.gitea/workflows/deploy_new_config.yaml

@@ -16,6 +16,12 @@ jobs:
     if: github.event.pull_request.merged == true
     runs-on: ubuntu-latest
     steps:
-      - name: Trigger the webhook to start pulling new Ansible configs
-      # LAN IP is used because those hosts are in the same network
+      - name: Trigger the webhook to start pulling the latest version from the repo
+        # LAN IP is used because those hosts are in the same network
+        run: curl "http://192.168.0.38:9000/hooks/pull-latest"
+      
+      - name: Trigger the webhook to update python and ansible modules
+        run: curl "http://192.168.0.38:9000/hooks/run-update-script"
+     
+      - name: Trigger the webhook to run the playbook
         run: curl "http://192.168.0.38:9000/hooks/run-maintain-playbook"

inventory/hosts.yaml

@@ -5,9 +5,13 @@ physical:
       ansible_become_password: "{{ ansible_become_passwd }}"
       ansible_connection: local
       ansible_python_interpreter: "{{ ansible_playbook_python }}"
-    192.168.0.98:
-      ansible_become_password: "{{ ansible_become_passwd }}"
     192.168.0.6:
       ansible_become_password: "{{ ansible_become_passwd }}"
     192.168.0.8:
       ansible_become_password: "{{ ansible_become_passwd }}"
+    192.168.0.12:
+      ansible_become_password: "{{ ansible_become_passwd }}"
+    192.168.0.16:
+      ansible_become_password: "{{ ansible_become_passwd }}"
+    192.168.0.39:
+      ansible_become_password: "{{ ansible_become_passwd }}"

playbooks/maintain.yaml

@@ -5,9 +5,6 @@
   
   vars_files:
     ../inventory/group_vars/all/secrets.yaml
-  vars:
-    ansible_user_passwd_hash: "{{ ansible_password | password_hash('sha512', 's3edscrj45e6r') }}"
-    user_passwd_hash: "{{ user_password | password_hash('sha512', 's3ed6123jhgcr') }}"
   
   roles:
     # Check the Internet connection

requirements.txt

@@ -4,29 +4,34 @@ ansible-lint==26.6.0
 attrs==26.1.0
 black==26.5.1
 bracex==3.0
+certifi==2026.7.22
 cffi==2.1.0
+charset-normalizer==3.4.9
 click==8.4.2
 cryptography==49.0.0
 distro==1.9.0
 filelock==3.29.7
+idna==3.18
 Jinja2==3.1.6
 jsonschema==4.26.0
 jsonschema-specifications==2025.9.1
 MarkupSafe==3.0.3
 mypy_extensions==1.1.0
+netaddr==1.3.0
 packaging==26.2
 pathspec==1.1.1
 platformdirs==4.10.0
-proxmoxer>=2.3
+proxmoxer==2.3.0
 pycparser==3.0
 pytokens==0.4.1
 PyYAML==6.0.3
 referencing==0.37.0
-requests>=2.34.2
+requests==2.34.2
 resolvelib==1.2.1
 rpds-py==2026.6.3
 ruamel.yaml==0.19.1
 ruamel.yaml.clib==0.2.15
 subprocess-tee==0.4.2
+urllib3==2.7.0
 wcmatch==11.0
 yamllint==1.38.0

requirements.yaml

@@ -0,0 +1,17 @@
+---
+
+collections:
+  - name: ansible.posix
+    version: 2.2.2
+
+  - name: ansible.utils
+    version: 6.0.3
+
+  - name: community.general
+    version: 13.2.0
+
+  - name: community.library_inventory_filtering_v1
+    version: 1.1.5
+
+  - name: community.proxmox
+    version: 2.0.0

scripts/run_maintain_playbook.sh

@@ -1,3 +1,11 @@
 #!/bin/bash
+
+LOCK_FILE=/tmp/vmn_ansible_lock_file.lock
+
+while [ -f "$LOCK_FILE" ]
+do
+  sleep 1s
+done
+
 source .venv/bin/activate
 ansible-playbook playbooks/maintain.yaml --vault-pass-file ~/vault_password -i inventory/hosts.yaml --private-key ~/.ssh/ansible_key

scripts/update_modules.sh

@@ -0,0 +1,18 @@
+#!/bin/bash
+
+# Create a lock file to prevent other scripts from running with old modules
+touch /tmp/vmn_ansible_lock_file.lock
+
+source .venv/bin/activate
+
+# Install python packages
+pip install -r requirements.txt
+
+# Install collections from the file
+ansible-galaxy collection install -r requirements.yml -p ./collections/
+
+# Install roles
+ansible-galaxy role install -r requirements.yml -p ./roles/
+
+# Installation is finished, remove the lock
+rm /tmp/vmn_ansible_lock_file.lock

systemd/ansible-maintenance.service

@@ -6,10 +6,10 @@ Wants=network-online.target
 [Service]
 Type=oneshot
 # CAHNGE TO MATCH YOUR REQUIREMENTS
-User=max
-Group=max
-WorkingDirectory=/home/max/projects/ansible_home
-ExecStart=/home/max/projects/ansible_home/run_playbook.sh /home/max/projects/ansible_home/playbooks/maintain.yaml 
+User=ansible
+Group=ansible
+WorkingDirectory=/home/ansible/ansible-production
+ExecStart=/home/ansible/ansible-production/run_maintain_playbook.sh 
 StandardOutput=journal
 StandardError=journal
 # Optional: prevent runaway if the playbook hangs

systemd/ansible-maintenance.timer

@@ -1,9 +1,9 @@
 [Unit]
-Description=Timer for Ansible maintenance playbook, runs every 10 minutes
+Description=Timer for Ansible maintenance playbook, runs every day
 Requires=ansible-maintenance.service
 
 [Timer]
-OnUnitActiveSec=10min
+OnUnitActiveSec=1d
 Persistent=true
 Unit=ansible-maintenance.service