konairius/homelab
10
0
Fork 0
Code Issues 10 Pull Requests 1 Packages Projects Releases 1 Wiki Activity

feat(ansible): update-os play + pipeline for host package upgrades #1421

Merged
k.renner merged 2 commits from feat/update-os into main 2026-10-22 09:59:13 +00:00
Conversation 2 Commits 2 Files Changed 3
+200
2 Commits
Author SHA1 Message Date
claude-botandClaude Opus 5.5 9439e0d58c fix(os-update): reboot when the booted kernel is no longer installed
ci/woodpecker/pr/ci-scripts-test Pipeline was successful
Details
ci/woodpecker/pr/ci-manifests-test Pipeline was successful
Details
ci/woodpecker/deployment/update-os Pipeline was successful
Details 
Review #1811: on Arch the reboot only fired when this run's pacman task
changed something, while the post-reboot check looks at host state. A
host whose newer kernel was installed by an interrupted earlier run (or
by hand) skipped the reboot, failed the kernel check and stopped the
whole run. The play now also reboots when /usr/lib/modules/$(uname -r)
is gone before the reboot step.

Also from the review:
- assert >= 1 GiB free on / before upgrading (edge-1 runs from a
  6.6 GiB eMMC root, 2.1 GiB free on 2026-10-22)
- play comment names the groups it covers instead of 'every host'
- pipeline comment points at the README 02:00-05:00 window

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-22 11:55:18 +02:00
claude-botandClaude Opus 5.5 92615c0402 feat(ansible): add update-os play and pipeline for host package upgrades
ci/woodpecker/pr/ci-manifests-test Pipeline is running
Details
ci/woodpecker/pr/ci-scripts-test Pipeline was successful
Details 
Since 52899ecb (#625) removed plays/update.yml and the update-all
pipeline together with the Proxmox fleet, nothing upgrades the remaining
Ansible hosts. proxy-1/2 and edge-1 (Arch) and netbird (Ubuntu) all run
kernels affected by CVE-2026-99999.

os-update role, per host:
- records failed systemd units and running docker containers
- Arch: archlinux-keyring first, then pacman -Syu
- Debian/Ubuntu: apt full-upgrade + autoremove
- reboots when pacman changed something / reboot-required is set
- asserts the running kernel is the installed one (Arch) or no reboot
  is pending (Debian)
- waits until every previously running container is back and no new
  failed units appear

update-os.yml runs netbird_proxy, then edge_host, then netbird_server,
serial: 1 with max_fail_percentage: 0, so the first failing host stops
the whole run before the next host is touched.

The pipeline is deployment-only (target update-os): edge-1 is the sole
NTP server and carries Z-Wave and the heating CAN bus, and netbird is
the control plane; neither may reboot on a cron.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-22 10:04:28 +02:00