Update mikrotikbackup_clean.yml

initial_install/collections/requirements.yml

@@ -1,2 +0,0 @@
-collections:
-  - name: freeipa.ansible_freeipa

initial_install/playbook.yml

@@ -1,35 +0,0 @@
----
-- name: Baseline system setup
-  hosts: all
-  become: true
-
-  roles:
-    - role: baseline_sudo
-      tags: sudo
-
-    - role: users
-      tags: users
-
-# ==============================
-# FREEIPA / SSSD (optional)
-# ==============================
-
-- name: FreeIPA client setup
-  hosts: all
-  become: true
-  tags: never,sssd
-
-  roles:
-    - role: freeipa_client
-
-# ==============================
-# SSH HARDENING (run last!)
-# ==============================
-
-- name: SSH hardening
-  hosts: all
-  become: true
-  tags: never,hardening
-
-  roles:
-    - role: ssh_hardening

initial_install/roles/baseline_sudo/tasks/main.yml

@@ -1,23 +0,0 @@
----
-- name: Ensure sudo package is installed
-  ansible.builtin.package:
-    name: sudo
-    state: present
-
-- name: Ensure automation user has passwordless sudo
-  ansible.builtin.copy:
-    dest: /etc/sudoers.d/automation
-    owner: root
-    group: root
-    mode: '0440'
-    content: |
-      automation ALL=(ALL:ALL) NOPASSWD: ALL
-    validate: 'visudo -cf %s'
-
-- name: Ensure sudo binary has correct permissions
-  ansible.builtin.file:
-    path: /usr/bin/sudo
-    owner: root
-    group: root
-    mode: '4755'
-  when: ansible_facts.os_family in ["Debian", "RedHat"]

initial_install/roles/freeipa_client/handlers/main.yml

@@ -1,5 +0,0 @@
----
-- name: Restart SSSD
-  ansible.builtin.service:
-    name: sssd
-    state: restarted

initial_install/roles/freeipa_client/tasks/main.yml

@@ -1,57 +0,0 @@
----
-- name: Install FreeIPA client packages
-  ansible.builtin.package:
-    name:
-      - freeipa-client
-      - sssd
-      - sssd-tools
-      - oddjob
-      - oddjob-mkhomedir
-    state: present
-
-- name: Set hostname FQDN
-  ansible.builtin.hostname:
-    name: "{{ inventory_hostname }}.im.lab"
-
-- name: Check if FreeIPA client is already configured
-  ansible.builtin.stat:
-    path: /etc/ipa/default.conf
-  register: ipa_client_conf
-
-- name: Enroll to FreeIPA
-  ansible.builtin.command:
-    argv:
-      - ipa-client-install
-      - --domain=im.lab
-      - --realm=IM.LAB
-      - --server=ipa.im.lab
-      - "--hostname={{ inventory_hostname }}.im.lab"
-      - --mkhomedir
-      - --principal=admin
-      - --password={{ ipa_admin_password }}
-      - --unattended
-      - --force-join
-  no_log: false
-  when: not ipa_client_conf.stat.exists
-
-- name: Enable mkhomedir
-  ansible.builtin.command:
-    argv:
-      - authselect
-      - enable-feature
-      - with-mkhomedir
-  register: authselect_mkhomedir
-  changed_when: "'already enabled' not in authselect_mkhomedir.stdout"
-  failed_when: false
-
-- name: Enable and start oddjobd
-  ansible.builtin.service:
-    name: oddjobd
-    state: started
-    enabled: true
-
-- name: Enable and start SSSD
-  ansible.builtin.service:
-    name: sssd
-    state: started
-    enabled: true

initial_install/roles/ssh_hardening/handlers/main.yml

@@ -1,8 +0,0 @@
----
-- name: Restart SSH
-  ansible.builtin.service:
-    name: "{{ 'sshd'
-              if ansible_facts.os_family in
-              ['RedHat','Rocky','AlmaLinux','Fedora','OracleLinux','Suse']
-              else 'ssh' }}"
-    state: restarted

initial_install/roles/ssh_hardening/tasks/main.yml

@@ -1,29 +0,0 @@
----
-- name: Detect if system is Proxmox
-  ansible.builtin.stat:
-    path: /usr/bin/pveversion
-  register: proxmox_check
-
-- name: Ensure sshd_config.d exists
-  ansible.builtin.file:
-    path: /etc/ssh/sshd_config.d
-    state: directory
-
-- name: Deploy SSH hardening config
-  ansible.builtin.copy:
-    dest: /etc/ssh/sshd_config.d/99-ansible-hardening.conf
-    mode: '0644'
-    content: |
-      PasswordAuthentication no
-      ChallengeResponseAuthentication no
-      PubkeyAuthentication yes
-      AuthenticationMethods publickey
-      UsePAM yes
-
-      {% if not proxmox_check.stat.exists %}
-      PermitRootLogin no
-      {% else %}
-      PermitRootLogin prohibit-password
-      {% endif %}
-    validate: 'sshd -t -f %s'
-  notify: Restart SSH

initial_install/roles/users/tasks/main.yml

@@ -1,62 +0,0 @@
----
-- name: Define users
-  ansible.builtin.set_fact:
-    users:
-      - name: automation
-        shell: /bin/bash
-        sudo_nopasswd: true
-        ssh_keys:
-          - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEx+ltCKNIEM7F4PzGLv22cIu7N0Fpn5gxwV02xq0GS9 automation@internet-master.cz"
-
-      - name: hellsos
-        shell: /bin/bash
-        sudo_nopasswd: true
-        ssh_keys:
-          - "ssh-ed25519 AAAAC3..."
-
-      - name: jim
-        shell: /bin/bash
-        sudo_nopasswd: true
-        ssh_keys:
-          - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPFS4fsqMjMMu/Bi/884bw7yJBqvWusDRESvanH6Owco jakub@jimbuntu"
-
-# --------------------------------------------------
-# Create users
-# --------------------------------------------------
-- name: Ensure users exist
-  ansible.builtin.user:
-    name: "{{ item.name }}"
-    shell: "{{ item.shell }}"
-    create_home: true
-  loop: "{{ users }}"
-
-# --------------------------------------------------
-# Configure passwordless sudo safely
-# --------------------------------------------------
-- name: Configure passwordless sudo
-  ansible.builtin.copy:
-    dest: "/etc/sudoers.d/{{ item.name }}"
-    mode: '0440'
-    owner: root
-    group: root
-    content: |
-      {{ item.name }} ALL=(ALL:ALL) NOPASSWD: ALL
-    validate: 'visudo -cf %s'
-  loop: "{{ users }}"
-  when: item.sudo_nopasswd | default(false)
-
-# --------------------------------------------------
-# Install SSH keys
-# --------------------------------------------------
-- name: Install authorized SSH keys
-  ansible.builtin.authorized_key:
-    user: "{{ item.name }}"
-    key: "{{ item.ssh_keys | join('\n') }}"
-    exclusive: true
-  loop: "{{ users }}"
-
-# --------------------------------------------------
-# Reset connection so sudo rules take effect immediately
-# --------------------------------------------------
-- name: Reset SSH connection
-  meta: reset_connection

initial_setup.yml

@@ -10,7 +10,7 @@
         groups: []
         sudo_nopasswd: true
         ssh_keys:
-          - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEx+ltCKNIEM7F4PzGLv22cIu7N0Fpn5gxwV02xq0GS9 automation@internet-master.cz"
+          - "ssh-ed25519 AAAAC3..."
 
       - name: hellsos
         shell: /bin/bash
@@ -24,7 +24,7 @@
         groups: []
         sudo_nopasswd: true
         ssh_keys:
-          - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPFS4fsqMjMMu/Bi/884bw7yJBqvWusDRESvanH6Owco jakub@jimbuntu"
+          - "ssh-ed25519 AAAAC3..."
 
   tasks:
 

inv_linuxes

@@ -4,9 +4,6 @@ jim_storage ansible_host=192.168.19.7
 portainer2_hellsos ansible_host=192.168.52.9
 portainernode_hellsos ansible_host=192.168.52.21
 portainernode2_jim ansible_host=192.168.19.8
-galera3 ansible_host=192.168.19.92
-galera2 ansible_host=192.168.19.91
-testipaclient ansible_host=192.168.19.98
 
 [local]
 localhost ansible_connection=local

mikrotikbackup_clean.yml

@@ -1,146 +1,251 @@
+---
 - name: Backup and/or Upgrade MikroTik
   hosts: mikrotik_routers
   gather_facts: no
+  serial: 10
  
   vars:
     backup_dir: /opt/mikrotik_backups/
+    checkmk_url: "http://192.168.19.8:8080/cmk/check_mk/api/1.0/domain-types/host_service_passive_check/actions/set/invoke"
+    checkmk_user: "apitoken"
+    checkmk_token: "YXBpdG9rZW46TkVXX1NFQ1JFVA=="
+    checkmk_service_description: "MikroTik Backup/Upgrade"
  
   tasks:
  
     # ----------------------------
-    # Always: identity + timestamp
+    # Identity + timestamp
     # ----------------------------
     - name: Get router identity
       community.routeros.command:
         commands: /system identity print
       register: identity_raw
-      tags: always
  
     - name: Parse router name
       set_fact:
         router_name: "{{ identity_raw.stdout[0].split(': ')[1] | trim }}"
-      tags: always
  
     - name: Get timestamp
-      ansible.builtin.command: date +%Y-%m-%d_%H-%M-%S
+      command: date +%Y-%m-%d_%H-%M-%S
       register: date_out
       delegate_to: localhost
-      tags: always
+      changed_when: false
  
-    - name: Set timestamp fact
+    - name: Set timestamp
       set_fact:
         ts: "{{ date_out.stdout }}"
-      tags: always
  
     # ----------------------------
-    # Backup (tag: backup)
+    # Backup
     # ----------------------------
-    - name: Ensure local backup directory exists
-      ansible.builtin.file:
+    - name: Ensure backup directory exists
+      file:
         path: "{{ backup_dir }}"
         state: directory
         mode: "0755"
       delegate_to: localhost
-      tags: [backup, never]
  
     - name: Export router config
       community.routeros.command:
         commands: /export terse show-sensitive
       register: export_cfg
-      tags: [backup, never]
  
     - name: Save export locally
-      ansible.builtin.copy:
+      copy:
         content: "{{ export_cfg.stdout[0] }}"
         dest: "{{ backup_dir }}/{{ router_name }}-{{ ts }}.rsc"
+        mode: "0600"
       delegate_to: localhost
-      tags: [backup, never]
  
-    # ----------------------------
-    # Upgrade (tag: upgrade)
-    # ----------------------------
-    - name: Check current and latest available package versions
-      community.routeros.command:
-        commands: /system package update check-for-updates
-      register: update_check
-      tags: [upgrade, never]
-
-    - name: Normalize update output
+    - name: Mark backup success
       set_fact:
-        _update_text: "{{ update_check.stdout[0] | replace('\r', '') }}"
-      tags: [upgrade, never]
+        backup_file: "{{ backup_dir }}/{{ router_name }}-{{ ts }}.rsc"
  
-    # ⬇️  Add this to see exactly what RouterOS returns before parsing
-    - name: Debug raw update output
-      ansible.builtin.debug:
-        msg: "{{ _update_text }}"
-      tags: [upgrade, never]
+    # ----------------------------
+    # Update check
+    # ----------------------------
+    - name: Trigger update check
+      community.routeros.command:
+        commands: /system package update check-for-updates once
  
-    - name: Parse installed and latest versions
+    - name: Wait for MikroTik
+      pause:
+        seconds: 5
+ 
+    - name: Get update info
+      community.routeros.command:
+        commands: /system package update print
+      register: update_info
+ 
+    # ----------------------------
+    # Parsing
+    # ----------------------------
+    - name: Extract installed version
       set_fact:
         installed_version: >-
           {{
-            (_update_text | regex_findall('(?:installed|current)-version:[ ]*([0-9A-Za-z.]+)'))[0]
-            if (_update_text | regex_findall('(?:installed|current)-version:[ ]*([0-9A-Za-z.]+)'))
-            else 'unknown'
+            update_info.stdout[0]
+            | regex_search('installed-version:\s*(\S+)', '\1')
+            | first
+            | default('unknown')
+            | trim
           }}
+ 
+    - name: Extract latest version
+      set_fact:
         latest_version: >-
           {{
-            (_update_text | regex_findall('(?:latest|newest)-version:[ ]*([0-9A-Za-z.]+)'))[0]
-            if (_update_text | regex_findall('(?:latest|newest)-version:[ ]*([0-9A-Za-z.]+)'))
-            else 'unknown'
+            update_info.stdout[0]
+            | regex_search('latest-version:\s*(\S+)', '\1')
+            | first
+            | default('unknown')
+            | trim
           }}
-      tags: [upgrade, never]
  
-    - name: Fail if versions could not be parsed
-      ansible.builtin.fail:
+    - name: Extract status
+      set_fact:
+        update_status: >-
+          {{
+            update_info.stdout[0]
+            | regex_search('status:\s*(.+)', '\1')
+            | first
+            | default('unknown')
+            | trim
+          }}
+ 
+    - name: Extract channel
+      set_fact:
+        update_channel: >-
+          {{
+            update_info.stdout[0]
+            | regex_search('channel:\s*(\S+)', '\1')
+            | first
+            | default('unknown')
+            | trim
+          }}
+ 
+    - name: Debug parsed values
+      debug:
         msg: >
-          Could not parse versions from update output.
-          Raw text was: {{ _update_text }}
-      when: installed_version == 'unknown' or latest_version == 'unknown'
-      tags: [upgrade, never]
+          router={{ router_name }}
+          channel={{ update_channel }}
+          installed={{ installed_version }}
+          latest={{ latest_version }}
+          status={{ update_status }}
  
-    - name: Debug parsed versions
-      ansible.builtin.debug:
-        msg:
-          - "Installed: {{ installed_version }}"
-          - "Latest: {{ latest_version }}"
-      tags: [upgrade, never]
+    # ----------------------------
+    # Logic
+    # ----------------------------
+    - name: Detect update failure
+      set_fact:
+        update_failed: "{{ 'error' in (update_status | lower) or 'failed' in (update_status | lower) }}"
  
-    - name: Skip upgrade if already on latest
-      ansible.builtin.debug:
-        msg: "Router {{ router_name }} is already on latest version {{ installed_version }}. Skipping upgrade."
-      when: installed_version == latest_version
-      tags: [upgrade, never]
+    - name: Decide upgrade
+      set_fact:
+        upgrade_needed: >-
+          {{
+            not update_failed | bool and
+            installed_version != 'unknown' and
+            latest_version != 'unknown' and
+            installed_version != latest_version
+          }}
  
-    - name: Trigger package download and install
+    - name: Show decision
+      debug:
+        msg: "Router={{ router_name }} installed={{ installed_version }} latest={{ latest_version }} upgrade_needed={{ upgrade_needed }}"
+ 
+    - name: Skip upgrade (already up to date)
+      debug:
+        msg: "Router {{ router_name }} is already up to date ({{ installed_version }})"
+      when: not upgrade_needed | bool
+ 
+    # ----------------------------
+    # Upgrade
+    # ----------------------------
+    - name: Install update
       community.routeros.command:
         commands: /system package update install
+      when: upgrade_needed | bool
       register: upgrade_result
-      when: installed_version != latest_version
-      tags: [upgrade, never]
  
-    - name: Wait for router to come back online after reboot
-      community.routeros.command:
-        commands: /system resource print
-      register: reboot_wait
-      until: reboot_wait is not failed
-      retries: 30
-      delay: 15
+    - name: Wait for reboot
+      wait_for_connection:
+        delay: 180
+        timeout: 600
+        sleep: 10
       when:
-        - installed_version != latest_version
-        - upgrade_result is not failed
-      tags: [upgrade, never]
+        - upgrade_needed | bool
+        - upgrade_result is succeeded
  
-    - name: Confirm upgraded version
+    - name: Confirm version after upgrade
       community.routeros.command:
         commands: /system resource print
       register: post_upgrade_info
-      when: installed_version != latest_version
-      tags: [upgrade, never]
+      when: upgrade_needed | bool
+ 
+    - name: Parse new version
+      set_fact:
+        post_upgrade_version: >-
+          {{
+            post_upgrade_info.stdout[0]
+            | regex_search('version:\s*(\S+)', '\1')
+            | first
+            | default('unknown')
+            | trim
+          }}
+      when: upgrade_needed | bool
+ 
+    # ----------------------------
+    # Checkmk
+    # ----------------------------
+    - name: Result when no upgrade needed
+      set_fact:
+        cmk_state: "{{ 2 if update_failed | bool else 0 }}"
+        cmk_output: >-
+          {{ 'CRIT' if update_failed | bool else 'OK' }} -
+          router={{ router_name }}
+          installed={{ installed_version }}
+          latest={{ latest_version }}
+          status="{{ update_status }}"
+          upgrade_needed=no
+      when: not upgrade_needed | bool
+ 
+    - name: Result when upgrade happened
+      set_fact:
+        cmk_state: "{{ 0 if post_upgrade_version == latest_version else 2 }}"
+        cmk_output: >-
+          {{ 'OK' if post_upgrade_version == latest_version else 'CRIT' }} -
+          router={{ router_name }}
+          upgraded_from={{ installed_version }}
+          upgraded_to={{ post_upgrade_version }}
+          latest={{ latest_version }}
+      when: upgrade_needed | bool
+ 
+    - name: Send result to Checkmk
+      delegate_to: localhost
+      uri:
+        url: "{{ checkmk_url }}"
+        method: POST
+        url_username: "{{ checkmk_user }}"
+        url_password: "{{ checkmk_token }}"
+        force_basic_auth: yes
+        headers:
+          Content-Type: "application/json"
+          Accept: "application/json"
+        body_format: json
+        body:
+          host_name: "mikrotiks"
+          service_description: "{{ checkmk_service_description }}"
+          state: "{{ cmk_state | int }}"
+          output: "{{ cmk_output }}"
+      failed_when: false
+      register: cmk_result
+ 
+    - name: Debug Checkmk response
+      debug:
+        msg: "status={{ cmk_result.status }} body={{ cmk_result.json | default(cmk_result.msg) }}"
+ 
+    - name: Show Checkmk output
+      debug:
+        var: cmk_output
  
-    - name: Show post-upgrade RouterOS version
-      ansible.builtin.debug:
-        msg: "{{ post_upgrade_info.stdout[0] | regex_search('version: .+') }}"
-      when: installed_version != latest_version
-      tags: [upgrade, never]

test_sms.yml

@@ -7,7 +7,7 @@
     sms_username: "mikrotik"
     sms_password_send: "jdkotzHJIOPWhjtr32D"
     sms_password_recv: "jdkotzHJIOPWhjtr32D"
-    sms_wait_seconds: 15   # Wait 15s for delivery
+    sms_wait_seconds: 120   # Wait 2 minutes for delivery
 
   tasks:
     - name: Generate random test string