From 73e77bde703ce52026e19edd56d482e89afa46ba Mon Sep 17 00:00:00 2001 From: June Date: Mon, 18 May 2026 18:14:51 +0200 Subject: [PATCH 1/3] tag plays in playbooks (instead of tasks in roles) --- playbooks/deploy.yaml | 43 +++++++++++++++++++ playbooks/maintenance.yaml | 6 +++ .../handlers/main.yaml | 1 - .../tasks/disable.yaml | 3 -- .../tasks/enable.yaml | 4 -- .../tasks/main.yaml | 2 - roles/knot/handlers/main.yaml | 3 -- roles/knot/tasks/01-install.yaml | 1 - roles/knot/tasks/02-configure.yaml | 4 -- roles/knot/tasks/03-configure-exporter.yaml | 2 - 10 files changed, 49 insertions(+), 20 deletions(-) diff --git a/playbooks/deploy.yaml b/playbooks/deploy.yaml index a3b047b..ad866cc 100644 --- a/playbooks/deploy.yaml +++ b/playbooks/deploy.yaml @@ -3,69 +3,98 @@ hosts: base_config_hosts roles: - base_config + tags: + - base_config - name: Ensure systemd-networkd config deployment on systemd_networkd_hosts hosts: systemd_networkd_hosts roles: - systemd_networkd + tags: + - systemd_networkd - name: Ensure nftables deployment on nftables_hosts hosts: nftables_hosts roles: - nftables + tags: + - nftables - name: Ensure deployment of infrastructure authorized keys hosts: infrastructure_authorized_keys_hosts roles: - infrastructure_authorized_keys + tags: + - infrastructure_authorized_keys - name: Ensure Nextcloud config hosts: nextcloud_hosts roles: - nextcloud + tags: + - nextcloud - name: Ensure ola deployment on ola_hosts hosts: ola_hosts roles: - ola + tags: + - ola - name: Ensure foobazdmx deployment on foobazdmx_hosts hosts: foobazdmx_hosts roles: - foobazdmx + tags: + - foobazdmx - name: Ensure Dokuwiki config hosts: wiki_hosts roles: - dokuwiki + tags: + - dokuwiki - name: Ensure NetBox deployment on netbox_hosts hosts: netbox_hosts roles: - netbox + tags: + - netbox - name: Ensure NGINX deployment on nginx_hosts, which are also public_reverse_proxy_hosts, before certbot role runs hosts: nginx_hosts:&public_reverse_proxy_hosts roles: - nginx + tags: + - nginx + - public_reverse_proxy - name: Ensure certbot and certificate deployment on certbot_hosts hosts: certbot_hosts roles: - certbot + tags: + - certbot - name: Ensure OnlyOffice custom fonts ansible.builtin.import_playbook: onlyoffice_fonts.yaml + tags: + - onlyoffice_fonts - name: Ensure Docker Compose deployment on docker_compose_hosts hosts: docker_compose_hosts roles: - docker_compose + tags: + - docker_compose - name: Ensure NGINX deployment on nginx_hosts hosts: nginx_hosts:!public_reverse_proxy_hosts roles: - nginx + tags: + - nginx - name: Configure unattended upgrades for all non-hypervisors hosts: all:!hypervisors @@ -77,32 +106,46 @@ - "o=${distro_id},n=${distro_codename}" - "o=Docker,n=${distro_codename}" - "o=nginx,n=${distro_codename}" + tags: + - unattended_upgrades - name: Ensure Alloy is installed and Setup on alloy_hosts hosts: alloy_hosts become: true roles: - alloy + tags: + - alloy - name: Ensure ansible_pull deployment on ansible_pull_hosts hosts: ansible_pull_hosts roles: - ansible_pull + tags: + - ansible_pull - name: Ensure msmtp is setup on msmtp_hosts hosts: msmtp_hosts roles: - msmtp + tags: + - msmtp - name: Ensure Renovate is setup on renovate_hosts hosts: renovate_hosts roles: - renovate + tags: + - renovate - name: Run ensure_eh22_styleguide_dir Playbook ansible.builtin.import_playbook: ensure_eh22_styleguide_dir.yaml + tags: + - eh22_styleguide_dir - name: Setup authoritative dns servers hosts: auth-dns roles: - knot + tags: + - knot diff --git a/playbooks/maintenance.yaml b/playbooks/maintenance.yaml index c912a53..9fe3886 100644 --- a/playbooks/maintenance.yaml +++ b/playbooks/maintenance.yaml @@ -1,5 +1,7 @@ - name: Ensure NGINX repo setup and nginx install on relevant hosts hosts: nginx_hosts:nextcloud_hosts + tags: + - nextcloud_nginx tasks: - name: Ensure NGINX repo is setup ansible.builtin.include_role: @@ -13,6 +15,8 @@ - name: Ensure Docker repo setup and package install on relevant hosts hosts: docker_compose_hosts:nextcloud_hosts + tags: + - nextcloud_docker tasks: - name: Ensure Docker repo is setup ansible.builtin.include_role: @@ -28,6 +32,8 @@ hosts: all:!hypervisors roles: - apt_update_and_upgrade + tags: + - apt_update_and_upgrade - name: Run deploy Playbook ansible.builtin.import_playbook: deploy.yaml diff --git a/roles/deploy_systemd_resolved_config/handlers/main.yaml b/roles/deploy_systemd_resolved_config/handlers/main.yaml index b40760b..05b7521 100644 --- a/roles/deploy_systemd_resolved_config/handlers/main.yaml +++ b/roles/deploy_systemd_resolved_config/handlers/main.yaml @@ -1,6 +1,5 @@ --- - name: "reload systemd-resolved" - tags: [ "deploy_systemd_resolved_config" ] become: true ansible.builtin.systemd: name: "systemd-resolved.service" diff --git a/roles/deploy_systemd_resolved_config/tasks/disable.yaml b/roles/deploy_systemd_resolved_config/tasks/disable.yaml index 9092116..afa646a 100644 --- a/roles/deploy_systemd_resolved_config/tasks/disable.yaml +++ b/roles/deploy_systemd_resolved_config/tasks/disable.yaml @@ -1,13 +1,11 @@ --- - name: Ensure /etc/resolv.conf is a plain file - tags: [ "deploy_systemd_resolved_config" ] become: true ansible.builtin.file: path: "/etc/resolv.conf" state: file - name: Write nameserver config directly into /etc/resolv.conf - tags: [ "deploy_systemd_resolved_config" ] become: true ansible.builtin.template: src: "resolv.conf.j2" @@ -17,7 +15,6 @@ mode: u=rw,g=r,o=r - name: Disable systemd-resolved - tags: [ "deploy_systemd_resolved_config" ] become: true ansible.builtin.systemd: name: "systemd-resolved.service" diff --git a/roles/deploy_systemd_resolved_config/tasks/enable.yaml b/roles/deploy_systemd_resolved_config/tasks/enable.yaml index 9a7438e..2659c32 100644 --- a/roles/deploy_systemd_resolved_config/tasks/enable.yaml +++ b/roles/deploy_systemd_resolved_config/tasks/enable.yaml @@ -1,13 +1,11 @@ --- - name: Ensure systemd-resolved is installed - tags: [ "deploy_systemd_resolved_config" ] become: true when: ansible_facts["distribution"] == "Debian" ansible.builtin.package: name: [ "systemd-resolved" ] - name: Deploy systemd-resolved config - tags: [ "deploy_systemd_resolved_config" ] become: true notify: "reload systemd-resolved" ansible.builtin.template: @@ -18,7 +16,6 @@ mode: u=rw,g=r,o=r - name: Make /etc/resolv.conf points to systemd-resolved - tags: [ "deploy_systemd_resolved_config" ] become: true when: deploy_systemd_resolved_config__mode != "extern" ansible.builtin.file: # noqa: jinja @@ -35,7 +32,6 @@ {%- endif -%} - name: Ensure systemd-resolved is running and enabled - tags: [ "deploy_systemd_resolved_config" ] become: true ansible.builtin.systemd: name: systemd-resolved.service diff --git a/roles/deploy_systemd_resolved_config/tasks/main.yaml b/roles/deploy_systemd_resolved_config/tasks/main.yaml index 00bc293..00558dc 100644 --- a/roles/deploy_systemd_resolved_config/tasks/main.yaml +++ b/roles/deploy_systemd_resolved_config/tasks/main.yaml @@ -1,10 +1,8 @@ --- - name: Include enable.yaml - tags: [ "deploy_systemd_resolved_config" ] ansible.builtin.include_tasks: enable.yaml when: deploy_systemd_resolved_config__enable - name: Include disable.yaml - tags: [ "deploy_systemd_resolved_config" ] ansible.builtin.include_tasks: disable.yaml when: not deploy_systemd_resolved_config__enable diff --git a/roles/knot/handlers/main.yaml b/roles/knot/handlers/main.yaml index 38fce75..feb3ceb 100644 --- a/roles/knot/handlers/main.yaml +++ b/roles/knot/handlers/main.yaml @@ -1,19 +1,16 @@ --- - name: reload knot - tags: [ auth-dns ] become: true ansible.builtin.systemd: name: knot.service state: reloaded - name: netplan apply - tags: [ auth-dns ] become: true changed_when: true ansible.builtin.command: "netplan apply" - name: restart knot-exporter - tags: [ auth-dns ] become: true ansible.builtin.systemd: name: knot-exporter.service diff --git a/roles/knot/tasks/01-install.yaml b/roles/knot/tasks/01-install.yaml index 0a269d6..8a5feed 100644 --- a/roles/knot/tasks/01-install.yaml +++ b/roles/knot/tasks/01-install.yaml @@ -1,6 +1,5 @@ --- - name: Install knot - tags: [ auth-dns ] become: true ansible.builtin.package: name: diff --git a/roles/knot/tasks/02-configure.yaml b/roles/knot/tasks/02-configure.yaml index 2b0b0fa..a2a8e55 100644 --- a/roles/knot/tasks/02-configure.yaml +++ b/roles/knot/tasks/02-configure.yaml @@ -1,6 +1,5 @@ --- - name: Ensure required directories exist - tags: [ auth-dns ] become: true loop: [ "/etc/knot", "/etc/knot/zones" ] ansible.builtin.file: @@ -11,7 +10,6 @@ mode: u=rwx,g=rx,o= - name: Deploy knot configuration file - tags: [ auth-dns ] become: true notify: reload knot ansible.builtin.template: @@ -22,7 +20,6 @@ mode: u=rw,g=r,o= - name: Deploy configured zones - tags: [ auth-dns ] become: true notify: reload knot loop: "{{ knot__zones }}" @@ -42,7 +39,6 @@ # this results in outgoing zone transfers failing because knot will prefer to use the dynamic address over the statically configured one. # so because we are configuring a DNS Nameserver where known IP-Addresses are actually important for ACL reasons, SLAAC is disabled - name: Disable IPv6 SLAAC - tags: [ auth-dns ] become: true notify: netplan apply ansible.builtin.template: diff --git a/roles/knot/tasks/03-configure-exporter.yaml b/roles/knot/tasks/03-configure-exporter.yaml index 4254acb..8077ecd 100644 --- a/roles/knot/tasks/03-configure-exporter.yaml +++ b/roles/knot/tasks/03-configure-exporter.yaml @@ -1,5 +1,4 @@ - name: Deploy knot-exporter systemd unit - tags: [ auth-dns ] become: true register: knot_deploy_service_file notify: restart knot-exporter @@ -11,7 +10,6 @@ mode: u=rw,g=r,o=r - name: Ensure knot-exporter is running and enabled - tags: [ auth-dns ] become: true ansible.builtin.systemd: name: knot-exporter.service From e3eda21e2fe43845d3ce28865cea989da72492bb Mon Sep 17 00:00:00 2001 From: Renovate Date: Mon, 18 May 2026 22:31:24 +0000 Subject: [PATCH 2/3] Update docker.io/pretalx/standalone Docker tag to v2025.2.3 --- resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2 | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2 b/resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2 index 0bbfcb8..78dba42 100644 --- a/resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2 +++ b/resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2 @@ -33,7 +33,7 @@ services: - pretalx_net pretalx: - image: docker.io/pretalx/standalone:v2025.1.0 + image: docker.io/pretalx/standalone:v2025.2.3 entrypoint: gunicorn command: - "pretalx.wsgi" @@ -78,7 +78,7 @@ services: - pretalx_net celery: - image: docker.io/pretalx/standalone:v2025.1.0 + image: docker.io/pretalx/standalone:v2025.2.3 command: - taskworker restart: unless-stopped From 6d2a1c11a89e906511ff0245c0d9064a1fce7ed2 Mon Sep 17 00:00:00 2001 From: Renovate Date: Tue, 19 May 2026 06:46:06 +0000 Subject: [PATCH 3/3] Update docker.io/pretalx/standalone Docker tag to v2025.2.3 --- resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2 | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2 b/resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2 index 0bbfcb8..78dba42 100644 --- a/resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2 +++ b/resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2 @@ -33,7 +33,7 @@ services: - pretalx_net pretalx: - image: docker.io/pretalx/standalone:v2025.1.0 + image: docker.io/pretalx/standalone:v2025.2.3 entrypoint: gunicorn command: - "pretalx.wsgi" @@ -78,7 +78,7 @@ services: - pretalx_net celery: - image: docker.io/pretalx/standalone:v2025.1.0 + image: docker.io/pretalx/standalone:v2025.2.3 command: - taskworker restart: unless-stopped