# update_immich.yml - name: Update Immich on VM via Proxmox hosts: linux_servers gather_facts: false become: true become_user: root become_method: sudo vars: # --- Connection to VM (provided by Semaphore env vars) --- vm_ip: "{{ lookup('env', 'VM_IP') }}" vm_user: "{{ lookup('env', 'VM_USER') }}" vm_pass: "{{ lookup('env', 'VM_PASS') }}" use_sudo: false # --- Debug mode (controlled via Semaphore variable) --- DEBUG: "{{ lookup('env', 'DEBUG') | default(0) | int }}" RETRIES: "{{ lookup('env', 'RETRIES') | default(25) | int }}" # --- Immich specifics --- immich_project: "immich" # Where compose file lives on the VM immich_compose_dir: "/opt/immich" immich_compose_file: "{{ immich_compose_dir }}/docker-compose.yml" # Official Immich compose URL (latest release) immich_compose_url: "https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml" immich_port: 2283 # Optional external URL for controller-side readiness check # Default to https://photos.martinfencl.eu/photos if IMMICH_URL is not set immich_url: "{{ lookup('env', 'IMMICH_URL') | default('https://photos.martinfencl.eu/photos', true) }}" immich_retries: "{{ RETRIES }}" immich_delay: 2 # Docker command prefix (consistent behavior and quiet hints) docker_prefix: "unalias docker 2>/dev/null || true; DOCKER_CLI_HINTS=0; command docker" # Commands to run on the target VM (quiet outputs) # 1) Download latest docker-compose.yml from GitHub (with backup) # 2) Pull images according to compose # 3) Start / update stack immich_commands: - "cd {{ immich_compose_dir }} && wget -qO docker-compose.yml.new {{ immich_compose_url }} || true; if [ -s docker-compose.yml.new ]; then echo 'Downloaded new docker-compose.yml from GitHub (Immich latest).'; if [ -f docker-compose.yml ]; then cp docker-compose.yml docker-compose.yml.bak-$(date +%F_%H-%M-%S); echo 'Existing docker-compose.yml backed up.'; fi; mv docker-compose.yml.new docker-compose.yml; else echo 'WARNING: Failed to download a valid docker-compose.yml, keeping existing one.' >&2; rm -f docker-compose.yml.new 2>/dev/null || true; fi" - "{{ docker_prefix }} compose -p {{ immich_project }} -f {{ immich_compose_file }} pull >/dev/null" - "{{ docker_prefix }} compose -p {{ immich_project }} -f {{ immich_compose_file }} up -d --remove-orphans --force-recreate >/dev/null" # - "{{ docker_prefix }} compose -p {{ immich_project }} -f {{ immich_compose_file }} up -d --remove-orphans >/dev/null" tasks: - name: Ensure sshpass is installed (for password-based SSH) # English comments ansible.builtin.apt: name: sshpass state: present update_cache: yes - name: Run Immich update commands on VM (via SSH) # use SSHPASS env, hide item value ansible.builtin.command: argv: - sshpass - -e - ssh - -o - StrictHostKeyChecking=no - -o - ConnectTimeout=15 - "{{ vm_user }}@{{ vm_ip }}" - bash - -lc - "{{ ('sudo ' if use_sudo else '') + item }}" environment: SSHPASS: "{{ vm_pass }}" loop: "{{ immich_commands }}" loop_control: index_var: idx label: "cmd-{{ idx }}" register: immich_cmds changed_when: false no_log: "{{ DEBUG == 0 }}" run_once: true # <<< přidat - name: Show outputs for each Immich command ansible.builtin.debug: msg: | CMD: {{ item.item }} RC: {{ item.rc }} STDOUT: {{ (item.stdout | default('')).strip() }} STDERR: {{ (item.stderr | default('')).strip() }} loop: "{{ immich_cmds.results }}" when: DEBUG == 1 - name: Fail play if any Immich command failed ansible.builtin.assert: that: "item.rc == 0" fail_msg: "Immich update failed on VM: {{ item.item }} (rc={{ item.rc }})" success_msg: "All Immich update commands succeeded." loop: "{{ immich_cmds.results }}" loop_control: index_var: idx label: "cmd-{{ idx }}" run_once: true # ------------------------- # Readiness checks (controller first, then VM fallback) # ------------------------- - name: Immich | Wait for web UI (controller first, with retries) ansible.builtin.uri: url: "{{ (immich_url | regex_replace('/$','')) + '/' }}" method: GET return_content: true # Validate TLS only when using https:// validate_certs: "{{ (immich_url | default('')) is match('^https://') }}" status_code: 200 register: immich_controller delegate_to: localhost run_once: true when: immich_url is defined and (immich_url | length) > 0 retries: "{{ immich_retries }}" delay: "{{ immich_delay }}" until: immich_controller.status == 200 failed_when: false # allow task to finish without failing the play changed_when: false - name: Immich | VM-side fetch (HTML via Python, with retries) # use SSHPASS env here too ansible.builtin.command: argv: - sshpass - -e - ssh - -o - StrictHostKeyChecking=no - -o - ConnectTimeout=15 - "{{ vm_user }}@{{ vm_ip }}" - bash - -lc - | python3 - <<'PY' # Fetch Immich web UI from localhost and print HTML to stdout import urllib.request, sys try: with urllib.request.urlopen("http://127.0.0.1:{{ immich_port }}/", timeout=15) as r: sys.stdout.write(r.read().decode(errors='ignore')) except Exception: pass PY environment: SSHPASS: "{{ vm_pass }}" register: immich_vm changed_when: false failed_when: false when: immich_controller.status | default(0) != 200 or immich_controller.content is not defined retries: "{{ immich_retries }}" delay: "{{ immich_delay }}" until: (immich_vm.stdout | default('') | trim | length) > 0 and ('Immich' in (immich_vm.stdout | default(''))) no_log: "{{ DEBUG == 0 }}" - name: Immich | Choose homepage HTML (controller wins, else VM) # safe guard against empty result ansible.builtin.set_fact: immich_home_html: >- {{ ( immich_controller.content if (immich_controller is defined) and ((immich_controller.status|default(0))==200) and (immich_controller.content is defined) else (immich_vm.stdout | default('') | trim) ) }} when: - (immich_controller is defined and (immich_controller.status|default(0))==200 and (immich_controller.content is defined)) or ((immich_vm.stdout | default('') | trim | length) > 0) - name: Immich | Print concise summary ansible.builtin.debug: msg: >- Immich web UI {{ 'reachable' if (immich_home_html is defined) else 'NOT reachable' }}. Source={{ 'controller' if ((immich_controller is defined) and (immich_controller.status|default(0))==200 and (immich_controller.content is defined)) else 'vm' if (immich_vm.stdout|default('')|trim|length>0) else 'n/a' }}; length={{ (immich_home_html | default('')) | length }}; contains('Immich')={{ (immich_home_html is defined) and ('Immich' in immich_home_html) }} when: DEBUG == 1 - name: Immich | Web UI unavailable (after retries) ansible.builtin.debug: msg: "Immich web není dostupný ani po pokusech." when: immich_home_html is not defined and DEBUG == 1 # Optional detailed dump (short excerpt only) - name: Immich | HTML excerpt (debug) ansible.builtin.debug: msg: "{{ (immich_home_html | default(''))[:500] }}" when: immich_home_html is defined and DEBUG == 1 # ------------------------- # Final assertion: controller URL must be reachable # ------------------------- - name: Immich | Assert controller URL reachable (if configured) ansible.builtin.assert: that: - > not (immich_url is defined and (immich_url | length) > 0) or ( immich_controller is defined and (immich_controller.status | default(0)) == 200 ) fail_msg: "Immich controller URL {{ immich_url }} is NOT reachable with HTTP 200 after retries." success_msg: "Immich controller URL {{ immich_url }} is reachable with HTTP 200."