fix: update playbooks read the backup VMID from the registry; drop client-side prune
The *-update.yml playbooks hard-coded the pre-migration VMIDs, so after cutover the "safety backup" ran against the stopped OLD container. Now the VMID comes from homelab_services['<svc>'].vmid. Also removes `--prune-backups keep-all=1` from the vzdump calls: retention is PBS's job (prune-pbs), and the client-side flag needed Datastore.Modify/Prune the ansible@pve token does not have, which made vzdump print "Backup ... failed" and exit non-zero after a successful upload. gitea-update.yml additionally splits the offsite backup (hosts: gitea) from its audit (hosts: cloud-pc), matching the profile move into the container. pve-*.yml imports pass pve_provisioning_enabled: false so the runtime update path never re-enters container creation. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012uoq5AVK8mkBgg83Mq6o5V
This commit is contained in:
Dmitry
co-authored by
Claude Sonnet 5
Claude Sonnet 5
parent
a3fe8031fe
commit
5e27ba2513
@@ -2,19 +2,23 @@
|
||||
- name: Create and verify current PBS audit before AdGuard update
|
||||
hosts: mini-pc
|
||||
gather_facts: false
|
||||
vars:
|
||||
adguard_vmid: "{{ homelab_services['adguard'].vmid }}"
|
||||
tasks:
|
||||
- name: Verify AdGuard VMID ownership before backup
|
||||
ansible.builtin.command: pct config 144
|
||||
ansible.builtin.command: "pct config {{ adguard_vmid }}"
|
||||
register: adguard_pct_config
|
||||
changed_when: false
|
||||
failed_when: false
|
||||
|
||||
- name: Refuse to back up a foreign VMID 144
|
||||
- name: Refuse to back up a foreign AdGuard VMID
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- adguard_pct_config.rc == 0
|
||||
- adguard_existing_hostname == 'adguard'
|
||||
fail_msg: VMID 144 is not the AdGuard container.
|
||||
fail_msg: >-
|
||||
VMID {{ adguard_vmid }} from the service registry is not the
|
||||
AdGuard container.
|
||||
vars:
|
||||
adguard_existing_hostname: >-
|
||||
{{ adguard_pct_config.stdout_lines
|
||||
@@ -41,13 +45,11 @@
|
||||
ansible.builtin.command:
|
||||
argv:
|
||||
- vzdump
|
||||
- "144"
|
||||
- "{{ adguard_vmid }}"
|
||||
- --storage
|
||||
- pbs
|
||||
- --mode
|
||||
- snapshot
|
||||
- --prune-backups
|
||||
- keep-all=1
|
||||
- --exclude-path
|
||||
- /var/lib/docker/fuse-overlayfs/*/merged
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
- name: Create and verify Gitea backup before update
|
||||
hosts: cloud-pc
|
||||
hosts: gitea
|
||||
gather_facts: false
|
||||
tasks:
|
||||
- name: Create a fresh Gitea offsite backup
|
||||
@@ -12,6 +12,10 @@
|
||||
- homelab-restic-offsite-gitea.service
|
||||
changed_when: true
|
||||
|
||||
- name: Run Gitea backup audit
|
||||
hosts: cloud-pc
|
||||
gather_facts: false
|
||||
tasks:
|
||||
- name: Run Gitea offsite backup audit
|
||||
ansible.builtin.command:
|
||||
argv:
|
||||
@@ -22,6 +26,8 @@
|
||||
changed_when: true
|
||||
|
||||
- import_playbook: pve-gitea.yml
|
||||
vars:
|
||||
pve_provisioning_enabled: false
|
||||
|
||||
- name: Verify Gitea public endpoints after update
|
||||
hosts: ru-vps
|
||||
|
||||
@@ -24,23 +24,26 @@
|
||||
- name: Create a fresh Grimmory PBS backup
|
||||
hosts: cloud-pc
|
||||
gather_facts: false
|
||||
vars:
|
||||
grimmory_vmid: "{{ homelab_services['grimmory'].vmid }}"
|
||||
tasks:
|
||||
- name: Read Grimmory LXC config
|
||||
ansible.builtin.command:
|
||||
argv:
|
||||
- pct
|
||||
- config
|
||||
- "149"
|
||||
- "{{ grimmory_vmid }}"
|
||||
register: grimmory_pct_config
|
||||
changed_when: false
|
||||
|
||||
- name: Assert VMID 149 belongs to Grimmory
|
||||
- name: Assert registry VMID belongs to Grimmory
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- grimmory_pct_hostname_line != ""
|
||||
- grimmory_pct_hostname == "grimmory"
|
||||
fail_msg: >-
|
||||
Refusing to run vzdump 149 because pct config hostname is not grimmory:
|
||||
Refusing to run vzdump {{ grimmory_vmid }} because pct config
|
||||
hostname is not grimmory:
|
||||
{{ grimmory_pct_hostname_line | default('missing hostname line') }}
|
||||
vars:
|
||||
grimmory_pct_hostname_line: >-
|
||||
@@ -66,13 +69,11 @@
|
||||
ansible.builtin.command:
|
||||
argv:
|
||||
- vzdump
|
||||
- "149"
|
||||
- "{{ grimmory_vmid }}"
|
||||
- --storage
|
||||
- pbs
|
||||
- --mode
|
||||
- snapshot
|
||||
- --prune-backups
|
||||
- keep-all=1
|
||||
- --exclude-path
|
||||
- /var/lib/docker/fuse-overlayfs/*/merged
|
||||
|
||||
@@ -90,6 +91,8 @@
|
||||
changed_when: true
|
||||
|
||||
- import_playbook: pve-grimmory.yml
|
||||
vars:
|
||||
pve_provisioning_enabled: false
|
||||
|
||||
- name: Verify Grimmory public endpoint after update
|
||||
hosts: ru-vps
|
||||
|
||||
@@ -2,19 +2,23 @@
|
||||
- name: Verify Mihomo PBS audit before update
|
||||
hosts: mini-pc
|
||||
gather_facts: false
|
||||
vars:
|
||||
mihomo_vmid: "{{ homelab_services['mihomo'].vmid }}"
|
||||
tasks:
|
||||
- name: Read VMID 143 configuration
|
||||
ansible.builtin.command: "pct config 143"
|
||||
- name: Read Mihomo VMID configuration
|
||||
ansible.builtin.command: "pct config {{ mihomo_vmid }}"
|
||||
register: mihomo_pct_config
|
||||
changed_when: false
|
||||
failed_when: false
|
||||
|
||||
- name: Refuse to run backup unless VMID 143 is Mihomo
|
||||
- name: Refuse to run backup unless registry VMID is Mihomo
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- mihomo_pct_config.rc == 0
|
||||
- mihomo_update_hostname == 'mihomo'
|
||||
fail_msg: VMID 143 must be the Mihomo container before backup.
|
||||
fail_msg: >-
|
||||
VMID {{ mihomo_vmid }} from the service registry must be the Mihomo
|
||||
container before backup.
|
||||
vars:
|
||||
mihomo_update_hostname: >-
|
||||
{{ mihomo_pct_config.stdout_lines
|
||||
@@ -41,13 +45,11 @@
|
||||
ansible.builtin.command:
|
||||
argv:
|
||||
- vzdump
|
||||
- "143"
|
||||
- "{{ mihomo_vmid }}"
|
||||
- --storage
|
||||
- pbs
|
||||
- --mode
|
||||
- snapshot
|
||||
- --prune-backups
|
||||
- keep-all=1
|
||||
- --exclude-path
|
||||
- /var/lib/docker/fuse-overlayfs/*/merged
|
||||
|
||||
|
||||
@@ -24,18 +24,22 @@
|
||||
- name: Create and verify Vaultwarden PBS backup before update
|
||||
hosts: mini-pc
|
||||
gather_facts: false
|
||||
vars:
|
||||
vaultwarden_vmid: "{{ homelab_services['vaultwarden'].vmid }}"
|
||||
tasks:
|
||||
- name: Read existing VMID 140 configuration
|
||||
ansible.builtin.command: pct config 140
|
||||
- name: Read existing Vaultwarden VMID configuration
|
||||
ansible.builtin.command: "pct config {{ vaultwarden_vmid }}"
|
||||
register: vaultwarden_existing_vmid
|
||||
changed_when: false
|
||||
|
||||
- name: Refuse to modify a foreign VMID 140
|
||||
- name: Refuse to modify a foreign Vaultwarden VMID
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- vaultwarden_existing_vmid.rc == 0
|
||||
- vaultwarden_existing_hostname == 'vaultwarden'
|
||||
fail_msg: VMID 140 already exists and is not the Vaultwarden container.
|
||||
fail_msg: >-
|
||||
VMID {{ vaultwarden_vmid }} from the service registry is not the
|
||||
Vaultwarden container.
|
||||
vars:
|
||||
vaultwarden_existing_hostname: >-
|
||||
{{ vaultwarden_existing_vmid.stdout_lines
|
||||
@@ -62,13 +66,11 @@
|
||||
ansible.builtin.command:
|
||||
argv:
|
||||
- vzdump
|
||||
- "140"
|
||||
- "{{ vaultwarden_vmid }}"
|
||||
- --storage
|
||||
- pbs
|
||||
- --mode
|
||||
- snapshot
|
||||
- --prune-backups
|
||||
- keep-all=1
|
||||
- --exclude-path
|
||||
- /var/lib/docker/fuse-overlayfs/*/merged
|
||||
|
||||
@@ -82,6 +84,8 @@
|
||||
changed_when: true
|
||||
|
||||
- import_playbook: pve-vaultwarden.yml
|
||||
vars:
|
||||
pve_provisioning_enabled: false
|
||||
|
||||
- name: Verify Vaultwarden public endpoint after update
|
||||
hosts: ru-vps
|
||||
|
||||
Reference in New Issue
Block a user