Update inv_linuxes

Reviewed-on: #1

initial_install/roles/freeipa_client/tasks/main.yml

@@ -11,13 +11,18 @@
 
 - name: Set hostname FQDN
   ansible.builtin.hostname:
-    name: "{{ inventory_hostname }}.im.lab"
+    name: "{{ inventory_hostname }}"
 
 - name: Check if FreeIPA client is already configured
   ansible.builtin.stat:
     path: /etc/ipa/default.conf
   register: ipa_client_conf
 
+- name: Check if Kerberos host keytab exists
+  ansible.builtin.stat:
+    path: /etc/krb5.keytab
+  register: ipa_keytab
+
 - name: Enroll to FreeIPA
   ansible.builtin.command:
     argv:
@@ -25,14 +30,36 @@
       - --domain=im.lab
       - --realm=IM.LAB
       - --server=ipa.im.lab
-      - "--hostname={{ inventory_hostname }}.im.lab"
+      - "--hostname={{ inventory_hostname }}"
       - --mkhomedir
       - --principal=admin
-      - --password={{ ipa_admin_password }}
+      - "--password={{ ipa_admin_password }}"
       - --unattended
       - --force-join
-  no_log: false
-  when: not ipa_client_conf.stat.exists
+  no_log: true
+  when:
+    - not ipa_client_conf.stat.exists or not ipa_keytab.stat.exists
+
+- name: Check current sudo alternative
+  ansible.builtin.command:
+    cmd: update-alternatives --query sudo
+  register: sudo_alternative
+  changed_when: false
+  failed_when: false
+  when: ansible_facts['distribution'] == "Ubuntu"
+
+- name: Switch to classic sudo
+  ansible.builtin.command:
+    argv:
+      - update-alternatives
+      - --set
+      - sudo
+      - /usr/bin/sudo.ws
+  when:
+    - ansible_facts['distribution'] == "Ubuntu"
+    - sudo_alternative.rc == 0
+    - "'/usr/bin/sudo.ws' in sudo_alternative.stdout"
+    - "'Value: /usr/bin/sudo.ws' not in sudo_alternative.stdout"
 
 - name: Prioritize SSS over local accounts in NSS
   ansible.builtin.lineinfile:
@@ -44,7 +71,14 @@
     - group
   notify: Restart SSSD
 
-- name: Enable mkhomedir
+- name: Check if authselect is available
+  ansible.builtin.command:
+    cmd: command -v authselect
+  register: authselect_available
+  changed_when: false
+  failed_when: false
+
+- name: Enable mkhomedir with authselect
   ansible.builtin.command:
     argv:
       - authselect
@@ -53,6 +87,7 @@
   register: authselect_mkhomedir
   changed_when: "'already enabled' not in authselect_mkhomedir.stdout"
   failed_when: false
+  when: authselect_available.rc == 0
 
 - name: Enable and start oddjobd
   ansible.builtin.service:

inv_linuxes

@@ -1,20 +1,24 @@
 [linux_servers_jim]
 jimbuntu ansible_host=192.168.19.4
-portainernode2_jim ansible_host=192.168.19.8
-galera3 ansible_host=192.168.19.92
-galera2 ansible_host=192.168.19.91
+portainer2-jim.im.lab ansible_host=192.168.19.8
+#galera3 ansible_host=192.168.19.92
+#galera2 ansible_host=192.168.19.91
 testipaclient ansible_host=192.168.19.98
-testclient ansible_host=192.168.19.115
+#testclient ansible_host=192.168.19.115
 portainer1-jim.im.lab ansible_host=192.168.19.7
 
 [linux_servers_hellsos]
-portainer2_hellsos ansible_host=192.168.52.9
-portainernode_hellsos ansible_host=192.168.52.21
+portainer2-hellsos.im.lab ansible_host=192.168.52.9
+portainer1-hellsos.im.lab ansible_host=192.168.52.21
+amp-hellsos.im.lab ansible_host=192.168.52.4
 
 [linux_servers:children]
 linux_servers_jim
 linux_servers_hellsos
 
 
+[linux_servers_poli]
+portainer1-poli.im.lab ansible_host=192.168.6.3
+
 [local]
 localhost ansible_connection=local

mikrotikbackup_clean.yml

@@ -70,7 +70,6 @@
         _update_text: "{{ update_check.stdout[0] | replace('\r', '') }}"
       tags: [upgrade, never]
 
-    # ⬇️  Add this to see exactly what RouterOS returns before parsing
     - name: Debug raw update output
       ansible.builtin.debug:
         msg: "{{ _update_text }}"
@@ -116,7 +115,15 @@
     - name: Trigger package download and install
       community.routeros.command:
         commands: /system package update install
-      register: upgrade_result
+      vars:
+        ansible_command_timeout: 60
+      when: installed_version != latest_version
+      ignore_errors: true
+      tags: [upgrade, never]
+
+    - name: Wait before reconnecting after reboot
+      ansible.builtin.pause:
+        seconds: 30
       when: installed_version != latest_version
       tags: [upgrade, never]
 
@@ -124,12 +131,10 @@
       community.routeros.command:
         commands: /system resource print
       register: reboot_wait
-      until: reboot_wait is not failed
-      retries: 30
+      until: reboot_wait is succeeded
+      retries: 20
       delay: 15
-      when:
-        - installed_version != latest_version
-        - upgrade_result is not failed
+      when: installed_version != latest_version
       tags: [upgrade, never]
 
     - name: Confirm upgraded version

requirements.yml

@@ -1,2 +1,3 @@
 collections:
   - name: community.routeros
+  - name: community.general

roles/update_apt/tasks/main.yml

@@ -0,0 +1,23 @@
+---
+- name: Update apt cache
+  ansible.builtin.apt:
+    update_cache: true
+    lock_timeout: 300
+
+- name: Perform full upgrade
+  ansible.builtin.apt:
+    upgrade: full
+    autoremove: true
+    autoclean: true
+    lock_timeout: 300
+  register: apt_upgrade
+  retries: 3
+  delay: 10
+  until: apt_upgrade is succeeded
+
+- name: Fix broken packages
+  ansible.builtin.command:
+    cmd: apt-get -f install -y
+  register: fix_result
+  failed_when: false
+  changed_when: "'Setting up' in fix_result.stdout"

roles/update_arch/tasks/main.yml

@@ -0,0 +1,9 @@
+---
+- name: Update pacman cache and upgrade all packages
+  community.general.pacman:
+    update_cache: true
+    upgrade: true
+  register: pacman_upgrade
+  retries: 3
+  delay: 10
+  until: pacman_upgrade is succeeded

roles/update_portainer/defaults/main.yml

@@ -0,0 +1,5 @@
+---
+# Portainer's official updater recreates the server container while preserving
+# its existing Docker configuration and persistent data.
+portainer_updater_image: portainer/portainer-updater:latest
+portainer_target_tag: sts

roles/update_portainer/tasks/main.yml

@@ -0,0 +1,72 @@
+---
+- name: Check whether Docker is available
+  ansible.builtin.command:
+    argv:
+      - docker
+      - info
+  register: portainer_docker_info
+  changed_when: false
+  failed_when: false
+
+- name: Find and update Portainer
+  when: portainer_docker_info.rc == 0
+  block:
+    - name: List all container IDs
+      ansible.builtin.command:
+        argv:
+          - docker
+          - container
+          - ls
+          - --all
+          - --quiet
+      register: portainer_all_containers
+      changed_when: false
+
+    - name: Inspect all container images
+      ansible.builtin.command:
+        argv: >-
+          {{ ['docker', 'container', 'inspect']
+             + portainer_all_containers.stdout_lines }}
+      register: portainer_container_inspection
+      changed_when: false
+      when: portainer_all_containers.stdout_lines | length > 0
+
+    - name: Select installed Portainer editions
+      ansible.builtin.set_fact:
+        portainer_installed_images: >-
+          {{ (portainer_container_inspection.stdout | default('[]') | from_json)
+             | map(attribute='Config.Image')
+             | select('match',
+                 '^(?:[^/]+/)?portainer/(?:portainer|portainer-(?:ce|ee))(?::|@|$)')
+             | unique
+             | list }}
+
+    - name: Update Portainer to the newest release
+      ansible.builtin.command:
+        argv:
+          - docker
+          - run
+          - --rm
+          - --pull
+          - always
+          - --volume
+          - /var/run/docker.sock:/var/run/docker.sock
+          - "{{ portainer_updater_image }}"
+          - portainer
+          - >-
+            --image={{ 'portainer/portainer-ee:' ~ portainer_target_tag
+                       if 'portainer-ee' in item
+                       else 'portainer/portainer-ce:' ~ portainer_target_tag }}
+      loop: "{{ portainer_installed_images }}"
+      loop_control:
+        label: "{{ item }}"
+      register: portainer_update
+      changed_when: true
+      when:
+        - portainer_installed_images | length > 0
+        - not ansible_check_mode
+
+    - name: Report when no Portainer server is installed
+      ansible.builtin.debug:
+        msg: No Portainer CE or Business Edition server container found; skipping.
+      when: portainer_installed_images | length == 0

update.yml

@@ -1,91 +1,141 @@
 ---
-- name: Update system (APT + Flatpak)
-  hosts: all
-  become: yes
-  gather_facts: yes
+- name: Update Linux system
+  hosts: all:!localhost:!portainer2-jim.im.lab
+  become: true
+  gather_facts: false
   serial: 5
 
   tasks:
 
+    # ---------------------------------------------------------
+    # Connectivity
+    # ---------------------------------------------------------
+
     - name: Ensure SSH is reachable (skip host if not)
-      delegate_to: localhost
-      wait_for:
+      ansible.builtin.wait_for:
         host: "{{ ansible_host | default(inventory_hostname) }}"
         port: 22
         timeout: 5
+      delegate_to: localhost
       register: ssh_check
-      ignore_errors: yes
+      ignore_errors: true
+      become: false
 
-    - meta: end_host
+    - name: Skip host if SSH is unreachable
+      ansible.builtin.meta: end_host
       when: ssh_check is failed
 
+    - name: Gather facts
+      ansible.builtin.setup:
+
     - name: Ping with retries (handle intermittent flaps)
-      ping:
+      ansible.builtin.ping:
       register: ping_result
       retries: 5
       delay: 5
       until: ping_result is success
 
-    - name: Wait for apt lock to be released
-      shell: |
-        while fuser /var/lib/dpkg/lock-frontend >/dev/null 2>&1; do
-          echo "Waiting for apt lock..."
-          sleep 5
-        done
-      changed_when: false
+    # ---------------------------------------------------------
+    # Distribution packages
+    # ---------------------------------------------------------
 
-    - name: Update apt cache
-      apt:
-        update_cache: yes
+    - name: Update Debian-family packages
+      ansible.builtin.include_role:
+        name: update_apt
+      when: ansible_facts.os_family == 'Debian'
 
-    - name: Perform full upgrade
-      apt:
-        upgrade: full
-        autoremove: yes
-        autoclean: yes
-      register: apt_upgrade
-      retries: 3
-      delay: 10
-      until: apt_upgrade is succeeded
+    - name: Update Arch Linux packages
+      ansible.builtin.include_role:
+        name: update_arch
+      when: ansible_facts.os_family == 'Archlinux'
 
-    - name: Fix broken packages
-      command: apt-get -f install -y
-      register: fix_result
-      failed_when: false
-      changed_when: "'Setting up' in fix_result.stdout"
+    - name: Skip unsupported Linux distribution
+      ansible.builtin.debug:
+        msg: >-
+          Package updates are not configured for
+          {{ ansible_facts.distribution }} ({{ ansible_facts.os_family }}).
+      when: ansible_facts.os_family not in ['Debian', 'Archlinux']
+
+    # ---------------------------------------------------------
+    # Flatpak
+    # ---------------------------------------------------------
 
     - name: Check if Flatpak is installed
-      command: which flatpak
+      ansible.builtin.command:
+        cmd: which flatpak
       register: flatpak_check
       changed_when: false
       failed_when: false
 
     - name: Update system Flatpaks
-      command: flatpak update -y --noninteractive --system
-      when: flatpak_check.rc == 0
+      ansible.builtin.command:
+        cmd: flatpak update -y --noninteractive --system
+      register: flatpak_system_update
+      changed_when: "'Nothing to do' not in flatpak_system_update.stdout"
       failed_when: false
+      when: flatpak_check.rc == 0
 
     - name: Update user Flatpaks
-      command: flatpak update -y --noninteractive --user
+      ansible.builtin.command:
+        cmd: flatpak update -y --noninteractive --user
       become: false
-      when: flatpak_check.rc == 0
+      register: flatpak_user_update
+      changed_when: "'Nothing to do' not in flatpak_user_update.stdout"
       failed_when: false
+      when: flatpak_check.rc == 0
 
     - name: Remove unused Flatpaks
-      command: flatpak uninstall -y --noninteractive --unused
+      ansible.builtin.command:
+        cmd: flatpak uninstall -y --noninteractive --unused
+      register: flatpak_unused
+      changed_when: "'Nothing unused to uninstall' not in flatpak_unused.stdout"
+      failed_when: false
       when: flatpak_check.rc == 0
+
+    # ---------------------------------------------------------
+    # Snap
+    # ---------------------------------------------------------
+
+    - name: Check if Snap is installed
+      ansible.builtin.command:
+        cmd: which snap
+      register: snap_check
+      changed_when: false
       failed_when: false
 
     - name: Update snap packages
-      command: snap refresh
+      ansible.builtin.command:
+        cmd: snap refresh
+      register: snap_refresh
+      changed_when: "'All snaps up to date' not in snap_refresh.stdout"
       failed_when: false
+      when: snap_check.rc == 0
+
+    # ---------------------------------------------------------
+    # Reboot check
+    # ---------------------------------------------------------
 
     - name: Check if reboot is required
-      stat:
+      ansible.builtin.stat:
         path: /var/run/reboot-required
       register: reboot_required
 
     - name: Notify if reboot required
-      debug:
+      ansible.builtin.debug:
         msg: "Reboot required on {{ inventory_hostname }}"
       when: reboot_required.stat.exists
+
+    # ---------------------------------------------------------
+    # Portainer
+    # Only runs when --tags portainer is specified
+    # ---------------------------------------------------------
+
+    - name: Update Portainer containers
+      ansible.builtin.include_role:
+        name: update_portainer
+        apply:
+          tags:
+            - portainer
+      tags:
+        - never
+        - portainer