feat: remove obsolete update_tozneberto playbook

- Introduced playbooks for health checks, Collabora updates, Nextcloud backups, upgrades, and Redis updates.
- Each playbook includes necessary tasks for managing services in a Docker environment.

check_raid.yml

@@ -0,0 +1,439 @@
+# check_raid.yml
+
+---
+- name: Check Linux MD RAID health on pve1
+  hosts: pve1_vm
+  gather_facts: false
+
+  vars:
+    # Semaphore Survey Variables are preferred.
+    # Environment variables are used only as a fallback.
+    raid_md_raw: >-
+      {{
+        RAID_MD
+        | default(lookup('env', 'RAID_MD'), true)
+        | default('auto', true)
+        | string
+        | trim
+        | lower
+      }}
+
+    # RAID_MD can be md0, md1, /dev/md0, or auto
+    raid_md_device: "{{ raid_md_raw | regex_replace('^/dev/', '') }}"
+
+    # Allow a healthy array to be checking, repairing, recovering,
+    # resyncing, or reshaping
+    raid_allow_sync: >-
+      {{
+        RAID_ALLOW_SYNC
+        | default(lookup('env', 'RAID_ALLOW_SYNC'), true)
+        | default('1', true)
+        | int
+      }}
+
+    # A server without Linux MD RAID is considered unhealthy by default
+    raid_allow_no_array: >-
+      {{
+        RAID_ALLOW_NO_ARRAY
+        | default(lookup('env', 'RAID_ALLOW_NO_ARRAY'), true)
+        | default('0', true)
+        | int
+      }}
+
+    # Enable raw diagnostic output
+    raid_debug: >-
+      {{
+        DEBUG
+        | default(lookup('env', 'DEBUG'), true)
+        | default('0', true)
+        | int
+      }}
+
+    raid_check_script: |
+      import re
+      import sys
+
+      target = {{ raid_md_device | to_json }}
+      allow_sync = bool({{ raid_allow_sync | int }})
+      allow_no_array = bool({{ raid_allow_no_array | int }})
+
+      try:
+          with open(
+              "/proc/mdstat",
+              "r",
+              encoding="utf-8",
+              errors="replace",
+          ) as mdstat_file:
+              mdstat = mdstat_file.read()
+      except Exception as exc:
+          print(
+              "ERROR RAID "
+              f"read_mdstat_failed="
+              f"{type(exc).__name__}:{exc}"
+          )
+          sys.exit(2)
+
+      header_pattern = re.compile(
+          r"^(md\d+)\s*:\s*(.*)$",
+          re.MULTILINE,
+      )
+
+      header_matches = list(header_pattern.finditer(mdstat))
+      array_blocks = {}
+
+      for index, match in enumerate(header_matches):
+          block_end = (
+              header_matches[index + 1].start()
+              if index + 1 < len(header_matches)
+              else len(mdstat)
+          )
+
+          array_blocks[match.group(1)] = mdstat[
+              match.start():block_end
+          ]
+
+      def md_sort_key(name):
+          try:
+              return int(name[2:])
+          except ValueError:
+              return name
+
+      def parse_array(name, block):
+          lines = block.splitlines()
+          header = lines[0]
+          header_data = header.split(":", 1)[1].strip()
+
+          state_match = re.match(
+              r"^(active|inactive)\b",
+              header_data,
+              re.IGNORECASE,
+          )
+
+          state = (
+              state_match.group(1).lower()
+              if state_match
+              else "unknown"
+          )
+
+          remaining_header = (
+              header_data[state_match.end():].strip()
+              if state_match
+              else header_data
+          )
+
+          mode = "rw"
+
+          # Handle states such as "active (auto-read-only)"
+          if remaining_header.startswith("("):
+              closing_parenthesis = remaining_header.find(")")
+
+              if closing_parenthesis >= 0:
+                  mode = remaining_header[
+                      1:closing_parenthesis
+                  ]
+
+                  remaining_header = remaining_header[
+                      closing_parenthesis + 1:
+                  ].strip()
+
+          level = (
+              remaining_header.split()[0].lower()
+              if remaining_header
+              else "unknown"
+          )
+
+          status_match = re.search(
+              r"\[(\d+)\s*/\s*(\d+)\]"
+              r"\s*\[([U_]+)\]",
+              block,
+          )
+
+          active_members = None
+          total_members = None
+          member_status = None
+
+          if status_match:
+              active_members = int(status_match.group(1))
+              total_members = int(status_match.group(2))
+              member_status = status_match.group(3)
+
+          operation_match = re.search(
+              r"\b("
+              r"resync|"
+              r"recovery|"
+              r"reshape|"
+              r"check|"
+              r"repair"
+              r")\b",
+              block,
+              re.IGNORECASE,
+          )
+
+          operation = (
+              operation_match.group(1).lower()
+              if operation_match
+              else "none"
+          )
+
+          progress_match = re.search(
+              r"(?:"
+              r"resync|"
+              r"recovery|"
+              r"reshape|"
+              r"check|"
+              r"repair"
+              r")\s*=\s*([0-9.]+%)",
+              block,
+              re.IGNORECASE,
+          )
+
+          progress = (
+              progress_match.group(1)
+              if progress_match
+              else "none"
+          )
+
+          return {
+              "name": name,
+              "state": state,
+              "mode": mode,
+              "level": level,
+              "active_members": active_members,
+              "total_members": total_members,
+              "member_status": member_status,
+              "operation": operation,
+              "progress": progress,
+              "faulty_member": bool(
+                  re.search(
+                      r"\(F\)",
+                      block,
+                      re.IGNORECASE,
+                  )
+              ),
+          }
+
+      def format_array(array):
+          if array["member_status"] is None:
+              members = "n/a"
+              member_status = "n/a"
+          else:
+              members = (
+                  f'{array["active_members"]}/'
+                  f'{array["total_members"]}'
+              )
+
+              member_status = array["member_status"]
+
+          return (
+              f'{array["name"]}'
+              "{"
+              f'state={array["state"]},'
+              f'mode={array["mode"]},'
+              f'level={array["level"]},'
+              f'members={members},'
+              f'status={member_status},'
+              f'operation={array["operation"]},'
+              f'progress={array["progress"]}'
+              "}"
+          )
+
+      if not array_blocks:
+          if allow_no_array:
+              print("OK RAID none=no-md-arrays")
+              sys.exit(0)
+
+          print("ERROR RAID none=no-md-arrays")
+          sys.exit(2)
+
+      available_arrays = sorted(
+          array_blocks.keys(),
+          key=md_sort_key,
+      )
+
+      if target == "auto":
+          selected_names = available_arrays
+      elif target in array_blocks:
+          selected_names = [target]
+      else:
+          print(
+              "ERROR RAID "
+              f"target_not_found={target} "
+              f'found={",".join(available_arrays)}'
+          )
+          sys.exit(2)
+
+      selected_arrays = [
+          parse_array(
+              name,
+              array_blocks[name],
+          )
+          for name in selected_names
+      ]
+
+      failures = []
+      errors = []
+
+      # These RAID levels may not always provide a redundant-member token
+      tokenless_levels = {
+          "raid0",
+          "linear",
+      }
+
+      for array in selected_arrays:
+          name = array["name"]
+
+          if array["state"] != "active":
+              failures.append(
+                  f'{name}:state={array["state"]}'
+              )
+
+          if array["faulty_member"]:
+              failures.append(
+                  f"{name}:faulty-member"
+              )
+
+          if array["member_status"] is not None:
+              if "_" in array["member_status"]:
+                  failures.append(
+                      f'{name}:degraded='
+                      f'[{array["member_status"]}]'
+                  )
+
+              if (
+                  array["active_members"]
+                  != array["total_members"]
+              ):
+                  failures.append(
+                      f'{name}:members='
+                      f'{array["active_members"]}/'
+                      f'{array["total_members"]}'
+                  )
+
+          elif array["level"] not in tokenless_levels:
+              errors.append(
+                  f"{name}:member-status-not-found"
+              )
+
+          if (
+              array["operation"] != "none"
+              and not allow_sync
+          ):
+              failures.append(
+                  f'{name}:operation='
+                  f'{array["operation"]}'
+              )
+
+      details = " ".join(
+          format_array(array)
+          for array in selected_arrays
+      )
+
+      if errors:
+          print(
+              f"ERROR RAID {details} "
+              f'reason={";".join(errors)}'
+          )
+          sys.exit(2)
+
+      if failures:
+          print(
+              f"FAIL RAID {details} "
+              f'reason={";".join(failures)}'
+          )
+          sys.exit(1)
+
+      print(f"OK RAID {details}")
+      sys.exit(0)
+
+  tasks:
+    - name: Validate RAID check configuration
+      ansible.builtin.assert:
+        that:
+          - (raid_allow_sync | int) in [0, 1]
+          - (raid_allow_no_array | int) in [0, 1]
+          - (raid_debug | int) in [0, 1]
+          - >-
+            (
+              raid_md_device
+              | regex_search('^(auto|md[0-9]+)$')
+            ) is not none
+        fail_msg: >-
+          ERROR RAID invalid-configuration.
+          RAID_MD must be auto, md0, md1, or /dev/md0.
+          DEBUG, RAID_ALLOW_SYNC, and RAID_ALLOW_NO_ARRAY
+          must be 0 or 1.
+        quiet: true
+
+    - name: Run Linux MD RAID health check
+      ansible.builtin.command:
+        argv:
+          - python3
+          - "-"
+        stdin: "{{ raid_check_script }}"
+        stdin_add_newline: true
+      register: raid_cmd
+      changed_when: false
+      failed_when: false
+
+    - name: Build one-line RAID result
+      ansible.builtin.set_fact:
+        raid_line: >-
+          {%- set stdout = (
+            raid_cmd.stdout
+            | default('')
+            | trim
+            | regex_replace('[\r\n]+', ' ')
+            | regex_replace('\s+', ' ')
+          ) -%}
+          {%- set stderr = (
+            raid_cmd.stderr
+            | default('')
+            | trim
+            | regex_replace('[\r\n]+', ' ')
+            | regex_replace('\s+', ' ')
+          ) -%}
+          {%- if stdout | length > 0 -%}
+          {{ stdout }}
+          {%- elif stderr | length > 0 -%}
+          ERROR RAID command_failed rc={{ raid_cmd.rc }}
+          stderr={{ stderr[:500] }}
+          {%- else -%}
+          ERROR RAID no-output rc={{ raid_cmd.rc }}
+          {%- endif -%}
+      changed_when: false
+
+    - name: Show raw RAID command result
+      ansible.builtin.debug:
+        msg:
+          rc: "{{ raid_cmd.rc }}"
+          stdout: "{{ raid_cmd.stdout | default('') }}"
+          stderr: "{{ raid_cmd.stderr | default('') }}"
+      when: (raid_debug | int) == 1
+
+    - name: Read raw mdstat in debug mode
+      ansible.builtin.command:
+        argv:
+          - cat
+          - /proc/mdstat
+      register: mdstat_debug
+      changed_when: false
+      failed_when: false
+      when: (raid_debug | int) == 1
+
+    - name: Show raw mdstat in debug mode
+      ansible.builtin.debug:
+        msg:
+          rc: "{{ mdstat_debug.rc | default('undefined') }}"
+          stdout: "{{ mdstat_debug.stdout | default('') }}"
+          stderr: "{{ mdstat_debug.stderr | default('') }}"
+      when: (raid_debug | int) == 1
+
+    - name: Show successful RAID result
+      ansible.builtin.debug:
+        msg: "{{ raid_line }}"
+      when: (raid_cmd.rc | int) == 0
+
+    - name: Fail when RAID is unhealthy
+      ansible.builtin.fail:
+        msg: "{{ raid_line }}"
+      when: (raid_cmd.rc | int) != 0

docker-compose/docker-compose-bettershift.yml

@@ -0,0 +1,27 @@
+name: bettershift
+
+services:
+  bettershift:
+    container_name: bettershift
+    image: ghcr.io/pantelx/bettershift:v2.2.1
+    restart: unless-stopped
+
+    ports:
+      - '0.0.0.0:3067:3000'
+
+    volumes:
+      - /data/compose/bettershift/data:/app/data
+
+    env_file:
+      - .env.bettershift
+
+    environment:
+      - TZ=Europe/Prague
+
+networks:
+  backend:
+    driver: bridge
+    ipam:
+      config:
+        - subnet: 172.20.0.0/24
+          gateway: 172.20.0.1

docker-compose/docker-compose-collabora.yml

@@ -0,0 +1,23 @@
+version: '3'
+
+services:
+  collabora:
+    image: collabora/code:latest
+    container_name: collabora
+    restart: unless-stopped
+    networks:
+      - cloud
+    environment:
+      - TZ=Europe/Prague
+      - password=password
+      - username=nextcloud
+      - domain=cloud.martinfencl.eu
+      - extra_params=--o:ssl.enable=false --o:ssl.termination=true
+      - aliasgroup1=https://cloud.martinfencl.eu:443,https://collabora.martinfencl.eu:443
+      - dictionaries=de_DE en_GB en_US es_ES fr_FR it nl pt_BR pt_PT ru cs_CZ
+    ports:
+      - 9980:9980
+
+networks:
+  cloud:
+    driver: bridge

docker-compose/docker-compose-glance.yml

@@ -0,0 +1,25 @@
+# docker-compose-glance.yml
+
+name: glance
+
+services:
+  glance:
+    container_name: glance
+    image: glanceapp/glance:latest
+    restart: unless-stopped
+    volumes:
+      # Relative to project_src (~/.ansible-compose/glance), so no username is
+      # hardcoded. The playbook creates this directory and uploads glance.yml.
+      # The image entrypoint is /app/glance --config /app/config/glance.yml,
+      # so the file must be named exactly glance.yml.
+      - ./config:/app/config
+      - /etc/localtime:/etc/localtime:ro
+    environment:
+      # Used by the calendar widget and by relative timestamps
+      - TZ=Europe/Prague
+    env_file:
+      # Deployed by the playbook from the persistent env file on the VM.
+      # Provides GITHUB_TOKEN, referenced from glance.yml as ${GITHUB_TOKEN}.
+      - .env
+    ports:
+      - '9445:8080'

docker-compose/docker-compose-homarr.yml

@@ -0,0 +1,13 @@
+services:
+  homarr:
+    container_name: homarr
+    image: ghcr.io/homarr-labs/homarr:latest
+    restart: unless-stopped
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock # Optional, only if you want docker integration
+      - /data/compose/homarr/appdata:/appdata
+    environment:
+      - SECRET_ENCRYPTION_KEY=4fb16028fa1788d9a24fa93a323aa4a278524bed177c8c38454f4c4068c1b9b6
+    ports:
+      - '7575:7575'
+  

docker-compose/docker-compose-immich.override.yml

@@ -0,0 +1,5 @@
+services:
+  immich-server:
+    volumes:
+      - /mnt/nextcloud-howard-photos:/mnt/nextcloud-howard-photos
+      - /mnt/nextcloud-kamilkaprdelka-photos:/mnt/nextcloud-kamilkaprdelka-photos

docker-compose/docker-compose-immich.yml

@@ -0,0 +1,77 @@
+#
+# WARNING: To install Immich, follow our guide: https://docs.immich.app/install/docker-compose
+#
+# Make sure to use the docker-compose.yml of the current release:
+#
+# https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml
+#
+# The compose file on main may not be compatible with the latest release.
+
+name: immich
+
+services:
+  immich-server:
+    container_name: immich_server
+    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
+    # extends:
+    #   file: hwaccel.transcoding.yml
+    #   service: cpu # set to one of [nvenc, quicksync, rkmpp, vaapi, vaapi-wsl] for accelerated transcoding
+    volumes:
+      - ${UPLOAD_LOCATION}:/usr/src/app/upload
+      #- /mnt/nextcloud-howard-photos:/mnt/nextcloud-howard-photos:ro  # read-only external library
+      #- /mnt/nextcloud-kamilkaprdelka-photos:/mnt/nextcloud-kamilkaprdelka-photos:ro  # read-only external library
+      - /mnt/nextcloud-howard-photos:/mnt/nextcloud-howard-photos
+      - /mnt/nextcloud-kamilkaprdelka-photos:/mnt/nextcloud-kamilkaprdelka-photos
+      - /etc/localtime:/etc/localtime:ro
+    env_file:
+      - .env
+    ports:
+      - '2283:2283'
+    depends_on:
+      - redis
+      - database
+    restart: always
+    healthcheck:
+      disable: false
+
+  immich-machine-learning:
+    container_name: immich_machine_learning
+    # For hardware acceleration, add one of -[armnn, cuda, rocm, openvino, rknn] to the image tag.
+    # Example tag: ${IMMICH_VERSION:-release}-cuda
+    image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
+    # extends: # uncomment this section for hardware acceleration - see https://docs.immich.app/features/ml-hardware-acceleration
+    #   file: hwaccel.ml.yml
+    #   service: cpu # set to one of [armnn, cuda, rocm, openvino, openvino-wsl, rknn] for accelerated inference - use the `-wsl` version for WSL2 where applicable
+    volumes:
+      - model-cache:/cache
+    env_file:
+      - .env
+    restart: always
+    healthcheck:
+      disable: false
+
+  redis:
+    container_name: immich_redis
+    image: docker.io/valkey/valkey:8@sha256:81db6d39e1bba3b3ff32bd3a1b19a6d69690f94a3954ec131277b9a26b95b3aa
+    healthcheck:
+      test: redis-cli ping || exit 1
+    restart: always
+
+  database:
+    container_name: immich_postgres
+    image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357191b76a916ae5eb93464d65c07511da41e3bf7a8416db519b40b1c23
+    environment:
+      POSTGRES_PASSWORD: ${DB_PASSWORD}
+      POSTGRES_USER: ${DB_USERNAME}
+      POSTGRES_DB: ${DB_DATABASE_NAME}
+      POSTGRES_INITDB_ARGS: '--data-checksums'
+      # Uncomment the DB_STORAGE_TYPE: 'HDD' var if your database isn't stored on SSDs
+      # DB_STORAGE_TYPE: 'HDD'
+    volumes:
+      # Do not edit the next line. If you want to change the database storage location on your system, edit the value of DB_DATA_LOCATION in the .env file
+      - ${DB_DATA_LOCATION}:/var/lib/postgresql/data
+    shm_size: 128mb
+    restart: always
+
+volumes:
+  model-cache:

docker-compose/docker-compose-jellyfin.yml

@@ -0,0 +1,33 @@
+
+services:
+  jellyfin:
+    image: lscr.io/linuxserver/jellyfin:latest
+    container_name: jellyfin
+    restart: unless-stopped
+
+    ports:
+      - "8096:8096"
+      - "7359:7359/udp"
+      - "1900:1900/udp"
+
+    environment:
+      - TZ=Europe/Prague
+      - PUID=0
+      - PGID=0
+
+    volumes:
+      - /opt/jellyfin/config:/config
+      - /opt/jellyfin/cache:/cache
+      - /mnt/films:/media/films:ro
+      - /mnt/books:/media/books:ro
+      - /mnt/ondrulin:/media/ondrulin:ro
+
+    devices:
+      - /dev/dri:/dev/dri
+
+    group_add:
+      - "104"
+      - "44"
+
+    tmpfs:
+      - /transcode:rw,size=8g,mode=1777

docker-compose/docker-compose-minecraft.yml

@@ -0,0 +1,71 @@
+services:
+  mc:
+    image: itzg/minecraft-server:2026.6.0-java17
+    container_name: mc-futurecraft
+    restart: unless-stopped
+
+    ports:
+      - "25565:25565"
+
+    environment:
+      EULA: "TRUE"
+
+      # CurseForge
+      TYPE: "AUTO_CURSEFORGE"
+      CF_API_KEY: "${CF_API_KEY}"
+
+      # Slug is still required as an identifier,
+      # but modpack itself is loaded from the supplied ZIP
+      CF_SLUG: "futurecraft-5-0"
+      CF_MODPACK_ZIP: "/modpacks/futurecraft-5.0.zip"
+
+      # Server
+      MEMORY: "${MEMORY:-10G}"
+      LEVEL: "world"
+      DIFFICULTY: "normal"
+      VIEW_DISTANCE: "10"
+      SIMULATION_DISTANCE: "6"
+      MAX_PLAYERS: "5"
+
+      # RCON
+      ENABLE_RCON: "true"
+      RCON_PASSWORD: "${RCON_PASSWORD}"
+
+      ONLINE_MODE: "FALSE"
+      ENABLE_WHITELIST: "TRUE"
+
+    volumes:
+      - mc_data:/data
+      - /home/howard/.ansible-compose/modpacks:/modpacks:ro
+
+
+  backup:
+    image: itzg/mc-backup:latest
+    container_name: mc-futurecraft-backup
+    restart: unless-stopped
+
+    depends_on:
+      - mc
+
+    environment:
+      SRC_DIR: "/data"
+      DEST_DIR: "/backups"
+
+      BACKUP_INTERVAL: "12h"
+      INITIAL_DELAY: "5m"
+      PRUNE_BACKUPS_DAYS: "5"
+
+      EXCLUDES: "backups,cache,logs"
+
+      RCON_HOST: "mc"
+      RCON_PASSWORD: "${RCON_PASSWORD}"
+
+    volumes:
+      - mc_data:/data:ro
+      - /backups/minecraft-futurecraft:/backups
+
+
+volumes:
+  mc_data:
+    external: true
+    name: minecraft_mc_data

docker-compose/docker-compose-minecraft_old1.yml

@@ -0,0 +1,49 @@
+services:
+  mc:
+    image: itzg/minecraft-server:java17
+    container_name: mc-futurecraft
+    restart: unless-stopped
+    ports:
+      - "25565:25565"
+    environment:
+      EULA: "TRUE"
+      TYPE: "AUTO_CURSEFORGE"
+      CF_API_KEY: "${CF_API_KEY}"
+      CF_SLUG: "futurecraft-5-0"
+
+      JAVA_VERSION: "17"
+
+      MEMORY: "${MEMORY:-10G}"
+      LEVEL: "world"
+      DIFFICULTY: "normal"
+      VIEW_DISTANCE: "10"
+      SIMULATION_DISTANCE: "6"
+      MAX_PLAYERS: "5"
+
+      ENABLE_RCON: "true"
+      RCON_PASSWORD: "${RCON_PASSWORD}"
+      ONLINE_MODE: "FALSE"
+      ENABLE_WHITELIST: "TRUE"
+    volumes:
+      - mc_data:/data
+
+  backup:
+    image: itzg/mc-backup:latest
+    container_name: mc-futurecraft-backup
+    restart: unless-stopped
+    depends_on:
+      - mc
+    environment:
+      SRC_DIR: /data
+      DEST_DIR: /data/backups
+      BACKUP_INTERVAL: "12h"
+      INITIAL_DELAY: "5m"
+      PRUNE_BACKUPS_DAYS: "14"
+      EXCLUDES: "backups,cache,logs"
+      RCON_HOST: mc
+      RCON_PASSWORD: "${RCON_PASSWORD}"
+    volumes:
+      - mc_data:/data
+
+volumes:
+  mc_data:

docker-compose/docker-compose-nextcloud.yml

@@ -0,0 +1,75 @@
+services:
+  nextcloud:
+    image: nextcloud:34.0.2-apache
+    container_name: nextcloud
+    restart: unless-stopped
+    networks:
+      - cloud
+    depends_on:
+      - nextclouddb
+      - redis
+    ports:
+      - 8080:80
+    volumes:
+      - /data/compose/nextcloud/config:/var/www/html/config
+      - /data/compose/nextcloud/data:/var/www/html/data
+      - /data/compose/nextcloud/custom_apps:/var/www/html/custom_apps
+    environment:
+      - TZ=Europe/Prague
+      - MYSQL_DATABASE=nextcloud
+      - MYSQL_USER=nextcloud
+      - MYSQL_PASSWORD=dbpassword
+      - MYSQL_HOST=nextclouddb
+      - REDIS_HOST=redis
+      - NEXTCLOUD_ADMIN_USER=root
+      - NEXTCLOUD_ADMIN_PASSWORD=1234SilneHeslo.-.
+      - PHP_MEMORY_LIMIT=2048M
+
+
+  nextclouddb:
+    image: mariadb
+    container_name: nextcloud-db
+    restart: unless-stopped
+    command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW
+    networks:
+      - cloud
+    volumes:
+      - /data/compose/nextcloud/nextclouddb:/var/lib/mysql
+    environment:
+      - TZ=Europe/Prague
+      - MYSQL_RANDOM_ROOT_PASSWORD=true
+      - MYSQL_DATABASE=nextcloud
+      - MYSQL_USER=nextcloud
+      - MYSQL_PASSWORD=dbpassword
+      - MARIADB_AUTO_UPGRADE=1
+
+  redis:
+    image: redis:alpine
+    container_name: redis
+    restart: unless-stopped
+    command: redis-server --save "" --appendonly no    # cache only, no persistence
+    networks:
+      - cloud
+    volumes:
+      - /data/compose/nextcloud/redis:/data
+
+  #collabora:
+  #  image: collabora/code
+  #  container_name: collabora
+  #  restart: unless-stopped
+  #  networks:
+  #    - cloud
+  #  environment:
+  #    - TZ=Europe/Prague
+  #    - password=password
+  #    - username=nextcloud
+  #    - domain=cloud.martinfencl.eu
+  #    - extra_params=--o:ssl.enable=false --o:ssl.termination=true
+  #    - aliasgroup1=https://cloud.martinfencl.eu:443,https://collabora.martinfencl.eu:443
+  #    - dictionaries=de_DE en_GB en_US es_ES fr_FR it nl pt_BR pt_PT ru cs_CZ
+  #  ports:
+  #    - 9980:9980
+
+networks:
+  cloud:
+    driver: bridge

docker-compose/docker-compose-nextcloud.yml.j2

@@ -0,0 +1,74 @@
+services:
+  nextcloud:
+    image: "nextcloud:{{ nextcloud_version }}-apache"
+    container_name: nextcloud
+    restart: unless-stopped
+    networks:
+      - cloud
+    depends_on:
+      - nextclouddb
+      - redis
+    ports:
+      - 8080:80
+    volumes:
+      - /data/compose/nextcloud/config:/var/www/html/config
+      - /data/compose/nextcloud/data:/var/www/html/data
+      - /data/compose/nextcloud/custom_apps:/var/www/html/custom_apps
+    environment:
+      - TZ=Europe/Prague
+      - MYSQL_DATABASE=nextcloud
+      - MYSQL_USER=nextcloud
+      - MYSQL_PASSWORD=dbpassword
+      - MYSQL_HOST=nextclouddb
+      - REDIS_HOST=redis
+      - NEXTCLOUD_ADMIN_USER=root
+      - NEXTCLOUD_ADMIN_PASSWORD=1234SilneHeslo.-.
+      - PHP_MEMORY_LIMIT=2048M
+
+
+  nextclouddb:
+    image: mariadb
+    container_name: nextcloud-db
+    restart: unless-stopped
+    command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW
+    networks:
+      - cloud
+    volumes:
+      - /data/compose/nextcloud/nextclouddb:/var/lib/mysql
+    environment:
+      - TZ=Europe/Prague
+      - MYSQL_RANDOM_ROOT_PASSWORD=true
+      - MYSQL_DATABASE=nextcloud
+      - MYSQL_USER=nextcloud
+      - MYSQL_PASSWORD=dbpassword
+      - MARIADB_AUTO_UPGRADE=1
+
+  redis:
+    image: redis:alpine
+    container_name: redis
+    restart: unless-stopped
+    networks:
+      - cloud
+    volumes:
+      - /data/compose/nextcloud/redis:/data
+
+  #collabora:
+  #  image: collabora/code
+  #  container_name: collabora
+  #  restart: unless-stopped
+  #  networks:
+  #    - cloud
+  #  environment:
+  #    - TZ=Europe/Prague
+  #    - password=password
+  #    - username=nextcloud
+  #    - domain=cloud.martinfencl.eu
+  #    - extra_params=--o:ssl.enable=false --o:ssl.termination=true
+  #    - aliasgroup1=https://cloud.martinfencl.eu:443,https://collabora.martinfencl.eu:443
+  #    - dictionaries=de_DE en_GB en_US es_ES fr_FR it nl pt_BR pt_PT ru cs_CZ
+  #  ports:
+  #    - 9980:9980
+
+networks:
+  cloud:
+    driver: bridge

docker-compose/docker-compose-semaphore.yml

@@ -0,0 +1,28 @@
+# docker-compose/docker-compose-semaphore.yml
+
+services:
+  semaphore:
+    image: semaphoreui/semaphore:v2.19.6
+    container_name: semaphore
+    user: "0:0"
+    ports:
+      - "3000:3000"
+    environment:
+      SEMAPHORE_TMP_PATH: /var/lib/semaphore/projects
+      SEMAPHORE_ADMIN: admin
+      SEMAPHORE_ADMIN_NAME: admin
+      SEMAPHORE_ADMIN_EMAIL: admin@localhost
+    env_file:
+      - /data/compose/semaphore/semaphore.env
+    volumes:
+      - /data/compose/semaphore/db:/etc/semaphore
+      - /data/compose/semaphore/projects:/var/lib/semaphore/projects
+      - /data/compose/semaphore/backups:/opt/mikrotik_backups/
+      - /data/compose/semaphore/ansible.cfg:/etc/ansible/ansible.cfg:ro
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:3000/api/ping >/dev/null || exit 1"]
+      interval: 10s
+      timeout: 5s
+      retries: 12
+      start_period: 20s
+    restart: unless-stopped

docker-compose/docker-compose-semaphore_backup.yml

@@ -0,0 +1,26 @@
+version: "3.8"
+
+services:
+  semaphore:
+    image: semaphoreui/semaphore:latest
+    user: "0:0"
+    ports:
+      - "3000:3000"
+
+    environment:
+      SEMAPHORE_DB_DIALECT: bolt
+      SEMAPHORE_DB_PATH: /etc/semaphore/semaphore.db.bolt  # full path to file!
+      SEMAPHORE_TMP_PATH: /var/lib/semaphore/projects
+      SEMAPHORE_ADMIN: admin
+      SEMAPHORE_ADMIN_NAME: admin
+      SEMAPHORE_ADMIN_EMAIL: admin@localhost
+      SEMAPHORE_ADMIN_PASSWORD: changeme
+      SEMAPHORE_ACCESS_KEY_ENCRYPTION: "rZffGjw4BGlwoM+66fStJ4Pg+ivLc5ghtty3yoscltY="
+
+    volumes:
+      - /data/compose/semaphore/db:/etc/semaphore
+      - /data/compose/semaphore/projects:/var/lib/semaphore/projects
+      - /data/compose/semaphore/backups:/opt/mikrotik_backups/
+      - /data/compose/semaphore/ansible.cfg:/etc/ansible.cfg:ro  # mount as file, ne do /etc/ansible/ansible.cfg
+
+    restart: unless-stopped

docker-compose/docker-compose-uptimekuma.yml

@@ -0,0 +1,12 @@
+version: '3.8'
+
+services:
+  uptime-kuma:
+    container_name: uptime-kuma-dev
+    image: louislam/uptime-kuma:latest
+    volumes:
+      #- ./data:/app/data
+
+      - /data/compose/kuma/data:/app/data
+    ports:
+      - "3001:3001"  # <Host Port>:<Container Port>

files/glance/glance.yml

@@ -0,0 +1,89 @@
+# glance.yml - source of truth lives in git, deployed by update_glance.yml
+# GITHUB_TOKEN comes from the persistent env file on the VM, never from git.
+
+pages:
+  - name: Home
+    # Optionally, if you only have a single page you can hide the desktop navigation for a cleaner look
+    # hide-desktop-navigation: true
+    columns:
+      - size: small
+        widgets:
+          - type: calendar
+            first-day-of-week: monday
+
+          - type: rss
+            limit: 10
+            collapse-after: 3
+            cache: 12h
+            feeds:
+              - url: https://www.root.cz/rss/clanky/
+                title: root clanky
+                limit: 6
+              - url: https://www.root.cz/rss/zpravicky/
+                title: root zpravy
+                limit: 6
+
+          - type: twitch-channels
+            channels:
+              - theprimeagen
+              - j_blow
+              - piratesoftware
+              - cohhcarnage
+              - christitustech
+              - EJ_SA
+
+      - size: full
+        widgets:
+          - type: group
+            widgets:
+              - type: hacker-news
+              - type: lobsters
+
+          - type: videos
+            channels:
+              - UCXuqSBlHAE6Xw-yeJA0Tunw # Linus Tech Tips
+              - UCR-DXc1voovS8nhAvccRZhg # Jeff Geerling
+              - UCsBjURrPoezykLs9EqgamOA # Fireship
+              - UCBJycsmduvYEL83R_U4JriQ # Marques Brownlee
+              - UCHnyfMqiRRG1u-2MsSQLbXA # Veritasium
+
+          - type: group
+            widgets:
+              - type: reddit
+                subreddit: technology
+                show-thumbnails: true
+              - type: reddit
+                subreddit: selfhosted
+                show-thumbnails: true
+
+      - size: small
+        widgets:
+          - type: weather
+            location: Ceske Budejovice, Czechia
+            units: metric # alternatively "imperial"
+            hour-format: 24h # alternatively "12h"
+            # Optionally hide the location from being displayed in the widget
+            # hide-location: true
+
+          - type: markets
+            markets:
+              - symbol: SPY
+                name: S&P 500
+              - symbol: BTC-USD
+                name: Bitcoin
+              - symbol: BTC-EUR
+                name: Bitcoin
+              - symbol: CZK=X
+                name: USD/CZK
+
+          - type: releases
+            cache: 1d
+            # Without a token the GitHub API allows up to 60 requests per hour.
+            # A read-only token with no scopes raises this to 5000.
+            token: ${GITHUB_TOKEN}
+            repositories:
+              - trezor/trezor-firmware
+              - glanceapp/glance
+              - go-gitea/gitea
+              - immich-app/immich
+              - syncthing/syncthing

inv_linuxes

@@ -1,5 +1,3 @@
 [linux_servers]
-jimbuntu ansible_host=192.168.19.4
+proxmox_nextcloud ansible_host=192.168.69.2
-jim_storage ansible_host=192.168.19.7
+proxmox_services ansible_host=192.168.69.3
-portainer2 ansible_host=192.168.52.9
-portainernode ansible_host=192.168.52.21

inv_mikrotiks

@@ -1,2 +1,8 @@
 [mikrotiks]
-storage ansible_host=192.168.19.3 ansible_ssh_common_args='-o StrictHostKeyChecking=no'
+mikrotik_fencl_server ansible_host=192.168.69.1
+mikrotik_fencl_5G    ansible_host=192.168.68.1
+
+[mikrotiks:vars]
+ansible_connection=network_cli
+ansible_network_os=community.routeros.routeros
+ansible_command_timeout=15

inv_vm

@@ -0,0 +1,5 @@
+[vm]
+pve1_vm ansible_host=192.168.69.253
+pve2_vm ansible_host=192.168.69.254
+[lxc]
+pve2_lxc_jellyfin ansible_host=192.168.69.252

mikrotikbackup_clean.yml

@@ -0,0 +1,331 @@
+# mikrotikbackup_clean.yml
+
+
+---
+- name: Backup and/or upgrade MikroTik
+  hosts: mikrotiks
+  gather_facts: false
+
+  vars:
+    # This directory is located on the Semaphore runner
+    backup_dir: /opt/mikrotik_backups
+
+    # Maximum time for a router to return after an upgrade
+    upgrade_wait_timeout: 900
+
+  tasks:
+    # -------------------------------------------------------------------------
+    # Common information
+    # -------------------------------------------------------------------------
+
+    - name: Get router identity
+      community.routeros.command:
+        commands:
+          - /system identity get name
+      register: identity_raw
+      changed_when: false
+      tags:
+        - always
+
+    - name: Build safe router name
+      ansible.builtin.set_fact:
+        router_name: >-
+          {{
+            (
+              identity_raw.stdout[0]
+              | default(inventory_hostname, true)
+              | trim
+            )
+            | regex_replace('[^A-Za-z0-9._-]+', '_')
+            | regex_replace('^_+|_+$', '')
+          }}
+      tags:
+        - always
+
+    - name: Validate router name
+      ansible.builtin.assert:
+        that:
+          - router_name | length > 0
+        fail_msg: >-
+          Could not determine RouterOS identity for
+          {{ inventory_hostname }}.
+        quiet: true
+      tags:
+        - always
+
+    - name: Generate backup timestamp
+      ansible.builtin.command:
+        argv:
+          - date
+          - --utc
+          - "+%Y-%m-%d_%H-%M-%S"
+      register: date_out
+      changed_when: false
+      delegate_to: localhost
+      tags:
+        - always
+
+    - name: Set timestamp fact
+      ansible.builtin.set_fact:
+        backup_timestamp: "{{ date_out.stdout | trim }}"
+      tags:
+        - always
+
+    # -------------------------------------------------------------------------
+    # Backup
+    # Run with: --tags backup
+    # -------------------------------------------------------------------------
+
+    - name: Ensure local backup directory exists
+      ansible.builtin.file:
+        path: "{{ backup_dir }}"
+        state: directory
+        mode: "0700"
+      delegate_to: localhost
+      run_once: true
+      tags:
+        - backup
+        - never
+
+    - name: Export RouterOS configuration
+      community.routeros.command:
+        commands:
+          - /export terse show-sensitive
+      register: export_cfg
+      changed_when: false
+      no_log: true
+      tags:
+        - backup
+        - never
+
+    - name: Validate exported configuration
+      ansible.builtin.assert:
+        that:
+          - export_cfg.stdout is defined
+          - export_cfg.stdout | length > 0
+          - export_cfg.stdout[0] | default('') | trim | length > 0
+        fail_msg: >-
+          RouterOS returned an empty configuration export
+          for {{ inventory_hostname }}.
+        quiet: true
+      no_log: true
+      tags:
+        - backup
+        - never
+
+    - name: Set backup filename
+      ansible.builtin.set_fact:
+        backup_file: >-
+          {{
+            backup_dir
+            ~ '/'
+            ~ router_name
+            ~ '-'
+            ~ backup_timestamp
+            ~ '.rsc'
+          }}
+      tags:
+        - backup
+        - never
+
+    - name: Save RouterOS configuration locally
+      ansible.builtin.copy:
+        content: "{{ export_cfg.stdout[0] | trim }}\n"
+        dest: "{{ backup_file }}"
+        mode: "0600"
+      delegate_to: localhost
+      no_log: true
+      diff: false
+      tags:
+        - backup
+        - never
+
+    - name: Show backup result
+      ansible.builtin.debug:
+        msg: >-
+          MikroTik backup completed:
+          host={{ inventory_hostname }}
+          identity={{ router_name }}
+          file={{ backup_file }}
+      tags:
+        - backup
+        - never
+
+    # -------------------------------------------------------------------------
+    # Upgrade
+    # Run with: --tags upgrade
+    # Run with backup before upgrade: --tags backup,upgrade
+    # -------------------------------------------------------------------------
+
+    - name: Check current and latest RouterOS versions
+      community.routeros.command:
+        commands:
+          - /system package update check-for-updates
+      register: update_check
+      changed_when: false
+      tags:
+        - upgrade
+        - never
+
+    - name: Normalize update output
+      ansible.builtin.set_fact:
+        update_text: >-
+          {{
+            update_check.stdout[0]
+            | default('')
+            | replace('\r', '')
+          }}
+      tags:
+        - upgrade
+        - never
+
+    - name: Extract version matches
+      ansible.builtin.set_fact:
+        installed_version_matches: >-
+          {{
+            update_text
+            | regex_findall(
+                '(?im)^\\s*(?:installed|current)-version:\\s*(\\S+)\\s*$'
+              )
+          }}
+        latest_version_matches: >-
+          {{
+            update_text
+            | regex_findall(
+                '(?im)^\\s*(?:latest|newest)-version:\\s*(\\S+)\\s*$'
+              )
+          }}
+      tags:
+        - upgrade
+        - never
+
+    - name: Set installed and latest versions
+      ansible.builtin.set_fact:
+        installed_version: >-
+          {{
+            installed_version_matches[0]
+            if installed_version_matches | length > 0
+            else 'unknown'
+          }}
+        latest_version: >-
+          {{
+            latest_version_matches[0]
+            if latest_version_matches | length > 0
+            else 'unknown'
+          }}
+      tags:
+        - upgrade
+        - never
+
+    - name: Show raw update output
+      ansible.builtin.debug:
+        msg: "{{ update_text }}"
+      tags:
+        - upgrade
+        - never
+
+    - name: Validate parsed RouterOS versions
+      ansible.builtin.assert:
+        that:
+          - installed_version != 'unknown'
+          - latest_version != 'unknown'
+        fail_msg: >-
+          Could not parse RouterOS versions on
+          {{ inventory_hostname }}.
+          Raw output: {{ update_text }}
+        quiet: true
+      tags:
+        - upgrade
+        - never
+
+    - name: Show RouterOS versions
+      ansible.builtin.debug:
+        msg:
+          - "Router: {{ router_name }}"
+          - "Installed: {{ installed_version }}"
+          - "Latest: {{ latest_version }}"
+      tags:
+        - upgrade
+        - never
+
+    - name: Show already up-to-date result
+      ansible.builtin.debug:
+        msg: >-
+          Router {{ router_name }} is already running
+          RouterOS {{ installed_version }}.
+      when: installed_version == latest_version
+      tags:
+        - upgrade
+        - never
+
+    - name: Trigger RouterOS package installation
+      community.routeros.command:
+        commands:
+          - /system package update install
+      register: upgrade_result
+      changed_when: true
+      failed_when: false
+      when: installed_version != latest_version
+      tags:
+        - upgrade
+        - never
+
+    - name: Wait for router SSH service to stop
+      ansible.builtin.wait_for:
+        host: "{{ ansible_host | default(inventory_hostname) }}"
+        port: "{{ ansible_port | default(22) | int }}"
+        state: stopped
+        connect_timeout: 5
+        timeout: 180
+      delegate_to: localhost
+      failed_when: false
+      when: installed_version != latest_version
+      tags:
+        - upgrade
+        - never
+
+    - name: Wait for router SSH service to start
+      ansible.builtin.wait_for:
+        host: "{{ ansible_host | default(inventory_hostname) }}"
+        port: "{{ ansible_port | default(22) | int }}"
+        state: started
+        delay: 10
+        connect_timeout: 5
+        timeout: "{{ upgrade_wait_timeout }}"
+      delegate_to: localhost
+      when: installed_version != latest_version
+      tags:
+        - upgrade
+        - never
+
+    - name: Reset RouterOS connection
+      ansible.builtin.meta: reset_connection
+      when: installed_version != latest_version
+      tags:
+        - upgrade
+        - never
+
+    - name: Read RouterOS version after upgrade
+      community.routeros.command:
+        commands:
+          - /system resource get version
+      register: post_upgrade_version
+      retries: 20
+      delay: 15
+      until: post_upgrade_version is succeeded
+      changed_when: false
+      when: installed_version != latest_version
+      tags:
+        - upgrade
+        - never
+
+    - name: Show RouterOS version after upgrade
+      ansible.builtin.debug:
+        msg: >-
+          Router {{ router_name }} is online.
+          RouterOS version:
+          {{ post_upgrade_version.stdout[0] | default('unknown') | trim }}
+      when: installed_version != latest_version
+      tags:
+        - upgrade
+        - never

nextcloud/check_stack_nextcloud.yml

@@ -0,0 +1,236 @@
+# nextcloud/check_stack_nextcloud.yml
+
+- name: Run Nextcloud maintenance on VM via Proxmox
+  hosts: proxmox_nextcloud
+  gather_facts: false
+  become: true
+  become_user: root
+  become_method: sudo
+
+  vars:
+    # vm_pass is stored in Semaphore as a secret environment variable.
+    vm_password: "{{ lookup('ansible.builtin.env', 'vm_pass') }}"
+
+    # Other values are loaded directly from Semaphore Extra variables.
+    vm_use_sudo: "{{ use_sudo | default(false) | bool }}"
+
+    nextcloud_container: "nextcloud"
+    nextcloud_db_container: "nextcloud-db"
+    redis_container: "redis"
+
+    nextcloud_local_status_url: "http://127.0.0.1:8080/status.php"
+
+    collabora_url: "https://collabora.martinfencl.eu/"
+    collabora_discovery_url: "https://collabora.martinfencl.eu/hosting/discovery"
+
+    vm_commands:
+      - name: Run Nextcloud cron
+        command: >-
+          docker exec -u www-data
+          {{ nextcloud_container | quote }}
+          php -f /var/www/html/cron.php
+
+      - name: Update Nextcloud applications
+        command: >-
+          docker exec -u www-data
+          {{ nextcloud_container | quote }}
+          php occ app:update --all
+
+      - name: Run Nextcloud maintenance repair
+        command: >-
+          docker exec -u www-data
+          {{ nextcloud_container | quote }}
+          php occ maintenance:repair --include-expensive
+
+      - name: Read Nextcloud status
+        command: >-
+          docker exec -u www-data
+          {{ nextcloud_container | quote }}
+          php occ status
+
+      - name: Check required containers
+        command: >-
+          for container in
+          {{ nextcloud_container | quote }}
+          {{ nextcloud_db_container | quote }}
+          {{ redis_container | quote }};
+          do
+            state="$(docker inspect --format '{% raw %}{{.State.Running}}{% endraw %}' "${container}" 2>/dev/null)";
+            if [ "${state}" != "true" ]; then
+              echo "Container ${container} is not running" >&2;
+              exit 1;
+            fi;
+          done
+
+      - name: Check MariaDB readiness
+        command: >-
+          docker exec
+          {{ nextcloud_db_container | quote }}
+          sh -c
+          'mariadb-admin ping -h 127.0.0.1 --silent 2>/dev/null
+          || mysqladmin ping -h 127.0.0.1 --silent 2>/dev/null'
+
+      - name: Check Redis readiness
+        command: >-
+          set -o pipefail;
+          docker exec
+          {{ redis_container | quote }}
+          redis-cli -h 127.0.0.1 ping
+          | grep -qx PONG
+
+      - name: Check Nextcloud local status endpoint
+        command: >-
+          set -o pipefail;
+          curl
+          --fail
+          --silent
+          --show-error
+          --max-time 15
+          {{ nextcloud_local_status_url | quote }}
+          | grep -q '"installed":true'
+
+  pre_tasks:
+    - name: Validate VM connection variables
+      ansible.builtin.assert:
+        that:
+          - vm_ip is defined
+          - vm_ip | string | trim | length > 0
+          - vm_user is defined
+          - vm_user | string | trim | length > 0
+          - vm_password | string | length > 0
+        fail_msg: >-
+          Missing vm_ip, vm_user or vm_pass.
+          Check the attached Semaphore Variable Group.
+        quiet: true
+      no_log: true
+
+  tasks:
+    - name: Ensure sshpass is installed
+      ansible.builtin.apt:
+        name: sshpass
+        state: present
+        update_cache: true
+
+    - name: Run Nextcloud checks on VM
+      ansible.builtin.command:
+        argv:
+          - sshpass
+          - -e
+          - ssh
+          - -o
+          - StrictHostKeyChecking=no
+          - -o
+          - UserKnownHostsFile=/dev/null
+          - -o
+          - LogLevel=ERROR
+          - -o
+          - ConnectTimeout=15
+          - -o
+          - ServerAliveInterval=10
+          - -o
+          - ServerAliveCountMax=3
+          - "{{ vm_user }}@{{ vm_ip }}"
+          - >-
+            {{
+              ('sudo -n bash -lc ' ~ (item.command | quote))
+              if vm_use_sudo
+              else
+              ('bash -lc ' ~ (item.command | quote))
+            }}
+      environment:
+        SSHPASS: "{{ vm_password }}"
+      loop: "{{ vm_commands }}"
+      loop_control:
+        label: "{{ item.name }}"
+      register: vm_cmds
+      changed_when: false
+      failed_when: false
+      no_log: true
+
+    - name: Show outputs for each VM command
+      ansible.builtin.debug:
+        msg: |
+          CHECK: {{ item.item.name }}
+          CMD:   {{ item.item.command }}
+          RC:    {{ item.rc }}
+
+          STDOUT:
+          {{ item.stdout | default('') | trim }}
+
+          STDERR:
+          {{ item.stderr | default('') | trim }}
+      loop: "{{ vm_cmds.results }}"
+      loop_control:
+        label: "{{ item.item.name }}"
+
+    - name: Fail if any Nextcloud VM command failed
+      ansible.builtin.assert:
+        that:
+          - item.rc == 0
+        fail_msg: |
+          Nextcloud check failed: {{ item.item.name }}
+          Command: {{ item.item.command }}
+          RC: {{ item.rc }}
+
+          STDOUT:
+          {{ item.stdout | default('') | trim }}
+
+          STDERR:
+          {{ item.stderr | default('') | trim }}
+        quiet: true
+      loop: "{{ vm_cmds.results }}"
+      loop_control:
+        label: "{{ item.item.name }}"
+
+    - name: Check external Collabora root endpoint
+      ansible.builtin.uri:
+        url: "{{ collabora_url }}"
+        method: GET
+        return_content: true
+        validate_certs: true
+        status_code: 200
+        timeout: 20
+      register: collabora_root
+      delegate_to: localhost
+      run_once: true
+      changed_when: false
+      failed_when: >-
+        (collabora_root.status | default(0) | int != 200)
+        or
+        ('OK' not in (collabora_root.content | default('')))
+
+    - name: Check external Collabora discovery endpoint
+      ansible.builtin.uri:
+        url: "{{ collabora_discovery_url }}"
+        method: GET
+        return_content: true
+        validate_certs: true
+        status_code: 200
+        timeout: 20
+      register: collabora_discovery
+      delegate_to: localhost
+      run_once: true
+      changed_when: false
+      failed_when: >-
+        (collabora_discovery.status | default(0) | int != 200)
+        or
+        ('<wopi-discovery' not in
+        (collabora_discovery.content | default('')))
+
+    - name: Show final health summary
+      ansible.builtin.debug:
+        msg: |
+          Nextcloud VM connection: OK
+          Nextcloud cron: OK
+          Nextcloud applications: OK
+          Nextcloud maintenance repair: OK
+          Nextcloud status: OK
+          Nextcloud container: OK
+          MariaDB container: OK
+          Redis container: OK
+          MariaDB readiness: OK
+          Redis readiness: OK
+          Nextcloud local HTTP endpoint: OK
+          Collabora root endpoint: OK
+          Collabora discovery endpoint: OK
+      run_once: true

nextcloud/update_collabora.yml

@@ -0,0 +1,92 @@
+# nextcloud/update_collabora.yml
+
+- name: Update Collabora
+  hosts: pve2_vm
+  gather_facts: false
+
+  vars:
+    # Compose sync (controller -> target)
+    compose_local_dir: "{{ lookup('env','PWD') }}/docker-compose"
+    compose_remote_base: "/home/{{ ansible_user }}/.ansible-compose"
+    compose_remote_dir: "{{ compose_remote_base }}/docker-compose"
+    compose_remote_archive: "{{ compose_remote_base }}/docker-compose.tar.gz"
+
+    # Collabora settings
+    collabora_project: collabora
+    collabora_compose_filename: "docker-compose-collabora.yml"
+    collabora_service: collabora
+    collabora_port: 9980
+
+  tasks:
+    - name: Ensure remote base directory exists
+      ansible.builtin.file:
+        path: "{{ compose_remote_base }}"
+        state: directory
+        mode: "0755"
+
+    - name: Create local archive of docker-compose directory (controller)
+      ansible.builtin.archive:
+        path: "{{ compose_local_dir }}/"
+        dest: "/tmp/docker-compose.tar.gz"
+        format: gz
+      delegate_to: localhost
+      run_once: true
+
+    - name: Upload archive to remote host
+      ansible.builtin.copy:
+        src: "/tmp/docker-compose.tar.gz"
+        dest: "{{ compose_remote_archive }}"
+        mode: "0644"
+
+    - name: Recreate remote compose directory
+      ansible.builtin.file:
+        path: "{{ compose_remote_dir }}"
+        state: absent
+
+    - name: Ensure remote compose directory exists
+      ansible.builtin.file:
+        path: "{{ compose_remote_dir }}"
+        state: directory
+        mode: "0755"
+
+    - name: Extract archive on remote host
+      ansible.builtin.unarchive:
+        src: "{{ compose_remote_archive }}"
+        dest: "{{ compose_remote_dir }}"
+        remote_src: true
+
+    - name: Pull latest Collabora image
+      community.docker.docker_compose_v2:
+        project_name: "{{ collabora_project }}"
+        project_src: "{{ compose_remote_dir }}"
+        files:
+          - "{{ collabora_compose_filename }}"
+        pull: always
+
+    - name: Recreate Collabora service
+      community.docker.docker_compose_v2:
+        project_name: "{{ collabora_project }}"
+        project_src: "{{ compose_remote_dir }}"
+        files:
+          - "{{ collabora_compose_filename }}"
+        services:
+          - "{{ collabora_service }}"
+        state: present
+        recreate: always
+
+    - name: Wait for Collabora port
+      ansible.builtin.wait_for:
+        host: 127.0.0.1
+        port: "{{ collabora_port }}"
+        timeout: 120
+
+    - name: Check Collabora discovery endpoint (retry until ready)
+      ansible.builtin.uri:
+        url: "http://127.0.0.1:{{ collabora_port }}/hosting/discovery"
+        status_code: 200
+        return_content: true
+      register: collabora_http
+      retries: 40
+      delay: 3
+      until: collabora_http.status == 200 and ('<wopi-discovery' in (collabora_http.content | default('')))
+      changed_when: false

nextcloud/update_nextcloud_v1.yml

@@ -0,0 +1,287 @@
+# nextcloud/update_nextcloud.yml
+
+- name: Update Nextcloud on VM via Proxmox
+  hosts: proxmox_nextcloud  # linux_servers
+  gather_facts: false
+  become: true
+  become_user: root
+  become_method: sudo
+
+  vars:
+    # --- Connection to VM (provided by Semaphore env vars) ---
+    vm_ip:   "{{ lookup('env', 'VM_IP') }}"
+    vm_user: "{{ lookup('env', 'VM_USER') }}"
+    vm_pass: "{{ lookup('env', 'VM_PASS') }}"
+    use_sudo: false
+
+    # --- Debug / retries ---
+    DEBUG: "{{ lookup('env', 'DEBUG') | default(0) | int }}"
+    RETRIES: "{{ lookup('env', 'RETRIES') | default(25) | int }}"
+
+    # --- Nextcloud specifics ---
+    nextcloud_project: "nextcloud-collabora"
+    nextcloud_compose_file: "/data/compose/nextcloud/docker-compose-nextcloud.yml"
+    nextcloud_service: "nextcloud"
+
+    # Backup directory on the VM (timestamped on controller)
+    backup_dir: "/data/compose/nextcloud/backup-{{ lookup('pipe', 'date +%F-%H%M%S') }}"
+
+    nextcloud_base_url: "https://cloud.martinfencl.eu"
+    nextcloud_status_url: "{{ nextcloud_base_url }}/status.php"
+
+    # Docker command prefix (consistent behavior and quiet hints)
+    docker_prefix: "unalias docker 2>/dev/null || true; DOCKER_CLI_HINTS=0; command docker"
+
+    # --- Backup phase commands (run on VM) ---
+    nextcloud_backup_commands:
+      - >
+        mkdir -p "{{ backup_dir }}"
+      - >
+        docker exec -u www-data nextcloud php occ maintenance:mode --on
+      # Create tarball of config + custom_apps inside the container
+      - >
+        docker exec nextcloud sh -c 'tar czf /tmp/nextcloud_conf.tgz -C /var/www/html config custom_apps'
+      # Copy that tarball to the host backup directory
+      - >
+        docker cp nextcloud:/tmp/nextcloud_conf.tgz "{{ backup_dir }}/nextcloud_conf.tgz"
+      # Remove temporary file inside the container
+      - >
+        docker exec nextcloud rm /tmp/nextcloud_conf.tgz || true
+      # Database dump from DB container (unchanged)
+      - >
+        docker exec nextcloud-db sh -c 'command -v mariadb-dump >/dev/null && mariadb-dump -u"$MYSQL_USER" -p"$MYSQL_PASSWORD" "$MYSQL_DATABASE" || mysqldump -u"$MYSQL_USER" -p"$MYSQL_PASSWORD" "$MYSQL_DATABASE"' > "{{ backup_dir }}/db.sql"
+
+    # --- Upgrade phase commands (run on VM) ---
+    nextcloud_upgrade_commands:
+      - >
+        {{ docker_prefix }} compose -p {{ nextcloud_project }} -f {{ nextcloud_compose_file }} pull {{ nextcloud_service }}
+      - >
+        {{ docker_prefix }} compose -p {{ nextcloud_project }} -f {{ nextcloud_compose_file }} up -d --no-deps --force-recreate {{ nextcloud_service }}
+      - >
+        docker exec -u www-data nextcloud php occ upgrade
+      - >
+        docker exec -u www-data nextcloud php occ app:update --all || true
+      - >
+        docker exec -u www-data nextcloud php occ maintenance:repair --include-expensive || true
+
+  tasks:
+    - name: Ensure sshpass is installed (for password-based SSH)
+      ansible.builtin.apt:
+        name: sshpass
+        state: present
+        update_cache: yes
+
+    - name: Nextcloud | Show current version before upgrade (DEBUG)
+      ansible.builtin.command:
+        argv:
+          - sshpass
+          - -e
+          - ssh
+          - -o
+          - StrictHostKeyChecking=no
+          - -o
+          - ConnectTimeout=15
+          - "{{ vm_user }}@{{ vm_ip }}"
+          - bash
+          - -lc
+          - 'docker exec -u www-data nextcloud php occ -V || true'
+      environment:
+        SSHPASS: "{{ vm_pass }}"
+      register: nc_version_before
+      changed_when: false
+      failed_when: false
+      when: DEBUG == 1
+
+    # -------------------------
+    # Backup phase
+    # -------------------------
+    - name: Nextcloud | Run backup commands on VM (via SSH)  # run plain commands via SSH
+      ansible.builtin.command:
+        argv:
+          - sshpass
+          - -e
+          - ssh
+          - -o
+          - StrictHostKeyChecking=no
+          - -o
+          - ConnectTimeout=15
+          - "{{ vm_user }}@{{ vm_ip }}"
+          - "{{ ('sudo ' if use_sudo else '') + item }}"
+      environment:
+        SSHPASS: "{{ vm_pass }}"
+      loop: "{{ nextcloud_backup_commands }}"
+      loop_control:
+        index_var: idx
+        label: "backup-cmd-{{ idx }}"
+      register: nc_backup_cmds
+      changed_when: false
+      no_log: "{{ DEBUG == 0 }}"
+
+    - name: Nextcloud | Show outputs of backup commands (DEBUG)
+      ansible.builtin.debug:
+        msg: |
+          CMD: {{ item.item }}
+          RC:  {{ item.rc }}
+          STDOUT:
+          {{ (item.stdout | default('')).strip() }}
+          STDERR:
+          {{ (item.stderr | default('')).strip() }}
+      loop: "{{ nc_backup_cmds.results }}"
+      when: DEBUG == 1
+
+    - name: Nextcloud | Fail play if any backup command failed
+      ansible.builtin.assert:
+        that: "item.rc == 0"
+        fail_msg: "Nextcloud backup step failed on VM: {{ item.item }} (rc={{ item.rc }})"
+        success_msg: "All Nextcloud backup commands succeeded."
+      loop: "{{ nc_backup_cmds.results }}"
+      loop_control:
+        index_var: idx
+        label: "backup-cmd-{{ idx }}"
+
+    # -------------------------
+    # Upgrade phase
+    # -------------------------
+
+    - name: Nextcloud | Run upgrade commands on VM (via SSH)
+      ansible.builtin.command:
+        argv:
+          - sshpass
+          - -e
+          - ssh
+          - -o
+          - StrictHostKeyChecking=no
+          - -o
+          - ConnectTimeout=15
+          - "{{ vm_user }}@{{ vm_ip }}"
+          - bash
+          - -lc
+          - "{{ ('sudo ' if use_sudo else '') + item }}"
+      environment:
+        SSHPASS: "{{ vm_pass }}"
+      loop: "{{ nextcloud_upgrade_commands }}"
+      loop_control:
+        index_var: idx
+        label: "upgrade-cmd-{{ idx }}"
+      register: nc_upgrade_cmds
+      changed_when: false
+      failed_when: false
+      no_log: "{{ DEBUG == 0 }}"
+
+    - name: Nextcloud | Show outputs of upgrade commands (DEBUG)
+      ansible.builtin.debug:
+        msg: |
+          CMD: {{ item.item }}
+          RC:  {{ item.rc }}
+          STDOUT:
+          {{ (item.stdout | default('')).strip() }}
+          STDERR:
+          {{ (item.stderr | default('')).strip() }}
+      loop: "{{ nc_upgrade_cmds.results }}"
+      when: DEBUG == 1
+
+    - name: Nextcloud | Fail play if any upgrade command failed
+      ansible.builtin.assert:
+        that: "item.rc == 0"
+        fail_msg: "Nextcloud upgrade step failed on VM: {{ item.item }} (rc={{ item.rc }})"
+        success_msg: "All Nextcloud upgrade commands succeeded."
+      loop: "{{ nc_upgrade_cmds.results }}"
+      loop_control:
+        index_var: idx
+        label: "upgrade-cmd-{{ idx }}"
+
+    - name: Nextcloud | Disable maintenance mode (only after successful upgrade)
+      ansible.builtin.command:
+        argv:
+          - sshpass
+          - -e
+          - ssh
+          - -o
+          - StrictHostKeyChecking=no
+          - -o
+          - ConnectTimeout=15
+          - "{{ vm_user }}@{{ vm_ip }}"
+          - "{{ ('sudo ' if use_sudo else '') }}docker exec -u www-data nextcloud php occ maintenance:mode --off"
+      environment:
+        SSHPASS: "{{ vm_pass }}"
+      register: nc_maint_off
+      changed_when: false
+      no_log: "{{ DEBUG == 0 }}"
+
+    # -------------------------
+    # Readiness check (status.php)
+    # -------------------------
+
+    - name: Nextcloud | Wait for status.php (controller first)
+      ansible.builtin.uri:
+        url: "{{ nextcloud_status_url }}"
+        method: GET
+        return_content: true
+        validate_certs: true
+        status_code: 200
+      register: nc_status_controller
+      delegate_to: localhost
+      run_once: true
+      retries: "{{ RETRIES }}"
+      delay: 4
+      until: nc_status_controller.status == 200
+      failed_when: false
+      changed_when: false
+
+    - name: Nextcloud | VM-side fetch status.php (JSON via Python)
+      ansible.builtin.command:
+        argv:
+          - sshpass
+          - -e
+          - ssh
+          - -o
+          - StrictHostKeyChecking=no
+          - -o
+          - ConnectTimeout=15
+          - "{{ vm_user }}@{{ vm_ip }}"
+          - bash
+          - -lc
+          - |
+            python3 - <<'PY'
+            import json, urllib.request, sys
+            try:
+                with urllib.request.urlopen("{{ nextcloud_status_url }}", timeout=15) as r:
+                    sys.stdout.write(r.read().decode())
+            except Exception:
+                pass
+            PY
+      environment:
+        SSHPASS: "{{ vm_pass }}"
+      register: nc_status_vm
+      changed_when: false
+      failed_when: false
+      when: nc_status_controller.status | default(0) != 200 or nc_status_controller.json is not defined
+      no_log: "{{ DEBUG == 0 }}"
+
+    - name: Nextcloud | Choose status JSON (controller wins, else VM)
+      ansible.builtin.set_fact:
+        nextcloud_status_json: >-
+          {{
+            (nc_status_controller.json
+              if (nc_status_controller.status | default(0)) == 200 and (nc_status_controller.json is defined)
+              else (
+                (nc_status_vm.stdout | default('') | trim | length > 0)
+                | ternary((nc_status_vm.stdout | trim | from_json), omit)
+              )
+            )
+          }}
+      failed_when: false
+
+    - name: Nextcloud | Print concise status summary (DEBUG)
+      ansible.builtin.debug:
+        msg: >-
+          Nextcloud {{ nextcloud_status_json.version | default('?') }}
+          (installed={{ nextcloud_status_json.installed | default('?') }},
+          maintenance={{ nextcloud_status_json.maintenance | default('?') }},
+          needsDbUpgrade={{ nextcloud_status_json.needsDbUpgrade | default('?') }})
+      when: nextcloud_status_json is defined and DEBUG == 1
+
+    - name: Nextcloud | Status JSON not available (DEBUG)
+      ansible.builtin.debug:
+        msg: "status.php is not reachable or did not return JSON."
+      when: nextcloud_status_json is not defined and DEBUG == 1

old/mikrotikbackup.yml

@@ -7,7 +7,7 @@
 
     - name: Ensure output directory exists
       ansible.builtin.file:
-        path: output
+        path: /opt/mikrotik_backups
         state: directory
         mode: '0755'
       delegate_to: localhost
@@ -42,7 +42,7 @@
     - name: Save export to local file
       ansible.builtin.copy:
         content: "{{ export_output.stdout }}"
-        dest: "output/{{ router_name }}-{{ current_date }}.config"
+        dest: "/opt/mikrotik_backups/{{ router_name }}-{{ current_date }}.config"
       delegate_to: localhost
       when: export_output.rc == 0
 
@@ -52,7 +52,7 @@
       when: system_identity.rc == 0
 
     - name: Download binary backup
-      shell: timeout 15 scp -o StrictHostKeyChecking=no -P {{ ansible_port }} {{ ansible_user }}@{{ ansible_host }}:{{ router_name }}-{{ current_date }}-backup.backup output/
+      shell: timeout 15 scp -o StrictHostKeyChecking=no -P {{ ansible_port }} {{ ansible_user }}@{{ ansible_host }}:{{ router_name }}-{{ current_date }}-backup.backup /opt/mikrotik_backups/
       delegate_to: localhost
       when: system_identity.rc == 0
 

old/update_broker_kafka-ui.yml

@@ -0,0 +1,155 @@
+# update_broker_kafka-ui.yml
+
+- name: Update Kafka broker3 and Redpanda Console on VM via Proxmox
+  hosts: linux_servers
+  gather_facts: false
+  become: true
+  become_user: root
+  become_method: sudo
+
+  vars:
+    # --- Connection to VM (provided by Semaphore env vars) ---
+    vm_ip:   "{{ lookup('env', 'VM_IP') }}"
+    vm_user: "{{ lookup('env', 'VM_USER') }}"
+    vm_pass: "{{ lookup('env', 'VM_PASS') }}"
+    use_sudo: false
+
+    # --- Debug mode (controlled via Semaphore variable) ---
+    DEBUG: "{{ lookup('env', 'DEBUG') | default(0) | int }}"
+    RETRIES: "{{ lookup('env', 'RETRIES') | default(25) | int }}"
+
+    # --- Kafka / Redpanda Console specifics ---
+    kafka_project: "kafka"
+    # Adjusted to match your actual compose file location
+    kafka_compose_file: "/data/compose/docker-compose.yml"
+
+    kafka_services:
+      - broker3
+      - kafka-ui
+
+    redpanda_console_port: 8084
+
+    # Controller-side URL (default to direct VM IP/port or external URL)
+    redpanda_console_url: "{{ lookup('env', 'REDPANDA_CONSOLE_URL') | default('http://192.168.69.254:8084/overview', true) }}"
+
+    redpanda_retries: "{{ RETRIES }}"
+    redpanda_delay: 2
+
+    # Docker command prefix (consistent behavior and quiet hints)
+    docker_prefix: "unalias docker 2>/dev/null || true; DOCKER_CLI_HINTS=0; command docker"
+
+    # Commands to run on the target VM (quiet outputs)
+    # 1) Pull latest images for broker3 + kafka-ui
+    # 2) Stop any running containers with these names (legacy or compose-managed)
+    # 3) Remove any containers with these names to avoid name conflicts
+    # 4) Recreate services via docker compose
+    kafka_commands:
+      - "{{ docker_prefix }} compose -p {{ kafka_project }} -f {{ kafka_compose_file }} pull {{ kafka_services | join(' ') }} >/dev/null"
+      - "{{ docker_prefix }} stop {{ kafka_services | join(' ') }} >/dev/null 2>&1 || true"
+      - "{{ docker_prefix }} rm -f {{ kafka_services | join(' ') }} >/dev/null 2>&1 || true"
+      - "{{ docker_prefix }} compose -p {{ kafka_project }} -f {{ kafka_compose_file }} up -d --no-deps --force-recreate {{ kafka_services | join(' ') }} >/dev/null"
+
+  tasks:
+    - name: Ensure sshpass is installed (for password-based SSH)  # English comments
+      ansible.builtin.apt:
+        name: sshpass
+        state: present
+        update_cache: yes
+
+    - name: Run Kafka update commands on VM (via SSH)  # use SSHPASS env, hide item value
+      ansible.builtin.command:
+        argv:
+          - sshpass
+          - -e                     # read password from SSHPASS environment
+          - ssh
+          - -o
+          - StrictHostKeyChecking=no
+          - -o
+          - ConnectTimeout=15
+          - "{{ vm_user }}@{{ vm_ip }}"
+          - bash
+          - -lc
+          - "{{ ('sudo ' if use_sudo else '') + item }}"
+      environment:
+        SSHPASS: "{{ vm_pass }}"    # supply password via environment
+      loop: "{{ kafka_commands }}"
+      loop_control:
+        index_var: idx              # capture loop index
+        label: "cmd-{{ idx }}"      # avoid printing full command in (item=...) line
+      register: kafka_cmds
+      changed_when: false
+      no_log: "{{ DEBUG == 0 }}"    # hide outputs and env when not debugging
+
+    - name: Show outputs for each Kafka command
+      ansible.builtin.debug:
+        msg: |
+          CMD: {{ item.item }}
+          RC:  {{ item.rc }}
+          STDOUT:
+          {{ (item.stdout | default('')).strip() }}
+          STDERR:
+          {{ (item.stderr | default('')).strip() }}
+      loop: "{{ kafka_cmds.results }}"
+      when: DEBUG == 1
+
+    - name: Fail play if any Kafka command failed  # also hide item label
+      ansible.builtin.assert:
+        that: "item.rc == 0"
+        fail_msg: "Kafka/Redpanda Console update failed on VM: {{ item.item }} (rc={{ item.rc }})"
+        success_msg: "All Kafka/Redpanda Console update commands succeeded."
+      loop: "{{ kafka_cmds.results }}"
+      loop_control:
+        index_var: idx
+        label: "cmd-{{ idx }}"
+
+    # -------------------------
+    # Readiness check – Redpanda Console UI
+    # -------------------------
+
+    - name: Redpanda Console | Wait for overview page (controller, with retries)
+      ansible.builtin.uri:
+        url: "{{ redpanda_console_url }}"
+        method: GET
+        return_content: true
+        validate_certs: false           # plain HTTP on 192.168.69.254 (or as configured)
+        status_code: 200
+      register: redpanda_controller
+      delegate_to: localhost
+      run_once: true
+      when: redpanda_console_url is defined and (redpanda_console_url | length) > 0
+      retries: "{{ redpanda_retries }}"
+      delay: "{{ redpanda_delay }}"
+      until: redpanda_controller.status == 200
+      failed_when: false
+      changed_when: false
+
+    - name: Redpanda Console | Print concise summary
+      ansible.builtin.debug:
+        msg: >-
+          Redpanda Console overview {{ 'reachable' if (redpanda_controller is defined and (redpanda_controller.status|default(0))==200) else 'NOT reachable' }}.
+          status={{ redpanda_controller.status | default('n/a') }};
+          length={{ (redpanda_controller.content | default('')) | length }};
+      when: DEBUG == 1 and (redpanda_controller is defined)
+
+    # Optional detailed dump (short excerpt only)
+    - name: Redpanda Console | HTML excerpt (debug)
+      ansible.builtin.debug:
+        msg: "{{ (redpanda_controller.content | default(''))[:500] }}"
+      when: DEBUG == 1 and (redpanda_controller is defined) and (redpanda_controller.content is defined)
+
+    # -------------------------
+    # Final assertion: Console URL must be reachable
+    # -------------------------
+
+    - name: Redpanda Console | Assert overview reachable (if URL configured)
+      ansible.builtin.assert:
+        that:
+          - >
+            not (redpanda_console_url is defined and (redpanda_console_url | length) > 0)
+            or
+            (
+              redpanda_controller is defined
+              and (redpanda_controller.status | default(0)) == 200
+            )
+        fail_msg: "Redpanda Console URL {{ redpanda_console_url }} is NOT reachable with HTTP 200 after retries."
+        success_msg: "Redpanda Console URL {{ redpanda_console_url }} is reachable with HTTP 200."

old/update_collabora.yml

@@ -0,0 +1,174 @@
+# nextcloud/update_collabora.yml
+
+- name: Update Collabora CODE on VM via Proxmox
+  hosts: linux_servers
+  gather_facts: false
+  become: true
+  become_user: root
+  become_method: sudo
+
+  vars:
+    # --- Connection to VM (provided by Semaphore env vars) ---
+    vm_ip:   "{{ lookup('env', 'VM_IP') }}"
+    vm_user: "{{ lookup('env', 'VM_USER') }}"
+    vm_pass: "{{ lookup('env', 'VM_PASS') }}"
+    use_sudo: false
+
+    # --- Debug mode (controlled via Semaphore variable) ---
+    DEBUG: "{{ lookup('env', 'DEBUG') | default(0) | int }}"
+    RETRIES: "{{ lookup('env', 'RETRIES') | default(25) | int }}"
+
+    # --- Collabora specifics ---
+    collabora_debug_caps: true
+    collabora_caps_url: "https://collabora.martinfencl.eu/hosting/capabilities"
+
+    # Use the FULL Nextcloud stack compose file; only target the 'collabora' service inside it
+    collabora_project: "nextcloud-collabora"
+    collabora_compose_file: "/data/compose/nextcloud/nextcloud-collabora.yml"
+    collabora_service: "collabora"
+
+    # Docker command prefix (consistent behavior and quiet hints)
+    docker_prefix: "unalias docker 2>/dev/null || true; DOCKER_CLI_HINTS=0; command docker"
+
+    # Commands to run on the target VM (quiet outputs)
+    collabora_commands:
+      - "{{ docker_prefix }} pull -q collabora/code:latest >/dev/null"
+      - "{{ docker_prefix }} compose -p {{ collabora_project }} -f {{ collabora_compose_file }} pull {{ collabora_service }} >/dev/null"
+      - "{{ docker_prefix }} compose -p {{ collabora_project }} -f {{ collabora_compose_file }} up -d --no-deps --force-recreate {{ collabora_service }} >/dev/null"
+
+  tasks:
+    - name: Ensure sshpass is installed (for password-based SSH)  # English comments
+      ansible.builtin.apt:
+        name: sshpass
+        state: present
+        update_cache: yes
+
+    - name: Run Collabora update commands on VM (via SSH)  # use SSHPASS env, hide item value
+      ansible.builtin.command:
+        argv:
+          - sshpass
+          - -e
+          - ssh
+          - -o
+          - StrictHostKeyChecking=no
+          - -o
+          - ConnectTimeout=15
+          - "{{ vm_user }}@{{ vm_ip }}"
+          - bash
+          - -lc
+          - "{{ ('sudo ' if use_sudo else '') + item }}"
+      environment:
+        SSHPASS: "{{ vm_pass }}"
+      loop: "{{ collabora_commands }}"
+      loop_control:
+        index_var: idx              # <-- capture loop index here
+        label: "cmd-{{ idx }}"      # <-- use idx instead of loop.index
+      register: collab_cmds
+      changed_when: false
+      no_log: "{{ DEBUG == 0 }}"
+
+    - name: Show outputs for each Collabora command
+      ansible.builtin.debug:
+        msg: |
+          CMD: {{ item.item }}
+          RC:  {{ item.rc }}
+          STDOUT:
+          {{ (item.stdout | default('')).strip() }}
+          STDERR:
+          {{ (item.stderr | default('')).strip() }}
+      loop: "{{ collab_cmds.results }}"
+      when: DEBUG == 1
+
+    - name: Fail play if any Collabora command failed  # also hide item label
+      ansible.builtin.assert:
+        that: "item.rc == 0"
+        fail_msg: "Collabora update failed on VM: {{ item.item }} (rc={{ item.rc }})"
+        success_msg: "All Collabora update commands succeeded."
+      loop: "{{ collab_cmds.results }}"
+      loop_control:
+        index_var: idx
+        label: "cmd-{{ idx }}"
+
+    # -------------------------
+    # Readiness checks (controller first, then VM fallback)
+    # -------------------------
+
+    - name: Collabora | Wait for capabilities (controller first)
+      ansible.builtin.uri:
+        url: "{{ collabora_caps_url }}"
+        method: GET
+        return_content: true
+        validate_certs: true
+        status_code: 200
+      register: caps_controller
+      delegate_to: localhost
+      run_once: true
+      retries: "{{ RETRIES }}"
+      delay: 2
+      until: caps_controller.status == 200
+      failed_when: false
+      changed_when: false
+
+    - name: Collabora | VM-side fetch (pure JSON via Python)  # use SSHPASS env here too
+      ansible.builtin.command:
+        argv:
+          - sshpass
+          - -e
+          - ssh
+          - -o
+          - StrictHostKeyChecking=no
+          - -o
+          - ConnectTimeout=15
+          - "{{ vm_user }}@{{ vm_ip }}"
+          - bash
+          - -lc
+          - |
+            python3 - <<'PY'
+            import json, urllib.request, sys
+            try:
+                with urllib.request.urlopen("{{ collabora_caps_url }}", timeout=15) as r:
+                    sys.stdout.write(r.read().decode())
+            except Exception:
+                pass
+            PY
+      environment:
+        SSHPASS: "{{ vm_pass }}"
+      register: caps_vm
+      changed_when: false
+      failed_when: false
+      when: caps_controller.status | default(0) != 200 or caps_controller.json is not defined
+      no_log: "{{ DEBUG == 0 }}"
+
+    - name: Collabora | Choose JSON (controller wins, else VM)
+      ansible.builtin.set_fact:
+        collab_caps_json: >-
+          {{
+            (caps_controller.json
+              if (caps_controller.status|default(0))==200 and (caps_controller.json is defined)
+              else (
+                (caps_vm.stdout | default('') | trim | length > 0)
+                | ternary((caps_vm.stdout | trim | from_json), omit)
+              )
+            )
+          }}
+      failed_when: false
+
+    - name: Collabora | Print concise summary
+      ansible.builtin.debug:
+        msg: >-
+          Collabora {{ collab_caps_json.productVersion | default('?') }}
+          ({{ collab_caps_json.productName | default('?') }}),
+          convert-to.available={{ collab_caps_json['convert-to']['available'] | default('n/a') }},
+          serverId={{ collab_caps_json.serverId | default('n/a') }}
+      when: collab_caps_json is defined and DEBUG == 1
+
+    - name: Collabora | Capabilities unavailable (after retries)
+      ansible.builtin.debug:
+        msg: "Capabilities endpoint není dostupný ani po pokusech."
+      when: collab_caps_json is not defined and DEBUG == 1
+
+    # Optional full JSON (debug)
+    - name: Collabora | Full JSON (debug)
+      ansible.builtin.debug:
+        var: collab_caps_json
+      when: collabora_debug_caps and (collab_caps_json is defined) and DEBUG == 1

old/update_homarr.yml

@@ -0,0 +1,194 @@
+# update_homarr.yml
+
+- name: Update Homarr on VM via Proxmox
+  hosts: linux_servers
+  gather_facts: false
+  become: true
+  become_user: root
+  become_method: sudo
+
+  vars:
+    # VM connection (provided by Semaphore env vars)
+    vm_ip:   "{{ lookup('env', 'VM_IP') }}"
+    vm_user: "{{ lookup('env', 'VM_USER') }}"
+    vm_pass: "{{ lookup('env', 'VM_PASS') }}"
+    use_sudo: false
+
+    # --- Debug mode (controlled via Semaphore variable) ---
+    DEBUG: "{{ lookup('env', 'DEBUG') | default(0) | int }}"
+    RETRIES: "{{ lookup('env', 'RETRIES') | default(25) | int }}"
+
+    # Homarr specifics
+    homarr_project: "homarr"
+    homarr_compose_file: "/data/compose/homarr/docker-compose-homarr.yml"
+    homarr_service: "homarr"
+    homarr_image: "ghcr.io/homarr-labs/homarr:latest"
+    homarr_port: 7575
+
+    # Optional external URL for controller-side readiness check (e.g., https://homarr.example.com)
+    # If empty/undefined, controller check is skipped and we only probe from the VM.
+    homarr_url: "{{ lookup('env', 'HOMARR_URL') | default('', true) }}"
+
+    # Fixed container name used in your compose (avoid conflicts with any leftover container)
+    homarr_container_name: "homarr"
+
+    # Retry policy (same pattern as Kuma): 25x with 2s delay
+    homarr_retries: "{{ RETRIES }}"
+    homarr_delay: 2
+
+    # Docker command prefix (consistent behavior)
+    docker_prefix: "unalias docker 2>/dev/null || true; DOCKER_CLI_HINTS=0; command docker"
+
+    # Commands to run on the target VM (quiet outputs)
+    homarr_commands:
+      - "{{ docker_prefix }} pull -q {{ homarr_image }} >/dev/null"
+      - "{{ docker_prefix }} compose -p {{ homarr_project }} -f {{ homarr_compose_file }} pull {{ homarr_service }} >/dev/null"
+      # remove conflicting container name before compose up (silently)
+      - "{{ docker_prefix }} rm -f {{ homarr_container_name }} >/dev/null 2>&1 || true"
+      - "{{ docker_prefix }} compose -p {{ homarr_project }} -f {{ homarr_compose_file }} up -d --no-deps --force-recreate {{ homarr_service }} >/dev/null"
+
+  tasks:
+    - name: Ensure sshpass is installed (for password-based SSH)  # English comments
+      ansible.builtin.apt:
+        name: sshpass
+        state: present
+        update_cache: yes
+
+    - name: Run Homarr update commands on VM (via SSH)  # use SSHPASS env, hide item label
+      ansible.builtin.command:
+        argv:
+          - sshpass
+          - -e                     # read password from SSHPASS environment
+          - ssh
+          - -o
+          - StrictHostKeyChecking=no
+          - -o
+          - ConnectTimeout=15
+          - "{{ vm_user }}@{{ vm_ip }}"
+          - bash
+          - -lc
+          - "{{ ('sudo ' if use_sudo else '') + item }}"
+      environment:
+        SSHPASS: "{{ vm_pass }}"    # supply password via environment
+      loop: "{{ homarr_commands }}"
+      loop_control:
+        index_var: idx              # capture loop index
+        label: "cmd-{{ idx }}"      # avoid printing full command in (item=...) line
+      register: homarr_cmds
+      changed_when: false
+      no_log: "{{ DEBUG == 0 }}"    # hide outputs and env when not debugging
+
+    - name: Show outputs for each Homarr command
+      ansible.builtin.debug:
+        msg: |
+          CMD: {{ item.item }}
+          RC:  {{ item.rc }}
+          STDOUT:
+          {{ (item.stdout | default('')).strip() }}
+          STDERR:
+          {{ (item.stderr | default('')).strip() }}
+      loop: "{{ homarr_cmds.results }}"
+      when: DEBUG == 1
+
+    - name: Fail play if any Homarr command failed  # also hide item label
+      ansible.builtin.assert:
+        that: "item.rc == 0"
+        fail_msg: "Homarr update failed on VM: {{ item.item }} (rc={{ item.rc }})"
+        success_msg: "All Homarr update commands succeeded."
+      loop: "{{ homarr_cmds.results }}"
+      loop_control:
+        index_var: idx
+        label: "cmd-{{ idx }}"
+
+    # -------------------------
+    # Readiness checks (controller first, then VM fallback)
+    # -------------------------
+
+    - name: Homarr | Wait for homepage (controller first, with retries)
+      ansible.builtin.uri:
+        url: "{{ (homarr_url | regex_replace('/$','')) + '/' }}"
+        method: GET
+        return_content: true
+        # Validate TLS only when using https://
+        validate_certs: "{{ (homarr_url | default('')) is match('^https://') }}"
+        status_code: 200
+      register: homarr_controller
+      delegate_to: localhost
+      run_once: true
+      when: homarr_url is defined and (homarr_url | length) > 0
+      retries: "{{ homarr_retries }}"
+      delay: "{{ homarr_delay }}"
+      until: homarr_controller.status == 200
+      failed_when: false
+      changed_when: false
+
+    - name: Homarr | VM-side fetch (HTML via Python, with retries)  # use SSHPASS env here too
+      ansible.builtin.command:
+        argv:
+          - sshpass
+          - -e
+          - ssh
+          - -o
+          - StrictHostKeyChecking=no
+          - -o
+          - ConnectTimeout=15
+          - "{{ vm_user }}@{{ vm_ip }}"
+          - bash
+          - -lc
+          - |
+            python3 - <<'PY'
+            # Fetch Homarr homepage from localhost and print HTML to stdout
+            import urllib.request, sys
+            try:
+                with urllib.request.urlopen("http://127.0.0.1:{{ homarr_port }}/", timeout=15) as r:
+                    sys.stdout.write(r.read().decode(errors='ignore'))
+            except Exception:
+                pass
+            PY
+      environment:
+        SSHPASS: "{{ vm_pass }}"
+      register: homarr_vm
+      changed_when: false
+      failed_when: false
+      when: homarr_controller.status | default(0) != 200 or homarr_controller.content is not defined
+      retries: "{{ homarr_retries }}"
+      delay: "{{ homarr_delay }}"
+      until: (homarr_vm.stdout | default('') | trim | length) > 0 and ('Homarr' in (homarr_vm.stdout | default('')))
+      no_log: "{{ DEBUG == 0 }}"
+
+    - name: Homarr | Choose homepage HTML (controller wins, else VM)  # safe guard against empty result
+      ansible.builtin.set_fact:
+        homarr_home_html: >-
+          {{
+            (
+              homarr_controller.content
+              if (homarr_controller is defined)
+                 and ((homarr_controller.status|default(0))==200)
+                 and (homarr_controller.content is defined)
+              else
+                 (homarr_vm.stdout | default('') | trim)
+            )
+          }}
+      when:
+        - (homarr_controller is defined and (homarr_controller.status|default(0))==200 and (homarr_controller.content is defined))
+          or ((homarr_vm.stdout | default('') | trim | length) > 0)
+
+    - name: Homarr | Print concise summary
+      ansible.builtin.debug:
+        msg: >-
+          Homarr homepage {{ 'reachable' if (homarr_home_html is defined) else 'NOT reachable' }}.
+          Source={{ 'controller' if ((homarr_controller is defined) and (homarr_controller.status|default(0))==200 and (homarr_controller.content is defined)) else 'vm' if (homarr_vm.stdout|default('')|trim|length>0) else 'n/a' }};
+          length={{ (homarr_home_html | default('')) | length }};
+          contains('Homarr')={{ (homarr_home_html is defined) and ('Homarr' in homarr_home_html) }}
+      when: DEBUG == 1
+
+    - name: Homarr | Homepage unavailable (after retries)
+      ansible.builtin.debug:
+        msg: "Homarr web není dostupný ani po pokusech."
+      when: homarr_home_html is not defined and DEBUG == 1
+
+    # Optional detailed dump (short excerpt only)
+    - name: Homarr | HTML excerpt (debug)
+      ansible.builtin.debug:
+        msg: "{{ (homarr_home_html | default(''))[:500] }}"
+      when: homarr_home_html is defined and DEBUG == 1

old/update_immich.yml

@@ -0,0 +1,313 @@
+# update_immich.yml
+
+- name: Update Immich on VM via Proxmox
+  hosts: linux_servers
+  gather_facts: false
+  become: true
+  become_user: root
+  become_method: sudo
+
+  vars:
+    # VM connection (provided by Semaphore env vars)
+    vm_ip:   "{{ lookup('env', 'VM_IP') }}"
+    vm_user: "{{ lookup('env', 'VM_USER') }}"
+    vm_pass: "{{ lookup('env', 'VM_PASS') }}"
+    use_sudo: false
+
+    # --- Debug mode (controlled via Semaphore variable) ---
+    DEBUG: "{{ lookup('env', 'DEBUG') | default(0) | int }}"
+    RETRIES: "{{ lookup('env', 'RETRIES') | default(25) | int }}"
+
+    # Immich specifics
+    immich_dir: "/opt/immich"
+    immich_project: "immich"
+    immich_compose_url: "https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml"
+    immich_compose_file: "/opt/immich/docker-compose.yml"
+    immich_override_file: "/opt/immich/docker-compose.override.yml"
+    immich_port: 2283
+
+    # Optional external URL for controller-side readiness check (e.g., https://photos.example.com)
+    immich_url: "{{ lookup('env', 'IMMICH_URL') | default('', true) }}"
+
+    # Retry policy
+    immich_retries: "{{ RETRIES }}"
+    immich_delay: 2
+
+    # Docker command prefix (consistent behavior)
+    docker_prefix: "unalias docker 2>/dev/null || true; DOCKER_CLI_HINTS=0; command docker"
+
+    # Compose command (always include override to keep local mounts separate from upstream compose)
+    immich_compose_cmd: >-
+      {{ docker_prefix }} compose
+      -p {{ immich_project }}
+      -f {{ immich_compose_file }}
+      -f {{ immich_override_file }}
+
+    # Commands to run on the target VM
+    immich_commands:
+      - "cd {{ immich_dir }}"
+
+      - |
+        cd {{ immich_dir }}
+        mkdir -p backups
+        if [ -f docker-compose.yml ]; then
+          cp -a docker-compose.yml "backups/docker-compose.yml.$(date +%F_%H%M%S).bak"
+        fi
+        if [ -f .env ]; then
+          cp -a .env "backups/.env.$(date +%F_%H%M%S).bak"
+        fi
+        if [ -f docker-compose.override.yml ]; then
+          cp -a docker-compose.override.yml "backups/docker-compose.override.yml.$(date +%F_%H%M%S).bak"
+        fi
+
+      - |
+        cd {{ immich_dir }}
+        # Download latest compose from Immich releases (requires curl or wget)
+        if command -v curl >/dev/null 2>&1; then
+          curl -fsSL -o docker-compose.yml "{{ immich_compose_url }}"
+        elif command -v wget >/dev/null 2>&1; then
+          wget -qO docker-compose.yml "{{ immich_compose_url }}"
+        else
+          echo "Neither curl nor wget is available on the VM."
+          exit 1
+        fi
+
+      - |
+        cd {{ immich_dir }}
+        # Ensure override compose exists (create if missing)
+        if [ ! -f "{{ immich_override_file }}" ]; then
+          printf '%s\n' \
+            'services:' \
+            '  immich-server:' \
+            '    volumes:' \
+            '      - /mnt/nextcloud-howard-photos:/mnt/nextcloud-howard-photos' \
+            '      - /mnt/nextcloud-kamilkaprdelka-photos:/mnt/nextcloud-kamilkaprdelka-photos' \
+            > "{{ immich_override_file }}"
+        fi
+        # Fail early if override is still missing/empty
+        test -s "{{ immich_override_file }}"
+
+
+      - |
+        cd {{ immich_dir }}
+        # Ensure .env exists. If missing, try to reconstruct it from running containers to avoid breaking DB creds.
+        python3 - <<'PY'
+        import json
+        import subprocess
+        from pathlib import Path
+
+        env_path = Path(".env")
+        if env_path.exists():
+            raise SystemExit(0)
+
+        def run(cmd):
+            p = subprocess.run(cmd, capture_output=True, text=True)
+            return p.returncode, p.stdout, p.stderr
+
+        rc, out, err = run(["bash", "-lc", "command docker inspect immich_postgres immich_server"])
+        if rc != 0 or not out.strip():
+            print("ERROR: .env is missing and cannot inspect running containers (immich_postgres/immich_server).", flush=True)
+            print("Create /opt/immich/.env manually or ensure the containers exist.", flush=True)
+            raise SystemExit(1)
+
+        data = json.loads(out)
+
+        by_name = {}
+        for c in data:
+            name = (c.get("Name") or "").lstrip("/")
+            by_name[name] = c
+
+        pg = by_name.get("immich_postgres")
+        srv = by_name.get("immich_server")
+        if not pg or not srv:
+            print("ERROR: Could not find immich_postgres and immich_server in docker inspect output.", flush=True)
+            raise SystemExit(1)
+
+        def env_map(container):
+            m = {}
+            for kv in (container.get("Config", {}).get("Env") or []):
+                if "=" in kv:
+                    k, v = kv.split("=", 1)
+                    m[k] = v
+            return m
+
+        def find_mount_source(container, dest):
+            for m in (container.get("Mounts") or []):
+                if m.get("Destination") == dest:
+                    return m.get("Source")
+            return ""
+
+        pg_env = env_map(pg)
+        db_user = pg_env.get("POSTGRES_USER", "")
+        db_pass = pg_env.get("POSTGRES_PASSWORD", "")
+        db_name = pg_env.get("POSTGRES_DB", "")
+
+        db_data = find_mount_source(pg, "/var/lib/postgresql/data")
+        upload_loc = find_mount_source(srv, "/usr/src/app/upload")
+
+        # Try to preserve the currently used image tag as IMMICH_VERSION (optional but safer)
+        immich_version = ""
+        image = (srv.get("Config", {}).get("Image") or "")
+        if ":" in image and "@" not in image:
+            immich_version = image.rsplit(":", 1)[-1]
+        elif ":" in image and "@" in image:
+            # image like repo:tag@sha256:...
+            immich_version = image.split("@", 1)[0].rsplit(":", 1)[-1]
+
+        missing = []
+        for k, v in [
+            ("DB_USERNAME", db_user),
+            ("DB_PASSWORD", db_pass),
+            ("DB_DATABASE_NAME", db_name),
+            ("DB_DATA_LOCATION", db_data),
+            ("UPLOAD_LOCATION", upload_loc),
+        ]:
+            if not v:
+                missing.append(k)
+
+        if missing:
+            print("ERROR: Could not reconstruct these .env values from containers: " + ", ".join(missing), flush=True)
+            raise SystemExit(1)
+
+        lines = [
+            f"UPLOAD_LOCATION={upload_loc}",
+            f"DB_DATA_LOCATION={db_data}",
+            f"DB_USERNAME={db_user}",
+            f"DB_PASSWORD={db_pass}",
+            f"DB_DATABASE_NAME={db_name}",
+        ]
+        if immich_version:
+            lines.append(f"IMMICH_VERSION={immich_version}")
+
+        env_path.write_text("\n".join(lines) + "\n", encoding="utf-8")
+        print("Created .env from running containers.", flush=True)
+        PY
+
+      - |
+        cd {{ immich_dir }}
+        # Comment out healthcheck.start_interval if present (safe no-op if missing)
+        sed -i -E 's/^([[:space:]]*)start_interval:/\1# start_interval:/' docker-compose.yml || true
+
+      - "cd {{ immich_dir }} && {{ immich_compose_cmd }} config >/dev/null"
+      - "cd {{ immich_dir }} && {{ immich_compose_cmd }} pull >/dev/null"
+      - "cd {{ immich_dir }} && {{ immich_compose_cmd }} up -d --remove-orphans --force-recreate >/dev/null"
+
+  tasks:
+    - name: Ensure sshpass is installed (for password-based SSH)  # English comments
+      ansible.builtin.apt:
+        name: sshpass
+        state: present
+        update_cache: yes
+
+    - name: Run Immich update commands on VM (via SSH)  # use SSHPASS env, hide item label
+      ansible.builtin.command:
+        argv:
+          - sshpass
+          - -e
+          - ssh
+          - -o
+          - StrictHostKeyChecking=no
+          - -o
+          - ConnectTimeout=15
+          - "{{ vm_user }}@{{ vm_ip }}"
+          - bash
+          - -lc
+          - "{{ ('sudo ' if use_sudo else '') + item }}"
+      environment:
+        SSHPASS: "{{ vm_pass }}"
+      loop: "{{ immich_commands }}"
+      loop_control:
+        index_var: idx
+        label: "cmd-{{ idx }}"
+      register: immich_cmds
+      changed_when: false
+      no_log: "{{ DEBUG == 0 }}"
+      run_once: true
+
+    - name: Show outputs for each Immich command
+      ansible.builtin.debug:
+        msg: |
+          CMD: {{ item.item }}
+          RC:  {{ item.rc }}
+          STDOUT:
+          {{ (item.stdout | default('')).strip() }}
+          STDERR:
+          {{ (item.stderr | default('')).strip() }}
+      loop: "{{ immich_cmds.results }}"
+      when: DEBUG == 1
+      run_once: true
+
+    - name: Fail play if any Immich command failed
+      ansible.builtin.assert:
+        that: "item.rc == 0"
+        fail_msg: "Immich update failed on VM: {{ item.item }} (rc={{ item.rc }})"
+        success_msg: "All Immich update commands succeeded."
+      loop: "{{ immich_cmds.results }}"
+      loop_control:
+        index_var: idx
+        label: "cmd-{{ idx }}"
+      run_once: true
+
+    # -------------------------
+    # Readiness checks (controller first, then VM fallback)
+    # -------------------------
+
+    - name: Immich | Wait for API ping (controller first, with retries)
+      ansible.builtin.uri:
+        url: "{{ (immich_url | regex_replace('/$','')) + '/api/server/ping' }}"
+        method: GET
+        return_content: true
+        validate_certs: "{{ (immich_url | default('')) is match('^https://') }}"
+        status_code: 200
+      register: immich_controller
+      delegate_to: localhost
+      run_once: true
+      when: immich_url is defined and (immich_url | length) > 0
+      retries: "{{ immich_retries }}"
+      delay: "{{ immich_delay }}"
+      until: immich_controller.status == 200 and ('pong' in (immich_controller.content | default('')))
+      failed_when: false
+      changed_when: false
+
+    - name: Immich | VM-side ping (JSON via Python, with retries)
+      ansible.builtin.command:
+        argv:
+          - sshpass
+          - -e
+          - ssh
+          - -o
+          - StrictHostKeyChecking=no
+          - -o
+          - ConnectTimeout=15
+          - "{{ vm_user }}@{{ vm_ip }}"
+          - bash
+          - -lc
+          - |
+            python3 - <<'PY'
+            # Ping Immich API from localhost and print response to stdout
+            import urllib.request, sys
+            try:
+                with urllib.request.urlopen("http://127.0.0.1:{{ immich_port }}/api/server/ping", timeout=15) as r:
+                    sys.stdout.write(r.read().decode(errors='ignore'))
+            except Exception:
+                pass
+            PY
+      environment:
+        SSHPASS: "{{ vm_pass }}"
+      register: immich_vm
+      changed_when: false
+      failed_when: false
+      when: immich_controller.status | default(0) != 200
+      retries: "{{ immich_retries }}"
+      delay: "{{ immich_delay }}"
+      until: (immich_vm.stdout | default('') | trim | length) > 0 and ('pong' in (immich_vm.stdout | default('')))
+      no_log: "{{ DEBUG == 0 }}"
+      run_once: true
+
+    - name: Immich | Print concise summary
+      ansible.builtin.debug:
+        msg: >-
+          Immich API ping {{ 'OK' if (('pong' in (immich_controller.content|default(''))) or ('pong' in (immich_vm.stdout|default('')))) else 'NOT OK' }}.
+          Source={{ 'controller' if (immich_controller.status|default(0))==200 else 'vm' if (immich_vm.stdout|default('')|trim|length>0) else 'n/a' }}.
+      when: DEBUG == 1
+      run_once: true

old/update_nextcloud_mariadb_redis.yml

@@ -0,0 +1,293 @@
+# nextcloud/update_nextcloud_db_redis.yml
+
+- name: Update Nextcloud DB and Redis on VM via Proxmox
+  hosts: linux_servers
+  gather_facts: false
+  become: true
+  become_user: root
+  become_method: sudo
+
+  vars:
+    # --- Connection to VM (provided by Semaphore env vars) ---
+    vm_ip:   "{{ lookup('env', 'VM_IP') }}"
+    vm_user: "{{ lookup('env', 'VM_USER') }}"
+    vm_pass: "{{ lookup('env', 'VM_PASS') }}"
+    use_sudo: false
+
+    # --- Debug / retries ---
+    DEBUG: "{{ lookup('env', 'DEBUG') | default(0) | int }}"
+    RETRIES: "{{ lookup('env', 'RETRIES') | default(25) | int }}"
+
+    # --- Nextcloud specifics ---
+    nextcloud_project: "nextcloud-collabora"
+    nextcloud_compose_file: "/data/compose/nextcloud/docker-compose-nextcloud.yml"
+
+    # Service names from docker-compose file
+    nextcloud_web_service: "nextcloud"
+    nextcloud_db_service: "nextclouddb"
+    redis_service: "redis"
+
+    # Backup directory on the VM (timestamped on controller)
+    backup_dir: "/data/compose/nextcloud/backup-db-redis-{{ lookup('pipe', 'date +%F-%H%M%S') }}"
+
+    nextcloud_base_url: "https://cloud.martinfencl.eu"
+    nextcloud_status_url: "{{ nextcloud_base_url }}/status.php"
+
+    # Docker command prefix (consistent behavior and quiet hints)
+    docker_prefix: "unalias docker 2>/dev/null || true; DOCKER_CLI_HINTS=0; command docker"
+
+    # --- Backup phase commands (run on VM) ---
+    # Same idea as in update_nextcloud.yml: maintenance on + config/custom_apps + DB dump
+    nextcloud_backup_commands:
+      - >
+        mkdir -p "{{ backup_dir }}"
+      - >
+        docker exec -u www-data nextcloud php occ maintenance:mode --on
+      - >
+        docker exec nextcloud sh -c 'tar czf /tmp/nextcloud_conf.tgz -C /var/www/html config custom_apps'
+      - >
+        docker cp nextcloud:/tmp/nextcloud_conf.tgz "{{ backup_dir }}/nextcloud_conf.tgz"
+      - >
+        docker exec nextcloud rm /tmp/nextcloud_conf.tgz || true
+      - >
+        docker exec nextcloud-db sh -c 'command -v mariadb-dump >/dev/null && mariadb-dump -u"$MYSQL_USER" -p"$MYSQL_PASSWORD" "$MYSQL_DATABASE" || mysqldump -u"$MYSQL_USER" -p"$MYSQL_PASSWORD" "$MYSQL_DATABASE"' > "{{ backup_dir }}/db.sql"
+
+    # --- DB + Redis upgrade commands (run on VM) ---
+    db_redis_upgrade_commands:
+      # Update MariaDB service
+      - >
+        {{ docker_prefix }} compose -p {{ nextcloud_project }} -f {{ nextcloud_compose_file }} pull {{ nextcloud_db_service }}
+      - >
+        {{ docker_prefix }} compose -p {{ nextcloud_project }} -f {{ nextcloud_compose_file }} up -d --no-deps --force-recreate {{ nextcloud_db_service }}
+      # Simple DB health check (non-fatal)
+      - >
+        docker exec nextcloud-db sh -c 'mysqladmin ping -u"$MYSQL_USER" -p"$MYSQL_PASSWORD" "$MYSQL_DATABASE"' || true
+      # Update Redis service
+      - >
+        {{ docker_prefix }} compose -p {{ nextcloud_project }} -f {{ nextcloud_compose_file }} pull {{ redis_service }}
+      - >
+        {{ docker_prefix }} compose -p {{ nextcloud_project }} -f {{ nextcloud_compose_file }} up -d --no-deps --force-recreate {{ redis_service }}
+      # Simple Redis health check (non-fatal)
+      - >
+        docker exec redis redis-cli PING || true
+
+  tasks:
+    - name: Ensure sshpass is installed (for password-based SSH)
+      ansible.builtin.apt:
+        name: sshpass
+        state: present
+        update_cache: yes
+
+    - name: Nextcloud | Show current version before DB/Redis upgrade (DEBUG)
+      ansible.builtin.command:
+        argv:
+          - sshpass
+          - -e
+          - ssh
+          - -o
+          - StrictHostKeyChecking=no
+          - -o
+          - ConnectTimeout=15
+          - "{{ vm_user }}@{{ vm_ip }}"
+          - bash
+          - -lc
+          - 'docker exec -u www-data nextcloud php occ -V || true'
+      environment:
+        SSHPASS: "{{ vm_pass }}"
+      register: nc_version_before
+      changed_when: false
+      failed_when: false
+      when: DEBUG == 1
+
+    # -------------------------
+    # Backup phase
+    # -------------------------
+    - name: Nextcloud | Run backup commands on VM (via SSH)
+      ansible.builtin.command:
+        argv:
+          - sshpass
+          - -e
+          - ssh
+          - -o
+          - StrictHostKeyChecking=no
+          - -o
+          - ConnectTimeout=15
+          - "{{ vm_user }}@{{ vm_ip }}"
+          - "{{ ('sudo ' if use_sudo else '') + item }}"
+      environment:
+        SSHPASS: "{{ vm_pass }}"
+      loop: "{{ nextcloud_backup_commands }}"
+      loop_control:
+        index_var: idx
+        label: "backup-cmd-{{ idx }}"
+      register: nc_backup_cmds
+      changed_when: false
+      no_log: "{{ DEBUG == 0 }}"
+
+    - name: Nextcloud | Show outputs of backup commands (DEBUG)
+      ansible.builtin.debug:
+        msg: |
+          CMD: {{ item.item }}
+          RC:  {{ item.rc }}
+          STDOUT:
+          {{ (item.stdout | default('')).strip() }}
+          STDERR:
+          {{ (item.stderr | default('')).strip() }}
+      loop: "{{ nc_backup_cmds.results }}"
+      when: DEBUG == 1
+
+    - name: Nextcloud | Fail play if any backup command failed
+      ansible.builtin.assert:
+        that: "item.rc == 0"
+        fail_msg: "Nextcloud DB/Redis backup step failed on VM: {{ item.item }} (rc={{ item.rc }})"
+        success_msg: "All Nextcloud DB/Redis backup commands succeeded."
+      loop: "{{ nc_backup_cmds.results }}"
+      loop_control:
+        index_var: idx
+        label: "backup-cmd-{{ idx }}"
+
+    # -------------------------
+    # DB + Redis upgrade phase
+    # -------------------------
+
+    - name: Nextcloud | Run DB/Redis upgrade commands on VM (via SSH)
+      ansible.builtin.command:
+        argv:
+          - sshpass
+          - -e
+          - ssh
+          - -o
+          - StrictHostKeyChecking=no
+          - -o
+          - ConnectTimeout=15
+          - "{{ vm_user }}@{{ vm_ip }}"
+          - bash
+          - -lc
+          - "{{ ('sudo ' if use_sudo else '') + item }}"
+      environment:
+        SSHPASS: "{{ vm_pass }}"
+      loop: "{{ db_redis_upgrade_commands }}"
+      loop_control:
+        index_var: idx
+        label: "db-redis-cmd-{{ idx }}"
+      register: nc_db_redis_cmds
+      changed_when: false
+      failed_when: false
+      no_log: "{{ DEBUG == 0 }}"
+
+    - name: Nextcloud | Show outputs of DB/Redis upgrade commands (DEBUG)
+      ansible.builtin.debug:
+        msg: |
+          CMD: {{ item.item }}
+          RC:  {{ item.rc }}
+          STDOUT:
+          {{ (item.stdout | default('')).strip() }}
+          STDERR:
+          {{ (item.stderr | default('')).strip() }}
+      loop: "{{ nc_db_redis_cmds.results }}"
+      when: DEBUG == 1
+
+    - name: Nextcloud | Fail play if any DB/Redis upgrade command failed
+      ansible.builtin.assert:
+        that: "item.rc == 0"
+        fail_msg: "Nextcloud DB/Redis upgrade step failed on VM: {{ item.item }} (rc={{ item.rc }})"
+        success_msg: "All Nextcloud DB/Redis upgrade commands succeeded."
+      loop: "{{ nc_db_redis_cmds.results }}"
+      loop_control:
+        index_var: idx
+        label: "db-redis-cmd-{{ idx }}"
+
+    # -------------------------
+    # Disable maintenance + readiness check
+    # -------------------------
+
+    - name: Nextcloud | Disable maintenance mode after DB/Redis upgrade
+      ansible.builtin.command:
+        argv:
+          - sshpass
+          - -e
+          - ssh
+          - -o
+          - StrictHostKeyChecking=no
+          - -o
+          - ConnectTimeout=15
+          - "{{ vm_user }}@{{ vm_ip }}"
+          - "{{ ('sudo ' if use_sudo else '') }}docker exec -u www-data nextcloud php occ maintenance:mode --off"
+      environment:
+        SSHPASS: "{{ vm_pass }}"
+      register: nc_maint_off
+      changed_when: false
+      no_log: "{{ DEBUG == 0 }}"
+
+    - name: Nextcloud | Wait for status.php (controller first)
+      ansible.builtin.uri:
+        url: "{{ nextcloud_status_url }}"
+        method: GET
+        return_content: true
+        validate_certs: true
+        status_code: 200
+      register: nc_status_controller
+      delegate_to: localhost
+      run_once: true
+      retries: "{{ RETRIES }}"
+      delay: 4
+      failed_when: false
+      changed_when: false
+
+    - name: Nextcloud | VM-side fetch status.php (JSON via Python)
+      ansible.builtin.command:
+        argv:
+          - sshpass
+          - -e
+          - ssh
+          - -o
+          - StrictHostKeyChecking=no
+          - -o
+          - ConnectTimeout=15
+          - "{{ vm_user }}@{{ vm_ip }}"
+          - bash
+          - -lc
+          - |
+            python3 - <<'PY'
+            import json, urllib.request, sys
+            try:
+                with urllib.request.urlopen("{{ nextcloud_status_url }}", timeout=15) as r:
+                    sys.stdout.write(r.read().decode())
+            except Exception:
+                pass
+            PY
+      environment:
+        SSHPASS: "{{ vm_pass }}"
+      register: nc_status_vm
+      changed_when: false
+      failed_when: false
+      when: nc_status_controller.status | default(0) != 200 or nc_status_controller.json is not defined
+      no_log: "{{ DEBUG == 0 }}"
+
+    - name: Nextcloud | Choose status JSON (controller wins, else VM)
+      ansible.builtin.set_fact:
+        nextcloud_status_json: >-
+          {{
+            (nc_status_controller.json
+              if (nc_status_controller.status | default(0)) == 200 and (nc_status_controller.json is defined)
+              else (
+                (nc_status_vm.stdout | default('') | trim | length > 0)
+                | ternary((nc_status_vm.stdout | trim | from_json), omit)
+              )
+            )
+          }}
+      failed_when: false
+
+    - name: Nextcloud | Print concise status summary (DEBUG)
+      ansible.builtin.debug:
+        msg: >-
+          Nextcloud {{ nextcloud_status_json.version | default('?') }}
+          (installed={{ nextcloud_status_json.installed | default('?') }},
+          maintenance={{ nextcloud_status_json.maintenance | default('?') }},
+          needsDbUpgrade={{ nextcloud_status_json.needsDbUpgrade | default('?') }})
+      when: nextcloud_status_json is defined and DEBUG == 1
+
+    - name: Nextcloud | Status JSON not available (DEBUG)
+      ansible.builtin.debug:
+        msg: "status.php is not reachable or did not return JSON."
+      when: nextcloud_status_json is not defined and DEBUG == 1

old/update_portainer_agent.yml

@@ -0,0 +1,118 @@
+# update_portainer_agent.yml
+
+- name: Update Portainer Agent on VM via Proxmox
+  hosts: linux_servers
+  gather_facts: false
+  become: true
+  become_user: root
+  become_method: sudo
+
+  vars:
+    # --- Connection to VM (provided by Semaphore env vars) ---
+    vm_ip:   "{{ lookup('env', 'VM_IP') }}"
+    vm_user: "{{ lookup('env', 'VM_USER') }}"
+    vm_pass: "{{ lookup('env', 'VM_PASS') }}"
+    use_sudo: false
+
+    # --- Debug mode (controlled via Semaphore variable) ---
+    DEBUG: "{{ lookup('env', 'DEBUG') | default(0) | int }}"
+    RETRIES: "{{ lookup('env', 'RETRIES') | default(25) | int }}"
+
+    # --- Portainer Agent specifics ---
+    portainer_agent_image: "portainer/agent:latest"
+    portainer_agent_container: "portainer_agent"
+    portainer_agent_port: 9001
+
+    # Docker command prefix (consistent behavior and quiet hints)
+    docker_prefix: "unalias docker 2>/dev/null || true; DOCKER_CLI_HINTS=0; command docker"
+
+    # Commands to run on the target VM (quiet outputs)
+    portainer_commands:
+      - "{{ docker_prefix }} pull -q {{ portainer_agent_image }} >/dev/null"
+      - "{{ docker_prefix }} stop {{ portainer_agent_container }} >/dev/null 2>&1 || true"
+      - "{{ docker_prefix }} rm {{ portainer_agent_container }} >/dev/null 2>&1 || true"
+      - >
+        {{ docker_prefix }} run -d
+        --name {{ portainer_agent_container }}
+        --restart=always
+        -p {{ portainer_agent_port }}:9001
+        -v /var/run/docker.sock:/var/run/docker.sock
+        -v /var/lib/docker/volumes:/var/lib/docker/volumes
+        {{ portainer_agent_image }} >/dev/null
+
+  tasks:
+    - name: Ensure sshpass is installed (for password-based SSH)  # English comments
+      ansible.builtin.apt:
+        name: sshpass
+        state: present
+        update_cache: yes
+
+    - name: Run Portainer Agent update commands on VM (via SSH)  # run all commands via sshpass
+      ansible.builtin.command:
+        argv:
+          - sshpass
+          - -e
+          - ssh
+          - -o
+          - StrictHostKeyChecking=no
+          - -o
+          - ConnectTimeout=15
+          - "{{ vm_user }}@{{ vm_ip }}"
+          - bash
+          - -lc
+          - "{{ ('sudo ' if use_sudo else '') + item }}"
+      environment:
+        SSHPASS: "{{ vm_pass }}"
+      loop: "{{ portainer_commands }}"
+      loop_control:
+        index_var: idx              # capture loop index
+        label: "cmd-{{ idx }}"      # avoid printing full command in (item=...) line
+      register: portainer_cmds
+      changed_when: false
+      no_log: "{{ DEBUG == 0 }}"    # hide outputs and env when not debugging
+
+    - name: Show outputs for each Portainer command
+      ansible.builtin.debug:
+        msg: |
+          CMD: {{ item.item }}
+          RC:  {{ item.rc }}
+          STDOUT:
+          {{ (item.stdout | default('')).strip() }}
+          STDERR:
+          {{ (item.stderr | default('')).strip() }}
+      loop: "{{ portainer_cmds.results }}"
+      when: DEBUG == 1
+
+    - name: Fail play if any Portainer command failed
+      ansible.builtin.assert:
+        that: "item.rc == 0"
+        fail_msg: "Portainer Agent update failed on VM: {{ item.item }} (rc={{ item.rc }})"
+        success_msg: "All Portainer Agent update commands succeeded."
+      loop: "{{ portainer_cmds.results }}"
+      loop_control:
+        index_var: idx
+        label: "cmd-{{ idx }}"
+
+    # -------------------------
+    # Readiness check (TCP port)
+    # -------------------------
+
+    - name: Portainer Agent | Wait for TCP port to be open from controller
+      ansible.builtin.wait_for:
+        host: "{{ vm_ip }}"
+        port: "{{ portainer_agent_port }}"
+        delay: 2                    # initial delay before first check
+        timeout: "{{ RETRIES * 2 }}" # total timeout in seconds
+        state: started
+      register: portainer_wait
+      delegate_to: localhost
+      run_once: true
+      changed_when: false
+
+    - name: Portainer Agent | Print concise summary
+      ansible.builtin.debug:
+        msg: >-
+          Portainer Agent TCP {{ vm_ip }}:{{ portainer_agent_port }}
+          reachable={{ (portainer_wait is defined) and (not portainer_wait.failed | default(false)) }}
+          elapsed={{ portainer_wait.elapsed | default('n/a') }}s
+      when: DEBUG == 1

old/update_semaphore.yml

@@ -0,0 +1,65 @@
+# update_semaphore.yml
+
+- name: Update Semaphore on VM via Proxmox
+  hosts: linux_servers
+  gather_facts: false
+  become: true
+  become_user: root
+  become_method: sudo
+
+  vars:
+    # --- Connection to VM (provided by Semaphore env vars) ---
+    vm_ip:   "{{ lookup('env', 'VM_IP') }}"      # IP vm-portainer
+    vm_user: "{{ lookup('env', 'VM_USER') }}"
+    vm_pass: "{{ lookup('env', 'VM_PASS') }}"
+    use_sudo: false
+
+    # --- Debug mode (controlled via Semaphore variable) ---
+    DEBUG: "{{ lookup('env', 'DEBUG') | default(0) | int }}"
+
+    # --- Semaphore specifics ---
+    semaphore_project: "semaphore"
+    semaphore_compose_file: "/data/compose/semaphore/docker-compose.yml"
+    semaphore_service: "semaphore"
+
+  tasks:
+    - name: Ensure sshpass is installed (for password-based SSH)  # English comments
+      ansible.builtin.apt:
+        name: sshpass
+        state: present
+        update_cache: yes
+
+    - name: Run Semaphore self-update on VM in background (nohup)
+      ansible.builtin.command:
+        argv:
+          - sshpass
+          - -e
+          - ssh
+          - -o
+          - StrictHostKeyChecking=no
+          - -o
+          - ConnectTimeout=15
+          - "{{ vm_user }}@{{ vm_ip }}"
+          - bash
+          - -lc
+          - |
+            nohup bash -c '
+              unalias docker 2>/dev/null || true
+              DOCKER_CLI_HINTS=0 docker compose \
+                -p {{ semaphore_project }} \
+                -f {{ semaphore_compose_file }} \
+                up -d --no-deps --force-recreate --pull always {{ semaphore_service }}
+            ' >/dev/null 2>&1 &
+      environment:
+        SSHPASS: "{{ vm_pass }}"
+      register: semaphore_update
+      changed_when: false
+      no_log: "{{ DEBUG == 0 }}"
+
+    - name: Show result of Semaphore self-update (debug)
+      ansible.builtin.debug:
+        msg: |
+          RC:      {{ semaphore_update.rc }}
+          STDOUT:  {{ (semaphore_update.stdout | default('')).strip() }}
+          STDERR:  {{ (semaphore_update.stderr | default('')).strip() }}
+      when: DEBUG == 1

old/update_uptime_kuma.yml

@@ -0,0 +1,194 @@
+# nextcloud/update_uptime_kuma.yml
+
+- name: Update Uptime Kuma on VM via Proxmox
+  hosts: linux_servers
+  gather_facts: false
+  become: true
+  become_user: root
+  become_method: sudo
+
+  vars:
+    # VM connection (provided by Semaphore env vars)
+    vm_ip:   "{{ lookup('env', 'VM_IP') }}"
+    vm_user: "{{ lookup('env', 'VM_USER') }}"
+    vm_pass: "{{ lookup('env', 'VM_PASS') }}"
+    use_sudo: false
+
+    # --- Debug mode (controlled via Semaphore variable) ---
+    DEBUG: "{{ lookup('env', 'DEBUG') | default(0) | int }}"
+    RETRIES: "{{ lookup('env', 'RETRIES') | default(25) | int }}"
+
+    # Uptime Kuma specifics
+    kuma_project: "uptime-kuma"
+    kuma_compose_file: "/data/compose/uptime-kuma/docker-compose-uptime-kuma.yml"
+    kuma_service: "uptime-kuma"
+    kuma_image: "louislam/uptime-kuma:latest"
+    kuma_port: 3001
+
+    # Optional external URL for controller-side readiness check (e.g., https://kuma.example.com)
+    # If empty/undefined, controller check is skipped and we only probe from the VM.
+    kuma_url: "{{ lookup('env', 'KUMA_URL') | default('', true) }}"
+
+    # Fixed container name used in your compose (conflicts with previous/Portainer-run container)
+    kuma_container_name: "uptime-kuma-dev"
+
+    # Retry policy
+    kuma_retries: "{{ RETRIES }}"
+    kuma_delay: 2
+
+    # Docker command prefix (consistent behavior)
+    docker_prefix: "unalias docker 2>/dev/null || true; DOCKER_CLI_HINTS=0; command docker"
+
+    # Commands to run on the target VM (quiet outputs like in Collabora play)
+    kuma_commands:
+      - "{{ docker_prefix }} pull -q {{ kuma_image }} >/dev/null"
+      - "{{ docker_prefix }} compose -p {{ kuma_project }} -f {{ kuma_compose_file }} pull {{ kuma_service }} >/dev/null"
+      # remove conflicting container name before compose up (silently)
+      - "{{ docker_prefix }} rm -f {{ kuma_container_name }} >/dev/null 2>&1 || true"
+      - "{{ docker_prefix }} compose -p {{ kuma_project }} -f {{ kuma_compose_file }} up -d --no-deps --force-recreate {{ kuma_service }} >/dev/null"
+
+  tasks:
+    - name: Ensure sshpass is installed (for password-based SSH)  # English comments
+      ansible.builtin.apt:
+        name: sshpass
+        state: present
+        update_cache: yes
+
+    - name: Run Uptime Kuma update commands on VM (via SSH)  # use SSHPASS env, hide item label
+      ansible.builtin.command:
+        argv:
+          - sshpass
+          - -e                     # read password from SSHPASS environment
+          - ssh
+          - -o
+          - StrictHostKeyChecking=no
+          - -o
+          - ConnectTimeout=15
+          - "{{ vm_user }}@{{ vm_ip }}"
+          - bash
+          - -lc
+          - "{{ ('sudo ' if use_sudo else '') + item }}"
+      environment:
+        SSHPASS: "{{ vm_pass }}"    # supply password via environment
+      loop: "{{ kuma_commands }}"
+      loop_control:
+        index_var: idx              # capture loop index
+        label: "cmd-{{ idx }}"      # avoid printing full command in (item=...) line
+      register: kuma_cmds
+      changed_when: false
+      no_log: "{{ DEBUG == 0 }}"    # hide outputs and env when not debugging
+
+    - name: Show outputs for each Uptime Kuma command
+      ansible.builtin.debug:
+        msg: |
+          CMD: {{ item.item }}
+          RC:  {{ item.rc }}
+          STDOUT:
+          {{ (item.stdout | default('')).strip() }}
+          STDERR:
+          {{ (item.stderr | default('')).strip() }}
+      loop: "{{ kuma_cmds.results }}"
+      when: DEBUG == 1
+
+    - name: Fail play if any Uptime Kuma command failed  # also hide item label
+      ansible.builtin.assert:
+        that: "item.rc == 0"
+        fail_msg: "Uptime Kuma update failed on VM: {{ item.item }} (rc={{ item.rc }})"
+        success_msg: "All Uptime Kuma update commands succeeded."
+      loop: "{{ kuma_cmds.results }}"
+      loop_control:
+        index_var: idx
+        label: "cmd-{{ idx }}"
+
+    # -------------------------
+    # Readiness checks (controller first, then VM fallback)
+    # -------------------------
+
+    - name: Kuma | Wait for homepage (controller first, with retries)
+      ansible.builtin.uri:
+        url: "{{ (kuma_url | regex_replace('/$','')) + '/' }}"
+        method: GET
+        return_content: true
+        # Validate TLS only when using https://
+        validate_certs: "{{ (kuma_url | default('')) is match('^https://') }}"
+        status_code: 200
+      register: kuma_controller
+      delegate_to: localhost
+      run_once: true
+      when: kuma_url is defined and (kuma_url | length) > 0
+      retries: "{{ kuma_retries }}"
+      delay: "{{ kuma_delay }}"
+      until: kuma_controller.status == 200
+      failed_when: false
+      changed_when: false
+
+    - name: Kuma | VM-side fetch (HTML via Python, with retries)  # use SSHPASS env here too
+      ansible.builtin.command:
+        argv:
+          - sshpass
+          - -e
+          - ssh
+          - -o
+          - StrictHostKeyChecking=no
+          - -o
+          - ConnectTimeout=15
+          - "{{ vm_user }}@{{ vm_ip }}"
+          - bash
+          - -lc
+          - |
+            python3 - <<'PY'
+            # Fetch Kuma homepage from localhost and print HTML to stdout
+            import urllib.request, sys
+            try:
+                with urllib.request.urlopen("http://127.0.0.1:{{ kuma_port }}/", timeout=15) as r:
+                    sys.stdout.write(r.read().decode(errors='ignore'))
+            except Exception:
+                pass
+            PY
+      environment:
+        SSHPASS: "{{ vm_pass }}"
+      register: kuma_vm
+      changed_when: false
+      failed_when: false
+      when: kuma_controller.status | default(0) != 200 or kuma_controller.content is not defined
+      retries: "{{ kuma_retries }}"
+      delay: "{{ kuma_delay }}"
+      until: (kuma_vm.stdout | default('') | trim | length) > 0 and ('Uptime Kuma' in (kuma_vm.stdout | default('')))
+      no_log: "{{ DEBUG == 0 }}"   # hide command and output when not debugging
+
+    - name: Kuma | Choose homepage HTML (controller wins, else VM)  # safe guard against empty result
+      ansible.builtin.set_fact:
+        kuma_home_html: >-
+          {{
+            (
+              kuma_controller.content
+              if (kuma_controller is defined)
+                 and ((kuma_controller.status|default(0))==200)
+                 and (kuma_controller.content is defined)
+              else
+                 (kuma_vm.stdout | default('') | trim)
+            )
+          }}
+      when:
+        - (kuma_controller is defined and (kuma_controller.status|default(0))==200 and (kuma_controller.content is defined))
+          or ((kuma_vm.stdout | default('') | trim | length) > 0)
+
+    - name: Kuma | Print concise summary
+      ansible.builtin.debug:
+        msg: >-
+          Uptime Kuma homepage {{ 'reachable' if (kuma_home_html is defined) else 'NOT reachable' }}.
+          Source={{ 'controller' if ((kuma_controller is defined) and (kuma_controller.status|default(0))==200 and (kuma_controller.content is defined)) else 'vm' if (kuma_vm.stdout|default('')|trim|length>0) else 'n/a' }};
+          length={{ (kuma_home_html | default('')) | length }};
+          contains('Uptime Kuma')={{ (kuma_home_html is defined) and ('Uptime Kuma' in kuma_home_html) }}
+      when: DEBUG == 1
+
+    - name: Kuma | Homepage unavailable (after retries)
+      ansible.builtin.debug:
+        msg: "Kuma web není dostupná ani po pokusech."
+      when: kuma_home_html is not defined and DEBUG == 1
+
+    # Optional detailed dump (short excerpt only)
+    - name: Kuma | HTML excerpt (debug)
+      ansible.builtin.debug:
+        msg: "{{ (kuma_home_html | default(''))[:500] }}"
+      when: kuma_home_html is defined and DEBUG == 1

portainer/update_portainer_agent_lxc.yml

@@ -0,0 +1,69 @@
+# update_portainer_agent_lxc.yml
+
+- name: Update Portainer Agent (LXC, no compose)
+  hosts: pve2_lxc_jellyfin
+  gather_facts: false
+
+  vars:
+    agent_container_name: portainer_agent
+    agent_port: 9001
+
+  tasks:
+    - name: Check if agent container exists
+      ansible.builtin.command:
+        argv:
+          - bash
+          - -lc
+          - "docker ps -a --format '{{ \"{{\" }}.Names{{ \"}}\" }}' | grep -x '{{ agent_container_name }}'"
+      register: agent_exists
+      changed_when: false
+      failed_when: false
+
+    - name: Abort if agent container is missing
+      ansible.builtin.fail:
+        msg: "Container '{{ agent_container_name }}' not found."
+      when: agent_exists.rc != 0
+
+    - name: Read current agent image
+      ansible.builtin.command:
+        argv:
+          - bash
+          - -lc
+          - "docker inspect -f '{{ \"{{\" }}.Config.Image{{ \"}}\" }}' {{ agent_container_name }}"
+      register: agent_image
+      changed_when: false
+
+    - name: Pull latest image tag for current agent image
+      ansible.builtin.command:
+        argv:
+          - bash
+          - -lc
+          - "docker pull {{ agent_image.stdout | trim }}"
+      changed_when: true
+
+    - name: Recreate agent container with standard Portainer Agent args
+      ansible.builtin.command:
+        argv:
+          - bash
+          - -lc
+          - |
+            set -euo pipefail
+
+            # Stop/remove old container
+            docker rm -f "{{ agent_container_name }}" >/dev/null 2>&1 || true
+
+            # Run Portainer Agent with common, safe defaults
+            docker run -d \
+              --name "{{ agent_container_name }}" \
+              --restart=always \
+              -p {{ agent_port }}:9001 \
+              -v /var/run/docker.sock:/var/run/docker.sock \
+              -v /var/lib/docker/volumes:/var/lib/docker/volumes \
+              "{{ agent_image.stdout | trim }}"
+      changed_when: true
+
+    - name: Wait for agent port
+      ansible.builtin.wait_for:
+        host: 127.0.0.1
+        port: "{{ agent_port }}"
+        timeout: 60

portainer/update_portainer_agent_vm.yml

@@ -0,0 +1,69 @@
+# update_portainer_agent_vm.yml
+
+- name: Update Portainer Agent (VM, no compose)
+  hosts: pve2_vm
+  gather_facts: false
+
+  vars:
+    agent_container_name: portainer_agent
+    agent_port: 9001
+
+  tasks:
+    - name: Check if agent container exists
+      ansible.builtin.command:
+        argv:
+          - bash
+          - -lc
+          - "docker ps -a --format '{{ \"{{\" }}.Names{{ \"}}\" }}' | grep -x '{{ agent_container_name }}'"
+      register: agent_exists
+      changed_when: false
+      failed_when: false
+
+    - name: Abort if agent container is missing
+      ansible.builtin.fail:
+        msg: "Container '{{ agent_container_name }}' not found."
+      when: agent_exists.rc != 0
+
+    - name: Read current agent image
+      ansible.builtin.command:
+        argv:
+          - bash
+          - -lc
+          - "docker inspect -f '{{ \"{{\" }}.Config.Image{{ \"}}\" }}' {{ agent_container_name }}"
+      register: agent_image
+      changed_when: false
+
+    - name: Pull latest image tag for current agent image
+      ansible.builtin.command:
+        argv:
+          - bash
+          - -lc
+          - "docker pull {{ agent_image.stdout | trim }}"
+      changed_when: true
+
+    - name: Recreate agent container with standard Portainer Agent args
+      ansible.builtin.command:
+        argv:
+          - bash
+          - -lc
+          - |
+            set -euo pipefail
+
+            # Stop/remove old container
+            docker rm -f "{{ agent_container_name }}" >/dev/null 2>&1 || true
+
+            # Run Portainer Agent with common, safe defaults
+            docker run -d \
+              --name "{{ agent_container_name }}" \
+              --restart=always \
+              -p {{ agent_port }}:9001 \
+              -v /var/run/docker.sock:/var/run/docker.sock \
+              -v /var/lib/docker/volumes:/var/lib/docker/volumes \
+              "{{ agent_image.stdout | trim }}"
+      changed_when: true
+
+    - name: Wait for agent port
+      ansible.builtin.wait_for:
+        host: 127.0.0.1
+        port: "{{ agent_port }}"
+        timeout: 60

update_bettershift.yml

@@ -0,0 +1,85 @@
+# update_bettershift.yml
+
+- name: Update BetterShift
+  hosts: pve2_vm
+  gather_facts: false
+
+  vars:
+    compose_local_dir: "{{ playbook_dir }}/docker-compose"
+    compose_remote_base: "/home/{{ ansible_user }}/.ansible-compose/docker-compose"
+
+    bettershift_project: bettershift
+    bettershift_compose_filename: "docker-compose-bettershift.yml"
+    bettershift_service: bettershift
+    bettershift_port: 3067
+    bettershift_data_dir: "/data/compose/bettershift/data"
+
+  tasks:
+    - name: Ensure remote compose directory exists
+      ansible.builtin.file:
+        path: "{{ compose_remote_base }}"
+        state: directory
+        mode: "0755"
+
+    - name: Ensure BetterShift data directory exists
+      ansible.builtin.file:
+        path: "{{ bettershift_data_dir }}"
+        state: directory
+        mode: "0755"
+
+    - name: Upload BetterShift compose file to remote host
+      ansible.builtin.copy:
+        src: "{{ compose_local_dir }}/{{ bettershift_compose_filename }}"
+        dest: "{{ compose_remote_base }}/{{ bettershift_compose_filename }}"
+        mode: "0644"
+
+    - name: Check BetterShift env file exists on remote host
+      ansible.builtin.stat:
+        path: "{{ compose_remote_base }}/.env.bettershift"
+      register: bettershift_env_file
+
+    - name: Fail if BetterShift env file is missing
+      ansible.builtin.fail:
+        msg: >-
+          Missing {{ compose_remote_base }}/.env.bettershift on remote host.
+          Create it manually because it contains secrets.
+      when: not bettershift_env_file.stat.exists
+
+    - name: Pull latest BetterShift image
+      community.docker.docker_compose_v2:
+        project_name: "{{ bettershift_project }}"
+        project_src: "{{ compose_remote_base }}"
+        files:
+          - "{{ bettershift_compose_filename }}"
+        pull: always
+
+    - name: Recreate BetterShift service
+      community.docker.docker_compose_v2:
+        project_name: "{{ bettershift_project }}"
+        project_src: "{{ compose_remote_base }}"
+        files:
+          - "{{ bettershift_compose_filename }}"
+        services:
+          - "{{ bettershift_service }}"
+        state: present
+        recreate: always
+
+    - name: Wait for BetterShift port
+      ansible.builtin.wait_for:
+        host: 127.0.0.1
+        port: "{{ bettershift_port }}"
+        timeout: 60
+
+    - name: Check BetterShift HTTP endpoint
+      ansible.builtin.uri:
+        url: "http://127.0.0.1:{{ bettershift_port }}/"
+        status_code:
+          - 200
+          - 307
+          - 308
+        follow_redirects: none
+      register: bettershift_http
+      retries: 30
+      delay: 3
+      until: bettershift_http.status in [200, 307, 308]
+      changed_when: false

update_glance.yml

@@ -0,0 +1,139 @@
+# update_glance.yml
+
+- name: Update Glance
+  hosts: pve2_vm
+  gather_facts: false
+
+  vars:
+    # Compose sync (controller -> target)
+    compose_local_dir: "{{ playbook_dir }}/docker-compose"
+    compose_remote_base: "/home/{{ ansible_user }}/.ansible-compose"
+
+    # Glance settings
+    glance_project: glance
+    glance_port: 9445
+    glance_compose_filename: "docker-compose-glance.yml"
+    glance_service: glance
+
+    # Own project directory, so .env does not collide with other stacks
+    glance_remote_dir: "{{ compose_remote_base }}/glance"
+    glance_config_remote_dir: "{{ compose_remote_base }}/glance/config"
+
+    # Config delivery (git -> controller -> target)
+    glance_config_local: "{{ playbook_dir }}/files/glance/glance.yml"
+
+    # Persistent env file on the VM (NOT in git)
+    glance_env_persistent: "{{ compose_remote_base }}/env/glance.env"
+
+  tasks:
+    - name: Ensure remote base directory exists
+      ansible.builtin.file:
+        path: "{{ compose_remote_base }}"
+        state: directory
+        mode: "0755"
+
+    - name: Ensure remote env directory exists
+      ansible.builtin.file:
+        path: "{{ compose_remote_base }}/env"
+        state: directory
+
+    - name: Check for persistent Glance env file
+      ansible.builtin.stat:
+        path: "{{ glance_env_persistent }}"
+      register: glance_env_stat
+
+    - name: Abort when Glance env is missing
+      ansible.builtin.fail:
+        msg: >-
+          Missing persistent env file: {{ glance_env_persistent }}.
+          Create it on the VM with a GITHUB_TOKEN variable.
+      when: not glance_env_stat.stat.exists
+
+    - name: Ensure Glance project directory exists
+      ansible.builtin.file:
+        path: "{{ glance_remote_dir }}"
+        state: directory
+        mode: "0755"
+
+    - name: Ensure Glance config directory exists
+      ansible.builtin.file:
+        path: "{{ glance_config_remote_dir }}"
+        state: directory
+        mode: "0755"
+
+    - name: Upload Glance compose file to remote host
+      ansible.builtin.copy:
+        src: "{{ compose_local_dir }}/{{ glance_compose_filename }}"
+        dest: "{{ glance_remote_dir }}/{{ glance_compose_filename }}"
+        mode: "0644"
+
+    - name: Upload Glance configuration
+      ansible.builtin.copy:
+        src: "{{ glance_config_local }}"
+        dest: "{{ glance_config_remote_dir }}/glance.yml"
+        mode: "0644"
+
+    - name: Deploy Glance .env into compose directory
+      ansible.builtin.copy:
+        src: "{{ glance_env_persistent }}"
+        dest: "{{ glance_remote_dir }}/.env"
+        remote_src: true
+        mode: "0600"
+
+    - name: Pull latest Glance image
+      community.docker.docker_compose_v2:
+        project_name: "{{ glance_project }}"
+        project_src: "{{ glance_remote_dir }}"
+        files:
+          - "{{ glance_compose_filename }}"
+        pull: always
+
+    - name: Recreate Glance service
+      community.docker.docker_compose_v2:
+        project_name: "{{ glance_project }}"
+        project_src: "{{ glance_remote_dir }}"
+        files:
+          - "{{ glance_compose_filename }}"
+        services:
+          - "{{ glance_service }}"
+        state: present
+        recreate: always
+
+    - name: Verify Glance is serving
+      block:
+        - name: Wait for Glance port
+          ansible.builtin.wait_for:
+            host: 127.0.0.1
+            port: "{{ glance_port }}"
+            timeout: 60
+
+        - name: Check Glance HTTP endpoint (retry until ready)
+          ansible.builtin.uri:
+            url: "http://127.0.0.1:{{ glance_port }}/"
+            status_code: 200
+          register: glance_http
+          retries: 30
+          delay: 3
+          until: glance_http.status == 200
+          changed_when: false
+
+      rescue:
+        - name: Collect Glance container logs
+          ansible.builtin.command:
+            cmd: "docker logs --tail 50 glance"
+          register: glance_logs
+          changed_when: false
+          failed_when: false
+
+        - name: Show Glance container logs
+          ansible.builtin.debug:
+            msg: "{{ glance_logs.stderr_lines | default([]) + glance_logs.stdout_lines | default([]) }}"
+
+        - name: Fail after showing logs
+          ansible.builtin.fail:
+            msg: "Glance did not become healthy on port {{ glance_port }}. See container logs above."
+
+    - name: Clean up legacy compose file from shared base directory
+      ansible.builtin.file:
+        path: "{{ compose_remote_base }}/{{ glance_compose_filename }}"
+        state: absent

update_homarr.yml

@@ -0,0 +1,64 @@
+# update_homarr.yml
+
+- name: Update Homarr
+  hosts: pve2_vm
+  gather_facts: false
+
+  vars:
+    # Compose sync (controller -> target)
+    compose_local_dir: "{{ playbook_dir }}/docker-compose"
+    compose_remote_base: "/home/{{ ansible_user }}/.ansible-compose"
+
+    # Homarr settings
+    homarr_project: homarr
+    homarr_compose_filename: "docker-compose-homarr.yml"
+    homarr_service: homarr
+    homarr_port: 7575
+
+  tasks:
+    - name: Ensure remote compose directory exists
+      ansible.builtin.file:
+        path: "{{ compose_remote_base }}"
+        state: directory
+        mode: "0755"
+
+    - name: Upload Homarr compose file to remote host
+      ansible.builtin.copy:
+        src: "{{ compose_local_dir }}/{{ homarr_compose_filename }}"
+        dest: "{{ compose_remote_base }}/{{ homarr_compose_filename }}"
+        mode: "0644"
+
+    - name: Pull latest Homarr image
+      community.docker.docker_compose_v2:
+        project_name: "{{ homarr_project }}"
+        project_src: "{{ compose_remote_base }}"
+        files:
+          - "{{ homarr_compose_filename }}"
+        pull: always
+
+    - name: Recreate Homarr service
+      community.docker.docker_compose_v2:
+        project_name: "{{ homarr_project }}"
+        project_src: "{{ compose_remote_base }}"
+        files:
+          - "{{ homarr_compose_filename }}"
+        services:
+          - "{{ homarr_service }}"
+        state: present
+        recreate: always
+
+    - name: Wait for Homarr port
+      ansible.builtin.wait_for:
+        host: 127.0.0.1
+        port: "{{ homarr_port }}"
+        timeout: 60
+
+    - name: Check Homarr HTTP endpoint
+      ansible.builtin.uri:
+        url: "http://127.0.0.1:{{ homarr_port }}/"
+        status_code: 200
+      register: homarr_http
+      retries: 30
+      delay: 3
+      until: homarr_http.status == 200
+      changed_when: false

update_immich.yml

@@ -0,0 +1,116 @@
+# update_immich.yml
+
+- name: Update Immich
+  hosts: pve2_vm
+  gather_facts: false
+
+  vars:
+    # Compose sync (controller -> target)
+    compose_local_dir: "{{ playbook_dir }}/docker-compose"
+    compose_remote_base: "/home/{{ ansible_user }}/.ansible-compose"
+    compose_remote_dir: "{{ compose_remote_base }}/docker-compose"
+    compose_remote_archive: "{{ compose_remote_base }}/docker-compose.tar.gz"
+
+    # Immich settings
+    immich_project: immich
+    immich_port: 2283
+    immich_compose_files:
+      - docker-compose-immich.yml
+      - docker-compose-immich.override.yml
+
+    # Persistent env file on the VM (NOT in git)
+    immich_env_persistent: "{{ compose_remote_base }}/env/immich.env"
+
+  tasks:
+    - name: Ensure remote base directory exists
+      ansible.builtin.file:
+        path: "{{ compose_remote_base }}"
+        state: directory
+        mode: "0755"
+
+    - name: Ensure remote env directory exists
+      ansible.builtin.file:
+        path: "{{ compose_remote_base }}/env"
+        state: directory
+
+    - name: Fail if persistent Immich env file is missing
+      ansible.builtin.stat:
+        path: "{{ immich_env_persistent }}"
+      register: immich_env_stat
+
+    - name: Abort when Immich env is missing
+      ansible.builtin.fail:
+        msg: >-
+          Missing persistent env file: {{ immich_env_persistent }}.
+          Create it on the VM with DB_* and UPLOAD_LOCATION variables.
+      when: not immich_env_stat.stat.exists
+
+    - name: Create local archive of docker-compose directory (controller)
+      ansible.builtin.archive:
+        path: "{{ compose_local_dir }}/"
+        dest: "/tmp/docker-compose.tar.gz"
+        format: gz
+      delegate_to: localhost
+      run_once: true
+
+    - name: Upload archive to remote host
+      ansible.builtin.copy:
+        src: "/tmp/docker-compose.tar.gz"
+        dest: "{{ compose_remote_archive }}"
+        mode: "0644"
+
+    - name: Recreate remote compose directory
+      ansible.builtin.file:
+        path: "{{ compose_remote_dir }}"
+        state: absent
+
+    - name: Ensure remote compose directory exists
+      ansible.builtin.file:
+        path: "{{ compose_remote_dir }}"
+        state: directory
+        mode: "0755"
+
+    - name: Extract archive on remote host
+      ansible.builtin.unarchive:
+        src: "{{ compose_remote_archive }}"
+        dest: "{{ compose_remote_dir }}"
+        remote_src: true
+
+    - name: Deploy Immich .env into compose directory
+      ansible.builtin.copy:
+        src: "{{ immich_env_persistent }}"
+        dest: "{{ compose_remote_dir }}/.env"
+        remote_src: true
+        mode: "0600"
+
+    - name: Pull latest Immich images
+      community.docker.docker_compose_v2:
+        project_name: "{{ immich_project }}"
+        project_src: "{{ compose_remote_dir }}"
+        files: "{{ immich_compose_files }}"
+        pull: always
+
+    - name: Recreate Immich stack
+      community.docker.docker_compose_v2:
+        project_name: "{{ immich_project }}"
+        project_src: "{{ compose_remote_dir }}"
+        files: "{{ immich_compose_files }}"
+        state: present
+        recreate: always
+
+    - name: Wait for Immich port
+      ansible.builtin.wait_for:
+        host: 127.0.0.1
+        port: "{{ immich_port }}"
+        timeout: 120
+
+    - name: Check Immich API ping (retry until ready)
+      ansible.builtin.uri:
+        url: "http://127.0.0.1:{{ immich_port }}/api/server/ping"
+        status_code: 200
+        return_content: true
+      register: immich_ping
+      retries: 40
+      delay: 3
+      until: immich_ping.status == 200 and ('pong' in (immich_ping.content | default('')))
+      changed_when: false

update_jellyfin.yml

@@ -0,0 +1,94 @@
+# update_jellyfin.yml
+
+- name: Update Jellyfin
+  hosts: pve2_lxc_jellyfin
+  gather_facts: false
+
+  vars:
+    # Compose sync (controller -> target)
+    compose_local_dir: "{{ playbook_dir }}/docker-compose"
+    compose_remote_base: "/home/{{ ansible_user }}/.ansible-compose"
+    compose_remote_dir: "{{ compose_remote_base }}/docker-compose"
+    compose_remote_archive: "{{ compose_remote_base }}/docker-compose.tar.gz"
+
+    # Jellyfin settings
+    jellyfin_compose_filename: "docker-compose-jellyfin.yml"
+    jellyfin_service: jellyfin
+    jellyfin_port: 8096
+
+  tasks:
+    - name: Ensure remote base directory exists
+      ansible.builtin.file:
+        path: "{{ compose_remote_base }}"
+        state: directory
+        mode: "0755"
+
+    - name: Create local archive of docker-compose directory (controller)
+      ansible.builtin.archive:
+        path: "{{ compose_local_dir }}/"
+        dest: "/tmp/docker-compose.tar.gz"
+        format: gz
+      delegate_to: localhost
+      run_once: true
+
+    - name: Upload archive to remote host
+      ansible.builtin.copy:
+        src: "/tmp/docker-compose.tar.gz"
+        dest: "{{ compose_remote_archive }}"
+        mode: "0644"
+
+    - name: Recreate remote compose directory
+      ansible.builtin.file:
+        path: "{{ compose_remote_dir }}"
+        state: absent
+
+    - name: Ensure remote compose directory exists
+      ansible.builtin.file:
+        path: "{{ compose_remote_dir }}"
+        state: directory
+        mode: "0755"
+
+    - name: Extract archive on remote host
+      ansible.builtin.unarchive:
+        src: "{{ compose_remote_archive }}"
+        dest: "{{ compose_remote_dir }}"
+        remote_src: true
+
+    - name: Pull latest Jellyfin image (docker-compose v1)
+      ansible.builtin.command:
+        argv:
+          - bash
+          - -lc
+          - >
+            cd "{{ compose_remote_dir }}"
+            && docker-compose -f "{{ jellyfin_compose_filename }}" pull
+      changed_when: true
+
+    - name: Recreate Jellyfin service (docker-compose v1)
+      ansible.builtin.command:
+        argv:
+          - bash
+          - -lc
+          - >
+            cd "{{ compose_remote_dir }}"
+            && docker-compose -f "{{ jellyfin_compose_filename }}"
+            up -d --force-recreate --remove-orphans "{{ jellyfin_service }}"
+      changed_when: true
+
+    - name: Wait for Jellyfin port
+      ansible.builtin.wait_for:
+        host: 127.0.0.1
+        port: "{{ jellyfin_port }}"
+        timeout: 180
+
+    - name: Check Jellyfin HTTP endpoint (retry until ready)
+      ansible.builtin.uri:
+        url: "http://127.0.0.1:{{ jellyfin_port }}/"
+        status_code:
+          - 200
+          - 302
+      register: jellyfin_http
+      retries: 40
+      delay: 3
+      until: jellyfin_http.status in [200, 302]
+      changed_when: false

update_minecraft.yml

@@ -0,0 +1,142 @@
+# update_minecraft.yml
+
+- name: Update Minecraft (Futurecraft)
+  hosts: pve2_vm
+  gather_facts: false
+
+  vars:
+    # Compose sync (controller -> target)
+    compose_local_dir: "{{ playbook_dir }}/docker-compose"
+    compose_remote_base: "/home/{{ ansible_user }}/.ansible-compose"
+    compose_remote_dir: "{{ compose_remote_base }}/docker-compose"
+    compose_remote_archive: "{{ compose_remote_base }}/docker-compose.tar.gz"
+
+    # Minecraft settings
+    mc_project: minecraft
+    mc_compose_filename: "docker-compose-minecraft.yml"
+    mc_port: 25565
+
+    # Persistent env file on the VM (NOT in git)
+    # Must contain: CF_API_KEY, RCON_PASSWORD, optionally MEMORY
+    mc_env_persistent: "{{ compose_remote_base }}/env/minecraft.env"
+
+    # Container name from your compose file (used for log readiness check)
+    mc_container_name: "mc-futurecraft"
+
+  tasks:
+    - name: Ensure remote base directory exists
+      become: true
+      ansible.builtin.file:
+        path: "{{ compose_remote_base }}"
+        state: directory
+        owner: "{{ ansible_user }}"
+        group: "{{ ansible_user }}"
+        mode: "0755"
+
+    - name: Ensure remote env directory exists
+      become: true
+      ansible.builtin.file:
+        path: "{{ compose_remote_base }}/env"
+        state: directory
+        owner: "{{ ansible_user }}"
+        group: "{{ ansible_user }}"
+        mode: "0755"
+
+    - name: Fail if persistent Minecraft env file is missing
+      ansible.builtin.stat:
+        path: "{{ mc_env_persistent }}"
+      register: mc_env_stat
+
+    - name: Abort when Minecraft env is missing
+      ansible.builtin.fail:
+        msg: >-
+          Missing persistent env file: {{ mc_env_persistent }}.
+          Create it on the VM with at least:
+            CF_API_KEY=...
+            RCON_PASSWORD=...
+          Optional:
+            MEMORY=10G
+      when: not mc_env_stat.stat.exists
+
+    - name: Create local archive of docker-compose directory (controller)
+      ansible.builtin.archive:
+        path: "{{ compose_local_dir }}/"
+        dest: "/tmp/docker-compose.tar.gz"
+        format: gz
+      delegate_to: localhost
+      run_once: true
+
+    - name: Upload archive to remote host
+      ansible.builtin.copy:
+        src: "/tmp/docker-compose.tar.gz"
+        dest: "{{ compose_remote_archive }}"
+        mode: "0644"
+
+    - name: Recreate remote compose directory
+      become: true
+      ansible.builtin.file:
+        path: "{{ compose_remote_dir }}"
+        state: absent
+
+    - name: Ensure remote compose directory exists
+      become: true
+      ansible.builtin.file:
+        path: "{{ compose_remote_dir }}"
+        state: directory
+        owner: "{{ ansible_user }}"
+        group: "{{ ansible_user }}"
+        mode: "0755"
+
+    - name: Extract archive on remote host
+      ansible.builtin.unarchive:
+        src: "{{ compose_remote_archive }}"
+        dest: "{{ compose_remote_dir }}"
+        remote_src: true
+
+    - name: Deploy Minecraft .env into compose directory
+      ansible.builtin.copy:
+        src: "{{ mc_env_persistent }}"
+        dest: "{{ compose_remote_dir }}/.env"
+        remote_src: true
+        mode: "0600"
+
+    - name: Pull latest Minecraft images (docker compose)
+      ansible.builtin.command: >
+        docker compose
+        -p {{ mc_project }}
+        -f {{ compose_remote_dir }}/{{ mc_compose_filename }}
+        pull
+      changed_when: false
+
+    - name: Recreate Minecraft stack (docker compose up)
+      ansible.builtin.command: >
+        docker compose
+        -p {{ mc_project }}
+        -f {{ compose_remote_dir }}/{{ mc_compose_filename }}
+        up -d --remove-orphans --force-recreate
+      changed_when: false
+
+    - name: Show last container logs after start (quick diagnostics)
+      ansible.builtin.command: >
+        docker logs --tail 60 {{ mc_container_name }}
+      register: mc_start_logs
+      changed_when: false
+
+    - name: Print last logs (for debugging)
+      ansible.builtin.debug:
+        var: mc_start_logs.stdout_lines
+
+    - name: Wait for Minecraft port
+      ansible.builtin.wait_for:
+        host: 127.0.0.1
+        port: "{{ mc_port }}"
+        timeout: 600
+
+    - name: Wait until server reports "Done" in docker logs (ready)
+      ansible.builtin.command: >
+        docker logs --tail 200 {{ mc_container_name }}
+      register: mc_docker_logs
+      retries: 60
+      delay: 5
+      until: "'Done (' in mc_docker_logs.stdout"
+      changed_when: false

update_semaphore.yml

@@ -0,0 +1,172 @@
+# update_semaphore.yml
+
+- name: Update Semaphore (self-update safe)
+  hosts: pve2_vm
+  gather_facts: false
+
+  vars:
+    # Compose sync (controller -> target)
+    compose_local_dir: "{{ playbook_dir }}/docker-compose"
+    compose_remote_base: "/home/{{ ansible_user }}/.ansible-compose"
+    compose_remote_dir: "{{ compose_remote_base }}/docker-compose"
+    compose_remote_archive: "{{ compose_remote_base }}/docker-compose.tar.gz"
+
+    # Semaphore settings
+    semaphore_project: semaphore
+    semaphore_container: semaphore
+    semaphore_compose_filename: "docker-compose-semaphore.yml"
+    semaphore_port: 3000
+
+    semaphore_update_log: "{{ compose_remote_base }}/semaphore-update.log"
+    semaphore_update_delay: 20
+
+  tasks:
+    - name: Show result of the previous update
+      ansible.builtin.command:
+        argv: [tail, -n, "12", "{{ semaphore_update_log }}"]
+      register: prev_log
+      changed_when: false
+      failed_when: false
+
+    - name: Previous update result
+      ansible.builtin.debug:
+        var: prev_log.stdout_lines
+
+    - name: Refuse compose that overrides DB or encryption config
+      ansible.builtin.assert:
+        that:
+          - forbidden | length == 0
+        fail_msg: "Compose sets forbidden env vars: {{ forbidden }}. Remove them."
+        success_msg: "Compose does not override DB or encryption config."
+      vars:
+        forbidden: >-
+          {{ lookup('file', compose_local_dir ~ '/' ~ semaphore_compose_filename)
+             | regex_findall('(?m)^\s*(SEMAPHORE_DB_\w+|SEMAPHORE_ACCESS_KEY_ENCRYPTION)\s*:') }}
+      delegate_to: localhost
+      run_once: true
+
+    - name: Ensure remote base directory exists
+      ansible.builtin.file:
+        path: "{{ compose_remote_base }}"
+        state: directory
+        mode: "0755"
+
+    - name: Create local archive of docker-compose directory (controller)
+      ansible.builtin.archive:
+        path: "{{ compose_local_dir }}/"
+        dest: "/tmp/docker-compose.tar.gz"
+        format: gz
+      delegate_to: localhost
+      run_once: true
+
+    - name: Upload archive to remote host
+      ansible.builtin.copy:
+        src: "/tmp/docker-compose.tar.gz"
+        dest: "{{ compose_remote_archive }}"
+        mode: "0644"
+
+    - name: Recreate remote compose directory
+      ansible.builtin.file:
+        path: "{{ compose_remote_dir }}"
+        state: absent
+
+    - name: Ensure remote compose directory exists
+      ansible.builtin.file:
+        path: "{{ compose_remote_dir }}"
+        state: directory
+        mode: "0755"
+
+    - name: Extract archive on remote host
+      ansible.builtin.unarchive:
+        src: "{{ compose_remote_archive }}"
+        dest: "{{ compose_remote_dir }}"
+        remote_src: true
+
+    - name: Back up Semaphore database
+      ansible.builtin.command:
+        argv:
+          - docker
+          - exec
+          - "{{ semaphore_container }}"
+          - python3
+          - -c
+          - |
+            import json, os, sqlite3, datetime, glob
+            cfg = json.load(open('/etc/semaphore/config.json'))
+            out = '/etc/semaphore/backups'
+            os.makedirs(out, exist_ok=True)
+            ts = datetime.datetime.now(datetime.timezone.utc).strftime('%Y%m%d-%H%M%S')
+            dst = f'{out}/database-{ts}.sqlite'
+            a = sqlite3.connect('file:' + cfg['sqlite']['host'] + '?mode=ro', uri=True)
+            b = sqlite3.connect(dst)
+            with b:
+                a.backup(b)
+            b.close(); a.close()
+            json.dump(cfg, open(f'{out}/config-{ts}.json', 'w'), indent=2)
+            print(dst, os.path.getsize(dst), 'bytes')
+            for old in sorted(glob.glob(f'{out}/database-*.sqlite'), reverse=True)[10:]:
+                os.remove(old)
+                stale = f"{out}/config-{os.path.basename(old)[9:-7]}.json"
+                if os.path.exists(stale):
+                    os.remove(stale)
+                print('pruned', old)
+      register: sem_db_backup
+      changed_when: true
+
+    - name: Database backup result
+      ansible.builtin.debug:
+        var: sem_db_backup.stdout_lines
+
+    - name: Recreate Semaphore in the background
+      ansible.builtin.shell: |
+        cat > "{{ compose_remote_base }}/semaphore-selfupdate.sh" <<'SH'
+        #!/usr/bin/env bash
+        set -uo pipefail
+        exec 2>&1
+        cd "{{ compose_remote_dir }}" || exit 1
+        COMPOSE=(docker compose -p "{{ semaphore_project }}" -f "{{ semaphore_compose_filename }}")
+
+        # Let the calling job finish and its status get written to the DB
+        # before we potentially replace the container running it.
+        sleep {{ semaphore_update_delay }}
+
+        echo "=== $(date -Is) update starting ==="
+        "${COMPOSE[@]}" pull || { echo "FAIL: pull failed" >&2; exit 1; }
+
+        # No --force-recreate: compose replaces the container only when the
+        # image or the resolved config (including env_file) actually changed,
+        # so unchanged runs cause no downtime.
+        "${COMPOSE[@]}" up -d --remove-orphans --wait --wait-timeout 300
+
+        for _ in $(seq 1 60); do
+          code=$(curl -s -o /dev/null -w '%{http_code}' \
+            "http://127.0.0.1:{{ semaphore_port }}/api/ping" || true)
+          if [ "$code" = "200" ]; then
+            echo "image: $(docker inspect "{{ semaphore_container }}" \
+              --format '{{ '{{' }}.Config.Image{{ '}}' }}')"
+            # Grep the whole log: when the container was not replaced, the
+            # startup line is far outside the last few lines.
+            docker logs "{{ semaphore_container }}" 2>&1 \
+              | grep -m1 'SQLite @' || echo "WARN: no 'SQLite @' line"
+            echo "OK: semaphore healthy at $(date -Is)"
+            exit 0
+          fi
+          sleep 5
+        done
+        echo "FAIL: no 200 from /api/ping after 300s" >&2
+        exit 1
+        SH
+        chmod +x "{{ compose_remote_base }}/semaphore-selfupdate.sh"
+        setsid nohup "{{ compose_remote_base }}/semaphore-selfupdate.sh" \
+          > "{{ semaphore_update_log }}" 2>&1 < /dev/null &
+        echo launched
+      args:
+        executable: /bin/bash
+      changed_when: true
+
+    - name: What happens next
+      ansible.builtin.debug:
+        msg:
+          - "Update starts in {{ semaphore_update_delay }}s, after this job ends."
+          - "If the image changed, the container is replaced — expected."
+          - "The log is the success signal: tail -n 20 {{ semaphore_update_log }}"

update_uptime_kuma.yml

@@ -0,0 +1,91 @@
+# update_uptimekuma.yml
+
+- name: Update Uptime Kuma
+  hosts: pve1_vm
+  gather_facts: false
+
+  vars:
+    # Compose sync (controller -> target)
+    compose_local_dir: "{{ playbook_dir }}/docker-compose"
+    compose_remote_base: "/home/{{ ansible_user }}/.ansible-compose"
+    compose_remote_dir: "{{ compose_remote_base }}/docker-compose"
+    compose_remote_archive: "{{ compose_remote_base }}/docker-compose.tar.gz"
+
+    # Uptime Kuma settings
+    uptimekuma_project: uptimekuma
+    uptimekuma_compose_filename: "docker-compose-uptimekuma.yml"
+    uptimekuma_service: uptime-kuma
+    uptimekuma_port: 3001
+
+  tasks:
+    - name: Ensure remote base directory exists
+      ansible.builtin.file:
+        path: "{{ compose_remote_base }}"
+        state: directory
+        mode: "0755"
+
+    - name: Create local archive of docker-compose directory (controller)
+      ansible.builtin.archive:
+        path: "{{ compose_local_dir }}/"
+        dest: "/tmp/docker-compose.tar.gz"
+        format: gz
+      delegate_to: localhost
+      run_once: true
+
+    - name: Upload archive to remote host
+      ansible.builtin.copy:
+        src: "/tmp/docker-compose.tar.gz"
+        dest: "{{ compose_remote_archive }}"
+        mode: "0644"
+
+    - name: Recreate remote compose directory
+      ansible.builtin.file:
+        path: "{{ compose_remote_dir }}"
+        state: absent
+
+    - name: Ensure remote compose directory exists
+      ansible.builtin.file:
+        path: "{{ compose_remote_dir }}"
+        state: directory
+        mode: "0755"
+
+    - name: Extract archive on remote host
+      ansible.builtin.unarchive:
+        src: "{{ compose_remote_archive }}"
+        dest: "{{ compose_remote_dir }}"
+        remote_src: true
+
+    - name: Pull latest Uptime Kuma image
+      community.docker.docker_compose_v2:
+        project_name: "{{ uptimekuma_project }}"
+        project_src: "{{ compose_remote_dir }}"
+        files:
+          - "{{ uptimekuma_compose_filename }}"
+        pull: always
+
+    - name: Recreate Uptime Kuma service
+      community.docker.docker_compose_v2:
+        project_name: "{{ uptimekuma_project }}"
+        project_src: "{{ compose_remote_dir }}"
+        files:
+          - "{{ uptimekuma_compose_filename }}"
+        services:
+          - "{{ uptimekuma_service }}"
+        state: present
+        recreate: always
+
+    - name: Wait for Uptime Kuma port
+      ansible.builtin.wait_for:
+        host: 127.0.0.1
+        port: "{{ uptimekuma_port }}"
+        timeout: 120
+
+    - name: Check Uptime Kuma HTTP endpoint (retry until ready)
+      ansible.builtin.uri:
+        url: "http://127.0.0.1:{{ uptimekuma_port }}/"
+        status_code: 200
+      register: kuma_http
+      retries: 30
+      delay: 3
+      until: kuma_http.status == 200
+      changed_when: false