feat: decommission memoir-bot (CT 142)

Service was unused. Live steps (revoke SecondBrain deploy key, drop the Uptime
Kuma monitor, pct stop 142) were done 2026-09-02; pct destroy is deliberately
deferred a week.

- delete playbooks/pve-memoir-bot.yml.
- hosts.yml: drop the memoir-bot host and its monitoring_exporters entry.
- roles/monitoring_server/templates/prometheus.yml.j2: drop 192.168.1.26 target.
- roles/uptime_kuma/defaults: drop 192.168.1.26 from no_proxy.
- roles/lxc_docker_host/defaults: drop the memoir-bot extra-packages comment.

The registry entry, the ssh_config Host block and the status.yml unit list are
removed in the commits that also carry OpenTofu-migration / quorum changes to
those files.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012uoq5AVK8mkBgg83Mq6o5V

ansible/inventory/hosts.yml

@@ -64,10 +64,6 @@ all:
           ansible_host: 192.168.1.25
           expected_lan_ip: 192.168.1.25
 
-        memoir-bot:
-          ansible_host: 192.168.1.26
-          expected_lan_ip: 192.168.1.26
-
         mihomo:
           ansible_host: 192.168.1.27
           expected_lan_ip: 192.168.1.27
@@ -103,7 +99,6 @@ all:
         ovpn-mini:
         vaultwarden:
         gitea:
-        memoir-bot:
         mihomo:
         adguard:
         monitoring:

ansible/playbooks/pve-memoir-bot.yml

@@ -1,305 +0,0 @@
----
-- name: Create memoir-bot LXC on mini-pc
-  hosts: mini-pc
-  gather_facts: false
-  vars:
-    memoir_bot_vmid: 142
-    memoir_bot_hostname: memoir-bot
-    memoir_bot_ip: 192.168.1.26/24
-    memoir_bot_gateway: 192.168.1.1
-    memoir_bot_bridge: vmbr0
-    memoir_bot_rootfs: local-lvm:16
-    memoir_bot_ostemplate: local:vztmpl/debian-13-standard_13.1-2_amd64.tar.zst
-    memoir_bot_pubkey_file: ~/.ssh/id_ed25519_homelab.pub
-  handlers:
-    - name: restart memoir-bot lxc
-      ansible.builtin.shell: "pct stop {{ memoir_bot_vmid }} || true; pct start {{ memoir_bot_vmid }}"
-      changed_when: true
-  tasks:
-    - name: Check if memoir-bot LXC exists
-      ansible.builtin.command: "pct config {{ memoir_bot_vmid }}"
-      register: memoir_bot_pct_config
-      changed_when: false
-      failed_when: false
-
-    - name: Install memoir-bot LXC SSH public key on PVE host
-      ansible.builtin.copy:
-        dest: /tmp/memoir-bot-lxc.pub
-        owner: root
-        group: root
-        mode: "0600"
-        content: "{{ lookup('file', memoir_bot_pubkey_file) }}\n"
-      when: memoir_bot_pct_config.rc != 0
-
-    - name: Create memoir-bot LXC
-      ansible.builtin.command: >-
-        pct create {{ memoir_bot_vmid }} {{ memoir_bot_ostemplate }}
-        --hostname {{ memoir_bot_hostname }}
-        --rootfs {{ memoir_bot_rootfs }}
-        --cores 1
-        --memory 512
-        --swap 512
-        --net0 name=eth0,bridge={{ memoir_bot_bridge }},gw={{ memoir_bot_gateway }},ip={{ memoir_bot_ip }},firewall=1
-        --nameserver 1.1.1.1
-        --unprivileged 1
-        --features nesting=1,keyctl=1
-        --onboot 1
-        --startup order=60
-        --cmode shell
-        --ssh-public-keys /tmp/memoir-bot-lxc.pub
-      when: memoir_bot_pct_config.rc != 0
-
-    - name: Start memoir-bot LXC
-      ansible.builtin.command: "pct start {{ memoir_bot_vmid }}"
-      register: memoir_bot_pct_start
-      changed_when: memoir_bot_pct_start.rc == 0
-      failed_when: memoir_bot_pct_start.rc not in [0, 255]
-
-    - name: Allow FUSE device in memoir-bot LXC config
-      ansible.builtin.lineinfile:
-        path: "/etc/pve/lxc/{{ memoir_bot_vmid }}.conf"
-        line: "lxc.cgroup2.devices.allow: c 10:229 rwm"
-        state: present
-      notify: restart memoir-bot lxc
-
-    - name: Bind mount FUSE device in memoir-bot LXC config
-      ansible.builtin.lineinfile:
-        path: "/etc/pve/lxc/{{ memoir_bot_vmid }}.conf"
-        line: "lxc.mount.entry: /dev/fuse dev/fuse none bind,create=file"
-        state: present
-      notify: restart memoir-bot lxc
-
-    - name: Apply pending LXC config changes
-      ansible.builtin.meta: flush_handlers
-
-    - name: Wait for memoir-bot SSH through ru-vps
-      ansible.builtin.wait_for_connection:
-        timeout: 120
-      delegate_to: memoir-bot
-      vars:
-        ansible_become: false
-
-- name: Configure Docker and memoir-bot inside LXC
-  hosts: memoir-bot
-  gather_facts: true
-  vars:
-    ansible_become: false
-    memoir_bot_source_dir: /home/ada/Documents/Projects/Other/memoir_bot/
-    memoir_bot_app_dir: /opt/memoir-bot/app
-    memoir_bot_state_dir: /srv/memoir-bot
-    memoir_bot_env_file: /srv/memoir-bot/.env
-    memoir_bot_env_source: /home/ada/Documents/Projects/Other/memoir_bot/.env
-    memoir_bot_ssh_private_key_file: ~/.ssh/id_ed25519
-    memoir_bot_ssh_public_key_file: ~/.ssh/id_ed25519.pub
-    memoir_bot_vault_repo: git@github.com:ada-dmitry/SecondBrain.git
-    memoir_bot_vault_dir: /srv/memoir-bot/vault
-    memoir_bot_image: memoir-bot:local
-    memoir_bot_container_name: memoir-bot
-  tasks:
-    - name: Install Docker and deploy dependencies
-      ansible.builtin.apt:
-        name:
-          - docker.io
-          - fuse-overlayfs
-          - git
-          - openssh-client
-          - rsync
-          - ca-certificates
-          - curl
-        state: present
-        update_cache: true
-
-    - name: Ensure Docker config directory exists
-      ansible.builtin.file:
-        path: /etc/docker
-        state: directory
-        owner: root
-        group: root
-        mode: "0755"
-
-    - name: Configure Docker storage driver for unprivileged LXC
-      ansible.builtin.copy:
-        dest: /etc/docker/daemon.json
-        owner: root
-        group: root
-        mode: "0644"
-        content: |
-          {
-            "storage-driver": "fuse-overlayfs"
-          }
-      register: docker_daemon_config
-
-    - name: Ensure Docker service is enabled and running
-      ansible.builtin.systemd:
-        name: docker
-        state: "{{ 'restarted' if docker_daemon_config.changed else 'started' }}"
-        enabled: true
-
-    - name: Ensure memoir-bot directories exist
-      ansible.builtin.file:
-        path: "{{ item }}"
-        state: directory
-        owner: root
-        group: root
-        mode: "0750"
-      loop:
-        - "{{ memoir_bot_app_dir }}"
-        - "{{ memoir_bot_state_dir }}"
-        - "{{ memoir_bot_state_dir }}/ssh"
-
-    - name: Copy memoir-bot env example
-      ansible.builtin.copy:
-        dest: "{{ memoir_bot_state_dir }}/.env.example"
-        owner: root
-        group: root
-        mode: "0640"
-        content: |
-          BOT_TOKEN=123456:telegram-token
-          ALLOWED_USER_IDS=123456789
-          OBSIDIAN_VAULT_PATH=/srv/obsidian/vault
-          DAILY_NOTES_DIR=03 Journal
-          NOTE_PATH_FORMAT=%Y/%m/%d.%m.%y.md
-          MESSAGE_TIME_FORMAT=%H:%M
-          TELEGRAM_PROXY=
-          REMINDER_MIN_HOURS=2
-          REMINDER_MAX_HOURS=3
-          REMINDER_START_HOUR=7
-          REMINDER_END_HOUR=23
-          REMINDER_TIMEZONE=Europe/Moscow
-
-    - name: Copy memoir-bot env file when present locally
-      ansible.builtin.copy:
-        src: "{{ memoir_bot_env_source }}"
-        dest: "{{ memoir_bot_env_file }}"
-        owner: root
-        group: root
-        mode: "0600"
-      when: lookup('ansible.builtin.fileglob', memoir_bot_env_source) | length > 0
-      no_log: true
-
-    - name: Install GitHub SSH private key for memoir-bot
-      ansible.builtin.copy:
-        src: "{{ memoir_bot_ssh_private_key_file }}"
-        dest: "{{ memoir_bot_state_dir }}/ssh/id_ed25519"
-        owner: root
-        group: root
-        mode: "0600"
-      no_log: true
-
-    - name: Install GitHub SSH public key for memoir-bot when present locally
-      ansible.builtin.copy:
-        src: "{{ memoir_bot_ssh_public_key_file }}"
-        dest: "{{ memoir_bot_state_dir }}/ssh/id_ed25519.pub"
-        owner: root
-        group: root
-        mode: "0644"
-      when: lookup('ansible.builtin.fileglob', memoir_bot_ssh_public_key_file) | length > 0
-
-    - name: Scan GitHub SSH host key
-      ansible.builtin.command: ssh-keyscan github.com
-      register: memoir_bot_github_host_key
-      changed_when: false
-
-    - name: Trust GitHub SSH host key for memoir-bot
-      ansible.builtin.known_hosts:
-        path: "{{ memoir_bot_state_dir }}/ssh/known_hosts"
-        name: github.com
-        key: "{{ memoir_bot_github_host_key.stdout }}"
-        state: present
-
-    - name: Clone SecondBrain vault
-      ansible.builtin.git:
-        repo: "{{ memoir_bot_vault_repo }}"
-        dest: "{{ memoir_bot_vault_dir }}"
-        key_file: "{{ memoir_bot_state_dir }}/ssh/id_ed25519"
-        accept_hostkey: true
-        update: true
-        version: main
-      register: memoir_bot_vault_checkout
-
-    - name: Configure memoir-bot vault Git author name
-      ansible.builtin.command: git config user.name memoir-bot
-      args:
-        chdir: "{{ memoir_bot_vault_dir }}"
-      changed_when: false
-
-    - name: Configure memoir-bot vault Git author email
-      ansible.builtin.command: git config user.email memoir-bot@homelab.local
-      args:
-        chdir: "{{ memoir_bot_vault_dir }}"
-      changed_when: false
-
-    - name: Sync memoir-bot source code
-      ansible.posix.synchronize:
-        src: "{{ memoir_bot_source_dir }}"
-        dest: "{{ memoir_bot_app_dir }}/"
-        delete: true
-        rsync_opts:
-          - "--exclude=.env"
-          - "--exclude=.git"
-          - "--exclude=.venv"
-          - "--exclude=__pycache__"
-          - "--exclude=*.pyc"
-      register: memoir_bot_source_sync
-
-    - name: Check if memoir-bot image exists
-      ansible.builtin.command: "docker image inspect {{ memoir_bot_image }}"
-      register: memoir_bot_image_inspect
-      changed_when: false
-      failed_when: false
-
-    - name: Build memoir-bot image
-      ansible.builtin.command: "docker build -t {{ memoir_bot_image }} {{ memoir_bot_app_dir }}"
-      when: memoir_bot_source_sync.changed or memoir_bot_image_inspect.rc != 0
-      register: memoir_bot_image_build
-      changed_when: memoir_bot_image_build.rc == 0
-
-    - name: Install memoir-bot systemd unit
-      ansible.builtin.copy:
-        dest: /etc/systemd/system/memoir-bot.service
-        owner: root
-        group: root
-        mode: "0644"
-        content: |
-          [Unit]
-          Description=Memoir Telegram bot container
-          After=docker.service
-          Requires=docker.service
-          ConditionPathExists={{ memoir_bot_env_file }}
-
-          [Service]
-          Restart=always
-          RestartSec=10
-          ExecStartPre=-/usr/bin/docker rm -f {{ memoir_bot_container_name }}
-          ExecStart=/usr/bin/docker run --rm \
-            --name {{ memoir_bot_container_name }} \
-            --env-file {{ memoir_bot_env_file }} \
-            -v {{ memoir_bot_state_dir }}/vault:/srv/obsidian/vault \
-            -v {{ memoir_bot_state_dir }}/ssh:/root/.ssh:ro \
-            {{ memoir_bot_image }}
-          ExecStop=/usr/bin/docker stop {{ memoir_bot_container_name }}
-
-          [Install]
-          WantedBy=multi-user.target
-      register: memoir_bot_unit
-
-    - name: Reload systemd when memoir-bot unit changes
-      ansible.builtin.systemd:
-        daemon_reload: true
-      when: memoir_bot_unit.changed
-
-    - name: Check memoir-bot env file
-      ansible.builtin.stat:
-        path: "{{ memoir_bot_env_file }}"
-      register: memoir_bot_env
-
-    - name: Enable memoir-bot service
-      ansible.builtin.systemd:
-        name: memoir-bot
-        enabled: true
-
-    - name: Start memoir-bot when env file exists
-      ansible.builtin.systemd:
-        name: memoir-bot
-        state: "{{ 'restarted' if memoir_bot_source_sync.changed or memoir_bot_image_build.changed or memoir_bot_unit.changed or memoir_bot_vault_checkout.changed else 'started' }}"
-      when: memoir_bot_env.stat.exists

ansible/roles/lxc_docker_host/defaults/main.yml

@@ -18,7 +18,6 @@ lxc_docker_host_packages:
 #   gitea:      [sqlite3, rsync]
 #   adguard:    [dnsutils]
 #   mihomo:     [git]
-#   memoir-bot: [git, openssh-client, rsync]
 #   grimmory:   [mariadb-client, openssl]
 lxc_docker_host_extra_packages: []
 

ansible/roles/monitoring_server/templates/prometheus.yml.j2

@@ -24,7 +24,6 @@ scrape_configs:
           - "192.168.1.23:9100"
           - "192.168.1.24:9100"
           - "192.168.1.25:9100"
-          - "192.168.1.26:9100"
           - "192.168.1.27:9100"
           - "192.168.1.28:9100"
           - "192.168.1.30:9100"

ansible/roles/uptime_kuma/defaults/main.yml

@@ -6,4 +6,4 @@ uptime_kuma_lan_cidr: 192.168.1.0/24
 uptime_kuma_listen_address: "{{ expected_lan_ip }}"
 uptime_kuma_openvpn_gateway_ip: 192.168.1.23
 uptime_kuma_http_proxy: http://192.168.1.27:7890
-uptime_kuma_no_proxy: "localhost,127.0.0.1,::1,ada-dev.ru,.ada-dev.ru,192.168.1.5,192.168.1.10,192.168.1.20,192.168.1.23,192.168.1.24,192.168.1.25,192.168.1.26,192.168.1.27,192.168.1.28,192.168.1.29,192.168.1.30,192.168.1.31,192.168.1.32,192.168.1.34,192.168.1.100"
+uptime_kuma_no_proxy: "localhost,127.0.0.1,::1,ada-dev.ru,.ada-dev.ru,192.168.1.5,192.168.1.10,192.168.1.20,192.168.1.23,192.168.1.24,192.168.1.25,192.168.1.27,192.168.1.28,192.168.1.29,192.168.1.30,192.168.1.31,192.168.1.32,192.168.1.34,192.168.1.100"