389 lines
13 KiB
YAML
389 lines
13 KiB
YAML
# nextcloud/update_nextcloud.yml
|
|
|
|
- name: Update Nextcloud on VM via Proxmox
|
|
hosts: proxmox_nextcloud
|
|
gather_facts: false
|
|
become: true
|
|
become_user: root
|
|
become_method: sudo
|
|
|
|
vars:
|
|
# --- Connection to VM (provided by Semaphore env vars) ---
|
|
vm_ip: "{{ lookup('env', 'VM_IP') }}"
|
|
vm_user: "{{ lookup('env', 'VM_USER') }}"
|
|
vm_pass: "{{ lookup('env', 'VM_PASS') }}"
|
|
use_sudo: false
|
|
|
|
# --- Debug / retries ---
|
|
DEBUG: "{{ lookup('env', 'DEBUG') | default(0) | int }}"
|
|
RETRIES: "{{ lookup('env', 'RETRIES') | default(25) | int }}"
|
|
|
|
# --- Nextcloud specifics ---
|
|
nextcloud_project: "nextcloud-collabora"
|
|
nextcloud_compose_file: "/data/compose/nextcloud/docker-compose-nextcloud.yml"
|
|
nextcloud_service: "nextcloud"
|
|
|
|
# Backup directory on the VM (timestamped on controller)
|
|
backup_dir: "/data/compose/nextcloud/backup-{{ lookup('pipe', 'date +%F-%H%M%S') }}"
|
|
|
|
nextcloud_base_url: "https://cloud.martinfencl.eu"
|
|
nextcloud_status_url: "{{ nextcloud_base_url }}/status.php"
|
|
|
|
# Docker command prefix (consistent behavior and quiet hints)
|
|
docker_prefix: "unalias docker 2>/dev/null || true; DOCKER_CLI_HINTS=0; command docker"
|
|
|
|
# SSH argv base (always run remote command via bash -lc)
|
|
ssh_argv_base:
|
|
- sshpass
|
|
- -e
|
|
- ssh
|
|
- -o
|
|
- StrictHostKeyChecking=no
|
|
- -o
|
|
- ConnectTimeout=15
|
|
- "{{ vm_user }}@{{ vm_ip }}"
|
|
- bash
|
|
- -lc
|
|
|
|
# --- Backup phase commands (run on VM) ---
|
|
nextcloud_backup_commands:
|
|
- >-
|
|
mkdir -p "{{ backup_dir }}"
|
|
- >-
|
|
{{ docker_prefix }} exec -u www-data nextcloud php occ maintenance:mode --on
|
|
- >-
|
|
{{ docker_prefix }} exec nextcloud sh -c 'tar czf /tmp/nextcloud_conf.tgz -C /var/www/html config custom_apps'
|
|
- >-
|
|
{{ docker_prefix }} cp nextcloud:/tmp/nextcloud_conf.tgz "{{ backup_dir }}/nextcloud_conf.tgz"
|
|
- >-
|
|
{{ docker_prefix }} exec nextcloud rm /tmp/nextcloud_conf.tgz || true
|
|
- >-
|
|
{{ docker_prefix }} exec nextcloud-db sh -c 'command -v mariadb-dump >/dev/null && mariadb-dump -u"$MYSQL_USER" -p"$MYSQL_PASSWORD" "$MYSQL_DATABASE" || mysqldump -u"$MYSQL_USER" -p"$MYSQL_PASSWORD" "$MYSQL_DATABASE"' > "{{ backup_dir }}/db.sql"
|
|
|
|
tasks:
|
|
- name: Ensure sshpass is installed (for password-based SSH)
|
|
ansible.builtin.apt:
|
|
name: sshpass
|
|
state: present
|
|
update_cache: yes
|
|
|
|
- name: Nextcloud | Show current version before upgrade (DEBUG)
|
|
ansible.builtin.command:
|
|
argv: >-
|
|
{{
|
|
ssh_argv_base
|
|
+ [ docker_prefix ~ ' exec -u www-data nextcloud php occ -V || true' ]
|
|
}}
|
|
environment:
|
|
SSHPASS: "{{ vm_pass }}"
|
|
register: nc_version_before
|
|
changed_when: false
|
|
failed_when: false
|
|
when: DEBUG == 1
|
|
no_log: "{{ DEBUG == 0 }}"
|
|
|
|
# -------------------------
|
|
# Backup phase
|
|
# -------------------------
|
|
- name: Nextcloud | Run backup commands on VM (via SSH)
|
|
ansible.builtin.command:
|
|
argv: >-
|
|
{{
|
|
ssh_argv_base
|
|
+ [ ((use_sudo | bool) | ternary('sudo -n ' ~ item, item)) ]
|
|
}}
|
|
environment:
|
|
SSHPASS: "{{ vm_pass }}"
|
|
loop: "{{ nextcloud_backup_commands }}"
|
|
loop_control:
|
|
index_var: idx
|
|
label: "backup-cmd-{{ idx }}"
|
|
register: nc_backup_cmds
|
|
changed_when: false
|
|
failed_when: false
|
|
no_log: "{{ DEBUG == 0 }}"
|
|
|
|
- name: Nextcloud | Show outputs of backup commands (DEBUG)
|
|
ansible.builtin.debug:
|
|
msg: |
|
|
CMD: {{ item.item }}
|
|
RC: {{ item.rc }}
|
|
STDOUT:
|
|
{{ (item.stdout | default('')).strip() }}
|
|
STDERR:
|
|
{{ (item.stderr | default('')).strip() }}
|
|
loop: "{{ nc_backup_cmds.results }}"
|
|
when: DEBUG == 1
|
|
|
|
- name: Nextcloud | Fail play if any backup command failed
|
|
ansible.builtin.assert:
|
|
that: "item.rc == 0"
|
|
fail_msg: "Nextcloud backup step failed on VM: {{ item.item }} (rc={{ item.rc }})"
|
|
success_msg: "All Nextcloud backup commands succeeded."
|
|
loop: "{{ nc_backup_cmds.results }}"
|
|
loop_control:
|
|
index_var: idx
|
|
label: "backup-cmd-{{ idx }}"
|
|
|
|
# -------------------------
|
|
# Upgrade phase (robust)
|
|
# -------------------------
|
|
- name: Nextcloud | Pull image
|
|
ansible.builtin.command:
|
|
argv: >-
|
|
{{
|
|
ssh_argv_base
|
|
+ [ docker_prefix ~ ' compose -p ' ~ nextcloud_project ~ ' -f ' ~ nextcloud_compose_file ~ ' pull ' ~ nextcloud_service ]
|
|
}}
|
|
environment:
|
|
SSHPASS: "{{ vm_pass }}"
|
|
register: nc_pull
|
|
changed_when: false
|
|
failed_when: false
|
|
no_log: "{{ DEBUG == 0 }}"
|
|
|
|
- name: Nextcloud | Recreate service
|
|
ansible.builtin.command:
|
|
argv: >-
|
|
{{
|
|
ssh_argv_base
|
|
+ [ docker_prefix ~ ' compose -p ' ~ nextcloud_project ~ ' -f ' ~ nextcloud_compose_file ~ ' up -d --no-deps --force-recreate ' ~ nextcloud_service ]
|
|
}}
|
|
environment:
|
|
SSHPASS: "{{ vm_pass }}"
|
|
register: nc_up
|
|
changed_when: false
|
|
failed_when: false
|
|
no_log: "{{ DEBUG == 0 }}"
|
|
|
|
- name: Nextcloud | Ensure maintenance mode is OFF before occ upgrade
|
|
ansible.builtin.command:
|
|
argv: >-
|
|
{{
|
|
ssh_argv_base
|
|
+ [ docker_prefix ~ ' exec -u www-data nextcloud php occ maintenance:mode --off || true' ]
|
|
}}
|
|
environment:
|
|
SSHPASS: "{{ vm_pass }}"
|
|
register: nc_maint_off_before_upgrade
|
|
changed_when: false
|
|
failed_when: false
|
|
no_log: "{{ DEBUG == 0 }}"
|
|
|
|
- name: Nextcloud | occ upgrade (attempt 1)
|
|
ansible.builtin.command:
|
|
argv: >-
|
|
{{
|
|
ssh_argv_base
|
|
+ [ docker_prefix ~ ' exec -u www-data nextcloud php occ upgrade' ]
|
|
}}
|
|
environment:
|
|
SSHPASS: "{{ vm_pass }}"
|
|
register: nc_upgrade_1
|
|
changed_when: false
|
|
failed_when: false
|
|
no_log: "{{ DEBUG == 0 }}"
|
|
|
|
- name: Nextcloud | Remediation if occ upgrade complains about maintenance/upgrade-in-progress
|
|
ansible.builtin.command:
|
|
argv: >-
|
|
{{
|
|
ssh_argv_base
|
|
+ [ item ]
|
|
}}
|
|
environment:
|
|
SSHPASS: "{{ vm_pass }}"
|
|
loop:
|
|
# Force-disable maintenance flag in config.php (works even if maintenance command is blocked)
|
|
- >-
|
|
{{ docker_prefix }} exec -u www-data nextcloud php occ config:system:set maintenance --type=boolean --value=false || true
|
|
# Repair can move stale updater step files and clear related state
|
|
- >-
|
|
{{ docker_prefix }} exec -u www-data nextcloud php occ maintenance:repair || true
|
|
# Ensure maintenance is off before retry
|
|
- >-
|
|
{{ docker_prefix }} exec -u www-data nextcloud php occ maintenance:mode --off || true
|
|
register: nc_remediate
|
|
changed_when: false
|
|
failed_when: false
|
|
when: >-
|
|
nc_upgrade_1.rc != 0 and (
|
|
('Maybe an upgrade is already in process' in (nc_upgrade_1.stdout | default(''))) or
|
|
('Maybe an upgrade is already in process' in (nc_upgrade_1.stderr | default(''))) or
|
|
('Nextcloud is in maintenance mode' in (nc_upgrade_1.stdout | default(''))) or
|
|
('Nextcloud is in maintenance mode' in (nc_upgrade_1.stderr | default('')))
|
|
)
|
|
no_log: "{{ DEBUG == 0 }}"
|
|
|
|
- name: Nextcloud | occ upgrade (attempt 2 after remediation)
|
|
ansible.builtin.command:
|
|
argv: >-
|
|
{{
|
|
ssh_argv_base
|
|
+ [ docker_prefix ~ ' exec -u www-data nextcloud php occ upgrade' ]
|
|
}}
|
|
environment:
|
|
SSHPASS: "{{ vm_pass }}"
|
|
register: nc_upgrade_2
|
|
changed_when: false
|
|
failed_when: false
|
|
when: nc_upgrade_1.rc != 0
|
|
no_log: "{{ DEBUG == 0 }}"
|
|
|
|
- name: Nextcloud | Decide final upgrade result
|
|
ansible.builtin.set_fact:
|
|
nc_upgrade_final: "{{ (nc_upgrade_2 if (nc_upgrade_2 is defined) else nc_upgrade_1) }}"
|
|
|
|
- name: Nextcloud | Show occ upgrade output (DEBUG)
|
|
ansible.builtin.debug:
|
|
msg: |
|
|
RC: {{ nc_upgrade_final.rc }}
|
|
STDOUT:
|
|
{{ (nc_upgrade_final.stdout | default('')).strip() }}
|
|
STDERR:
|
|
{{ (nc_upgrade_final.stderr | default('')).strip() }}
|
|
when: DEBUG == 1
|
|
|
|
- name: Nextcloud | Fail if occ upgrade did not succeed
|
|
ansible.builtin.assert:
|
|
that:
|
|
- nc_upgrade_final.rc == 0
|
|
fail_msg: >-
|
|
Nextcloud occ upgrade failed (rc={{ nc_upgrade_final.rc }}).
|
|
stdout={{ (nc_upgrade_final.stdout | default('') | trim) }}
|
|
stderr={{ (nc_upgrade_final.stderr | default('') | trim) }}
|
|
|
|
# Keep the rest under maintenance mode to avoid user activity during app updates/repairs
|
|
- name: Nextcloud | Enable maintenance mode for post-upgrade steps
|
|
ansible.builtin.command:
|
|
argv: >-
|
|
{{
|
|
ssh_argv_base
|
|
+ [ docker_prefix ~ ' exec -u www-data nextcloud php occ maintenance:mode --on' ]
|
|
}}
|
|
environment:
|
|
SSHPASS: "{{ vm_pass }}"
|
|
register: nc_maint_on_post
|
|
changed_when: false
|
|
failed_when: false
|
|
no_log: "{{ DEBUG == 0 }}"
|
|
|
|
- name: Nextcloud | Update apps (best-effort)
|
|
ansible.builtin.command:
|
|
argv: >-
|
|
{{
|
|
ssh_argv_base
|
|
+ [ docker_prefix ~ ' exec -u www-data nextcloud php occ app:update --all || true' ]
|
|
}}
|
|
environment:
|
|
SSHPASS: "{{ vm_pass }}"
|
|
register: nc_app_update
|
|
changed_when: false
|
|
failed_when: false
|
|
no_log: "{{ DEBUG == 0 }}"
|
|
|
|
- name: Nextcloud | Run maintenance repair (include expensive) (best-effort)
|
|
ansible.builtin.command:
|
|
argv: >-
|
|
{{
|
|
ssh_argv_base
|
|
+ [ docker_prefix ~ ' exec -u www-data nextcloud php occ maintenance:repair --include-expensive || true' ]
|
|
}}
|
|
environment:
|
|
SSHPASS: "{{ vm_pass }}"
|
|
register: nc_repair
|
|
changed_when: false
|
|
failed_when: false
|
|
no_log: "{{ DEBUG == 0 }}"
|
|
|
|
- name: Nextcloud | Disable maintenance mode (end)
|
|
ansible.builtin.command:
|
|
argv: >-
|
|
{{
|
|
ssh_argv_base
|
|
+ [ docker_prefix ~ ' exec -u www-data nextcloud php occ maintenance:mode --off' ]
|
|
}}
|
|
environment:
|
|
SSHPASS: "{{ vm_pass }}"
|
|
register: nc_maint_off_end
|
|
changed_when: false
|
|
failed_when: false
|
|
no_log: "{{ DEBUG == 0 }}"
|
|
|
|
- name: Nextcloud | Show current version after upgrade (DEBUG)
|
|
ansible.builtin.command:
|
|
argv: >-
|
|
{{
|
|
ssh_argv_base
|
|
+ [ docker_prefix ~ ' exec -u www-data nextcloud php occ -V || true' ]
|
|
}}
|
|
environment:
|
|
SSHPASS: "{{ vm_pass }}"
|
|
register: nc_version_after
|
|
changed_when: false
|
|
failed_when: false
|
|
when: DEBUG == 1
|
|
no_log: "{{ DEBUG == 0 }}"
|
|
|
|
# -------------------------
|
|
# Readiness check (status.php)
|
|
# -------------------------
|
|
- name: Nextcloud | Wait for status.php (controller first)
|
|
ansible.builtin.uri:
|
|
url: "{{ nextcloud_status_url }}"
|
|
method: GET
|
|
return_content: true
|
|
validate_certs: true
|
|
status_code: 200
|
|
register: nc_status_controller
|
|
delegate_to: localhost
|
|
run_once: true
|
|
retries: "{{ RETRIES }}"
|
|
delay: 4
|
|
until: nc_status_controller.status == 200
|
|
failed_when: false
|
|
changed_when: false
|
|
|
|
- name: Nextcloud | VM-side fetch status.php (JSON via Python)
|
|
ansible.builtin.command:
|
|
argv: >-
|
|
{{
|
|
ssh_argv_base
|
|
+ [ "python3 - <<'PY'\nimport sys, urllib.request\ntry:\n with urllib.request.urlopen(\"" ~ nextcloud_status_url ~ "\", timeout=15) as r:\n sys.stdout.write(r.read().decode())\nexcept Exception:\n pass\nPY" ]
|
|
}}
|
|
environment:
|
|
SSHPASS: "{{ vm_pass }}"
|
|
register: nc_status_vm
|
|
changed_when: false
|
|
failed_when: false
|
|
when: nc_status_controller.status | default(0) != 200 or nc_status_controller.json is not defined
|
|
no_log: "{{ DEBUG == 0 }}"
|
|
|
|
- name: Nextcloud | Choose status JSON (controller wins, else VM)
|
|
ansible.builtin.set_fact:
|
|
nextcloud_status_json: >-
|
|
{{
|
|
(nc_status_controller.json
|
|
if (nc_status_controller.status | default(0)) == 200 and (nc_status_controller.json is defined)
|
|
else (
|
|
(nc_status_vm.stdout | default('') | trim | length > 0)
|
|
| ternary((nc_status_vm.stdout | trim | from_json), omit)
|
|
)
|
|
)
|
|
}}
|
|
failed_when: false
|
|
|
|
- name: Nextcloud | Print concise status summary (DEBUG)
|
|
ansible.builtin.debug:
|
|
msg: >-
|
|
Nextcloud {{ nextcloud_status_json.version | default('?') }}
|
|
(installed={{ nextcloud_status_json.installed | default('?') }},
|
|
maintenance={{ nextcloud_status_json.maintenance | default('?') }},
|
|
needsDbUpgrade={{ nextcloud_status_json.needsDbUpgrade | default('?') }})
|
|
when: nextcloud_status_json is defined and DEBUG == 1
|
|
|
|
- name: Nextcloud | Status JSON not available (DEBUG)
|
|
ansible.builtin.debug:
|
|
msg: "status.php is not reachable or did not return JSON."
|
|
when: nextcloud_status_json is not defined and DEBUG == 1
|