From ca24bb73dcf55013a08dc723c126f88651dbb8c1 Mon Sep 17 00:00:00 2001 From: Maxim Vershinin Date: Mon, 17 Aug 2026 16:26:15 +0400 Subject: [PATCH 1/7] CHANGE: drops unnecessary lines from maintain playbook --- playbooks/maintain.yaml | 3 --- 1 file changed, 3 deletions(-) diff --git a/playbooks/maintain.yaml b/playbooks/maintain.yaml index 45a9e45..d15c438 100644 --- a/playbooks/maintain.yaml +++ b/playbooks/maintain.yaml @@ -5,9 +5,6 @@ vars_files: ../inventory/group_vars/all/secrets.yaml - vars: - ansible_user_passwd_hash: "{{ ansible_password | password_hash('sha512', 's3edscrj45e6r') }}" - user_passwd_hash: "{{ user_password | password_hash('sha512', 's3ed6123jhgcr') }}" roles: # Check the Internet connection From 271213d1ca4d7ed71679b6e9095cb80e55e4de8e Mon Sep 17 00:00:00 2001 From: Maxim Vershinin Date: Tue, 18 Aug 2026 12:26:00 +0400 Subject: [PATCH 2/7] CHANGE: adds ansible requirements file and a script for updating it on production machines, updates pip requirements --- requirements.txt | 9 +++++++-- requirements.yaml | 17 +++++++++++++++++ update_modules.sh | 12 ++++++++++++ 3 files changed, 36 insertions(+), 2 deletions(-) create mode 100644 requirements.yaml create mode 100755 update_modules.sh diff --git a/requirements.txt b/requirements.txt index bb5d472..9c2d48e 100644 --- a/requirements.txt +++ b/requirements.txt @@ -4,29 +4,34 @@ ansible-lint==26.6.0 attrs==26.1.0 black==26.5.1 bracex==3.0 +certifi==2026.7.22 cffi==2.1.0 +charset-normalizer==3.4.9 click==8.4.2 cryptography==49.0.0 distro==1.9.0 filelock==3.29.7 +idna==3.18 Jinja2==3.1.6 jsonschema==4.26.0 jsonschema-specifications==2025.9.1 MarkupSafe==3.0.3 mypy_extensions==1.1.0 +netaddr==1.3.0 packaging==26.2 pathspec==1.1.1 platformdirs==4.10.0 -proxmoxer>=2.3 +proxmoxer==2.3.0 pycparser==3.0 pytokens==0.4.1 PyYAML==6.0.3 referencing==0.37.0 -requests>=2.34.2 +requests==2.34.2 resolvelib==1.2.1 rpds-py==2026.6.3 ruamel.yaml==0.19.1 ruamel.yaml.clib==0.2.15 subprocess-tee==0.4.2 +urllib3==2.7.0 wcmatch==11.0 yamllint==1.38.0 diff --git a/requirements.yaml b/requirements.yaml new file mode 100644 index 0000000..bec0b55 --- /dev/null +++ b/requirements.yaml @@ -0,0 +1,17 @@ +--- + +collections: + - name: ansible.posix + version: 2.2.2 + + - name: ansible.utils + version: 6.0.3 + + - name: community.general + version: 13.2.0 + + - name: community.library_inventory_filtering_v1 + version: 1.1.5 + + - name: community.proxmox + version: 2.0.0 diff --git a/update_modules.sh b/update_modules.sh new file mode 100755 index 0000000..624d2e5 --- /dev/null +++ b/update_modules.sh @@ -0,0 +1,12 @@ +#!/bin/bash + +source .venv/bin/activate + +# Install python packages +pip install -r requirements.txt + +# Install collections from the file +ansible-galaxy collection install -r requirements.yml -p ./collections/ + +# Install roles +ansible-galaxy role install -r requirements.yml -p ./roles/ From 09145ac1e5a9f7bcefeb6d776c65efc5a98a760e Mon Sep 17 00:00:00 2001 From: Maxim Vershinin Date: Tue, 18 Aug 2026 12:29:48 +0400 Subject: [PATCH 3/7] CHANGE: moves scripts into a new directory --- run_maintain_playbook.sh => scripts/run_maintain_playbook.sh | 0 update_modules.sh => scripts/update_modules.sh | 0 2 files changed, 0 insertions(+), 0 deletions(-) rename run_maintain_playbook.sh => scripts/run_maintain_playbook.sh (100%) rename update_modules.sh => scripts/update_modules.sh (100%) diff --git a/run_maintain_playbook.sh b/scripts/run_maintain_playbook.sh similarity index 100% rename from run_maintain_playbook.sh rename to scripts/run_maintain_playbook.sh diff --git a/update_modules.sh b/scripts/update_modules.sh similarity index 100% rename from update_modules.sh rename to scripts/update_modules.sh From 0daa4a4cf91be023e69d67cb965606bb9d79a50f Mon Sep 17 00:00:00 2001 From: Maxim Vershinin Date: Tue, 18 Aug 2026 12:49:54 +0400 Subject: [PATCH 4/7] CHANGE: adds a lock file to the scripts --- scripts/run_maintain_playbook.sh | 8 ++++++++ scripts/update_modules.sh | 6 ++++++ 2 files changed, 14 insertions(+) diff --git a/scripts/run_maintain_playbook.sh b/scripts/run_maintain_playbook.sh index f2b8a80..c677ec7 100755 --- a/scripts/run_maintain_playbook.sh +++ b/scripts/run_maintain_playbook.sh @@ -1,3 +1,11 @@ #!/bin/bash + +LOCK_FILE=/tmp/vmn_ansible_lock_file.lock + +while [ -f "$LOCK_FILE" ] +do + sleep 1s +done + source .venv/bin/activate ansible-playbook playbooks/maintain.yaml --vault-pass-file ~/vault_password -i inventory/hosts.yaml --private-key ~/.ssh/ansible_key diff --git a/scripts/update_modules.sh b/scripts/update_modules.sh index 624d2e5..2e88220 100755 --- a/scripts/update_modules.sh +++ b/scripts/update_modules.sh @@ -1,5 +1,8 @@ #!/bin/bash +# Create a lock file to prevent other scripts from running with old modules +touch /tmp/vmn_ansible_lock_file.lock + source .venv/bin/activate # Install python packages @@ -10,3 +13,6 @@ ansible-galaxy collection install -r requirements.yml -p ./collections/ # Install roles ansible-galaxy role install -r requirements.yml -p ./roles/ + +# Installation is finished, remove the lock +rm /tmp/vmn_ansible_lock_file.lock From 6d584bc582b32cf2182018d003eabd542576f8e1 Mon Sep 17 00:00:00 2001 From: Maxim Vershinin Date: Tue, 18 Aug 2026 13:00:01 +0400 Subject: [PATCH 5/7] CHANGE: updates systemd service and timer --- systemd/ansible-maintenance.service | 8 ++++---- systemd/ansible-maintenance.timer | 4 ++-- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/systemd/ansible-maintenance.service b/systemd/ansible-maintenance.service index 2717b2b..2caaae1 100644 --- a/systemd/ansible-maintenance.service +++ b/systemd/ansible-maintenance.service @@ -6,10 +6,10 @@ Wants=network-online.target [Service] Type=oneshot # CAHNGE TO MATCH YOUR REQUIREMENTS -User=max -Group=max -WorkingDirectory=/home/max/projects/ansible_home -ExecStart=/home/max/projects/ansible_home/run_playbook.sh /home/max/projects/ansible_home/playbooks/maintain.yaml +User=ansible +Group=ansible +WorkingDirectory=/home/ansible/ansible-production +ExecStart=/home/ansible/ansible-production/run_maintain_playbook.sh StandardOutput=journal StandardError=journal # Optional: prevent runaway if the playbook hangs diff --git a/systemd/ansible-maintenance.timer b/systemd/ansible-maintenance.timer index 6e606e0..ae3c369 100644 --- a/systemd/ansible-maintenance.timer +++ b/systemd/ansible-maintenance.timer @@ -1,9 +1,9 @@ [Unit] -Description=Timer for Ansible maintenance playbook, runs every 10 minutes +Description=Timer for Ansible maintenance playbook, runs every day Requires=ansible-maintenance.service [Timer] -OnUnitActiveSec=10min +OnUnitActiveSec=1d Persistent=true Unit=ansible-maintenance.service From 122157eeeb8efbe4d1693f9142ae1704c6e8fca7 Mon Sep 17 00:00:00 2001 From: Maxim Vershinin Date: Tue, 18 Aug 2026 13:00:22 +0400 Subject: [PATCH 6/7] CHANGE: updates inventory --- inventory/hosts.yaml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/inventory/hosts.yaml b/inventory/hosts.yaml index b38a87b..6c4f7f7 100644 --- a/inventory/hosts.yaml +++ b/inventory/hosts.yaml @@ -5,9 +5,13 @@ physical: ansible_become_password: "{{ ansible_become_passwd }}" ansible_connection: local ansible_python_interpreter: "{{ ansible_playbook_python }}" - 192.168.0.98: - ansible_become_password: "{{ ansible_become_passwd }}" 192.168.0.6: ansible_become_password: "{{ ansible_become_passwd }}" 192.168.0.8: ansible_become_password: "{{ ansible_become_passwd }}" + 192.168.0.12: + ansible_become_password: "{{ ansible_become_passwd }}" + 192.168.0.16: + ansible_become_password: "{{ ansible_become_passwd }}" + 192.168.0.39: + ansible_become_password: "{{ ansible_become_passwd }}" From 5215f8d082761d9e03c9c1d1acd625925cd399c7 Mon Sep 17 00:00:00 2001 From: Maxim Vershinin Date: Tue, 18 Aug 2026 13:36:29 +0400 Subject: [PATCH 7/7] CHANGE: adds new webhooks to the gitea action --- .gitea/workflows/deploy_new_config.yaml | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/.gitea/workflows/deploy_new_config.yaml b/.gitea/workflows/deploy_new_config.yaml index 75f9e4e..a338fe7 100644 --- a/.gitea/workflows/deploy_new_config.yaml +++ b/.gitea/workflows/deploy_new_config.yaml @@ -16,6 +16,12 @@ jobs: if: github.event.pull_request.merged == true runs-on: ubuntu-latest steps: - - name: Trigger the webhook to start pulling new Ansible configs - # LAN IP is used because those hosts are in the same network + - name: Trigger the webhook to start pulling the latest version from the repo + # LAN IP is used because those hosts are in the same network + run: curl "http://192.168.0.38:9000/hooks/pull-latest" + + - name: Trigger the webhook to update python and ansible modules + run: curl "http://192.168.0.38:9000/hooks/run-update-script" + + - name: Trigger the webhook to run the playbook run: curl "http://192.168.0.38:9000/hooks/run-maintain-playbook"