DmitryandClaude Sonnet 5
5e27ba2513
The *-update.yml playbooks hard-coded the pre-migration VMIDs, so after cutover the "safety backup" ran against the stopped OLD container. Now the VMID comes from homelab_services['<svc>'].vmid. Also removes `--prune-backups keep-all=1` from the vzdump calls: retention is PBS's job (prune-pbs), and the client-side flag needed Datastore.Modify/Prune the ansible@pve token does not have, which made vzdump print "Backup ... failed" and exit non-zero after a successful upload. gitea-update.yml additionally splits the offsite backup (hosts: gitea) from its audit (hosts: cloud-pc), matching the profile move into the container. pve-*.yml imports pass pve_provisioning_enabled: false so the runtime update path never re-enters container creation. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012uoq5AVK8mkBgg83Mq6o5V
113 lines
3.2 KiB
YAML
113 lines
3.2 KiB
YAML
---
|
|
- name: Create and verify current PBS audit before AdGuard update
|
|
hosts: mini-pc
|
|
gather_facts: false
|
|
vars:
|
|
adguard_vmid: "{{ homelab_services['adguard'].vmid }}"
|
|
tasks:
|
|
- name: Verify AdGuard VMID ownership before backup
|
|
ansible.builtin.command: "pct config {{ adguard_vmid }}"
|
|
register: adguard_pct_config
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: Refuse to back up a foreign AdGuard VMID
|
|
ansible.builtin.assert:
|
|
that:
|
|
- adguard_pct_config.rc == 0
|
|
- adguard_existing_hostname == 'adguard'
|
|
fail_msg: >-
|
|
VMID {{ adguard_vmid }} from the service registry is not the
|
|
AdGuard container.
|
|
vars:
|
|
adguard_existing_hostname: >-
|
|
{{ adguard_pct_config.stdout_lines
|
|
| select('match', '^hostname: ')
|
|
| map('regex_replace', '^hostname: ', '')
|
|
| first
|
|
| default('') }}
|
|
|
|
- name: Check for active Proxmox backup before AdGuard PBS backup
|
|
ansible.builtin.command: pgrep -x vzdump
|
|
register: adguard_vzdump_preflight
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: Require no active Proxmox backup before AdGuard PBS backup
|
|
ansible.builtin.assert:
|
|
that:
|
|
- adguard_vzdump_preflight.rc != 0
|
|
fail_msg: >-
|
|
A Proxmox backup is already running on mini-pc.
|
|
Retry after the existing backup completes.
|
|
|
|
- name: Create a fresh AdGuard PBS backup
|
|
ansible.builtin.command:
|
|
argv:
|
|
- vzdump
|
|
- "{{ adguard_vmid }}"
|
|
- --storage
|
|
- pbs
|
|
- --mode
|
|
- snapshot
|
|
- --exclude-path
|
|
- /var/lib/docker/fuse-overlayfs/*/merged
|
|
|
|
- name: Run current PBS audit service
|
|
ansible.builtin.command:
|
|
argv:
|
|
- systemctl
|
|
- start
|
|
- --wait
|
|
- homelab-backup-audit-pbs.service
|
|
changed_when: true
|
|
|
|
- import_playbook: pve-adguard.yml
|
|
|
|
- name: Verify AdGuard public services after update
|
|
hosts: adguard
|
|
gather_facts: false
|
|
tasks:
|
|
- name: Check AdGuard HTTP root
|
|
ansible.builtin.uri:
|
|
url: http://127.0.0.1/
|
|
status_code: [200, 302]
|
|
return_content: false
|
|
register: adguard_http_root_check
|
|
retries: 24
|
|
delay: 5
|
|
until: adguard_http_root_check.status in [200, 302]
|
|
|
|
- name: Check AdGuard DNS over UDP
|
|
ansible.builtin.command:
|
|
argv:
|
|
- dig
|
|
- "@127.0.0.1"
|
|
- localhost
|
|
- A
|
|
- +time=2
|
|
- +tries=1
|
|
- +short
|
|
register: adguard_dns_udp_check
|
|
changed_when: false
|
|
retries: 12
|
|
delay: 5
|
|
until: adguard_dns_udp_check.rc == 0 and '127.0.0.1' in adguard_dns_udp_check.stdout
|
|
|
|
- name: Check AdGuard DNS over TCP
|
|
ansible.builtin.command:
|
|
argv:
|
|
- dig
|
|
- "@127.0.0.1"
|
|
- localhost
|
|
- A
|
|
- +tcp
|
|
- +time=2
|
|
- +tries=1
|
|
- +short
|
|
register: adguard_dns_tcp_check
|
|
changed_when: false
|
|
retries: 12
|
|
delay: 5
|
|
until: adguard_dns_tcp_check.rc == 0 and '127.0.0.1' in adguard_dns_tcp_check.stdout
|