Files

T

DerLinkman 30f3e9a4c6 rename dmc12 inventory to cloudlorean and vault admin_password

- replace inventory/dmc12.yml with cloudlorean.yml (+ group_vars) and update
  all README/AGENTS call examples and the inventory table
- move admin_password hash into encrypted vault.yml; remove plaintext copies
  from roles/bootstrap/defaults and group_vars/external.yml
- bootstrap.yml loads vault.yml via vars_files (same pattern as monitoring)
- monitoring: PSK config/registration updates, docker role defaults,
  os-updates logging/reboot refinements, ansible.cfg/execute.sh tweaks
- add .project-wiki knowledge base and .github agent instructions

2026-09-09 14:14:18 +02:00

2.4 KiB

Raw Blame History

id, type, status, title, created, updated, tags, related, source_paths, confidence

type

status

title

created

updated

OS Updates Role

Responsibility

Upgrade Debian packages with optional mirror rewrite, kernel-based reboot handling, and controller-side update logging.

Source Paths

roles/os-updates/tasks/main.yml → update_mirrors.yml (optional), upgrade_packages.yml → logging_preflight.yml, reboot.yml, logging_postflight.yml
Templates: sources.list.j2, sources.list-deb822.j2
Handlers: apt cleanup, apt autoremove

Public Interfaces

Playbook: playbooks/os-updates-deb.yml (chains healthcheck)
Key variables: os_update_auto_upgrade, os_also_update_mirror (false), os_update_mirrors (main + security mirror), os_update_version_codename (role default: host facts; group_vars/debian.yml hardcodes trixie), os_update_debian_codenames (trixie, bookworm, bullseye), os_update_reboot_on_proxmox (false), os_update_logging_enabled (true), os_update_log_dir (/ansible/logs), os_update_log_file (logs///update.log).

Important Flows

Mirror rewrite (only when os_also_update_mirror) with ignore_errors: true; only whitelisted Debian codenames are rewritten in sources.list.d.
Preflight logging: refresh cache, record start epoch/ISO, parse apt list --upgradable into names/versions/count.
apt upgrade: full (notifies cleanup/autoremove handlers).
Reboot decision: compare running kernel (uname -r) vs newest installed linux-image-*; skipped on LXC (virtualization_type != lxc). On proxmox group hosts the reboot is deferred unless os_update_reboot_on_proxmox. Otherwise: async /sbin/reboot, wait_for_connection (10s delay, 600s timeout), downtime and kernel after reboot recorded.
Postflight logging: duration, upgrade result, reboot details, kernel before/after appended to the update log (delegate_to: localhost).

Dependencies

None (ansible.builtin only). Paired with healthcheck at playbook level.

Tests

None automated.

Notes For Agents

Logging facts are shared with the healthcheck role via the same log file and start timestamp conventions.
Old-style module names (apt, file, blockinfile) remain here; use FQCN for new tasks.

2.4 KiB Raw Blame History