Merge pull request 'feat(maintenance): new checks added, existing improved' (#6) from dev into main

Reviewed-on: #6

.gitea/workflows/deploy_new_config.yaml

@@ -0,0 +1,21 @@
+name: Deploy new config to the Ansible server
+run-name: Config is being deployed
+
+on:
+  pull_request:
+    types: [closed]
+    branches: [ main ]
+
+env:
+  REGISTRY: git.vmn.su
+  OWNER: max
+  REPO: vmn-ansible
+
+jobs:
+  trigger-webhook:
+    if: github.event.pull_request.merged == true
+    runs-on: ubuntu-latest
+    steps:
+      - name: Trigger the webhook to run the playbook
+        # LAN IP is used because those hosts are in the same network
+        run: curl "http://192.168.0.38:9000/hooks/run-maintain-playbook"

inventory/group_vars/all/main.yaml

@@ -1,3 +1,5 @@
 ---
 
 ansible_become_passwd: "{{ ansible_password }}"
+human_admin_user: max
+proxmox_1_host: 192.168.0.2

inventory/hosts.yaml

@@ -1,13 +1,41 @@
 ---
-physical:
+all:
+  children:
+    physical:
+      proxmox_1:
+        ansible_host: "{{ proxmox_1_host }}"
+        ansible_become_password: "{{ ansible_become_passwd }}"
+        services_to_run: []
+    virtual:
       hosts:
         localhost:
           ansible_become_password: "{{ ansible_become_passwd }}"
           ansible_connection: local
           ansible_python_interpreter: "{{ ansible_playbook_python }}"
-    192.168.0.98:
+          services_to_run:
+            - webhook 
+        nfs-server:
+          ansible_host: 192.168.0.6
           ansible_become_password: "{{ ansible_become_passwd }}"
-    192.168.0.6:
+          services_to_run: []
+        jellyfin:
+          ansible_host: 192.168.0.8
           ansible_become_password: "{{ ansible_become_passwd }}"
-    192.168.0.8:
+          services_to_run: []
+        frigate:
+          ansible_host: 192.168.0.12
           ansible_become_password: "{{ ansible_become_passwd }}"
+          services_to_run: []
+        vs-code:
+          ansible_host: 192.168.0.16
+          ansible_become_password: "{{ ansible_become_passwd }}"
+          services_to_run: []
+        gitea-server:
+          ansible_host: 192.168.0.39
+          ansible_become_password: "{{ ansible_become_passwd }}"
+          services_to_run: []
+        ai-host:
+          ansible_host: 192.168.0.50
+          ansible_become_password: "{{ ansible_become_passwd }}"
+          services_to_run:
+            - coder_ai

playbooks/deploy_and_set_up_lxc_on_proxmox.yaml

@@ -12,7 +12,7 @@
 
   vars_prompt:
     - name: lxc_hostname
-      prompt: "Hostname for the container"
+      prompt: "Hostname for the container (may only contain letters (a-z, A-Z), numbers (0-9), and hyphens)"
       private: false
 
     - name: lxc_root_password
@@ -25,6 +25,18 @@
       prompt: "IP address for the container (in x.x.x.x/x formant)"
       private: false
 
+    - name: lxc_is_privileged
+      prompt: "Unprivileged LXC (true/false)?"
+      private: false
+
+  pre_tasks:
+    - name: Validate hostname
+      ansible.builtin.fail:
+        msg: |
+          Invalid hostname: "{{ lxc_hostname }}"
+          Hostname may only contain letters (a-z, A-Z), numbers (0-9), and hyphens (-).
+      when: not lxc_hostname is regex('^[a-zA-Z0-9-]+$')
+      run_once: true
 
   roles:
     - ../roles/deploy_lxc_on_proxmox 
@@ -62,5 +74,6 @@
     - ../roles/harden_ssh 
     - ../roles/base_system
     - ../roles/human_admin_user
-    - ../roles/set_locale_and_time
+    # Update configs - omz, nvim, ranger and so on. Distribute the last version of those configs
+    - ../roles/update_configs
 

playbooks/deploy_vm_from_cloud_init.yaml

@@ -1,6 +1,7 @@
 ---
-- name: Deploy a virtual machine from a cloud init image
+- name: Deploy VM
-  hosts: localhost
+  hosts: all
+  remote_user: ansible
   gather_facts: false
 
   vars_files:
@@ -8,10 +9,60 @@
   vars:
     ansible_user_passwd_hash: "{{ ansible_password | password_hash('sha512', 's3edscrj45e6r') }}"
     user_passwd_hash: "{{ user_password | password_hash('sha512', 's3ed6123jhgcr') }}"
+
   vars_prompt:
     - name: vm_hostname
-      prompt: "Hostname for the VM"
+      prompt: "Hostname for the VM (may only contain letters (a-z, A-Z), numbers (0-9), and hyphens)"
       private: false
 
+    - name: vm_ip_address
+      prompt: "IP address for the VM (in x.x.x.x/x formant)"
+      private: false
+
+  pre_tasks:
+    - name: Validate hostname
+      ansible.builtin.fail:
+        msg: |
+          Invalid hostname: "{{ vm_hostname }}"
+          Hostname may only contain letters (a-z, A-Z), numbers (0-9), and hyphens (-).
+      when: not vm_hostname is regex('^[a-zA-Z0-9-]+$')
+      run_once: true
+
   roles:
     - ../roles/deploy_vm_on_proxmox 
+
+  tasks:
+    - name: Make the prompted hostname available to the whole playbook
+      ansible.builtin.set_fact:
+        fact_vm_hostname: "{{ vm_hostname }}"
+    
+    - name: Make the prompted IP available to the whole playbook
+      ansible.builtin.set_fact:
+        fact_vm_ip_address: "{{ vm_ip_address.split('/') | first }}"
+
+    - name: Add the target host to the inventory
+      ansible.builtin.add_host:
+        name: "{{ fact_vm_ip_address }}"
+        groups: new_host
+        ansible_user: ansible
+        ansible_become_password: "{{ ansible_become_passwd }}"
+
+
+- name: Configure VM
+  hosts: new_host
+  remote_user: ansible
+
+  vars_files:
+    ../inventory/group_vars/all/secrets.yaml
+  vars:
+    ansible_user_passwd_hash: "{{ ansible_password | password_hash('sha512', 's3edscrj45e6r') }}"
+    user_passwd_hash: "{{ user_password | password_hash('sha512', 's3ed6123jhgcr') }}"
+
+  roles:
+    - ../roles/configure_ansible_user 
+    - ../roles/harden_ssh 
+    - ../roles/base_system
+    - ../roles/human_admin_user
+    # Update configs - omz, nvim, ranger and so on. Distribute the last version of those configs
+    - ../roles/update_configs
+

playbooks/maintain.yaml

@@ -1,21 +1,22 @@
 ---
 - name: Deploy and set up an LXC container in Proxmox
-  hosts: all
+  hosts: virtual
   remote_user: ansible
   
   vars_files:
     ../inventory/group_vars/all/secrets.yaml
-  vars:
-    ansible_user_passwd_hash: "{{ ansible_password | password_hash('sha512', 's3edscrj45e6r') }}"
-    user_passwd_hash: "{{ user_password | password_hash('sha512', 's3ed6123jhgcr') }}"
   
   roles:
     # Check the Internet connection
     # Check free disk space
     - ../roles/common_healthcheck
+    # Ensure that all the required packages are installed
+    - ../roles/base_system
     # Update the system
     - ../roles/update_system
     # Harden SSH - we must be sure that the last version of ssh configs are distributed
     - ../roles/harden_ssh
     # Update configs - omz, nvim, ranger and so on. Distribute the last version of those configs
     - ../roles/update_configs
+    # Make sure that the services that are supposed to run are running
+    - ../roles/check_services

requirements.txt

@@ -4,29 +4,34 @@ ansible-lint==26.6.0
 attrs==26.1.0
 black==26.5.1
 bracex==3.0
+certifi==2026.7.22
 cffi==2.1.0
+charset-normalizer==3.4.9
 click==8.4.2
 cryptography==49.0.0
 distro==1.9.0
 filelock==3.29.7
+idna==3.18
 Jinja2==3.1.6
 jsonschema==4.26.0
 jsonschema-specifications==2025.9.1
 MarkupSafe==3.0.3
 mypy_extensions==1.1.0
+netaddr==1.3.0
 packaging==26.2
 pathspec==1.1.1
 platformdirs==4.10.0
-proxmoxer>=2.3
+proxmoxer==2.3.0
 pycparser==3.0
 pytokens==0.4.1
 PyYAML==6.0.3
 referencing==0.37.0
-requests>=2.34.2
+requests==2.34.2
 resolvelib==1.2.1
 rpds-py==2026.6.3
 ruamel.yaml==0.19.1
 ruamel.yaml.clib==0.2.15
 subprocess-tee==0.4.2
+urllib3==2.7.0
 wcmatch==11.0
 yamllint==1.38.0

requirements.yaml

@@ -0,0 +1,17 @@
+---
+
+collections:
+  - name: ansible.posix
+    version: 2.2.2
+
+  - name: ansible.utils
+    version: 6.0.3
+
+  - name: community.general
+    version: 13.2.0
+
+  - name: community.library_inventory_filtering_v1
+    version: 1.1.5
+
+  - name: community.proxmox
+    version: 2.0.0

roles/base_system/tasks/install_packages.yaml

@@ -2,21 +2,7 @@
 - name: Installing basic utils for comfort work (apt-based system)
   when: (ansible_facts['os_family'] == "Debian")
   ansible.builtin.apt:
-    name:
+    name: "{{ debian_13_packages }}" 
-      - vim
-      - neovim
-      - gcc
-      - tree-sitter-cli
-      - luarocks
-      - ranger
-      - zsh
-      - rsync
-      - git
-      - curl
-      - kitty
-      - unattended-upgrades
-      - ssh
-      - openssh-server
     update-cache: true # Run apt update before installation
   become: true
   remote_user: ansible
@@ -40,6 +26,6 @@
 - name: Update and install packages on Alpine
   when: (ansible_facts['distribution'] == "Alpine")
   community.general.apk:
-    name: neovim vim ranger zsh rsync git curl kitty openssh
+    name: "{{ alpine_packages }}"
     update_cache: true
   remote_user: ansible

roles/base_system/tasks/main.yaml

@@ -5,3 +5,5 @@
 - name: Remove unnecessary packages
   ansible.builtin.include_tasks: remove_packages.yaml
 
+- name: Set locale and time
+  ansible.builtin.include_tasks: set_locale_and_time.yaml

roles/base_system/vars/main/alpine_packages.yaml

@@ -0,0 +1,13 @@
+---
+
+alpine_packages:
+  - curl
+  - gcc
+  - git
+  - kitty
+  - neovim
+  - openssh-server
+  - ranger
+  - rsync
+  - ssh
+  - zsh

roles/base_system/vars/main/debian_13_packages.yaml

@@ -0,0 +1,13 @@
+---
+
+debian_13_packages:
+  - curl
+  - gcc
+  - git
+  - kitty
+  - neovim
+  - openssh-server
+  - ranger
+  - rsync
+  - ssh
+  - zsh

roles/check_services/tasks/main.yaml

@@ -0,0 +1,7 @@
+---
+
+- name: Make sure required services are running
+  ansible.builtin.service:
+    name: "{{ item }}"
+    state: started
+  loop: "{{ services_to_run }}"

roles/common_healthcheck/tasks/main.yaml

@@ -23,8 +23,8 @@
       become: false
       # We have to use this complicated pipeline because of Alpine and its wierd df implementation
       ansible.builtin.shell: set -o pipefail && df -h / | tail -1 | awk '{gsub(/%/, "", $5); print $5}'
-      register: free_disk_space_result
+      register: common_healthcheck_space_left_result
-      failed_when: free_disk_space_result.stdout | int > 85
+      failed_when: common_healthcheck_space_left_result.stdout | int > 85
       changed_when: false   # This task does not change the system
 
   rescue:
@@ -41,5 +41,9 @@
         body:
           - "{{ ansible_facts['hostname'] }}: Disk space is low"
       delegate_to: 127.0.0.1
-      failed_when: false
+      failed_when: false    # It's OK if it fails, not critical
       changed_when: false   # This task does not change the system
+
+    - name: Resize rootfs if it's an LXC
+      ansible.builtin.include_tasks: resize_lxc_rootfs.yaml
+      when: ansible_virtualization_type == 'lxc'

roles/common_healthcheck/tasks/resize_lxc_rootfs.yaml

@@ -0,0 +1,24 @@
+---
+- name: Get container info by name
+  delegate_to: localhost
+  become: false
+  community.general.proxmox_vm_info:
+    validate_certs: false
+    node: proxmox-server
+    api_user: root@pam
+    api_host: 192.168.0.2
+    api_token_id: ansible
+    api_token_secret: "{{ proxmox_token_secret }}"
+
+    name: "{{ inventory_hostname }}"
+    type: lxc
+  register: common_healthcheck_vmid
+
+- name: Resize LXC's rootfs
+  become: true
+  ansible.builtin.command:
+    cmd: pct resize {{ common_healthcheck_vmid.proxmox_vms[0].vmid }} rootfs +5G
+  delegate_to: 192.168.0.2
+  changed_when: true
+  vars:
+    ansible_become_password: "{{ ansible_become_passwd  }}"

roles/deploy_lxc_on_proxmox/tasks/main.yaml

@@ -6,7 +6,7 @@
     validate_certs: false
     node: proxmox-server
     api_user: root@pam
-    api_host: 192.168.0.2
+    api_host: "{{ proxmox_1_host }}"
     api_token_id: ansible
     api_token_secret: "{{ proxmox_token_secret }}"
 
@@ -14,6 +14,7 @@
     password: "{{ lxc_root_password }}"
     hostname: "{{ lxc_hostname }}"
     ostemplate: 'main:vztmpl/debian-13-golden-image.tar.gz'
+    unprivileged: "{{ lxc_is_privileged }}"
     memory: 2048
     cores: 2
     state: present
@@ -33,12 +34,14 @@
     validate_certs: false
     node: proxmox-server
     api_user: root@pam
-    api_host: 192.168.0.2
+    api_host: "{{ proxmox_1_host }}"
     api_token_id: ansible
     api_token_secret: "{{ proxmox_token_secret }}"
 
     hostname: "{{ lxc_hostname }}"
     state: started
+  retries: 3
+  delay: 15
 
 - name: Sleep for a minute to ensure that ssh is ready
   become: false

roles/deploy_vm_on_proxmox/tasks/create_vm.yaml

@@ -0,0 +1,72 @@
+---
+
+- name: Create a new VM with minimal options only if it doesn't exist
+  become: false
+  community.proxmox.proxmox_kvm:
+    validate_certs: false
+    node: proxmox-server
+    api_user: root@pam
+    api_host: "{{ proxmox_1_host }}"
+    api_token_id: ansible
+    api_token_secret: "{{ proxmox_token_secret }}"
+
+    clone: debian-13-cloud-init-template
+    name: "{{ vm_hostname }}"
+    storage: main
+    format: qcow2
+    full: true
+    timeout: 500
+
+- name: Sleep for 20 seconds to ensure that Proxmox has cloned the VM
+  become: false
+  ansible.builtin.wait_for:
+    timeout: 20
+  delegate_to: localhost
+  changed_when: false
+
+- name: Update the cloned VM with cloud-init configuration
+  community.proxmox.proxmox_kvm:
+    validate_certs: false
+    node: proxmox-server
+    api_user: root@pam
+    api_host: "{{ proxmox_1_host }}"
+    api_token_id: ansible
+    api_token_secret: "{{ proxmox_token_secret }}"
+
+    name: "{{ vm_hostname }}"
+    # Cloud-init parameters
+    update: true
+    ide:
+      ide2: "local:cloudinit,format=qcow2"
+    ciuser: "ansible"
+    cipassword: "{{ ansible_become_passwd }}"
+    ipconfig:
+      ipconfig0: "ip={{ vm_ip_address }},gw=192.168.0.1"
+
+- name: Tweak the hardware settings
+  become: false
+  community.proxmox.proxmox_kvm:
+    validate_certs: false
+    node: proxmox-server
+    api_user: root@pam
+    api_host: "{{ proxmox_1_host }}"
+    api_token_id: ansible
+    api_token_secret: "{{ proxmox_token_secret }}"
+
+    name: "{{ vm_hostname }}"
+    cores: 4
+    memory: 4096 # Minimal value for debian based OS for smooth workflow
+    update: true
+
+- name: Make sure the VM has started
+  become: false
+  community.proxmox.proxmox_kvm:
+    validate_certs: false
+    node: proxmox-server
+    api_user: root@pam
+    api_host: "{{ proxmox_1_host }}"
+    api_token_id: ansible
+    api_token_secret: "{{ proxmox_token_secret }}"
+
+    name: "{{ vm_hostname }}"
+    state: started

roles/deploy_vm_on_proxmox/tasks/main.yaml

@@ -1,53 +1,25 @@
 ---
-- name: Create a new VM with minimal options
+
-  become: false
+- name: Check if VM already exists
   community.proxmox.proxmox_kvm:
     validate_certs: false
     node: proxmox-server
     api_user: root@pam
-    api_host: 192.168.0.2
+    api_host: "{{ proxmox_1_host }}"
-    api_token_id: ansible
-    api_token_secret: "{{ proxmox_token_secret }}"
-
-    clone: debian-13-cloud-init-template
-    name: "{{ vm_hostname }}"
-    storage: main
-    format: qcow2
-    full: true
-    timeout: 500
-
-- name: Sleep for 20 seconds to ensure that Proxmox has cloned the VM
-  become: false
-  ansible.builtin.wait_for:
-    timeout: 20
-  delegate_to: localhost
-  changed_when: false
-
-- name: Tweak the hardware settings
-  become: false
-  community.proxmox.proxmox_kvm:
-    validate_certs: false
-    node: proxmox-server
-    api_user: root@pam
-    api_host: 192.168.0.2
     api_token_id: ansible
     api_token_secret: "{{ proxmox_token_secret }}"
     
     name: "{{ vm_hostname }}"
-    cores: 4
+    state: current
-    memory: 4096 # Minimal value for debian based OS for smooth workflow
+  ignore_errors: true
-    update: true
+  register: vm_status
 
-- name: Make sure the VM has started
-  become: false
-  community.proxmox.proxmox_kvm:
-    validate_certs: false
-    node: proxmox-server
-    api_user: root@pam
-    api_host: 192.168.0.2
-    api_token_id: ansible
-    api_token_secret: "{{ proxmox_token_secret }}"
 
-    name: "{{ vm_hostname }}"
+- name: Create a new VM with minimal options only if it doesn't exist
-    state: started
+  when: vm_status is failed or 'does not exist in cluster' in vm_status.msg
+  ansible.builtin.include_tasks: create_vm.yaml 
+
+- name: Start the VM only if needed
+  when: '"does not exist in cluster" in vm_status.msg or vm_status.status != "running"'
+  ansible.builtin.include_tasks: start_vm.yaml 
 

roles/deploy_vm_on_proxmox/tasks/start_vm.yaml

@@ -0,0 +1,21 @@
+---
+
+- name: Make sure the VM has started
+  become: false
+  community.proxmox.proxmox_kvm:
+    validate_certs: false
+    node: proxmox-server
+    api_user: root@pam
+    api_host: "{{ proxmox_1_host }}"
+    api_token_id: ansible
+    api_token_secret: "{{ proxmox_token_secret }}"
+
+    name: "{{ vm_hostname }}"
+    state: started
+
+- name: Sleep for 120 seconds to ensure that Proxmox has cloned the VM
+  become: false
+  ansible.builtin.wait_for:
+    timeout: 120
+  delegate_to: localhost
+  changed_when: false

roles/harden_ssh/files/.vimrc

@@ -1,16 +0,0 @@
-set number
-set tabstop=2
-" Disable compatibility with vi which can cause unexpected issues.
-set nocompatible
-
-" Enable type file detection. Vim will be able to try to detect the type of file in use.
-filetype on
-
-" Enable plugins and load plugin for the detected file type.
-filetype plugin on
-
-" Load an indent file for the detected file type.
-filetype indent on
-
-" Turn syntax highlighting on.
-syntax on

roles/harden_ssh/files/.zshrc

@@ -1,105 +0,0 @@
-export PATH=$HOME/bin:$HOME/.local/bin:/usr/local/bin:/home/max/soft/gnu_linux:$PATH
-
-# Path to your Oh My Zsh installation.
-export ZSH="$HOME/.oh-my-zsh"
-
-export GTK_THEME=Adwaita-dark
-
-# Set name of the theme to load --- if set to "random", it will
-# load a random theme each time Oh My Zsh is loaded, in which case,
-# to know which specific one was loaded, run: echo $RANDOM_THEME
-# See https://github.com/ohmyzsh/ohmyzsh/wiki/Themes
-ZSH_THEME="gnzh"
-
-# Set list of themes to pick from when loading at random
-# Setting this variable when ZSH_THEME=random will cause zsh to load
-# a theme from this variable instead of looking in $ZSH/themes/
-# If set to an empty array, this variable will have no effect.
-# ZSH_THEME_RANDOM_CANDIDATES=( "robbyrussell" "agnoster" )
-
-# Uncomment the following line to use case-sensitive completion.
-# CASE_SENSITIVE="true"
-
-# Uncomment the following line to use hyphen-insensitive completion.
-# Case-sensitive completion must be off. _ and - will be interchangeable.
-# HYPHEN_INSENSITIVE="true"
-
-# Uncomment one of the following lines to change the auto-update behavior
-# zstyle ':omz:update' mode disabled  # disable automatic updates
-# zstyle ':omz:update' mode auto      # update automatically without asking
-# zstyle ':omz:update' mode reminder  # just remind me to update when it's time
-
-# Uncomment the following line to change how often to auto-update (in days).
-# zstyle ':omz:update' frequency 13
-
-# Uncomment the following line if pasting URLs and other text is messed up.
-# DISABLE_MAGIC_FUNCTIONS="true"
-
-# Uncomment the following line to disable colors in ls.
-# DISABLE_LS_COLORS="true"
-
-# Uncomment the following line to disable auto-setting terminal title.
-# DISABLE_AUTO_TITLE="true"
-
-# Uncomment the following line to enable command auto-correction.
-# ENABLE_CORRECTION="true"
-
-# Uncomment the following line to display red dots whilst waiting for completion.
-# You can also set it to another string to have that shown instead of the default red dots.
-# e.g. COMPLETION_WAITING_DOTS="%F{yellow}waiting...%f"
-# Caution: this setting can cause issues with multiline prompts in zsh < 5.7.1 (see #5765)
-# COMPLETION_WAITING_DOTS="true"
-
-# Uncomment the following line if you want to disable marking untracked files
-# under VCS as dirty. This makes repository status check for large repositories
-# much, much faster.
-# DISABLE_UNTRACKED_FILES_DIRTY="true"
-
-# Uncomment the following line if you want to change the command execution time
-# stamp shown in the history command output.
-# You can set one of the optional three formats:
-# "mm/dd/yyyy"|"dd.mm.yyyy"|"yyyy-mm-dd"
-# or set a custom format using the strftime function format specifications,
-# see 'man strftime' for details.
-# HIST_STAMPS="mm/dd/yyyy"
-
-# Would you like to use another custom folder than $ZSH/custom?
-# ZSH_CUSTOM=/path/to/new-custom-folder
-
-# Which plugins would you like to load?
-# Standard plugins can be found in $ZSH/plugins/
-# Custom plugins may be added to $ZSH_CUSTOM/plugins/
-# Example format: plugins=(rails git textmate ruby lighthouse)
-# Add wisely, as too many plugins slow down shell startup.
-#plugins=(git)
-
-source $ZSH/oh-my-zsh.sh
-
-# User configuration
-
-# export MANPATH="/usr/local/man:$MANPATH"
-
-# You may need to manually set your language environment
-# export LANG=en_US.UTF-8
-
-# Preferred editor for local and remote sessions
-# if [[ -n $SSH_CONNECTION ]]; then
-#   export EDITOR='vim'
-# else
-#   export EDITOR='nvim'
-# fi
-
-# Compilation flags
-# export ARCHFLAGS="-arch $(uname -m)"
-
-# Set personal aliases, overriding those provided by Oh My Zsh libs,
-# plugins, and themes. Aliases can be placed here, though Oh My Zsh
-# users are encouraged to define aliases within a top-level file in
-# the $ZSH_CUSTOM folder, with .zsh extension. Examples:
-# - $ZSH_CUSTOM/aliases.zsh
-# - $ZSH_CUSTOM/macos.zsh
-# For a full list of active aliases, run `alias`.
-#
-# Example aliases
-# alias zshconfig="mate ~/.zshrc"
-# alias ohmyzsh="mate ~/.oh-my-zsh"

roles/harden_ssh/handlers/main.yaml

@@ -0,0 +1,13 @@
+---
+
+- name: Restart ssh-server Debian
+  ansible.builtin.service:
+    name: sshd
+    state: restarted
+  changed_when: false # It's just a handler, no need to increase 'changed' counter
+
+- name: Restart ssh-server Ubuntu
+  ansible.builtin.service:
+    name: ssh
+    state: restarted
+  changed_when: false

roles/harden_ssh/tasks/main.yaml

@@ -6,6 +6,7 @@
     dest: /etc/ssh/sshd_config.d/hardened_sshd.conf
     mode: u=rw,g=r,o=r
   when: ansible_facts['distribution'] == 'Ubuntu'
+  notify: Restart ssh-server Ubuntu
 
 - name: Configure ssh-server daemon
   ansible.builtin.copy:
@@ -13,6 +14,7 @@
     dest: /etc/ssh/sshd_config.d/hardened_sshd.conf
     mode: u=rw,g=r,o=r
   when: ansible_facts['distribution'] == 'Debian'
+  notify: Restart ssh-server Debian
 
 - name: Configure ssh client
   remote_user: ansible
@@ -21,16 +23,16 @@
     dest: /etc/ssh/ssh_config.d/hardened_ssh.conf
     mode: u=rw,g=r,o=r
 
-- name: Restart ssh-server Debian
+    #- name: Restart ssh-server Debian
-  remote_user: ansible
+    #  remote_user: ansible
-  ansible.builtin.service:
+    #  ansible.builtin.service:
-    name: sshd
+    #    name: sshd
-    state: restarted
+    #    state: restarted
-  when: ansible_facts['distribution'] == 'Debian'
+    #  when: ansible_facts['distribution'] == 'Debian'
-
+    #
-- name: Restart ssh-server Ubuntu
+    #- name: Restart ssh-server Ubuntu
-  remote_user: ansible
+    #  remote_user: ansible
-  ansible.builtin.service:
+    #  ansible.builtin.service:
-    name: ssh
+    #    name: ssh
-    state: restarted
+    #    state: restarted
-  when: ansible_facts['distribution'] == 'Ubuntu'
+    #  when: ansible_facts['distribution'] == 'Ubuntu'

roles/human_admin_user/files/.zshrc

@@ -1,105 +1,13 @@
 export PATH=$HOME/bin:$HOME/.local/bin:/usr/local/bin:/home/max/soft/gnu_linux:$PATH
-
 # Path to your Oh My Zsh installation.
 export ZSH="$HOME/.oh-my-zsh"
-
+# GTK theme
 export GTK_THEME=Adwaita-dark
-
+# ZSH theme
-# Set name of the theme to load --- if set to "random", it will
-# load a random theme each time Oh My Zsh is loaded, in which case,
-# to know which specific one was loaded, run: echo $RANDOM_THEME
-# See https://github.com/ohmyzsh/ohmyzsh/wiki/Themes
 ZSH_THEME="gnzh"
+# OMZ updates
+zstyle ':omz:update' mode auto      # update automatically without asking
+zstyle ':omz:update' frequency 7
 
-# Set list of themes to pick from when loading at random
-# Setting this variable when ZSH_THEME=random will cause zsh to load
-# a theme from this variable instead of looking in $ZSH/themes/
-# If set to an empty array, this variable will have no effect.
-# ZSH_THEME_RANDOM_CANDIDATES=( "robbyrussell" "agnoster" )
-
-# Uncomment the following line to use case-sensitive completion.
-# CASE_SENSITIVE="true"
-
-# Uncomment the following line to use hyphen-insensitive completion.
-# Case-sensitive completion must be off. _ and - will be interchangeable.
-# HYPHEN_INSENSITIVE="true"
-
-# Uncomment one of the following lines to change the auto-update behavior
-# zstyle ':omz:update' mode disabled  # disable automatic updates
-# zstyle ':omz:update' mode auto      # update automatically without asking
-# zstyle ':omz:update' mode reminder  # just remind me to update when it's time
-
-# Uncomment the following line to change how often to auto-update (in days).
-# zstyle ':omz:update' frequency 13
-
-# Uncomment the following line if pasting URLs and other text is messed up.
-# DISABLE_MAGIC_FUNCTIONS="true"
-
-# Uncomment the following line to disable colors in ls.
-# DISABLE_LS_COLORS="true"
-
-# Uncomment the following line to disable auto-setting terminal title.
-# DISABLE_AUTO_TITLE="true"
-
-# Uncomment the following line to enable command auto-correction.
-# ENABLE_CORRECTION="true"
-
-# Uncomment the following line to display red dots whilst waiting for completion.
-# You can also set it to another string to have that shown instead of the default red dots.
-# e.g. COMPLETION_WAITING_DOTS="%F{yellow}waiting...%f"
-# Caution: this setting can cause issues with multiline prompts in zsh < 5.7.1 (see #5765)
-# COMPLETION_WAITING_DOTS="true"
-
-# Uncomment the following line if you want to disable marking untracked files
-# under VCS as dirty. This makes repository status check for large repositories
-# much, much faster.
-# DISABLE_UNTRACKED_FILES_DIRTY="true"
-
-# Uncomment the following line if you want to change the command execution time
-# stamp shown in the history command output.
-# You can set one of the optional three formats:
-# "mm/dd/yyyy"|"dd.mm.yyyy"|"yyyy-mm-dd"
-# or set a custom format using the strftime function format specifications,
-# see 'man strftime' for details.
-# HIST_STAMPS="mm/dd/yyyy"
-
-# Would you like to use another custom folder than $ZSH/custom?
-# ZSH_CUSTOM=/path/to/new-custom-folder
-
-# Which plugins would you like to load?
-# Standard plugins can be found in $ZSH/plugins/
-# Custom plugins may be added to $ZSH_CUSTOM/plugins/
-# Example format: plugins=(rails git textmate ruby lighthouse)
-# Add wisely, as too many plugins slow down shell startup.
-#plugins=(git)
 
 source $ZSH/oh-my-zsh.sh
-
-# User configuration
-
-# export MANPATH="/usr/local/man:$MANPATH"
-
-# You may need to manually set your language environment
-# export LANG=en_US.UTF-8
-
-# Preferred editor for local and remote sessions
-# if [[ -n $SSH_CONNECTION ]]; then
-#   export EDITOR='vim'
-# else
-#   export EDITOR='nvim'
-# fi
-
-# Compilation flags
-# export ARCHFLAGS="-arch $(uname -m)"
-
-# Set personal aliases, overriding those provided by Oh My Zsh libs,
-# plugins, and themes. Aliases can be placed here, though Oh My Zsh
-# users are encouraged to define aliases within a top-level file in
-# the $ZSH_CUSTOM folder, with .zsh extension. Examples:
-# - $ZSH_CUSTOM/aliases.zsh
-# - $ZSH_CUSTOM/macos.zsh
-# For a full list of active aliases, run `alias`.
-#
-# Example aliases
-# alias zshconfig="mate ~/.zshrc"
-# alias ohmyzsh="mate ~/.oh-my-zsh"

roles/human_admin_user/tasks/main.yaml

@@ -2,7 +2,7 @@
 - name: Create a new user with a password, set shell
   remote_user: ansible
   ansible.builtin.user:
-    name: max
+    name: "{{ human_admin_user }}"
     groups: sshusers,sudo
     password: "{{ user_passwd_hash }}"
     shell: /bin/zsh
@@ -10,7 +10,7 @@
 - name: Set authorized key taken from file
   remote_user: ansible
   ansible.posix.authorized_key:
-    user: max
+    user: "{{ human_admin_user }}"
     state: present
     key: "{{ lookup('file', lookup('env', 'HOME') + '/.ssh/ansible_key.pub') }}"
 
@@ -18,36 +18,34 @@
   remote_user: ansible
   ansible.builtin.copy:
     src: "{{ role_path }}/files/install_omz.sh"
-    dest: /home/max/install_omz.sh
+    dest: "/home/{{ human_admin_user }}/install_omz.sh"
-    owner: max
+    owner: "{{ human_admin_user }}"
-    group: max
+    group: "{{ human_admin_user }}"
     mode: u=rwx,g=r,o-rwx
 
 # WARNING: UNPRIVILEGED USER (not ansible) COMMANDS
-# Since the golden image contains installed zsh, this step may not be necessary
 - name: Install oh my zsh
-  remote_user: max
+  remote_user: "{{ human_admin_user }}"
-  become: false
+  ansible.builtin.command: "/home/{{ human_admin_user }}/install_omz.sh"
-  ansible.builtin.command: /home/max/install_omz.sh
   changed_when: true
-  failed_when: false
+  vars:
 
 - name: Configure oh my zsh, by pushing the config file
   remote_user: ansible
   ansible.builtin.copy:
     src: "{{ role_path }}/files/.zshrc"
-    dest: /home/max/.zshrc
+    dest: "/home/{{ human_admin_user }}/.zshrc"
-    owner: max
+    owner: "{{ human_admin_user }}"
-    group: max
+    group: "{{ human_admin_user }}"
     mode: u=rw,g=r,o-rwx
 
 - name: Configure vim, by pushing the config
   remote_user: ansible
   ansible.builtin.copy:
     src: "{{ role_path }}/files/.vimrc"
-    dest: /home/max/.vimrc
+    dest: "/home/{{ human_admin_user }}/.vimrc"
-    owner: max
+    owner: "{{ human_admin_user }}"
-    group: max
+    group: "{{ human_admin_user }}"
     mode: u=rw,g=r,o-rwx
 
 
@@ -56,13 +54,13 @@
 - name: Set authorized key taken from file
   remote_user: ansible
   ansible.posix.authorized_key:
-    user: max
+    user: "{{ human_admin_user }}"
     state: absent
     key: "{{ lookup('file', lookup('env', 'HOME') + '/.ssh/ansible_key.pub') }}"
 
 - name: Set authorized key taken from file
   remote_user: ansible
   ansible.posix.authorized_key:
-    user: max
+    user: "{{ human_admin_user }}"
     state: present
     key: "{{ lookup('file', lookup('env', 'HOME') + '/.ssh/max_regular_key.pub') }}"

roles/update_configs/files/.zshrc

@@ -1,105 +1,13 @@
 export PATH=$HOME/bin:$HOME/.local/bin:/usr/local/bin:/home/max/soft/gnu_linux:$PATH
-
 # Path to your Oh My Zsh installation.
 export ZSH="$HOME/.oh-my-zsh"
-
+# GTK theme
 export GTK_THEME=Adwaita-dark
-
+# ZSH theme
-# Set name of the theme to load --- if set to "random", it will
-# load a random theme each time Oh My Zsh is loaded, in which case,
-# to know which specific one was loaded, run: echo $RANDOM_THEME
-# See https://github.com/ohmyzsh/ohmyzsh/wiki/Themes
 ZSH_THEME="gnzh"
+# OMZ updates
+zstyle ':omz:update' mode auto      # update automatically without asking
+zstyle ':omz:update' frequency 7
 
-# Set list of themes to pick from when loading at random
-# Setting this variable when ZSH_THEME=random will cause zsh to load
-# a theme from this variable instead of looking in $ZSH/themes/
-# If set to an empty array, this variable will have no effect.
-# ZSH_THEME_RANDOM_CANDIDATES=( "robbyrussell" "agnoster" )
-
-# Uncomment the following line to use case-sensitive completion.
-# CASE_SENSITIVE="true"
-
-# Uncomment the following line to use hyphen-insensitive completion.
-# Case-sensitive completion must be off. _ and - will be interchangeable.
-# HYPHEN_INSENSITIVE="true"
-
-# Uncomment one of the following lines to change the auto-update behavior
-# zstyle ':omz:update' mode disabled  # disable automatic updates
-# zstyle ':omz:update' mode auto      # update automatically without asking
-# zstyle ':omz:update' mode reminder  # just remind me to update when it's time
-
-# Uncomment the following line to change how often to auto-update (in days).
-# zstyle ':omz:update' frequency 13
-
-# Uncomment the following line if pasting URLs and other text is messed up.
-# DISABLE_MAGIC_FUNCTIONS="true"
-
-# Uncomment the following line to disable colors in ls.
-# DISABLE_LS_COLORS="true"
-
-# Uncomment the following line to disable auto-setting terminal title.
-# DISABLE_AUTO_TITLE="true"
-
-# Uncomment the following line to enable command auto-correction.
-# ENABLE_CORRECTION="true"
-
-# Uncomment the following line to display red dots whilst waiting for completion.
-# You can also set it to another string to have that shown instead of the default red dots.
-# e.g. COMPLETION_WAITING_DOTS="%F{yellow}waiting...%f"
-# Caution: this setting can cause issues with multiline prompts in zsh < 5.7.1 (see #5765)
-# COMPLETION_WAITING_DOTS="true"
-
-# Uncomment the following line if you want to disable marking untracked files
-# under VCS as dirty. This makes repository status check for large repositories
-# much, much faster.
-# DISABLE_UNTRACKED_FILES_DIRTY="true"
-
-# Uncomment the following line if you want to change the command execution time
-# stamp shown in the history command output.
-# You can set one of the optional three formats:
-# "mm/dd/yyyy"|"dd.mm.yyyy"|"yyyy-mm-dd"
-# or set a custom format using the strftime function format specifications,
-# see 'man strftime' for details.
-# HIST_STAMPS="mm/dd/yyyy"
-
-# Would you like to use another custom folder than $ZSH/custom?
-# ZSH_CUSTOM=/path/to/new-custom-folder
-
-# Which plugins would you like to load?
-# Standard plugins can be found in $ZSH/plugins/
-# Custom plugins may be added to $ZSH_CUSTOM/plugins/
-# Example format: plugins=(rails git textmate ruby lighthouse)
-# Add wisely, as too many plugins slow down shell startup.
-#plugins=(git)
 
 source $ZSH/oh-my-zsh.sh
-
-# User configuration
-
-# export MANPATH="/usr/local/man:$MANPATH"
-
-# You may need to manually set your language environment
-# export LANG=en_US.UTF-8
-
-# Preferred editor for local and remote sessions
-# if [[ -n $SSH_CONNECTION ]]; then
-#   export EDITOR='vim'
-# else
-#   export EDITOR='nvim'
-# fi
-
-# Compilation flags
-# export ARCHFLAGS="-arch $(uname -m)"
-
-# Set personal aliases, overriding those provided by Oh My Zsh libs,
-# plugins, and themes. Aliases can be placed here, though Oh My Zsh
-# users are encouraged to define aliases within a top-level file in
-# the $ZSH_CUSTOM folder, with .zsh extension. Examples:
-# - $ZSH_CUSTOM/aliases.zsh
-# - $ZSH_CUSTOM/macos.zsh
-# For a full list of active aliases, run `alias`.
-#
-# Example aliases
-# alias zshconfig="mate ~/.zshrc"
-# alias ohmyzsh="mate ~/.oh-my-zsh"

roles/update_configs/files/nvim_config/lazy-lock.json

@@ -1,24 +0,0 @@
-{
-  "auto-save.nvim": { "branch": "main", "commit": "9aabcb8396224dcbf8d51c0c1d620d88a46e89d7" },
-  "bamboo.nvim": { "branch": "master", "commit": "1309bc88bffcf1bedc3e84e7fa9004de93da774a" },
-  "cmp-buffer": { "branch": "main", "commit": "b74fab3656eea9de20a9b8116afa3cfc4ec09657" },
-  "cmp-nvim-lsp": { "branch": "main", "commit": "cbc7b02bb99fae35cb42f514762b89b5126651ef" },
-  "dial.nvim": { "branch": "master", "commit": "f2634758455cfa52a8acea6f142dcd6271a1bf57" },
-  "dressing.nvim": { "branch": "master", "commit": "2d7c2db2507fa3c4956142ee607431ddb2828639" },
-  "hererocks": { "branch": "master", "commit": "204ab1ff8b68cb7db7c9bafb4be2abf7d22f864e" },
-  "lazy.nvim": { "branch": "main", "commit": "306a05526ada86a7b30af95c5cc81ffba93fef97" },
-  "lua-utils.nvim": { "branch": "main", "commit": "e565749421f4bbb5d2e85e37c3cef9d56553d8bd" },
-  "neorg": { "branch": "main", "commit": "d4dd8979c1129b5251d5565164f54d1cc258e92a" },
-  "nui.nvim": { "branch": "main", "commit": "de740991c12411b663994b2860f1a4fd0937c130" },
-  "nvim-cmp": { "branch": "main", "commit": "2ffe79f1f021def8dd1fcd81deb16f1bb0d989f3" },
-  "nvim-nio": { "branch": "master", "commit": "edcc181a875301dd21840189aa2f2f9ad69fc172" },
-  "nvim-treesitter": { "branch": "main", "commit": "c9f9ed6c1892f629ea399f4ee7905f2686fa13f2" },
-  "nvim-ts-autotag": { "branch": "main", "commit": "88c1453db4ba7dd24131086fe51fdf74e587d275" },
-  "nvim-web-devicons": { "branch": "master", "commit": "2ae6958df7ced50baac5035cec0c15799eedfbf7" },
-  "pathlib.nvim": { "branch": "main", "commit": "57e5598af6fe253761c1b48e0b59b7cd6699e2c1" },
-  "tree-sitter-norg": { "branch": "main", "commit": "d7edfaf89198aab652c7a1f0f818196efedaccfb" },
-  "tree-sitter-norg-meta": { "branch": "main", "commit": "729d4e54fb881ba0ddf0f925ec78401354c7c6db" },
-  "treesj": { "branch": "main", "commit": "79aedb401bbdc7e4202f7881eab5f6feb2105b0a" },
-  "vim-startuptime": { "branch": "master", "commit": "5f33e50f1e2e2a80370c9094e4c303ea54cd2aea" },
-  "which-key.nvim": { "branch": "main", "commit": "3aab2147e74890957785941f0c1ad87d0a44c15a" }
-}

roles/update_configs/files/nvim_config/lua/options.lua

@@ -1,4 +1,23 @@
-vim.opt.clipboard = 'unnamedplus'   -- use system clipboard 
+-- Use OSC52 only when we are in an SSH session
+-- Without this part clipboard via SSH doesn't work properly
+-- But if don't use SSH (X11 or Wayland session) then this part would only mess things up
+if vim.env.SSH_CLIENT or vim.env.SSH_TTY then
+  vim.g.clipboard = {
+    name = "OSC52",
+    copy = {
+      ["+"] = require("vim.ui.clipboard.osc52").copy("+"),
+      ["*"] = require("vim.ui.clipboard.osc52").copy("*"),
+    },
+    paste = {
+      ["+"] = require("vim.ui.clipboard.osc52").paste("+"),
+      ["*"] = require("vim.ui.clipboard.osc52").paste("*"),
+    },
+  }
+end
+
+vim.opt.clipboard = "unnamedplus"
+
+
 vim.opt.completeopt = {'menu', 'menuone', 'noselect'}
 
 -- Tab

roles/update_configs/files/nvim_config/lua/plugins/colorscheme.lua

@@ -16,18 +16,6 @@ return {
   -- With lazy the plugin will be automatically loaded when it is required somewhere
   { "folke/which-key.nvim", lazy = true },
 
-  {
-    "nvim-neorg/neorg",
-    -- lazy-load on filetype
-    ft = "norg",
-    -- options for neorg. This will automatically call `require("neorg").setup(opts)`
-    opts = {
-      load = {
-        ["core.defaults"] = {},
-      },
-    },
-  },
-
   {
     "dstein64/vim-startuptime",
     -- lazy-load on a command

roles/update_configs/files/nvim_config/lua/plugins/treesitter.lua

@@ -1,62 +0,0 @@
---- ~/nvim/lua/slydragonn/plugins/treesiter.lua
-
-return {
-    "nvim-treesitter/nvim-treesitter",
-    event = { "BufReadPre", "BufNewFile" },
-    build = ":TSUpdate",
-    dependencies = {
-        "windwp/nvim-ts-autotag",
-    },
-    config = function()
-        local treesitter = require("nvim-treesitter.config")
-
-        treesitter.setup({
-            highlight = {
-                enable = true,
-                additional_vim_regex_highlighting = false,
-            },
-            indent = { enable = true },
-            autotag = {
-                enable = true,
-            },
-            ensure_installed = {
-                "json",
-                "javascript",
-                "typescript",
-                "tsx",
-                "yaml",
-                "html",
-                "css",
-                "markdown",
-                "markdown_inline",
-                "bash",
-                "lua",
-                "vim",
-                "dockerfile",
-                "gitignore",
-                "c",
-                "rust",
-            },
-            incremental_selection = {
-                enable = true,
-                keymaps = {
-                    init_selection = "<C-space>",
-                    node_incremental = "<C-space>",
-                    scope_incremental = false,
-                    node_decremental = "<bs>",
-                },
-            },
-            rainbow = {
-                enable = true,
-                disable = { "html" },
-                extended_mode = false,
-                max_file_lines = nil,
-            },
-            context_commentstring = {
-                enable = true,
-                enable_autocmd = false,
-            },
-        })
-    end,
-}
-

roles/update_configs/files/ranger_config/rifle.conf

@@ -87,8 +87,8 @@ ext x?html?, has w3m,               terminal = w3m "$@"
 # Define the "editor" for text files as first action
 mime ^text,  label editor = ${VISUAL:-$EDITOR} -- "$@"
 mime ^text,  label pager  = "$PAGER" -- "$@"
-!mime ^text, label editor, ext xml|json|csv|tex|py|pl|rb|js|sh|php = ${VISUAL:-$EDITOR} -- "$@"
+!mime ^text, label editor, ext yml|yaml|xml|json|csv|tex|py|pl|rb|js|sh|php = ${VISUAL:-$EDITOR} -- "$@"
-!mime ^text, label pager,  ext xml|json|csv|tex|py|pl|rb|js|sh|php = "$PAGER" -- "$@"
+!mime ^text, label pager,  ext yml|yaml|xml|json|csv|tex|py|pl|rb|js|sh|php = "$PAGER" -- "$@"
 
 ext 1                         = man "$1"
 ext s[wmf]c, has zsnes, X     = zsnes "$1"

roles/update_configs/tasks/main.yaml

@@ -1,32 +1,13 @@
 ---
 - name: Configure oh my zsh, by pushing the config file
-  ansible.builtin.copy:
+  ansible.builtin.include_tasks: omz.yaml
-    src: "{{ role_path }}/files/.zshrc"
-    dest: /home/max/.zshrc
-    owner: max
-    group: max
-    mode: u=rw,g=r,o-rwx
 
 - name: Configure vim, by pushing the config
-  ansible.builtin.copy:
+  ansible.builtin.include_tasks: vim.yaml
-    src: "{{ role_path }}/files/.vimrc"
-    dest: /home/max/.vimrc
-    owner: max
-    group: max
-    mode: u=rw,g=r,o-rwx
 
 - name: Configure ranger, by pushing the config
-  ansible.builtin.copy:
+  ansible.builtin.include_tasks: ranger.yaml
-    src: "{{ role_path }}/files/ranger_config/"
+
-    dest: /home/max/.config/ranger
+- name: Configure Neovim, by pushing the config
-    owner: max
+  ansible.builtin.include_tasks: nvim.yaml
-    group: max
-    mode: u=rw,g=r,o-rwx
 
-- name: Configure neovim, by pushing the config
-  ansible.builtin.copy:
-    src: "{{ role_path }}/files/nvim_config/"
-    dest: /home/max/.config/nvim
-    owner: max
-    group: max
-    mode: u=rw,g=r,o-rwx

roles/update_configs/tasks/nvim.yaml

@@ -0,0 +1,14 @@
+---
+
+- name: Clear old Neovim config
+  ansible.builtin.file:
+    state: absent
+    path: "/home/{{ human_admin_user }}/.config/nvim"
+
+- name: Configure neovim, by pushing the config
+  ansible.builtin.copy:
+    src: "{{ role_path }}/files/nvim_config/"
+    dest: "/home/{{ human_admin_user }}/.config/nvim"
+    owner: "{{ human_admin_user }}"
+    group: "{{ human_admin_user }}"
+    mode: u=rw,g=r,o-rwx

roles/update_configs/tasks/omz.yaml

@@ -0,0 +1,8 @@
+---
+- name: Configure oh my zsh, by pushing the config file
+  ansible.builtin.copy:
+    src: "{{ role_path }}/files/.zshrc"
+    dest: "/home/{{ human_admin_user }}/.zshrc"
+    owner: "{{ human_admin_user }}"
+    group: "{{ human_admin_user }}"
+    mode: u=rw,g=r,o-rwx

roles/update_configs/tasks/ranger.yaml

@@ -0,0 +1,22 @@
+---
+
+- name: Clear old config
+  ansible.builtin.file:
+    state: absent
+    path: "/home/{{ human_admin_user }}/.config/ranger"
+
+- name: Configure ranger, by pushing the config
+  ansible.builtin.copy:
+    src: "{{ role_path }}/files/ranger_config/"
+    dest: "/home/{{ human_admin_user }}/.config/ranger"
+    owner: "{{ human_admin_user }}"
+    group: "{{ human_admin_user }}"
+    mode: u=rw,g=r,o-rwx
+
+- name: Make sure ~/.config/ranger/scope.sh is executable
+  ansible.builtin.file:
+    path: "/home/{{ human_admin_user }}/.config/ranger/scope.sh"
+    owner: "{{ human_admin_user }}"
+    group: "{{ human_admin_user }}"
+    mode: u=rwx,g=rx,o-rwx
+

roles/update_configs/tasks/vim.yaml

@@ -0,0 +1,10 @@
+---
+
+- name: Configure vim, by pushing the config
+  ansible.builtin.copy:
+    src: "{{ role_path }}/files/.vimrc"
+    dest: "/home/{{ human_admin_user }}/.vimrc"
+    owner: "{{ human_admin_user }}"
+    group: "{{ human_admin_user }}"
+    mode: u=rw,g=r,o-rwx
+

scripts/run_maintain_playbook.sh

@@ -0,0 +1,11 @@
+#!/bin/bash
+
+# 1 - Pull the latest code
+git pull origin main
+
+# 2 - Update dependencies and modules
+./scripts/update_modules.sh
+
+# 3 - Run the job
+source .venv/bin/activate
+ansible-playbook playbooks/maintain.yaml --vault-pass-file ~/vault_password -i inventory/hosts.yaml --private-key ~/.ssh/ansible_key

scripts/update_modules.sh

@@ -0,0 +1,12 @@
+#!/bin/bash
+
+source .venv/bin/activate
+
+# Install python packages
+pip install -r requirements.txt
+
+# Install collections from the file
+ansible-galaxy collection install -r requirements.yaml -p ./collections/
+
+# Install roles
+ansible-galaxy role install -r requirements.yaml -p ./roles/

systemd/ansible-maintenance.service

@@ -6,10 +6,10 @@ Wants=network-online.target
 [Service]
 Type=oneshot
 # CAHNGE TO MATCH YOUR REQUIREMENTS
-User=max
+User=ansible
-Group=max
+Group=ansible
-WorkingDirectory=/home/max/projects/ansible_home
+WorkingDirectory=/home/ansible/ansible-production
-ExecStart=/home/max/projects/ansible_home/run_playbook.sh /home/max/projects/ansible_home/playbooks/maintain.yaml 
+ExecStart=/home/ansible/ansible-production/run_maintain_playbook.sh 
 StandardOutput=journal
 StandardError=journal
 # Optional: prevent runaway if the playbook hangs

systemd/ansible-maintenance.timer

@@ -1,9 +1,9 @@
 [Unit]
-Description=Timer for Ansible maintenance playbook, runs every 10 minutes
+Description=Timer for Ansible maintenance playbook, runs every day
 Requires=ansible-maintenance.service
 
 [Timer]
-OnUnitActiveSec=10min
+OnUnitActiveSec=1d
 Persistent=true
 Unit=ansible-maintenance.service