From baef2c49b319202be87775d220e3d0fea33bbc42 Mon Sep 17 00:00:00 2001
From: Dmitry <ada.dmitry@gmail.com>
Date: Thu, 3 Sep 2026 07:04:36 +0300
Subject: [PATCH] feat: derive PBS backup jobs and audit VMIDs from the service
 registry

- pve-backup-jobs.yml: each job's vmid list is now computed from
  homelab_services by backup.job instead of a hand-maintained CSV. Adding a
  service no longer needs a separate edit here (the forgotten-edit failure
  mode that left CT 148 emergency-bot without a backup).
- roles/backup_audit/defaults: backup_audit_pbs_vmids derived from
  homelab_services by the monitoring.backup_audit_vmid flag; single shared
  freshness threshold backup_audit_pbs_max_age_hours (48).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012uoq5AVK8mkBgg83Mq6o5V
---
 ansible/playbooks/pve-backup-jobs.yml        | 19 ++++++++--
 ansible/roles/backup_audit/defaults/main.yml | 39 ++++++++------------
 2 files changed, 32 insertions(+), 26 deletions(-)

diff --git a/ansible/playbooks/pve-backup-jobs.yml b/ansible/playbooks/pve-backup-jobs.yml
index f58b14c..52c8b70 100644
--- a/ansible/playbooks/pve-backup-jobs.yml
+++ b/ansible/playbooks/pve-backup-jobs.yml
@@ -1,3 +1,7 @@
+# Списки VMID выводятся из реестра homelab_services по полю backup.job, а не
+# перечисляются вручную. Раньше добавление сервиса требовало отдельной правки
+# здесь, и о ней легко было забыть — CT 148 emergency-bot до сих пор без бэкапа
+# именно по этой причине.
 - name: Configure Proxmox backup jobs
   hosts: mini-pc
   gather_facts: false
@@ -6,7 +10,10 @@
       - id: homelab-pbs-daily-cloud
         comment: Daily PBS backup for cloud-pc service containers
         node: cloud-pc
-        vmid: 141,145,146,147,149
+        vmid: >-
+          {{ homelab_services.values() | selectattr('backup.job', 'defined')
+             | selectattr('backup.job', 'eq', 'homelab-pbs-daily-cloud')
+             | map(attribute='vmid') | sort | join(',') }}
         storage: pbs
         schedule: "02:10"
         mode: snapshot
@@ -14,7 +21,10 @@
       - id: homelab-pbs-daily-mini
         comment: Daily PBS backup for mini-pc service containers
         node: mini-pc
-        vmid: 132,140,142,143,144,150
+        vmid: >-
+          {{ homelab_services.values() | selectattr('backup.job', 'defined')
+             | selectattr('backup.job', 'eq', 'homelab-pbs-daily-mini')
+             | map(attribute='vmid') | sort | join(',') }}
         storage: pbs
         schedule: "02:40"
         mode: snapshot
@@ -22,7 +32,10 @@
       - id: homelab-local-weekly-pbs
         comment: Weekly local backup for PBS container rootfs/config
         node: cloud-pc
-        vmid: 120
+        vmid: >-
+          {{ homelab_services.values() | selectattr('backup.job', 'defined')
+             | selectattr('backup.job', 'eq', 'homelab-local-weekly-pbs')
+             | map(attribute='vmid') | sort | join(',') }}
         storage: backup
         schedule: "Sun 03:30"
         mode: snapshot
diff --git a/ansible/roles/backup_audit/defaults/main.yml b/ansible/roles/backup_audit/defaults/main.yml
index 6a9acdd..a58c869 100644
--- a/ansible/roles/backup_audit/defaults/main.yml
+++ b/ansible/roles/backup_audit/defaults/main.yml
@@ -3,29 +3,22 @@ backup_audit_log_file: /var/log/homelab-backup-audit.log
 backup_audit_timer_oncalendar: "*-*-* 06:00:00"
 backup_audit_timer_randomized_delay: 10m
 
-backup_audit_pbs_vmids:
-  - vmid: 132
-    max_age_hours: 48
-  - vmid: 140
-    max_age_hours: 48
-  - vmid: 141
-    max_age_hours: 48
-  - vmid: 142
-    max_age_hours: 48
-  - vmid: 143
-    max_age_hours: 48
-  - vmid: 144
-    max_age_hours: 48
-  - vmid: 145
-    max_age_hours: 48
-  - vmid: 146
-    max_age_hours: 48
-  - vmid: 147
-    max_age_hours: 48
-  - vmid: 149
-    max_age_hours: 48
-  - vmid: 150
-    max_age_hours: 48
+# Единый порог свежести для всех PBS-снапшотов. Вынесен отдельно, потому что
+# сам список VMID теперь выводится из реестра и per-vmid значения в нём нет.
+backup_audit_pbs_max_age_hours: 48
+
+# VMID берутся из homelab_services по флагу monitoring.backup_audit_vmid, а не
+# перечисляются вручную. Форма записи ({vmid, max_age_hours}) сохранена, чтобы
+# вызывающий playbook при необходимости мог передать свой список с иными
+# порогами — шаблон audit-pbs.sh.j2 читает именно эти два поля.
+backup_audit_pbs_vmids: >-
+  {{ homelab_services.values()
+     | selectattr('monitoring.backup_audit_vmid', 'defined')
+     | selectattr('monitoring.backup_audit_vmid')
+     | map(attribute='vmid') | sort
+     | map('community.general.dict_kv', 'vmid')
+     | map('combine', {'max_age_hours': backup_audit_pbs_max_age_hours})
+     | list }}
 
 backup_audit_restic_profiles: []
 backup_audit_metrics_dir: /var/lib/node_exporter/textfile_collector