Capture current Ansible control plane state

Commit the accumulated infrastructure work that was living only in the working tree: monitoring stack, emergency access/bot, gyro allocator, grimmory, adguard, backup audit and the OpenCode agent definitions. Also ignore Python bytecode, local archives and Nix/direnv artifacts. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GTocXkGUUazHdKKd3r9k71
2026-08-26 21:39:28 +03:00
parent 4bafa7d09e
commit c676be81ec
126 changed files with 10583 additions and 44 deletions
@@ -0,0 +1,106 @@
+---
+- name: Create and verify Grimmory backup before update
+  hosts: grimmory
+  gather_facts: false
+  tasks:
+    - name: Create a fresh Grimmory offsite backup
+      ansible.builtin.command:
+        argv:
+          - systemctl
+          - start
+          - --wait
+          - homelab-restic-offsite-grimmory.service
+      changed_when: true
+
+    - name: Run Grimmory offsite backup audit
+      ansible.builtin.command:
+        argv:
+          - systemctl
+          - start
+          - --wait
+          - homelab-backup-audit-grimmory.service
+      changed_when: true
+
+- name: Create a fresh Grimmory PBS backup
+  hosts: cloud-pc
+  gather_facts: false
+  tasks:
+    - name: Read Grimmory LXC config
+      ansible.builtin.command:
+        argv:
+          - pct
+          - config
+          - "149"
+      register: grimmory_pct_config
+      changed_when: false
+
+    - name: Assert VMID 149 belongs to Grimmory
+      ansible.builtin.assert:
+        that:
+          - grimmory_pct_hostname_line != ""
+          - grimmory_pct_hostname == "grimmory"
+        fail_msg: >-
+          Refusing to run vzdump 149 because pct config hostname is not grimmory:
+          {{ grimmory_pct_hostname_line | default('missing hostname line') }}
+      vars:
+        grimmory_pct_hostname_line: >-
+          {{ (grimmory_pct_config.stdout_lines | select('match', '^hostname:\\s+') | list | first | default('')) }}
+        grimmory_pct_hostname: >-
+          {{ grimmory_pct_hostname_line | regex_replace('^hostname:\\s*', '') }}
+
+    - name: Check for active Proxmox backup before Grimmory PBS backup
+      ansible.builtin.command: pgrep -x vzdump
+      register: grimmory_vzdump_preflight
+      changed_when: false
+      failed_when: false
+
+    - name: Require no active Proxmox backup before Grimmory PBS backup
+      ansible.builtin.assert:
+        that:
+          - grimmory_vzdump_preflight.rc != 0
+        fail_msg: >-
+          A Proxmox backup is already running on cloud-pc.
+          Retry after the existing backup completes.
+
+    - name: Create a fresh Grimmory PBS backup
+      ansible.builtin.command:
+        argv:
+          - vzdump
+          - "149"
+          - --storage
+          - pbs
+          - --mode
+          - snapshot
+          - --prune-backups
+          - keep-all=1
+          - --exclude-path
+          - /var/lib/docker/fuse-overlayfs/*/merged
+
+- name: Run PBS backup audit on mini-pc
+  hosts: mini-pc
+  gather_facts: false
+  tasks:
+    - name: Run current PBS backup audit on mini-pc
+      ansible.builtin.command:
+        argv:
+          - systemctl
+          - start
+          - --wait
+          - homelab-backup-audit-pbs.service
+      changed_when: true
+
+- import_playbook: pve-grimmory.yml
+
+- name: Verify Grimmory public endpoint after update
+  hosts: ru-vps
+  gather_facts: false
+  tasks:
+    - name: Check Grimmory public health endpoint
+      ansible.builtin.uri:
+        url: https://books.ada-dev.ru/api/v1/healthcheck
+        status_code: 200
+        return_content: false
+      register: grimmory_public_health
+      retries: 24
+      delay: 5
+      until: grimmory_public_health.status == 200