Check each host for pending packages before upgrading, then print a
per-host status (updated with the package list, up to date, or failed)
and one consolidated summary play with totals.
Failed upgrades are caught per host so they are reported instead of
dropping out of the run, and a final fail task keeps the run non-zero.
The read-only cache refresh and pending checks run with check_mode:
false, so --check works as a dry run.
Semaphore variable groups can pass values as extra vars or as environment
variables, and secrets can be either type. Read telegram_bot_token,
TELEGRAM_BOT_TOKEN (extra var) or TELEGRAM_BOT_TOKEN (env), same for the
chat id, and say in the "not configured" message which of the two is
missing so a wrong box or a detached variable group is visible in the log.
Claude-Session: https://claude.ai/code/session_01XEizHawueRXUcxQELRZ8kq
Review fixes:
- Availability plays: "ping_result is succeeded" is true for unreachable
hosts, so offline hosts were added to reachable_hosts and failed the
next play. Test reachability explicitly (7 playbooks).
- bootstrap_lxc: vim-enhanced and mtr-tiny package names, enable CRB next
to EPEL, add the root key without replacing authorized_keys, validate
sshd_config edits and restart sshd only on change.
- backup_docker: the command module does not expand $(...); fix rsync
filter order and add --exclude=*; restart only the containers that were
stopped, even when rsync fails; read the storage address from the
inventory; keep semaphore and semaphore-db running.
- new_lxc: community.general.proxmox no longer exists, use
community.proxmox; node is mini-pc; valid hostname; password or token
auth; let the module pick the VMID; longer timeout.
- proxmox-backup: surface the vzdump exit code, let vzdump prune with
keep-last, drop the rename/prune steps that globbed *.zstd.
- time-region: chrony regex no longer comments out its own server line;
/etc/localtime as a symlink; reuse facts across plays.
- update_pihole_blocklists: FQCN, become: true, changed_when.
- ansible.cfg gathering = smart; update_system only pings ubuntu/rocky.
Telegram alerts:
- health_check: filesystems above disk_warn_pct (default 80), excluding
efivarfs, and offline hosts.
- service_check: services not running.
- One message per run from localhost, credentials from Semaphore
(TELEGRAM_BOT_TOKEN / TELEGRAM_CHAT_ID), no_log on the send task,
prints the alert text when Telegram is not configured.
Claude-Session: https://claude.ai/code/session_01XEizHawueRXUcxQELRZ8kq
- inventory: add proxmox host, lxc and vms groups, critical_services per host
- retarget bootstrap and time-region to ubuntu:rocky so the Proxmox host is untouched
- add ansible.cfg, collections/requirements.yml, .gitignore, .yamllint, .ansible-lint
- remove stale root new_lxc.yml duplicate and the Nextcloud upgrade playbook
Claude-Session: https://claude.ai/code/session_01JEczyvRjfakkiDNkbZA7PR
Group hosts by OS (ubuntu/rocky) in inventory, refactor playbooks to
use group-targeted plays instead of ansible_os_family conditionals,
add bot host, and add Docker volume backup playbook via rsync to storage.
Harwinder Sekhon
harry