Robin Miller

- name: Update LXC containers in controlled batches
  hosts: lxc_all
  serial: 5
  tasks:
    - name: Apply pending upgrades
      ansible.builtin.apt:
        update_cache: true
        upgrade: dist

    - name: Health check — compose stack still running?
      ansible.builtin.command: docker compose ps --status running -q
      args:
        chdir: /opt/{{ service_name }}
      register: health
      changed_when: false
      failed_when: health.stdout == ""

    - name: Hold host for manual review instead of rolling on
      ansible.builtin.file:
        path: /var/lib/updates/hold/{{ inventory_hostname }}
        state: touch
      when: health is failed

module "webapp01" {
  source = "./modules/lxc-standard"

  hostname    = "webapp01"
  vmid        = 4210
  ip_address  = "192.0.2.10/24"   # documentation range — real IPs stay private
  gateway     = "192.0.2.1"
  target_node = "node01"
  cores       = 2
  memory_mb   = 2048
  disk_gb     = 16

  # the module enforces the conventions, not the caller:
  # Debian 12 template, unprivileged, onboot, firewall on,
  # backups scheduled, prevent_destroy unless marked otherwise
  tags        = ["docker", "web"]
  destroyable = false
}

#!/usr/bin/env bash
# Nightly: is the live cluster still what the Git repo says it is?
set -euo pipefail

repo=/opt/homelab
"$repo/scripts/collect/guests.sh" > "$repo/inventory/guests.yml"

cd "$repo"
if git diff --quiet -I '^# generated:' -- inventory/; then
  exit 0                     # no drift — stay silent
fi

git diff --stat -- inventory/ | tail -1 \
  | curl -s -H "Title: inventory drift detected" -H "Priority: high" \
      -d @- "https://ntfy.example.org/alerts"