infra/ansible/roles/uptime_kuma/tasks/main.yml

---
- name: Install Uptime Kuma runtime packages
  ansible.builtin.apt:
    name:
      - ca-certificates
      - docker.io
      - docker-compose
      - ufw
    state: present
    update_cache: true

- name: Ensure Docker is enabled and running
  ansible.builtin.systemd:
    name: docker
    enabled: true
    state: started

- name: Allow SSH and Uptime Kuma access from the LAN
  community.general.ufw:
    rule: allow
    port: "{{ item }}"
    proto: tcp
    src: "{{ uptime_kuma_lan_cidr }}"
  loop:
    - "22"
    - "{{ uptime_kuma_port }}"

- name: Allow SSH from the OpenVPN gateway
  community.general.ufw:
    rule: allow
    port: "22"
    proto: tcp
    src: "{{ uptime_kuma_openvpn_gateway_ip }}"

- name: Enable Uptime Kuma LXC firewall
  community.general.ufw:
    state: enabled
    policy: deny
    direction: incoming

- name: Create Uptime Kuma directories
  ansible.builtin.file:
    path: "{{ item }}"
    state: directory
    owner: root
    group: root
    mode: "0750"
  loop:
    - "{{ uptime_kuma_root }}"
    - "{{ uptime_kuma_root }}/data"

- name: Check if the configured Uptime Kuma image is present
  ansible.builtin.command: "docker image inspect {{ uptime_kuma_image }}"
  register: uptime_kuma_image_inspect
  changed_when: false
  failed_when: false

- name: Pull the configured Uptime Kuma image
  ansible.builtin.command: "docker pull {{ uptime_kuma_image }}"
  when: uptime_kuma_image_inspect.rc != 0
  register: uptime_kuma_image_pull
  changed_when: true

- name: Install Uptime Kuma compose definition
  ansible.builtin.copy:
    dest: "{{ uptime_kuma_root }}/compose.yml"
    owner: root
    group: root
    mode: "0640"
    content: |
      services:
        uptime-kuma:
          image: {{ uptime_kuma_image }}
          container_name: uptime-kuma
          restart: unless-stopped
          network_mode: host
          environment:
            HTTP_PROXY: {{ uptime_kuma_http_proxy }}
            HTTPS_PROXY: {{ uptime_kuma_http_proxy }}
            http_proxy: {{ uptime_kuma_http_proxy }}
            https_proxy: {{ uptime_kuma_http_proxy }}
            NO_PROXY: {{ uptime_kuma_no_proxy }}
            no_proxy: {{ uptime_kuma_no_proxy }}
          volumes:
            - {{ uptime_kuma_root }}/data:/app/data
  notify: restart uptime kuma

- name: Validate Uptime Kuma Compose configuration
  ansible.builtin.command: >-
    docker-compose -f {{ uptime_kuma_root }}/compose.yml config --quiet
  changed_when: false

- name: Install Uptime Kuma systemd unit
  ansible.builtin.copy:
    dest: /etc/systemd/system/uptime-kuma.service
    owner: root
    group: root
    mode: "0644"
    content: |
      [Unit]
      Description=Uptime Kuma
      Requires=docker.service
      After=docker.service

      [Service]
      Type=oneshot
      RemainAfterExit=yes
      WorkingDirectory={{ uptime_kuma_root }}
      ExecStart=/usr/bin/docker-compose -f {{ uptime_kuma_root }}/compose.yml up -d --remove-orphans
      ExecStop=/usr/bin/docker-compose -f {{ uptime_kuma_root }}/compose.yml down

      [Install]
      WantedBy=multi-user.target
  register: uptime_kuma_unit
  notify: restart uptime kuma

- name: Reload systemd when the Uptime Kuma unit changes
  ansible.builtin.systemd:
    daemon_reload: true
  when: uptime_kuma_unit.changed

- name: Enable and start Uptime Kuma
  ansible.builtin.systemd:
    name: uptime-kuma
    enabled: true
    state: "{{ 'restarted' if uptime_kuma_unit.changed or uptime_kuma_image_pull is changed else 'started' }}"

- name: Apply pending Uptime Kuma configuration changes
  ansible.builtin.meta: flush_handlers

- name: Check Uptime Kuma web interface
  ansible.builtin.uri:
    url: "http://{{ uptime_kuma_listen_address }}:{{ uptime_kuma_port }}/"
    status_code: 200
  register: uptime_kuma_health
  retries: 24
  delay: 5
  until: uptime_kuma_health.status == 200

# На хосте, где замороженный стек никогда не разворачивался (например, новый
# контейнер blue-green переезда), юнита homelab-monitoring нет, и systemd-модуль
# упал бы с "Could not find the requested service". Смысл шага — "legacy-стек не
# должен работать", а на чистом хосте это уже так. Проверено 2026-09-02.
- name: Detect the legacy monitoring unit
  ansible.builtin.stat:
    path: /etc/systemd/system/homelab-monitoring.service
  register: uptime_kuma_legacy_unit

- name: Freeze the legacy Prometheus monitoring stack after Uptime Kuma is healthy
  ansible.builtin.systemd:
    name: homelab-monitoring
    enabled: false
    state: stopped
  when: uptime_kuma_legacy_unit.stat.exists

- name: Remove legacy monitoring firewall rules
  community.general.ufw:
    rule: allow
    port: "{{ item.port }}"
    proto: tcp
    src: "{{ item.src }}"
    delete: true
  loop:
    - port: "3000"
      src: "{{ uptime_kuma_lan_cidr }}"
    - port: "9091"
      src: "{{ uptime_kuma_openvpn_gateway_ip }}"
    - port: "9100"
      src: "172.16.0.0/12"