fix: update playbooks read the backup VMID from the registry; drop client-side prune

The *-update.yml playbooks hard-coded the pre-migration VMIDs, so after cutover
the "safety backup" ran against the stopped OLD container. Now the VMID comes
from homelab_services['<svc>'].vmid.

Also removes `--prune-backups keep-all=1` from the vzdump calls: retention is
PBS's job (prune-pbs), and the client-side flag needed Datastore.Modify/Prune
the ansible@pve token does not have, which made vzdump print "Backup ... failed"
and exit non-zero after a successful upload.

gitea-update.yml additionally splits the offsite backup (hosts: gitea) from its
audit (hosts: cloud-pc), matching the profile move into the container.
pve-*.yml imports pass pve_provisioning_enabled: false so the runtime update
path never re-enters container creation.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012uoq5AVK8mkBgg83Mq6o5V

ansible/playbooks/adguard-update.yml

@@ -2,19 +2,23 @@
 - name: Create and verify current PBS audit before AdGuard update
   hosts: mini-pc
   gather_facts: false
+  vars:
+    adguard_vmid: "{{ homelab_services['adguard'].vmid }}"
   tasks:
     - name: Verify AdGuard VMID ownership before backup
-      ansible.builtin.command: pct config 144
+      ansible.builtin.command: "pct config {{ adguard_vmid }}"
       register: adguard_pct_config
       changed_when: false
       failed_when: false
 
-    - name: Refuse to back up a foreign VMID 144
+    - name: Refuse to back up a foreign AdGuard VMID
       ansible.builtin.assert:
         that:
           - adguard_pct_config.rc == 0
           - adguard_existing_hostname == 'adguard'
-        fail_msg: VMID 144 is not the AdGuard container.
+        fail_msg: >-
+          VMID {{ adguard_vmid }} from the service registry is not the
+          AdGuard container.
       vars:
         adguard_existing_hostname: >-
           {{ adguard_pct_config.stdout_lines
@@ -41,13 +45,11 @@
       ansible.builtin.command:
         argv:
           - vzdump
-          - "144"
+          - "{{ adguard_vmid }}"
           - --storage
           - pbs
           - --mode
           - snapshot
-          - --prune-backups
-          - keep-all=1
           - --exclude-path
           - /var/lib/docker/fuse-overlayfs/*/merged
 

ansible/playbooks/gitea-update.yml

@@ -1,6 +1,6 @@
 ---
 - name: Create and verify Gitea backup before update
-  hosts: cloud-pc
+  hosts: gitea
   gather_facts: false
   tasks:
     - name: Create a fresh Gitea offsite backup
@@ -12,6 +12,10 @@
           - homelab-restic-offsite-gitea.service
       changed_when: true
 
+- name: Run Gitea backup audit
+  hosts: cloud-pc
+  gather_facts: false
+  tasks:
     - name: Run Gitea offsite backup audit
       ansible.builtin.command:
         argv:
@@ -22,6 +26,8 @@
       changed_when: true
 
 - import_playbook: pve-gitea.yml
+  vars:
+    pve_provisioning_enabled: false
 
 - name: Verify Gitea public endpoints after update
   hosts: ru-vps

ansible/playbooks/grimmory-update.yml

@@ -24,23 +24,26 @@
 - name: Create a fresh Grimmory PBS backup
   hosts: cloud-pc
   gather_facts: false
+  vars:
+    grimmory_vmid: "{{ homelab_services['grimmory'].vmid }}"
   tasks:
     - name: Read Grimmory LXC config
       ansible.builtin.command:
         argv:
           - pct
           - config
-          - "149"
+          - "{{ grimmory_vmid }}"
       register: grimmory_pct_config
       changed_when: false
 
-    - name: Assert VMID 149 belongs to Grimmory
+    - name: Assert registry VMID belongs to Grimmory
       ansible.builtin.assert:
         that:
           - grimmory_pct_hostname_line != ""
           - grimmory_pct_hostname == "grimmory"
         fail_msg: >-
-          Refusing to run vzdump 149 because pct config hostname is not grimmory:
+          Refusing to run vzdump {{ grimmory_vmid }} because pct config
+          hostname is not grimmory:
           {{ grimmory_pct_hostname_line | default('missing hostname line') }}
       vars:
         grimmory_pct_hostname_line: >-
@@ -66,13 +69,11 @@
       ansible.builtin.command:
         argv:
           - vzdump
-          - "149"
+          - "{{ grimmory_vmid }}"
           - --storage
           - pbs
           - --mode
           - snapshot
-          - --prune-backups
-          - keep-all=1
           - --exclude-path
           - /var/lib/docker/fuse-overlayfs/*/merged
 
@@ -90,6 +91,8 @@
       changed_when: true
 
 - import_playbook: pve-grimmory.yml
+  vars:
+    pve_provisioning_enabled: false
 
 - name: Verify Grimmory public endpoint after update
   hosts: ru-vps

ansible/playbooks/mihomo-update.yml

@@ -2,19 +2,23 @@
 - name: Verify Mihomo PBS audit before update
   hosts: mini-pc
   gather_facts: false
+  vars:
+    mihomo_vmid: "{{ homelab_services['mihomo'].vmid }}"
   tasks:
-    - name: Read VMID 143 configuration
+    - name: Read Mihomo VMID configuration
-      ansible.builtin.command: "pct config 143"
+      ansible.builtin.command: "pct config {{ mihomo_vmid }}"
       register: mihomo_pct_config
       changed_when: false
       failed_when: false
 
-    - name: Refuse to run backup unless VMID 143 is Mihomo
+    - name: Refuse to run backup unless registry VMID is Mihomo
       ansible.builtin.assert:
         that:
           - mihomo_pct_config.rc == 0
           - mihomo_update_hostname == 'mihomo'
-        fail_msg: VMID 143 must be the Mihomo container before backup.
+        fail_msg: >-
+          VMID {{ mihomo_vmid }} from the service registry must be the Mihomo
+          container before backup.
       vars:
         mihomo_update_hostname: >-
           {{ mihomo_pct_config.stdout_lines
@@ -41,13 +45,11 @@
       ansible.builtin.command:
         argv:
           - vzdump
-          - "143"
+          - "{{ mihomo_vmid }}"
           - --storage
           - pbs
           - --mode
           - snapshot
-          - --prune-backups
-          - keep-all=1
           - --exclude-path
           - /var/lib/docker/fuse-overlayfs/*/merged
 

ansible/playbooks/vaultwarden-update.yml

@@ -24,18 +24,22 @@
 - name: Create and verify Vaultwarden PBS backup before update
   hosts: mini-pc
   gather_facts: false
+  vars:
+    vaultwarden_vmid: "{{ homelab_services['vaultwarden'].vmid }}"
   tasks:
-    - name: Read existing VMID 140 configuration
+    - name: Read existing Vaultwarden VMID configuration
-      ansible.builtin.command: pct config 140
+      ansible.builtin.command: "pct config {{ vaultwarden_vmid }}"
       register: vaultwarden_existing_vmid
       changed_when: false
 
-    - name: Refuse to modify a foreign VMID 140
+    - name: Refuse to modify a foreign Vaultwarden VMID
       ansible.builtin.assert:
         that:
           - vaultwarden_existing_vmid.rc == 0
           - vaultwarden_existing_hostname == 'vaultwarden'
-        fail_msg: VMID 140 already exists and is not the Vaultwarden container.
+        fail_msg: >-
+          VMID {{ vaultwarden_vmid }} from the service registry is not the
+          Vaultwarden container.
       vars:
         vaultwarden_existing_hostname: >-
           {{ vaultwarden_existing_vmid.stdout_lines
@@ -62,13 +66,11 @@
       ansible.builtin.command:
         argv:
           - vzdump
-          - "140"
+          - "{{ vaultwarden_vmid }}"
           - --storage
           - pbs
           - --mode
           - snapshot
-          - --prune-backups
-          - keep-all=1
           - --exclude-path
           - /var/lib/docker/fuse-overlayfs/*/merged
 
@@ -82,6 +84,8 @@
       changed_when: true
 
 - import_playbook: pve-vaultwarden.yml
+  vars:
+    pve_provisioning_enabled: false
 
 - name: Verify Vaultwarden public endpoint after update
   hosts: ru-vps