Capture current Ansible control plane state

Commit the accumulated infrastructure work that was living only in the
working tree: monitoring stack, emergency access/bot, gyro allocator,
grimmory, adguard, backup audit and the OpenCode agent definitions.

Also ignore Python bytecode, local archives and Nix/direnv artifacts.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GTocXkGUUazHdKKd3r9k71

ansible/roles/uptime_kuma/defaults/main.yml

@@ -0,0 +1,9 @@
+---
+uptime_kuma_root: /opt/uptime-kuma
+uptime_kuma_image: louislam/uptime-kuma:1.23.16@sha256:431fee3be822b04861cf0e35daf4beef6b7cb37391c5f26c3ad6e12ce280fe18
+uptime_kuma_port: 3001
+uptime_kuma_lan_cidr: 192.168.1.0/24
+uptime_kuma_listen_address: "{{ expected_lan_ip }}"
+uptime_kuma_openvpn_gateway_ip: 192.168.1.23
+uptime_kuma_http_proxy: http://192.168.1.27:7890
+uptime_kuma_no_proxy: "localhost,127.0.0.1,::1,ada-dev.ru,.ada-dev.ru,192.168.1.5,192.168.1.10,192.168.1.20,192.168.1.23,192.168.1.24,192.168.1.25,192.168.1.26,192.168.1.27,192.168.1.28,192.168.1.29,192.168.1.30,192.168.1.31,192.168.1.32,192.168.1.34,192.168.1.100"

ansible/roles/uptime_kuma/handlers/main.yml

@@ -0,0 +1,5 @@
+---
+- name: restart uptime kuma
+  ansible.builtin.systemd:
+    name: uptime-kuma
+    state: restarted

ansible/roles/uptime_kuma/tasks/main.yml

@@ -0,0 +1,159 @@
+---
+- name: Install Uptime Kuma runtime packages
+  ansible.builtin.apt:
+    name:
+      - ca-certificates
+      - docker.io
+      - docker-compose
+      - ufw
+    state: present
+    update_cache: true
+
+- name: Ensure Docker is enabled and running
+  ansible.builtin.systemd:
+    name: docker
+    enabled: true
+    state: started
+
+- name: Allow SSH and Uptime Kuma access from the LAN
+  community.general.ufw:
+    rule: allow
+    port: "{{ item }}"
+    proto: tcp
+    src: "{{ uptime_kuma_lan_cidr }}"
+  loop:
+    - "22"
+    - "{{ uptime_kuma_port }}"
+
+- name: Allow SSH from the OpenVPN gateway
+  community.general.ufw:
+    rule: allow
+    port: "22"
+    proto: tcp
+    src: "{{ uptime_kuma_openvpn_gateway_ip }}"
+
+- name: Enable Uptime Kuma LXC firewall
+  community.general.ufw:
+    state: enabled
+    policy: deny
+    direction: incoming
+
+- name: Create Uptime Kuma directories
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0750"
+  loop:
+    - "{{ uptime_kuma_root }}"
+    - "{{ uptime_kuma_root }}/data"
+
+- name: Check if the configured Uptime Kuma image is present
+  ansible.builtin.command: "docker image inspect {{ uptime_kuma_image }}"
+  register: uptime_kuma_image_inspect
+  changed_when: false
+  failed_when: false
+
+- name: Pull the configured Uptime Kuma image
+  ansible.builtin.command: "docker pull {{ uptime_kuma_image }}"
+  when: uptime_kuma_image_inspect.rc != 0
+  register: uptime_kuma_image_pull
+  changed_when: true
+
+- name: Install Uptime Kuma compose definition
+  ansible.builtin.copy:
+    dest: "{{ uptime_kuma_root }}/compose.yml"
+    owner: root
+    group: root
+    mode: "0640"
+    content: |
+      services:
+        uptime-kuma:
+          image: {{ uptime_kuma_image }}
+          container_name: uptime-kuma
+          restart: unless-stopped
+          network_mode: host
+          environment:
+            HTTP_PROXY: {{ uptime_kuma_http_proxy }}
+            HTTPS_PROXY: {{ uptime_kuma_http_proxy }}
+            http_proxy: {{ uptime_kuma_http_proxy }}
+            https_proxy: {{ uptime_kuma_http_proxy }}
+            NO_PROXY: {{ uptime_kuma_no_proxy }}
+            no_proxy: {{ uptime_kuma_no_proxy }}
+          volumes:
+            - {{ uptime_kuma_root }}/data:/app/data
+  notify: restart uptime kuma
+
+- name: Validate Uptime Kuma Compose configuration
+  ansible.builtin.command: >-
+    docker-compose -f {{ uptime_kuma_root }}/compose.yml config --quiet
+  changed_when: false
+
+- name: Install Uptime Kuma systemd unit
+  ansible.builtin.copy:
+    dest: /etc/systemd/system/uptime-kuma.service
+    owner: root
+    group: root
+    mode: "0644"
+    content: |
+      [Unit]
+      Description=Uptime Kuma
+      Requires=docker.service
+      After=docker.service
+
+      [Service]
+      Type=oneshot
+      RemainAfterExit=yes
+      WorkingDirectory={{ uptime_kuma_root }}
+      ExecStart=/usr/bin/docker-compose -f {{ uptime_kuma_root }}/compose.yml up -d --remove-orphans
+      ExecStop=/usr/bin/docker-compose -f {{ uptime_kuma_root }}/compose.yml down
+
+      [Install]
+      WantedBy=multi-user.target
+  register: uptime_kuma_unit
+  notify: restart uptime kuma
+
+- name: Reload systemd when the Uptime Kuma unit changes
+  ansible.builtin.systemd:
+    daemon_reload: true
+  when: uptime_kuma_unit.changed
+
+- name: Enable and start Uptime Kuma
+  ansible.builtin.systemd:
+    name: uptime-kuma
+    enabled: true
+    state: "{{ 'restarted' if uptime_kuma_unit.changed or uptime_kuma_image_pull is changed else 'started' }}"
+
+- name: Apply pending Uptime Kuma configuration changes
+  ansible.builtin.meta: flush_handlers
+
+- name: Check Uptime Kuma web interface
+  ansible.builtin.uri:
+    url: "http://{{ uptime_kuma_listen_address }}:{{ uptime_kuma_port }}/"
+    status_code: 200
+  register: uptime_kuma_health
+  retries: 24
+  delay: 5
+  until: uptime_kuma_health.status == 200
+
+- name: Freeze the legacy Prometheus monitoring stack after Uptime Kuma is healthy
+  ansible.builtin.systemd:
+    name: homelab-monitoring
+    enabled: false
+    state: stopped
+
+- name: Remove legacy monitoring firewall rules
+  community.general.ufw:
+    rule: allow
+    port: "{{ item.port }}"
+    proto: tcp
+    src: "{{ item.src }}"
+    delete: true
+  loop:
+    - port: "3000"
+      src: "{{ uptime_kuma_lan_cidr }}"
+    - port: "9091"
+      src: "{{ uptime_kuma_openvpn_gateway_ip }}"
+    - port: "9100"
+      src: "172.16.0.0/12"