diff --git a/.gitea/workflows/deploy_new_config.yaml b/.gitea/workflows/deploy_new_config.yaml index 75f9e4e..a338fe7 100644 --- a/.gitea/workflows/deploy_new_config.yaml +++ b/.gitea/workflows/deploy_new_config.yaml @@ -16,6 +16,12 @@ jobs: if: github.event.pull_request.merged == true runs-on: ubuntu-latest steps: - - name: Trigger the webhook to start pulling new Ansible configs - # LAN IP is used because those hosts are in the same network + - name: Trigger the webhook to start pulling the latest version from the repo + # LAN IP is used because those hosts are in the same network + run: curl "http://192.168.0.38:9000/hooks/pull-latest" + + - name: Trigger the webhook to update python and ansible modules + run: curl "http://192.168.0.38:9000/hooks/run-update-script" + + - name: Trigger the webhook to run the playbook run: curl "http://192.168.0.38:9000/hooks/run-maintain-playbook" diff --git a/inventory/hosts.yaml b/inventory/hosts.yaml index b38a87b..6c4f7f7 100644 --- a/inventory/hosts.yaml +++ b/inventory/hosts.yaml @@ -5,9 +5,13 @@ physical: ansible_become_password: "{{ ansible_become_passwd }}" ansible_connection: local ansible_python_interpreter: "{{ ansible_playbook_python }}" - 192.168.0.98: - ansible_become_password: "{{ ansible_become_passwd }}" 192.168.0.6: ansible_become_password: "{{ ansible_become_passwd }}" 192.168.0.8: ansible_become_password: "{{ ansible_become_passwd }}" + 192.168.0.12: + ansible_become_password: "{{ ansible_become_passwd }}" + 192.168.0.16: + ansible_become_password: "{{ ansible_become_passwd }}" + 192.168.0.39: + ansible_become_password: "{{ ansible_become_passwd }}" diff --git a/playbooks/maintain.yaml b/playbooks/maintain.yaml index 45a9e45..d15c438 100644 --- a/playbooks/maintain.yaml +++ b/playbooks/maintain.yaml @@ -5,9 +5,6 @@ vars_files: ../inventory/group_vars/all/secrets.yaml - vars: - ansible_user_passwd_hash: "{{ ansible_password | password_hash('sha512', 's3edscrj45e6r') }}" - user_passwd_hash: "{{ user_password | password_hash('sha512', 's3ed6123jhgcr') }}" roles: # Check the Internet connection diff --git a/requirements.txt b/requirements.txt index bb5d472..9c2d48e 100644 --- a/requirements.txt +++ b/requirements.txt @@ -4,29 +4,34 @@ ansible-lint==26.6.0 attrs==26.1.0 black==26.5.1 bracex==3.0 +certifi==2026.7.22 cffi==2.1.0 +charset-normalizer==3.4.9 click==8.4.2 cryptography==49.0.0 distro==1.9.0 filelock==3.29.7 +idna==3.18 Jinja2==3.1.6 jsonschema==4.26.0 jsonschema-specifications==2025.9.1 MarkupSafe==3.0.3 mypy_extensions==1.1.0 +netaddr==1.3.0 packaging==26.2 pathspec==1.1.1 platformdirs==4.10.0 -proxmoxer>=2.3 +proxmoxer==2.3.0 pycparser==3.0 pytokens==0.4.1 PyYAML==6.0.3 referencing==0.37.0 -requests>=2.34.2 +requests==2.34.2 resolvelib==1.2.1 rpds-py==2026.6.3 ruamel.yaml==0.19.1 ruamel.yaml.clib==0.2.15 subprocess-tee==0.4.2 +urllib3==2.7.0 wcmatch==11.0 yamllint==1.38.0 diff --git a/requirements.yaml b/requirements.yaml new file mode 100644 index 0000000..bec0b55 --- /dev/null +++ b/requirements.yaml @@ -0,0 +1,17 @@ +--- + +collections: + - name: ansible.posix + version: 2.2.2 + + - name: ansible.utils + version: 6.0.3 + + - name: community.general + version: 13.2.0 + + - name: community.library_inventory_filtering_v1 + version: 1.1.5 + + - name: community.proxmox + version: 2.0.0 diff --git a/run_maintain_playbook.sh b/scripts/run_maintain_playbook.sh similarity index 65% rename from run_maintain_playbook.sh rename to scripts/run_maintain_playbook.sh index f2b8a80..c677ec7 100755 --- a/run_maintain_playbook.sh +++ b/scripts/run_maintain_playbook.sh @@ -1,3 +1,11 @@ #!/bin/bash + +LOCK_FILE=/tmp/vmn_ansible_lock_file.lock + +while [ -f "$LOCK_FILE" ] +do + sleep 1s +done + source .venv/bin/activate ansible-playbook playbooks/maintain.yaml --vault-pass-file ~/vault_password -i inventory/hosts.yaml --private-key ~/.ssh/ansible_key diff --git a/scripts/update_modules.sh b/scripts/update_modules.sh new file mode 100755 index 0000000..2e88220 --- /dev/null +++ b/scripts/update_modules.sh @@ -0,0 +1,18 @@ +#!/bin/bash + +# Create a lock file to prevent other scripts from running with old modules +touch /tmp/vmn_ansible_lock_file.lock + +source .venv/bin/activate + +# Install python packages +pip install -r requirements.txt + +# Install collections from the file +ansible-galaxy collection install -r requirements.yml -p ./collections/ + +# Install roles +ansible-galaxy role install -r requirements.yml -p ./roles/ + +# Installation is finished, remove the lock +rm /tmp/vmn_ansible_lock_file.lock diff --git a/systemd/ansible-maintenance.service b/systemd/ansible-maintenance.service index 2717b2b..2caaae1 100644 --- a/systemd/ansible-maintenance.service +++ b/systemd/ansible-maintenance.service @@ -6,10 +6,10 @@ Wants=network-online.target [Service] Type=oneshot # CAHNGE TO MATCH YOUR REQUIREMENTS -User=max -Group=max -WorkingDirectory=/home/max/projects/ansible_home -ExecStart=/home/max/projects/ansible_home/run_playbook.sh /home/max/projects/ansible_home/playbooks/maintain.yaml +User=ansible +Group=ansible +WorkingDirectory=/home/ansible/ansible-production +ExecStart=/home/ansible/ansible-production/run_maintain_playbook.sh StandardOutput=journal StandardError=journal # Optional: prevent runaway if the playbook hangs diff --git a/systemd/ansible-maintenance.timer b/systemd/ansible-maintenance.timer index 6e606e0..ae3c369 100644 --- a/systemd/ansible-maintenance.timer +++ b/systemd/ansible-maintenance.timer @@ -1,9 +1,9 @@ [Unit] -Description=Timer for Ansible maintenance playbook, runs every 10 minutes +Description=Timer for Ansible maintenance playbook, runs every day Requires=ansible-maintenance.service [Timer] -OnUnitActiveSec=10min +OnUnitActiveSec=1d Persistent=true Unit=ansible-maintenance.service