Capture current Ansible control plane state

Commit the accumulated infrastructure work that was living only in the working tree: monitoring stack, emergency access/bot, gyro allocator, grimmory, adguard, backup audit and the OpenCode agent definitions. Also ignore Python bytecode, local archives and Nix/direnv artifacts. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GTocXkGUUazHdKKd3r9k71
2026-08-26 21:39:28 +03:00
parent 4bafa7d09e
commit c676be81ec
126 changed files with 10583 additions and 44 deletions
@@ -0,0 +1,110 @@
+---
+- name: Create and verify current PBS audit before AdGuard update
+  hosts: mini-pc
+  gather_facts: false
+  tasks:
+    - name: Verify AdGuard VMID ownership before backup
+      ansible.builtin.command: pct config 144
+      register: adguard_pct_config
+      changed_when: false
+      failed_when: false
+
+    - name: Refuse to back up a foreign VMID 144
+      ansible.builtin.assert:
+        that:
+          - adguard_pct_config.rc == 0
+          - adguard_existing_hostname == 'adguard'
+        fail_msg: VMID 144 is not the AdGuard container.
+      vars:
+        adguard_existing_hostname: >-
+          {{ adguard_pct_config.stdout_lines
+             | select('match', '^hostname: ')
+             | map('regex_replace', '^hostname: ', '')
+             | first
+             | default('') }}
+
+    - name: Check for active Proxmox backup before AdGuard PBS backup
+      ansible.builtin.command: pgrep -x vzdump
+      register: adguard_vzdump_preflight
+      changed_when: false
+      failed_when: false
+
+    - name: Require no active Proxmox backup before AdGuard PBS backup
+      ansible.builtin.assert:
+        that:
+          - adguard_vzdump_preflight.rc != 0
+        fail_msg: >-
+          A Proxmox backup is already running on mini-pc.
+          Retry after the existing backup completes.
+
+    - name: Create a fresh AdGuard PBS backup
+      ansible.builtin.command:
+        argv:
+          - vzdump
+          - "144"
+          - --storage
+          - pbs
+          - --mode
+          - snapshot
+          - --prune-backups
+          - keep-all=1
+          - --exclude-path
+          - /var/lib/docker/fuse-overlayfs/*/merged
+
+    - name: Run current PBS audit service
+      ansible.builtin.command:
+        argv:
+          - systemctl
+          - start
+          - --wait
+          - homelab-backup-audit-pbs.service
+      changed_when: true
+
+- import_playbook: pve-adguard.yml
+
+- name: Verify AdGuard public services after update
+  hosts: adguard
+  gather_facts: false
+  tasks:
+    - name: Check AdGuard HTTP root
+      ansible.builtin.uri:
+        url: http://127.0.0.1/
+        status_code: [200, 302]
+        return_content: false
+      register: adguard_http_root_check
+      retries: 24
+      delay: 5
+      until: adguard_http_root_check.status in [200, 302]
+
+    - name: Check AdGuard DNS over UDP
+      ansible.builtin.command:
+        argv:
+          - dig
+          - "@127.0.0.1"
+          - localhost
+          - A
+          - +time=2
+          - +tries=1
+          - +short
+      register: adguard_dns_udp_check
+      changed_when: false
+      retries: 12
+      delay: 5
+      until: adguard_dns_udp_check.rc == 0 and '127.0.0.1' in adguard_dns_udp_check.stdout
+
+    - name: Check AdGuard DNS over TCP
+      ansible.builtin.command:
+        argv:
+          - dig
+          - "@127.0.0.1"
+          - localhost
+          - A
+          - +tcp
+          - +time=2
+          - +tries=1
+          - +short
+      register: adguard_dns_tcp_check
+      changed_when: false
+      retries: 12
+      delay: 5
+      until: adguard_dns_tcp_check.rc == 0 and '127.0.0.1' in adguard_dns_tcp_check.stdout