thesabear
c05c7164c8
rocky-docker-lxc/, caddy-vm/, monitoring-vm/ (was missing entirely -
Grafana+Loki+Prometheus stack, refreshed and CA mount stripped same as
everything else), and automation/{ansible,automation-vm,iac}/ for the
three repos that live on the automation VM. Hawser is genuinely
deployed on all three of caddy-vm/monitoring-vm/automation-vm so it's
duplicated in each rather than picking one canonical home.
Old Ansible/ and "Infrastrucutre as Code/" content moved under
automation/ansible/old-playbooks and automation/iac/old-content as-is
for now - contents still need refreshing against the current repos and
a per-folder README, that's the next pass.
89 lines
2.8 KiB
YAML
89 lines
2.8 KiB
YAML
---
|
|
- name: Patching and Updating Linux Systems
|
|
hosts: all
|
|
become: true
|
|
vars:
|
|
GOTIFY_IP: xxx #[Your gotify host IP goes here]
|
|
GOTIFY_PORT: xxx #[Your gotify port goes here]
|
|
GOTIFY_TOKEN: xxx #[Your app token goes here]
|
|
ansible_python_interpreter: /usr/bin/python3
|
|
|
|
tasks:
|
|
- name: Update Debian-based Systems
|
|
when: ansible_os_family == 'Debian' or ansible_os_family == 'Ubuntu'
|
|
apt:
|
|
update_cache: yes
|
|
upgrade: dist
|
|
|
|
- name: Update RHEL-based Systems
|
|
when: ansible_os_family == 'RedHat'
|
|
yum:
|
|
name: '*'
|
|
state: latest
|
|
|
|
- name: List installed and updated packages
|
|
shell: grep -E "^$(date +%Y-%m-%d).+ (install|upgrade) " /var/log/dpkg.log |cut -d " " -f 3-5
|
|
register: result
|
|
|
|
- name: Check if Docker is installed
|
|
command: which docker
|
|
register: docker_installed
|
|
ignore_errors: true
|
|
changed_when: false
|
|
|
|
- name: Upgrade Python pip modules for Docker support (only if Docker is installed)
|
|
when: docker_installed.rc == 0 and ansible_os_family == 'RedHat'
|
|
pip:
|
|
name:
|
|
- docker
|
|
- requests
|
|
state: latest
|
|
executable: pip3
|
|
|
|
- name: Show Output of updated files
|
|
debug: msg="{{ result.stdout_lines }}"
|
|
|
|
- name: Check if reboot is required
|
|
stat:
|
|
path: /var/run/reboot-required
|
|
register: reboot_required_file
|
|
|
|
- name: Show Output of required reboots
|
|
debug: msg="{{ reboot_required_file.stat.exists == true }}"
|
|
|
|
- name: Rebooting machine
|
|
shell: sleep 2 && shutdown -r now "Ansible updates triggered"
|
|
async: 1
|
|
poll: 0
|
|
ignore_errors: true
|
|
when: reboot_required_file.stat.exists
|
|
|
|
- name: Waiting for the machine to come back
|
|
local_action: wait_for host={{ ansible_host }} state=started port=22 delay=30
|
|
become: false
|
|
when: reboot_required_file.stat.exists
|
|
###
|
|
- name: Remove DNF dependencies that are no longer required.
|
|
when: ansible_os_family == 'RedHat'
|
|
ansible.builtin.dnf:
|
|
autoremove: yes
|
|
|
|
- name: Remove APT dependencies that are no longer required.
|
|
when: ansible_os_family == 'Debian' or ansible_os_family == 'Ubuntu'
|
|
ansible.builtin.apt:
|
|
autoremove: yes
|
|
|
|
- name: notify via Gotify
|
|
uri:
|
|
url: 'http://{{ GOTIFY_IP }}:{{ GOTIFY_PORT }}/message?token={{ GOTIFY_TOKEN }}'
|
|
method: POST
|
|
body:
|
|
title:
|
|
content: All Packages Update
|
|
message:
|
|
content: The upgrade-packages playbook has completed for {{ ansible_host }} and is now updated. A required reboot is {{ reboot_required_file.stat.exists == true }}.
|
|
priority:
|
|
content: '5'
|
|
body_format: form-multipart
|
|
register: result
|
|
... |