Semaphore variable groups can pass values as extra vars or as environment
variables, and secrets can be either type. Read telegram_bot_token,
TELEGRAM_BOT_TOKEN (extra var) or TELEGRAM_BOT_TOKEN (env), same for the
chat id, and say in the "not configured" message which of the two is
missing so a wrong box or a detached variable group is visible in the log.
Claude-Session: https://claude.ai/code/session_01XEizHawueRXUcxQELRZ8kq
Review fixes:
- Availability plays: "ping_result is succeeded" is true for unreachable
hosts, so offline hosts were added to reachable_hosts and failed the
next play. Test reachability explicitly (7 playbooks).
- bootstrap_lxc: vim-enhanced and mtr-tiny package names, enable CRB next
to EPEL, add the root key without replacing authorized_keys, validate
sshd_config edits and restart sshd only on change.
- backup_docker: the command module does not expand $(...); fix rsync
filter order and add --exclude=*; restart only the containers that were
stopped, even when rsync fails; read the storage address from the
inventory; keep semaphore and semaphore-db running.
- new_lxc: community.general.proxmox no longer exists, use
community.proxmox; node is mini-pc; valid hostname; password or token
auth; let the module pick the VMID; longer timeout.
- proxmox-backup: surface the vzdump exit code, let vzdump prune with
keep-last, drop the rename/prune steps that globbed *.zstd.
- time-region: chrony regex no longer comments out its own server line;
/etc/localtime as a symlink; reuse facts across plays.
- update_pihole_blocklists: FQCN, become: true, changed_when.
- ansible.cfg gathering = smart; update_system only pings ubuntu/rocky.
Telegram alerts:
- health_check: filesystems above disk_warn_pct (default 80), excluding
efivarfs, and offline hosts.
- service_check: services not running.
- One message per run from localhost, credentials from Semaphore
(TELEGRAM_BOT_TOKEN / TELEGRAM_CHAT_ID), no_log on the send task,
prints the alert text when Telegram is not configured.
Claude-Session: https://claude.ai/code/session_01XEizHawueRXUcxQELRZ8kq
- inventory: add proxmox host, lxc and vms groups, critical_services per host
- retarget bootstrap and time-region to ubuntu:rocky so the Proxmox host is untouched
- add ansible.cfg, collections/requirements.yml, .gitignore, .yamllint, .ansible-lint
- remove stale root new_lxc.yml duplicate and the Nextcloud upgrade playbook
Claude-Session: https://claude.ai/code/session_01JEczyvRjfakkiDNkbZA7PR
Group hosts by OS (ubuntu/rocky) in inventory, refactor playbooks to
use group-targeted plays instead of ansible_os_family conditionals,
add bot host, and add Docker volume backup playbook via rsync to storage.
Harwinder Sekhon
harry