test_sms.yml	2025-10-12 18:58:25 +00:00
jakub	b805b506b4	Update test_sms.yml	2025-10-12 18:56:33 +00:00
jakub	9fad4e4d1a	Update inv_linuxes	2025-10-12 18:53:08 +00:00
jakub	a632da2a62	Update test_sms.yml	2025-10-12 18:50:51 +00:00
jakub	cf21ad70c1	Add test_sms.yml	2025-10-12 18:45:30 +00:00
jakub	1deb268d73	Update inv_mikrotiks	2025-09-20 10:26:36 +00:00
jakub	8373252ae9	Update update.yml	2025-09-20 10:12:50 +00:00
jakub	13a48cd734	Update inv_mikrotiks	2025-09-19 11:20:04 +00:00
jakub	b497723769	Update mikrotikbackup.yml	2025-09-19 11:13:44 +00:00