Martin Bauer
f043606466
Regular playbooks now use state: present, so they no longer upgrade packages as a side effect. This adds two separate, explicit mechanisms to keep the fleet patched instead: - update-packages.yml: ad hoc / to-be-scheduled fleet-wide upgrade (safe by default, dist available via -e), plus update-packages-pinned-example.yml as a template for pinning or bumping a single package outside that. - roles/unattended_upgrades: automatic security-only patching via unattended-upgrades, with a scheduled reboot window and mail left disabled pending a configured MTA. Applied to every host in full.yml and server.yml. Also removes a leftover `upgrade: yes` apt task from pi_standard_setup and server_basic_environment that was still doing a full upgrade on every routine run, defeating the point of the state: present switch. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
56 lines
1.6 KiB
Makefile
56 lines
1.6 KiB
Makefile
venv_bin := "venv/bin"
|
|
|
|
# List available commands
|
|
default:
|
|
@just --list
|
|
|
|
# Create the Python virtualenv used to run ansible
|
|
venv:
|
|
python3 -m venv venv
|
|
{{venv_bin}}/pip install --upgrade pip
|
|
|
|
# Install Python deps (requirements.txt) and Galaxy collections (requirements.yml)
|
|
install:
|
|
{{venv_bin}}/pip install -r requirements.txt
|
|
{{venv_bin}}/ansible-galaxy collection install -r requirements.yml < /dev/null
|
|
|
|
# Ping all hosts, or a group/host, e.g. `just ping kitchenpi`
|
|
ping group="all":
|
|
{{venv_bin}}/ansible {{group}} -m ping
|
|
|
|
# Show the resolved inventory as a tree
|
|
inventory:
|
|
{{venv_bin}}/ansible-inventory --graph
|
|
|
|
# Syntax-check a playbook, e.g. `just syntax full.yml`
|
|
syntax playbook:
|
|
{{venv_bin}}/ansible-playbook {{playbook}} --syntax-check
|
|
|
|
# Dry-run a playbook against a host/group without making changes
|
|
check playbook limit="all":
|
|
{{venv_bin}}/ansible-playbook {{playbook}} --limit {{limit}} --check --diff
|
|
|
|
# Run a playbook against a host/group, e.g. `just run full.yml kitchenpi`
|
|
run playbook limit="all":
|
|
{{venv_bin}}/ansible-playbook {{playbook}} --limit {{limit}}
|
|
|
|
# Run full.yml (pi roles) against one host/group, e.g. `just full kitchenpi`
|
|
full limit="all":
|
|
just run full.yml {{limit}}
|
|
|
|
# Run server.yml against the server host
|
|
server:
|
|
just run server.yml server
|
|
|
|
# Run the deliberate fleet package-update playbook, e.g. `just update kitchenpi`
|
|
update limit="all":
|
|
just run update-packages.yml {{limit}}
|
|
|
|
# List installed Galaxy collections
|
|
collections:
|
|
{{venv_bin}}/ansible-galaxy collection list
|
|
|
|
# Lint playbooks and roles
|
|
lint:
|
|
{{venv_bin}}/ansible-lint
|