Update mikrotikbackup.yml

homarr.yml

@@ -1,39 +0,0 @@
-- name: Update Homarr
-  hosts: linux_servers
-  become: true
-  gather_facts: false
-
-  vars:
-    homarr_project: homarr
-    homarr_compose_file: /data/compose/homarr/docker-compose-homarr.yml
-    homarr_service: homarr
-    homarr_port: 7575
-
-  tasks:
-    - name: Pull latest Homarr image
-      community.docker.docker_compose_v2:
-        project_src: "{{ homarr_compose_file | dirname }}"
-        files:
-          - "{{ homarr_compose_file | basename }}"
-        pull: always
-
-    - name: Recreate Homarr service
-      community.docker.docker_compose_v2:
-        project_src: "{{ homarr_compose_file | dirname }}"
-        files:
-          - "{{ homarr_compose_file | basename }}"
-        services:
-          - "{{ homarr_service }}"
-        state: present
-        recreate: always
-
-    - name: Wait for Homarr port
-      ansible.builtin.wait_for:
-        host: 127.0.0.1
-        port: "{{ homarr_port }}"
-        timeout: 60
-
-    - name: Check Homarr HTTP endpoint
-      ansible.builtin.uri:
-        url: "http://127.0.0.1:{{ homarr_port }}/"
-        status_code: 200

initial_setup.yml

@@ -1,111 +0,0 @@
----
-- name: Baseline user setup
-  hosts: all
-  become: true
-
-  vars:
-    users:
-      - name: automation
-        shell: /bin/bash
-        groups: []
-        sudo_nopasswd: true
-        ssh_keys:
-          - "ssh-ed25519 AAAAC3..."
-
-      - name: hellsos
-        shell: /bin/bash
-        groups: []
-        sudo_nopasswd: true
-        ssh_keys:
-          - "ssh-ed25519 AAAAC3..."
-
-      - name: jim
-        shell: /bin/bash
-        groups: []
-        sudo_nopasswd: true
-        ssh_keys:
-          - "ssh-ed25519 AAAAC3..."
-
-  tasks:
-
-    - name: Pick sudo group per distro
-      set_fact:
-        sudo_group: >-
-          {{ 'wheel'
-             if ansible_facts.os_family in
-             ['RedHat','Rocky','AlmaLinux','Fedora','OracleLinux','Suse']
-             else 'sudo' }}
-
-    - name: Ensure user exists
-      ansible.builtin.user:
-        name: "{{ item.name }}"
-        shell: "{{ item.shell }}"
-        groups: "{{ sudo_group }}"
-        append: true
-        create_home: true
-      loop: "{{ users }}"
-
-    - name: Enforce authorized SSH keys
-      ansible.builtin.authorized_key:
-        user: "{{ item.name }}"
-        key: "{{ item.ssh_keys | join('\n') }}"
-        exclusive: true
-      loop: "{{ users }}"
-
-    - name: Grant passwordless sudo
-      ansible.builtin.copy:
-        dest: "/etc/sudoers.d/{{ item.name }}"
-        mode: '0440'
-        content: "{{ item.name }} ALL=(ALL) NOPASSWD:ALL\n"
-        validate: 'visudo -cf %s'
-      loop: "{{ users }}"
-      when: item.sudo_nopasswd
-
-# ==============================
-# SECOND PLAY: SSH HARDENING
-# ==============================
-
-- name: SSH Hardening
-  hosts: all
-  become: true
-  tags: never,hardening
-
-  tasks:
-
-    - name: Detect if system is Proxmox
-      ansible.builtin.stat:
-        path: /usr/bin/pveversion
-      register: proxmox_check
-
-    - name: Ensure sshd_config.d directory exists
-      ansible.builtin.file:
-        path: /etc/ssh/sshd_config.d
-        state: directory
-
-    - name: Deploy SSH hardening config
-      ansible.builtin.copy:
-        dest: /etc/ssh/sshd_config.d/99-ansible-hardening.conf
-        mode: '0644'
-        content: |
-          PasswordAuthentication no
-          ChallengeResponseAuthentication no
-          PubkeyAuthentication yes
-          AuthenticationMethods publickey
-          UsePAM yes
-
-          {% if not proxmox_check.stat.exists %}
-          PermitRootLogin no
-          {% else %}
-          PermitRootLogin prohibit-password
-          {% endif %}
-        validate: 'sshd -t -f %s'
-      notify: Restart SSH
-
-  handlers:
-    - name: Restart SSH
-      ansible.builtin.service:
-        name: "{{ 'sshd'
-                  if ansible_facts.os_family in
-                  ['RedHat','Rocky','AlmaLinux','Fedora','OracleLinux','Suse']
-                  else 'ssh' }}"
-        state: restarted

inv_linuxes

@@ -1,9 +1,2 @@
 [linux_servers]
-jimbuntu ansible_host=192.168.19.4
-jim_storage ansible_host=192.168.19.7
-portainer2_hellsos ansible_host=192.168.52.9
-portainernode_hellsos ansible_host=192.168.52.21
-portainernode2_jim ansible_host=192.168.19.8
-
-[local]
-localhost ansible_connection=local
+proxmox ansible_host=192.168.69.2

inv_mikrotiks

@@ -1,16 +1,2 @@
-[mikrotik_routers]
-jim_main ansible_host=192.168.19.2
-jim_gw2 ansible_host=192.168.19.3
-hellsos ansible_host=192.168.40.1
-ewolet ansible_host=192.168.90.1
-Poli ansible_host=192.168.2.1
-Schmid ansible_host=192.168.177.1
-#Volf ansible_host=192.168.88.1
-fencl_home ansible_host=192.168.68.1
-fencl_tata ansible_host=192.168.69.1
-
-
-[mikrotik_routers:vars]
-ansible_connection=network_cli
-ansible_network_os=community.routeros.routeros
-ansible_command_timeout=15
+[mikrotiks]
+main_mikrotik_fencl ansible_host=192.168.69.1

mikrotikbackup.yml

@@ -33,7 +33,7 @@
         current_date: "{{ date_output.stdout }}"
 
     - name: Export router config
-      shell: timeout 15 ssh -o StrictHostKeyChecking=no {{ ansible_user }}@{{ ansible_host }} -p {{ ansible_port }} "/export show-sensitive"
+      shell: timeout 15 ssh -o StrictHostKeyChecking=no {{ ansible_user }}@{{ ansible_host }} -p {{ ansible_port }} "/export"
       register: export_output
       delegate_to: localhost
       when: system_identity.rc == 0

mikrotikbackup_clean.yml

@@ -1,108 +0,0 @@
-- name: Backup and/or Upgrade MikroTik
-  hosts: mikrotik_routers
-  gather_facts: no
-
-  vars:
-    backup_dir: /opt/mikrotik_backups/
-
-  tasks:
-
-    # ----------------------------
-    # Always: identity + timestamp
-    # ----------------------------
-    - name: Get router identity
-      community.routeros.command:
-        commands: /system identity print
-      register: identity_raw
-      tags: always
-
-    - name: Parse router name
-      set_fact:
-        router_name: "{{ identity_raw.stdout[0].split(': ')[1] | trim }}"
-      tags: always
-
-    - name: Get timestamp
-      ansible.builtin.command: date +%Y-%m-%d_%H-%M-%S
-      register: date_out
-      delegate_to: localhost
-      tags: always
-
-    - name: Set timestamp fact
-      set_fact:
-        ts: "{{ date_out.stdout }}"
-      tags: always
-
-    # ----------------------------
-    # Backup (tag: backup)
-    # ----------------------------
-    - name: Ensure local backup directory exists
-      ansible.builtin.file:
-        path: "{{ backup_dir }}"
-        state: directory
-        mode: "0755"
-      delegate_to: localhost
-      tags: [backup, never]
-
-    - name: Export router config
-      community.routeros.command:
-        commands: /export terse show-sensitive
-      register: export_cfg
-      tags: [backup, never]
-
-    - name: Save export locally
-      ansible.builtin.copy:
-        content: "{{ export_cfg.stdout[0] }}"
-        dest: "{{ backup_dir }}/{{ router_name }}-{{ ts }}.rsc"
-      delegate_to: localhost
-      tags: [backup, never]
-
-    # ----------------------------
-    # Upgrade (tag: upgrade)
-    # ----------------------------
-    - name: Check current and latest available package versions
-      community.routeros.command:
-        commands: /system package update check-for-updates
-      register: update_check
-      tags: [upgrade, never]
-
-    - name: Parse installed and latest versions
-      set_fact:
-        installed_version: "{{ update_check.stdout[0] | regex_search('installed-version: ([\\d.]+)', '\\1') | first }}"
-        latest_version: "{{ update_check.stdout[0] | regex_search('latest-version: ([\\d.]+)', '\\1') | first }}"
-      tags: [upgrade, never]
-
-    - name: Skip upgrade if already on latest
-      ansible.builtin.debug:
-        msg: "Router {{ router_name }} is already on latest version {{ installed_version }}. Skipping upgrade."
-      when: installed_version == latest_version
-      tags: [upgrade, never]
-
-    - name: Trigger package download and install
-      community.routeros.command:
-        commands: /system package update install
-      register: upgrade_result
-      when: installed_version != latest_version
-      tags: [upgrade, never]
-
-    - name: Wait for router to come back online after reboot
-      ansible.builtin.wait_for_connection:
-        delay: 180
-        timeout: 300
-        sleep: 10
-      when:
-        - installed_version != latest_version
-        - upgrade_result is not failed
-      tags: [upgrade, never]
-
-    - name: Confirm upgraded version
-      community.routeros.command:
-        commands: /system resource print
-      register: post_upgrade_info
-      when: installed_version != latest_version
-      tags: [upgrade, never]
-
-    - name: Show post-upgrade RouterOS version
-      ansible.builtin.debug:
-        msg: "{{ post_upgrade_info.stdout[0] | regex_search('version: .+') }}"
-      when: installed_version != latest_version
-      tags: [upgrade, never]

requirements.yml

@@ -1,2 +0,0 @@
-collections:
-  - name: community.routeros

test_sms.yml

@@ -1,57 +0,0 @@
----
-- name: Send and verify SMS delivery via internet-master.cz
-  hosts: localhost
-  gather_facts: false
-  vars:
-    sms_number: "601358865"
-    sms_username: "mikrotik"
-    sms_password_send: "jdkotzHJIOPWhjtr32D"
-    sms_password_recv: "jdkotzHJIOPWhjtr32D"
-    sms_wait_seconds: 120   # Wait 2 minutes for delivery
-
-  tasks:
-    - name: Generate random test string
-      set_fact:
-        random_string: "mikrotik_{{ lookup('password', '/dev/null length=8 chars=ascii_letters') }}"
-
-    - name: Send SMS message
-      uri:
-        url: "https://sms.internet-master.cz/send/?number={{ sms_number }}&message=@mikrotik@{{ random_string | urlencode }}&type=class-1&username={{ sms_username }}&password={{ sms_password_send }}"
-        method: GET
-        return_content: true
-      register: send_result
-
-    - name: Show send API response
-      debug:
-        var: send_result.content
-
-    - name: Wait for SMS to be delivered
-      pause:
-        seconds: "{{ sms_wait_seconds }}"
-
-    - name: Fetch received messages
-      uri:
-        url: "https://sms.internet-master.cz/receive/?username={{ sms_username }}&password={{ sms_password_recv }}"
-        method: GET
-        return_content: true
-      register: recv_result
-
-    - name: Parse received JSON
-      set_fact:
-        inbox: "{{ recv_result.json.inbox | default([]) }}"
-
-    - name: Check if random string message was received
-      set_fact:
-        message_found: "{{ inbox | selectattr('message', 'equalto', random_string) | list | length > 0 }}"
-
-    - name: Report result
-      debug:
-        msg: >
-          SMS with message '{{ random_string }}' was {{
-            'delivered ✅' if message_found else 'NOT delivered ❌'
-          }}.
-
-    - name: Fail if not delivered
-      fail:
-        msg: "Message '{{ random_string }}' not found in received inbox!"
-      when: not message_found

update.yml

@@ -1,91 +1,34 @@
----
 - name: Update system (APT + Flatpak)
   hosts: all
-  become: yes
-  gather_facts: yes
-  serial: 5
 
+  become: true
+  become_user: root
+  become_method: sudo
   tasks:
-
-    - name: Ensure SSH is reachable (skip host if not)
-      delegate_to: localhost
-      wait_for:
-        host: "{{ ansible_host | default(inventory_hostname) }}"
-        port: 22
-        timeout: 5
-      register: ssh_check
-      ignore_errors: yes
-
-    - meta: end_host
-      when: ssh_check is failed
-
-    - name: Ping with retries (handle intermittent flaps)
-      ping:
-      register: ping_result
-      retries: 5
-      delay: 5
-      until: ping_result is success
-
-    - name: Wait for apt lock to be released
-      shell: |
-        while fuser /var/lib/dpkg/lock-frontend >/dev/null 2>&1; do
-          echo "Waiting for apt lock..."
-          sleep 5
-        done
-      changed_when: false
-
-    - name: Update apt cache
+    - name: Update APT cache
       apt:
         update_cache: yes
 
-    - name: Perform full upgrade
+    - name: Upgrade all APT packages
       apt:
-        upgrade: full
-        autoremove: yes
-        autoclean: yes
-      register: apt_upgrade
-      retries: 3
-      delay: 10
-      until: apt_upgrade is succeeded
+        upgrade: dist
 
-    - name: Fix broken packages
-      command: apt-get -f install -y
-      register: fix_result
-      failed_when: false
-      changed_when: "'Setting up' in fix_result.stdout"
-
-    - name: Check if Flatpak is installed
-      command: which flatpak
-      register: flatpak_check
-      changed_when: false
-      failed_when: false
+    - name: Check if flatpak binary exists
+      stat:
+        path: /usr/bin/flatpak
+      register: flatpak_bin
 
     - name: Update system Flatpaks
-      command: flatpak update -y --noninteractive --system
-      when: flatpak_check.rc == 0
-      failed_when: false
+      shell: timeout 300 flatpak update -y
+      register: flatpak_sys
+      failed_when: flatpak_sys.rc != 0 and flatpak_sys.rc != 124
+      when: flatpak_bin.stat.exists
 
     - name: Update user Flatpaks
-      command: flatpak update -y --noninteractive --user
-      become: false
-      when: flatpak_check.rc == 0
-      failed_when: false
-
-    - name: Remove unused Flatpaks
-      command: flatpak uninstall -y --noninteractive --unused
-      when: flatpak_check.rc == 0
-      failed_when: false
-    
-    - name: Update snap packages
-      command: snap refresh
-      failed_when: false
-    
-    - name: Check if reboot is required
-      stat:
-        path: /var/run/reboot-required
-      register: reboot_required
-
-    - name: Notify if reboot required
-      debug:
-        msg: "Reboot required on {{ inventory_hostname }}"
-      when: reboot_required.stat.exists
+      become_user: jakub
+      environment:
+        XDG_RUNTIME_DIR: /run/user/1000
+      shell: timeout 300 flatpak update -y
+      register: flatpak_user
+      failed_when: flatpak_user.rc != 0 and flatpak_user.rc != 124
+      when: flatpak_bin.stat.exists

users-ssh.yml

@@ -1,12 +1,15 @@
----
+# users-ssh-nopasswd.yml
 - name: Ensure users, SSH keys, and passwordless sudo
   hosts: all
   become: true
+  become_user: root
+  become_method: sudo
 
   vars:
     users:
       - name: automation
         shell: /bin/bash
+        # optional extra groups besides sudo/wheel
         groups: []
         sudo_nopasswd: true
         keys:
@@ -27,43 +30,33 @@
           - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPFS4fsqMjMMu/Bi/884bw7yJBqvWusDRESvanH6Owco jakub@jimbuntu"
 
   tasks:
-
     - name: Pick sudo group per distro
       ansible.builtin.set_fact:
-        sudo_group: >-
-          {{ 'wheel'
-             if ansible_facts.os_family in
-             ['RedHat','Rocky','AlmaLinux','Fedora','OracleLinux','Suse']
-             else 'sudo' }}
+        sudo_group: "{{ 'wheel' if ansible_facts.os_family in ['RedHat','Rocky','AlmaLinux','Fedora','OracleLinux','Suse'] else 'sudo' }}"
 
     - name: Ensure user exists (creates home)
       ansible.builtin.user:
         name: "{{ item.name }}"
-        shell: "{{ item.shell | default(omit) }}"
+        shell: "{{ item.shell | default('/bin/bash') }}"
         groups: >-
           {{ (
                 (item.groups | default([]))
                 + ([sudo_group] if item.sudo_nopasswd | default(false) else [])
-             ) | unique | join(',')
-             if (
-               (item.groups | default([]) | length > 0)
-               or item.sudo_nopasswd | default(false)
-             )
+              ) | unique | join(',') if
+              ((item.groups | default([])) | length > 0) or (item.sudo_nopasswd | default(false))
               else omit }}
         append: true
         create_home: true
         state: present
       loop: "{{ users }}"
 
-    - name: Enforce authorized SSH keys
+    - name: Install authorized SSH keys
       ansible.builtin.authorized_key:
-        user: "{{ item.name }}"
-        key: "{{ item.keys | join('\n') }}"
+        user: "{{ item.0.name }}"
+        key: "{{ item.1 }}"
         state: present
         manage_dir: true
-        exclusive: true
-      loop: "{{ users }}"
-      when: item.keys is defined
+      loop: "{{ users | subelements('keys', skip_missing=True) }}"
 
     - name: Grant passwordless sudo via sudoers.d
       ansible.builtin.copy:
@@ -71,9 +64,7 @@
         owner: root
         group: root
         mode: '0440'
-        content: |
-          # Managed by Ansible
-          {{ item.name }} ALL=(ALL) NOPASSWD:ALL
+        content: "{{ item.name }} ALL=(ALL) NOPASSWD:ALL"
         validate: 'visudo -cf %s'
       when: item.sudo_nopasswd | default(false)
       loop: "{{ users }}"