---
# Deliberate, fleet-wide package update run. Decoupled on purpose from
# full.yml/server.yml (which use state: present and must stay idempotent/
# no-op on routine runs) — this is the one place packages actually get
# upgraded.
#
# Ad hoc run:
#   just update <limit>
#   venv/bin/ansible-playbook update-packages.yml --limit <host_or_group>
#
# Dry run first:
#   venv/bin/ansible-playbook update-packages.yml --limit <host_or_group> --check --diff
#
# Scheduling: not automated yet. When you're ready, the simplest option is
# a crontab entry on whichever machine you normally run ansible-playbook
# from, e.g. weekly at 04:00 on Sundays:
#   0 4 * * 0 cd /path/to/this/repo && venv/bin/ansible-playbook update-packages.yml >> update.log 2>&1
# Adjust the schedule by editing that line (`crontab -e`). Note this only
# fires if that machine is on and networked at the scheduled time.
#
# upgrade type tradeoff (update_packages_upgrade_type, default "safe"):
#   safe  - upgrades packages in place, never installs/removes packages to
#           resolve dependencies. Won't silently swap out a kernel
#           meta-package or drop something. Recommended default for an
#           unattended/fleet-wide run.
#   dist  - full upgrade, will install/remove packages as needed (kernel
#           transitions, etc). More thorough, more surprising. Use
#           deliberately: `-e update_packages_upgrade_type=dist`.
- name: Update packages across the fleet
  hosts: all
  vars:
    update_packages_upgrade_type: safe
    update_packages_autoremove: false
  tasks:
    - name: Update apt cache and upgrade packages
      ansible.builtin.apt:
        update_cache: true
        upgrade: "{{ update_packages_upgrade_type }}"
        autoremove: "{{ update_packages_autoremove }}"
      register: update_packages_result

    - name: Check whether a reboot is required after this upgrade
      ansible.builtin.stat:
        path: /var/run/reboot-required
      register: update_packages_reboot_required

    - name: Report reboot required
      ansible.builtin.debug:
        msg: "Reboot required on {{ inventory_hostname }}"
      when: update_packages_reboot_required.stat.exists