Harwinder Sekhon
006103760f
Review fixes: - Availability plays: "ping_result is succeeded" is true for unreachable hosts, so offline hosts were added to reachable_hosts and failed the next play. Test reachability explicitly (7 playbooks). - bootstrap_lxc: vim-enhanced and mtr-tiny package names, enable CRB next to EPEL, add the root key without replacing authorized_keys, validate sshd_config edits and restart sshd only on change. - backup_docker: the command module does not expand $(...); fix rsync filter order and add --exclude=*; restart only the containers that were stopped, even when rsync fails; read the storage address from the inventory; keep semaphore and semaphore-db running. - new_lxc: community.general.proxmox no longer exists, use community.proxmox; node is mini-pc; valid hostname; password or token auth; let the module pick the VMID; longer timeout. - proxmox-backup: surface the vzdump exit code, let vzdump prune with keep-last, drop the rename/prune steps that globbed *.zstd. - time-region: chrony regex no longer comments out its own server line; /etc/localtime as a symlink; reuse facts across plays. - update_pihole_blocklists: FQCN, become: true, changed_when. - ansible.cfg gathering = smart; update_system only pings ubuntu/rocky. Telegram alerts: - health_check: filesystems above disk_warn_pct (default 80), excluding efivarfs, and offline hosts. - service_check: services not running. - One message per run from localhost, credentials from Semaphore (TELEGRAM_BOT_TOKEN / TELEGRAM_CHAT_ID), no_log on the send task, prints the alert text when Telegram is not configured. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XEizHawueRXUcxQELRZ8kq
122 lines
3.2 KiB
YAML
122 lines
3.2 KiB
YAML
---
|
|
# Sets the timezone on every Ubuntu/Rocky guest. LXC containers share the
|
|
# host's clock, so NTP is disabled inside them; VMs sync against ntp_server.
|
|
#
|
|
# Extra vars (optional):
|
|
# timezone_region - default America/New_York
|
|
# ntp_server - default time.google.com
|
|
|
|
- name: Configure timezone
|
|
hosts: ubuntu:rocky
|
|
become: true
|
|
|
|
vars:
|
|
timezone_region: America/New_York
|
|
|
|
tasks:
|
|
- name: Link /etc/localtime to the zoneinfo file
|
|
ansible.builtin.file:
|
|
src: "/usr/share/zoneinfo/{{ timezone_region }}"
|
|
dest: /etc/localtime
|
|
state: link
|
|
force: true
|
|
|
|
- name: Write /etc/timezone
|
|
ansible.builtin.copy:
|
|
dest: /etc/timezone
|
|
content: "{{ timezone_region }}\n"
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
|
|
# The plays below reuse the facts gathered above instead of collecting them again.
|
|
|
|
- name: NTP on Ubuntu
|
|
hosts: ubuntu
|
|
become: true
|
|
gather_facts: false
|
|
|
|
vars:
|
|
ntp_server: time.google.com
|
|
|
|
tasks:
|
|
- name: Stop and mask timesyncd in LXC containers
|
|
ansible.builtin.systemd:
|
|
name: systemd-timesyncd
|
|
state: stopped
|
|
enabled: false
|
|
masked: true
|
|
when: ansible_virtualization_type == "lxc"
|
|
|
|
- name: Point timesyncd at ntp_server on VMs
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/systemd/timesyncd.conf
|
|
regexp: '^#?NTP='
|
|
line: "NTP={{ ntp_server }}"
|
|
when: ansible_virtualization_type != "lxc"
|
|
notify: Restart timesyncd
|
|
|
|
handlers:
|
|
- name: Restart timesyncd
|
|
ansible.builtin.systemd:
|
|
name: systemd-timesyncd
|
|
state: restarted
|
|
enabled: true
|
|
|
|
- name: NTP on Rocky Linux
|
|
hosts: rocky
|
|
become: true
|
|
gather_facts: false
|
|
|
|
vars:
|
|
ntp_server: time.google.com
|
|
|
|
tasks:
|
|
- name: Stop and mask chronyd in LXC containers
|
|
ansible.builtin.systemd:
|
|
name: chronyd
|
|
state: stopped
|
|
enabled: false
|
|
masked: true
|
|
when: ansible_virtualization_type == "lxc"
|
|
|
|
# The lookahead keeps the server line added below from being commented
|
|
# out again on the next run.
|
|
- name: Disable the default chrony pools on VMs
|
|
ansible.builtin.replace:
|
|
path: /etc/chrony.conf
|
|
regexp: '^(pool|server)\s+(?!{{ ntp_server | regex_escape }}(\s|$)).*'
|
|
replace: '# \g<0> (disabled by Ansible)'
|
|
when: ansible_virtualization_type != "lxc"
|
|
notify: Restart chronyd
|
|
|
|
- name: Point chrony at ntp_server on VMs
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/chrony.conf
|
|
regexp: '^server\s+{{ ntp_server | regex_escape }}(\s|$)'
|
|
line: "server {{ ntp_server }} iburst"
|
|
when: ansible_virtualization_type != "lxc"
|
|
notify: Restart chronyd
|
|
|
|
handlers:
|
|
- name: Restart chronyd
|
|
ansible.builtin.systemd:
|
|
name: chronyd
|
|
state: restarted
|
|
enabled: true
|
|
|
|
- name: Verify time configuration
|
|
hosts: ubuntu:rocky
|
|
become: true
|
|
gather_facts: false
|
|
|
|
tasks:
|
|
- name: Check current system time
|
|
ansible.builtin.command: date
|
|
register: check_time
|
|
changed_when: false
|
|
|
|
- name: Summary
|
|
ansible.builtin.debug:
|
|
msg: "{{ inventory_hostname }} ({{ ansible_virtualization_type | default('unknown') }}) - {{ check_time.stdout }}"
|