single playbook for mediapis

README.md

@@ -6,10 +6,13 @@ Pis (audio players, sensors, music mouse, etc.) plus one home server.
 ## Layout
 
 - `inventory.yml` — hosts and group vars (Pis under `iot`, plus `server`).
-- `full.yml`, `working.yml`, `server.yml`, `newrpi-provisioning.yml`,
-  `octopisetup.yml` — top-level playbooks. `full.yml` is the closest thing to
-  a canonical "apply everything" playbook; the others are narrower/ad-hoc
-  runs kept around for specific hosts or one-off tasks.
+  `group_vars/` and `host_vars/` hold vars for the `mediapis` group (the four
+  parallel audio-player Pis) and their host-specific overrides.
+- `mediapis.yml`, `working.yml`, `server.yml`, `newrpi-provisioning.yml`,
+  `octopisetup.yml` — top-level playbooks. `mediapis.yml` is the canonical
+  playbook for the `mediapis` group (`musikserverwohnzimmeroben`, `kitchenpi`,
+  `bedroompi`, `musicmouse`); the others are narrower/ad-hoc runs kept around
+  for specific hosts or one-off tasks.
 - `roles/` — one role per piece of functionality (audio backends, sensors,
   bluetooth monitoring, server basics, etc.). Each has a short `README.md`.
 - `update-packages.yml` — deliberate, fleet-wide package update (see
@@ -41,7 +44,7 @@ password.
 ## Running a playbook
 
 ```
-ansible-playbook full.yml --limit <host>
+ansible-playbook mediapis.yml --limit <host>
 ```
 
 `ansible.cfg` points Ansible at `inventory.yml` and `roles/` by default, so
@@ -49,13 +52,13 @@ no extra flags are needed for those.
 
 ## Keeping packages up to date
 
-Regular playbook runs (`full.yml`, `server.yml`, etc.) use `state: present`
+Regular playbook runs (`mediapis.yml`, `server.yml`, etc.) use `state: present`
 for packages, so they only install what's missing — they never upgrade
 anything as a side effect of an unrelated config change. Two separate,
 deliberate mechanisms handle upgrades instead:
 
 **Security patches — automatic.** The `unattended_upgrades` role (applied
-to every host in `full.yml`/`server.yml`) configures `unattended-upgrades`
+to every host in `mediapis.yml`/`server.yml`) configures `unattended-upgrades`
 to install security-origin updates automatically, with a scheduled reboot
 window (default 03:00, see `roles/unattended_upgrades/defaults/main.yml`)
 for patches that need one. Not scoped to full dist-upgrades.

ansible.cfg

@@ -2,5 +2,5 @@
 inventory = inventory.yml
 roles_path = roles
 lookup_plugins = lookup_plugins
-forks = 5
-strategy = free
+#strategy = free
+serial = 5

full.yml

@@ -1,70 +0,0 @@
----
-# - hosts: esszimmerradio
-#  roles:
-#    - pi_standard_setup
-#    - pi_squeezelite_custom
-#    - pi_shairport
-#    - pi_lirc
-#    - pi_sispmctl
-#
-
-- name: Musikserver Wohnzimmer oben
-  hosts: musikserverwohnzimmeroben
-  roles:
-    - unattended_upgrades
-    - pi_modern_shell_env
-    - pi_standard_setup
-    - pi_hifiberry_amp
-    - pi_squeezelite_custom
-    - pi_shairport
-    - pi_irserver
-    - pi_dhtsensor
-
-- name: Kitchen pi
-  hosts: kitchenpi
-  roles:
-    - unattended_upgrades
-    - pi_modern_shell_env
-    - pi_standard_setup
-    - pi_hifiberry_amp
-    - pi_squeezelite_custom
-    - pi_shairport
-    - pi_lirc
-    - pi_dhtsensor
-    - pi_disable_onboard_bluetooth
-    - bluetooth_monitor
-
-- name: Bedroom pi
-  hosts: bedroompi
-  roles:
-    - unattended_upgrades
-    - pi_modern_shell_env
-    - pi_standard_setup
-    - pi_squeezelite_custom
-    - pi_shairport
-    - pi_lirc
-    - pi_dhtsensor
-    - pi_disable_onboard_bluetooth
-    - bluetooth_monitor
-
-- name: Musicmouse
-  hosts: musicmouse
-  roles:
-    - unattended_upgrades
-    - pi_modern_shell_env
-    - pi_standard_setup
-    - pi_hifiberry_amp
-    - pi_musicmouse
-    - pi_squeezelite_custom
-    - pi_shairport
-    - pi_lirc
-    - bluetooth_monitor
-
-# - hosts: octopi
-#  roles:
-#    - pi_dhtsensor
-
-# - hosts: newrpi
-#  roles:
-#     - pi_standard_setup
-#     - pi_lirc

group_vars/mediapis.yml

@@ -0,0 +1,7 @@
+---
+mediapi_has_hifiberry_amp: false
+mediapi_ir_control: lirc
+mediapi_has_dhtsensor: false
+mediapi_disable_onboard_bluetooth: false
+mediapi_install_bluetooth_monitor: false
+mediapi_install_kidsmusic: false

host_vars/bedroompi.yml

@@ -0,0 +1,13 @@
+---
+squeezelite_name: BedroomPi
+pi_shairport_name: BedroomPi
+alsa_card_name: Codec
+sensor_room_name_ascii: schlafzimmer
+sensor_room_name: Schlafzimmer
+my_bt_monitor_watchdog_seconds: 600
+my_btmonitor_restart_ble_interface: hci0
+main_user: root
+
+mediapi_has_dhtsensor: true
+mediapi_disable_onboard_bluetooth: true
+mediapi_install_bluetooth_monitor: true

host_vars/kitchenpi.yml

@@ -0,0 +1,13 @@
+---
+squeezelite_name: KitchenPi
+pi_shairport_name: KitchenPi
+alsa_card_name: 0
+sensor_room_name_ascii: kueche
+sensor_room_name: Küche
+hifiberry_overlay: hifiberry-amp
+main_user: root
+
+mediapi_has_hifiberry_amp: true
+mediapi_has_dhtsensor: true
+mediapi_disable_onboard_bluetooth: true
+mediapi_install_bluetooth_monitor: true

host_vars/musicmouse.yml

@@ -0,0 +1,12 @@
+---
+squeezelite_name: MusicMouse
+pi_shairport_name: MusicMouse
+alsa_card_name: sndrpihifiberry
+hifiberry_overlay: hifiberry-dacplus
+sensor_room_name: Kinderzimmer
+sensor_room_name_ascii: kinderzimmer
+main_user: root
+
+mediapi_has_hifiberry_amp: true
+mediapi_install_bluetooth_monitor: true
+mediapi_install_kidsmusic: true

host_vars/musikserverwohnzimmeroben.yml

@@ -0,0 +1,12 @@
+---
+squeezelite_name: Wohnzimmer
+pi_shairport_name: _Oben_Wohnzimmer
+alsa_card_name: sndrpihifiberry
+sensor_room_name_ascii: wohnzimmeroben
+sensor_room_name: WohnzimmerOben
+hifiberry_overlay: hifiberry-dacplus
+main_user: root
+
+mediapi_has_hifiberry_amp: true
+mediapi_ir_control: irserver
+mediapi_has_dhtsensor: true

inventory.yml

@@ -13,23 +13,6 @@ all:
           sensor_room_name: prusaprinter
           pi_dhtsensor_dht_pin: 26
           main_user: root
-        bedroompi:
-          squeezelite_name: BedroomPi
-          pi_shairport_name: BedroomPi
-          alsa_card_name: Codec
-          sensor_room_name_ascii: schlafzimmer
-          sensor_room_name: Schlafzimmer
-          my_bt_monitor_watchdog_seconds: 600
-          my_btmonitor_restart_ble_interface: hci0
-          main_user: root
-        kitchenpi:
-          squeezelite_name: KitchenPi
-          pi_shairport_name: KitchenPi
-          alsa_card_name: 0
-          sensor_room_name_ascii: kueche
-          sensor_room_name: Küche
-          hifiberry_overlay: hifiberry-amp
-          main_user: root
         esszimmerradio: # oben, eltern
           squeezelite_name: Esszimmer
           pi_shairport_name: _Oben_Esszimmer
@@ -38,22 +21,6 @@ all:
           configure_wifi: true
           alsa_card_name: 1
           main_user: root
-        musikserverwohnzimmeroben: # oben, eltern
-          squeezelite_name: Wohnzimmer
-          pi_shairport_name: _Oben_Wohnzimmer
-          alsa_card_name: sndrpihifiberry
-          sensor_room_name_ascii: wohnzimmeroben
-          sensor_room_name: WohnzimmerOben
-          hifiberry_overlay: hifiberry-dacplus
-          main_user: root
-        musicmouse:
-          squeezelite_name: MusicMouse
-          pi_shairport_name: MusicMouse
-          alsa_card_name: sndrpihifiberry
-          hifiberry_overlay: hifiberry-dacplus
-          sensor_room_name: Kinderzimmer
-          sensor_room_name_ascii: kinderzimmer
-          main_user: root
         newrpi:
           squeezelite_name: MyTestRaspberry
           pi_shairport_name: MyTestRaspberry
@@ -70,9 +37,17 @@ all:
         homeassistant:
           sensor_room_name: Anschlussraum
           sensor_room_name_ascii: anschlussraum
+      children:
+        mediapis:
+          hosts:
+            musikserverwohnzimmeroben:
+            kitchenpi:
+            bedroompi:
+            musicmouse:
   vars:
     ansible_user: root
     ansible_python_interpreter: /usr/bin/python3
+    ansible_ssh_common_args: "-o ForwardAgent=yes"
     pi_squeezelite_squeezeserver: 192.168.178.80
     router_ip: 192.168.178.1
     home_assistant_url: https://ha.bauer.tech

justfile

@@ -22,7 +22,7 @@ ping group="all":
 inventory:
     {{venv_bin}}/ansible-inventory --graph
 
-# Syntax-check a playbook, e.g. `just syntax full.yml`
+# Syntax-check a playbook, e.g. `just syntax mediapis.yml`
 syntax playbook:
     {{venv_bin}}/ansible-playbook {{playbook}} --syntax-check
 
@@ -30,13 +30,13 @@ syntax playbook:
 check playbook limit="all":
     {{venv_bin}}/ansible-playbook {{playbook}} --limit {{limit}} --check --diff
 
-# Run a playbook against a host/group, e.g. `just run full.yml kitchenpi`
+# Run a playbook against a host/group, e.g. `just run mediapis.yml kitchenpi`
 run playbook limit="all":
     {{venv_bin}}/ansible-playbook {{playbook}} --limit {{limit}}
 
-# Run full.yml (pi roles) against one host/group, e.g. `just full kitchenpi`
-full limit="all":
-    just run full.yml {{limit}}
+# Run mediapis.yml (pi roles) against one host/group, e.g. `just mediapis kitchenpi`
+mediapis limit="all":
+    just run mediapis.yml {{limit}}
 
 # Run server.yml against the server host
 server:

mediapis.yml

@@ -0,0 +1,23 @@
+---
+- name: Media Pis (squeezelite/shairport audio players)
+  hosts: mediapis
+  roles:
+    - unattended_upgrades
+    - pi_modern_shell_env
+    - pi_standard_setup
+    - role: pi_hifiberry_amp
+      when: mediapi_has_hifiberry_amp
+    - role: pi_musicmouse
+      when: mediapi_install_kidsmusic
+    - pi_squeezelite_custom
+    - pi_shairport
+    - role: pi_irserver
+      when: mediapi_ir_control == 'irserver'
+    - role: pi_lirc
+      when: mediapi_ir_control == 'lirc'
+    - role: pi_dhtsensor
+      when: mediapi_has_dhtsensor
+    - role: pi_disable_onboard_bluetooth
+      when: mediapi_disable_onboard_bluetooth
+    - role: bluetooth_monitor
+      when: mediapi_install_bluetooth_monitor

roles/pi_modern_shell_env/defaults/main.yml

@@ -12,9 +12,14 @@ pi_modern_shell_env_packages:
   - tmux
   - curl
 
-# oh-my-posh isn't packaged in apt; installed via the official script
-# instead, matching the prompt used in ~/nixconfig's home-manager setup.
-pi_modern_shell_env_ohmyposh_install_url: https://ohmyposh.dev/install.sh
+# oh-my-posh isn't packaged in apt; the binary is fetched directly from its
+# CDN instead (see tasks/main.yml for why we don't use the official install
+# script), matching the prompt used in ~/nixconfig's home-manager setup.
+pi_modern_shell_env_ohmyposh_arch_map:
+  x86_64: amd64
+  aarch64: arm64
+  armv6l: arm
+  armv7l: arm
 
 pi_modern_shell_env_target_user: "{{ main_user | default('root') }}"
 

roles/pi_modern_shell_env/tasks/main.yml

@@ -17,17 +17,17 @@
     dest: /usr/local/bin/bat
     state: link
 
-- name: Download oh-my-posh install script
+- name: Download oh-my-posh binary
   ansible.builtin.get_url:
-    url: "{{ pi_modern_shell_env_ohmyposh_install_url }}"
-    dest: /tmp/ohmyposh-install.sh
+    # The official install script's own curl-based downloads are blocked by
+    # oh-my-posh's CDN on some devices (observed on Raspberry Pi OS's curl
+    # build: TLS handshake fails with SSL_ERROR_SYSCALL), while Ansible's
+    # get_url (Python urllib) succeeds against the same CDN. Download the
+    # binary directly instead of shelling out to the install script.
+    url: "https://cdn.ohmyposh.dev/releases/latest/posh-linux-{{ pi_modern_shell_env_ohmyposh_arch_map[ansible_architecture] }}"
+    dest: /usr/local/bin/oh-my-posh
     mode: "0755"
 
-- name: Run oh-my-posh install script
-  ansible.builtin.command:
-    cmd: /tmp/ohmyposh-install.sh -d /usr/local/bin
-    creates: /usr/local/bin/oh-my-posh
-
 - name: Determine target user's home directory
   ansible.builtin.set_fact:
     pi_modern_shell_env_target_home: "{{ '/root' if pi_modern_shell_env_target_user == 'root' else '/home/' + pi_modern_shell_env_target_user }}"