chore(deps): update dependency ansible-role-mirrors/ansible-role-unattended-upgrades to v4.1.0

Reviewed-on: #72
Co-authored-by: Michael Grote <michael.grote@posteo.de>
Co-committed-by: Michael Grote <michael.grote@posteo.de>

.woodpecker/ansible-lint.yml

@@ -8,11 +8,11 @@ steps:
     commands:
       - ansible-lint --version
       - echo $${VAULTPASS} > ./vault-pass.yml # nach des Secret in Großschreibung
-      - ansible-galaxy install -r requirements.yml
+      - ansible-galaxy install -r requirements.yaml
       - ansible-lint --force-color --format pep8
-    secrets:
-      - source: vault-pass # name des Secrets in Woodpecker/GUI
-        target: vaultpass # lower-case Name der Variable zur Verwendung in dem CI-File, wird dann so genutzt $${VAULTPASS}
+    # https://woodpecker-ci.org/docs/usage/secrets#use-secrets-in-commands
+    secrets: [vaultpass]
     when:
-      - evaluate: 'CI_COMMIT_AUTHOR_EMAIL != "renovate@mgrote.net"'
+      - event: [push, pull_request, cron]
+        evaluate: 'CI_COMMIT_AUTHOR_EMAIL != "renovate@mgrote.net"'
 ...

.woodpecker/gitleaks.yml

@@ -5,5 +5,6 @@ steps:
     commands:
       - gitleaks detect --no-git --verbose --source $CI_WORKSPACE
     when:
-      - evaluate: 'CI_COMMIT_AUTHOR_EMAIL != "renovate@mgrote.net"'
+      - event: [push, pull_request, cron]
+        evaluate: 'CI_COMMIT_AUTHOR_EMAIL != "renovate@mgrote.net"'
 ...

docker-compose/httpd/docker-compose.yml.j2

@@ -2,7 +2,7 @@ version: '3'
 services:
   httpd-registry:
     container_name: "httpd-registry"
-    image: "registry.mgrote.net/httpd:v1.1.43"
+    image: "registry.mgrote.net/httpd:latest"
     restart: always
     volumes:
       - uploads:/usr/local/apache2/htdocs/
@@ -17,7 +17,7 @@ services:
 
   python-api-server:
     container_name: httpd-api
-    image: "registry.mgrote.net/python-api-server:v1.1.148"
+    image: "registry.mgrote.net/python-api-server:latest"
     restart: always
     ports:
       - "5040:5000"

docker-compose/mail-relay/docker-compose.yml.j2

@@ -1,7 +1,7 @@
 version: '3.3'
 services:
   postfix:
-    image: "registry.mgrote.net/postfix:v1.1.196"
+    image: "registry.mgrote.net/postfix:latest"
     container_name: mail-relay
     restart: always
     ports:

docker-compose/miniflux/docker-compose.yml.j2

@@ -3,7 +3,7 @@ services:
 ######## Miniflux ########
   miniflux:
     container_name: "mf-frontend"
-    image: "ghcr.io/miniflux/miniflux:2.1.2"
+    image: "ghcr.io/miniflux/miniflux:2.1.3"
     restart: always
     depends_on:
       - mf-db16
@@ -34,7 +34,7 @@ services:
 ######## Postgres ########
   mf-db16:
     container_name: "mf-db16"
-    image: "postgres:16.2"
+    image: "postgres:16.3"
     restart: always
     environment:
       POSTGRES_USER: miniflux
@@ -62,7 +62,7 @@ services:
       MF_API_URL: https://miniflux.mgrote.net/v1
       MF_SLEEP: 600
       #MF_DEBUG: 1
-    image: "registry.mgrote.net/miniflux-filter:v1.1.101"
+    image: "registry.mgrote.net/miniflux-filter:latest"
     volumes:
       - ./filter.txt:/data/filter.txt
     networks:

docker-compose/miniflux/filter.txt

@@ -286,3 +286,4 @@ www.army-technology.com::who are the leaders
 www.army-technology.com::files patent
 www.army-technology.com::sees highest patent filings
 www.army-technology.com::theme innovation strategy
+www.army-technology.com::gets grant

docker-compose/munin/docker-compose.yml.j2

@@ -2,7 +2,7 @@ version: '3'
 services:
   munin:
     container_name: "munin-master"
-    image: registry.mgrote.net/munin-server:v1.1.80
+    image: registry.mgrote.net/munin-server:latest
     restart: always
     environment:
       MAILCONTACT: michael.grote@posteo.de

docker-compose/navidrome/docker-compose.yml.j2

@@ -3,7 +3,7 @@ services:
 ######## navidrome-mg ########
   navidrome-mg:
     container_name: "navidrome-mg"
-    image: "deluan/navidrome:0.51.1"
+    image: "deluan/navidrome:0.52.5"
     restart: always
     environment:
       ND_LOGLEVEL: info

docker-compose/nextcloud/docker-compose.yml.j2

@@ -25,7 +25,8 @@ services:
         [
           "CMD",
           "healthcheck.sh",
-          "--connect",
+          "--su-mysql",
+          "--connect"
         ]
       timeout: 30s
 
@@ -54,7 +55,7 @@ services:
 ######## cron ########
   nextcloud-cron:
     container_name: nextcloud-cron
-    image: "registry.mgrote.net/nextcloud-cronjob:v1.1.89"
+    image: "registry.mgrote.net/nextcloud-cronjob:latest"
     restart: unless-stopped
     network_mode: none
     volumes:
@@ -66,7 +67,7 @@ services:
 
 ######## Nextcloud ########
   nextcloud-app:
-    image: "nextcloud:28.0.4"
+    image: "nextcloud:29.0.0"
     container_name: nextcloud-app
     restart: unless-stopped
     depends_on:
@@ -92,6 +93,9 @@ services:
         PHP_UPLOAD_LIMIT: 10G
         APACHE_DISABLE_REWRITE_IP: 1
         TRUSTED_PROXIES: "192.168.48.0/24" # Subnetz in dem sich traefik befindet
+        NEXTCLOUD_UPLOAD_LIMIT: 10G
+        NEXTCLOUD_MAX_TIME: 3600
+        APACHE_BODY_LIMIT: 0 # unlimited, https://github.com/nextcloud/docker/issues/1796
     volumes:
       - app:/var/www/html
       - data:/var/www/html/data

docker-compose/registry/docker-compose.yml.j2

@@ -84,7 +84,7 @@ services:
       - traefik
       - intern
     healthcheck:
-      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost"]
+      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://127.0.0.1"]
       interval: 30s
       timeout: 10s
       retries: 3

docker-compose/routeros-config-export/docker-compose.yml

@@ -3,7 +3,7 @@ services:
   routeros-config-export:
     container_name: routeros-config-export
     restart: always
-    image: "registry.mgrote.net/routeros-config-export:v1.1.138"
+    image: "registry.mgrote.net/routeros-config-export:latest"
     volumes:
       - ./key_rb5009:/key_rb5009:ro
       - ./key_hex:/key_hex:ro
@@ -15,7 +15,7 @@ services:
               hex.mgrote.net,routeros-config-backup,/key_hex
               crs305.mgrote.net,routeros-config-backup,/key_crs305
       GIT_REPO_BRANCH: "master"
-      GIT_REPO_URL: "gitea@forgejo.mgrote.net:mg/routeros-configs.git"
+      GIT_REPO_URL: "ssh://gitea@forgejo.mgrote.net:2222/mg/routeros-configs.git"
       GIT_REPO_DEPLOY_KEY: "/deploy_token"
       GIT_USERNAME: oxidized-selfmade
       GIT_USER_MAIL: michael.grote@posteo.de

docker-compose/traefik/docker-compose.yml.j2

@@ -3,7 +3,7 @@ services:
 ######## traefik ########
   traefik:
     container_name: traefik
-    image: "traefik:v3.0"
+    image: "traefik:v3.0.0"
     restart: always
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro
@@ -47,6 +47,11 @@ services:
       - "./passwd:/passwd:ro" # Mount local passwd file at /passwd as read only
     networks:
       - traefik
+    healthcheck:
+      test: ["CMD", "wget", "--quiet", "--spider", "--tries=1", "http://127.0.0.1:3000/login"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
 
 ######## Networks ########
 networks:

docker-compose/unifi-network-application/docker-compose.yml.j2

@@ -45,7 +45,7 @@ services:
     # 1. mongosh
     # 2. db.getSiblingDB("unifidb").createUser({user: "unifiuser", pwd: "GEHEIM", roles: [{role: "dbOwner", db: "unifidb"}, {role: "dbOwner", db: "unifidb_stat"}]});
     # https://discourse.linuxserver.io/t/cant-connect-to-mongodb-for-unifi-network-application/8166
-    image: "docker.io/mongo:7.0.8"
+    image: "docker.io/mongo:7.0.9"
     container_name: unifi-db
     volumes:
       - db-data:/data/db

docker-compose/wiki/docker-compose.yml.j2

@@ -2,7 +2,7 @@ version: '3'
 services:
   wiki-webserver:
     container_name: wiki-webserver
-    image: "registry.mgrote.net/httpd:v1.1.43"
+    image: "registry.mgrote.net/httpd:latest"
     restart: always
     networks:
       - traefik

group_vars/all.yml

@@ -178,7 +178,7 @@ sanoid_templates:
     autoprune: 'yes'
 
 ### mgrote_zfs_sanoid
-sanoid_deb_url: http://docker10.mgrote.net:3344/sanoid_3.0.4.deb
+sanoid_deb_url: http://docker10.mgrote.net:3344/sanoid_v2.2.0.deb
 
 ### mgrote_munin_node
 munin_node_bind_host: "0.0.0.0"

group_vars/blocky.yml

@@ -80,7 +80,7 @@ blocky_custom_lookups: # optional
     ip: 192.168.3.239
   - name: pve5-test.mgrote.net
     ip: 192.168.2.17
-  - name: pve5.mgrote.net # bleibt im Router auch angelegt, weil wenn pve aus auch kein blocky ;-)
+  - name: pve5.mgrote.net # bleibt im Router auch angelegt, weil wenn pve aus auch kein blocky mehr ;-)
     ip: 192.168.2.16
   - name: rb5009.mgrote.net
     ip: 192.168.2.1
@@ -89,7 +89,6 @@ blocky_custom_lookups: # optional
   - name: ldap.mgrote.net
     ip: 192.168.2.47
 
-
 ### mgrote_munin_node
 # kann git.mgrote.net nicht auflösen, deshalb hiermit IP
 munin_node_plugins:

group_vars/git.yml

@@ -43,6 +43,11 @@ ufw_rules:
     protocol: tcp
     comment: 'gitea'
     from_ip: 0.0.0.0/0
+  - rule: allow
+    to_port: "{{ gitea_ssh_port }}"
+    protocol: tcp
+    comment: 'gitea'
+    from_ip: 0.0.0.0/0
 
 ### ansible_role_gitea
 # https://git.mgrote.net/ansible-roles-mirrors/ansible_role_gitea
@@ -61,9 +66,9 @@ gitea_configuration_path: "/etc/gitea" # anpassen
 gitea_app_name: "forgejo"
 gitea_fqdn: "git.mgrote.net"
 # ssh
-gitea_ssh_port: 22 # assuming the host SSH server is running on port 22
-gitea_start_ssh: false # to not start the built-in SSH server
-gitea_shell: "/bin/bash"
+gitea_ssh_port: 2222
+gitea_start_ssh: true
+gitea_shell: "/bin/false"
 # Repository
 gitea_default_branch: "master"
 gitea_default_private: "public"

group_vars/pve.yml

@@ -28,6 +28,13 @@ users:
     allow_sudo: true
     allow_passwordless_sudo: true
 
+### mgrote_cv4pve_autosnap
+cv4pve_api_user: root@pam!cv4pve-autosnap
+cv4pve_api_token: "{{ lookup('keepass', 'cv4pve_api_token', 'password') }}"
+cv4pve_vmid: all,-115
+cv4pve_keep_snapshots: 5
+cv4pve_version: "v1.14.8"
+
 ### mgrote_apt_manage_packages
 apt_packages_extra:
   - ifupdown2

host_vars/pve5-test.mgrote.net.yml

@@ -153,13 +153,6 @@ sanoid_datasets:
     snapshots: true
     template: '3tage'
 
-### mgrote_cv4pve-autosnap
-cv4pve_api_user: root@pam!cv4pve-autosnap
-cv4pve_api_token: "{{ lookup('keepass', 'cv4pve_api_token', 'password') }}"
-cv4pve_vmid: all
-cv4pve_keep_snapshots: 5
-cv4pve_dl_link: "https://github.com/Corsinvest/cv4pve-autosnap/releases/download/v1.10.0/cv4pve-autosnap-linux-x64.zip"
-
 ### mgrote_proxmox_bind_mounts
 pve_bind_mounts:
   - vmid: 100

host_vars/pve5.mgrote.net.yml

@@ -170,13 +170,6 @@ sanoid_datasets:
     snapshots: true
     template: 'pve3tage'
 
-### mgrote_cv4pve-autosnap
-cv4pve_api_user: root@pam!cv4pve-autosnap
-cv4pve_api_token: "{{ lookup('keepass', 'cv4pve_api_token', 'password') }}"
-cv4pve_vmid: all,-115
-cv4pve_keep_snapshots: 5
-cv4pve_dl_link: "https://github.com/Corsinvest/cv4pve-autosnap/releases/download/v1.14.7/cv4pve-autosnap-linux-x64.zip"
-
 ### mgrote_proxmox_bind_mounts
 pve_bind_mounts:
   ### fileserver3

playbooks/3_service/pve.yml

@@ -16,7 +16,8 @@
     - role: mgrote_smart
       tags: "smart"
     - role: mgrote_cv4pve_autosnap
-      tags: "cv4pve"
+      tags: cv4pve
+      become: true
     - role: mgrote_proxmox_bind_mounts
       tags: "bindmounts"
     - role: mgrote_proxmox_lxc_profiles

requirements.yaml

@@ -1,26 +1,30 @@
 collections:
-  - git+https://git.mgrote.net/ansible-collection-mirrors/community.general
-  - git+https://git.mgrote.net/ansible-collection-mirrors/community.crypto
-  - git+https://git.mgrote.net/ansible-collection-mirrors/ansible.posix
-  - git+https://git.mgrote.net/ansible-collection-mirrors/community.docker
+  - name: community.general
+    version: "8.6.0"
+  - name: community.crypto
+    version: "2.19.1"
+  - name: ansible.posix
+    version: "1.5.4"
+  - name: community.docker
+    version: "3.9.0"
 roles:
   - src: https://git.mgrote.net/ansible-role-mirrors/ansible-role-bootstrap
-    scm: git
+    version: "6.2.5"
   - src: https://git.mgrote.net/ansible-role-mirrors/ansible-ufw
-    scm: git
+    version: "v4.1.13"
   - src: https://git.mgrote.net/ansible-role-mirrors/ansible-manage-lvm
-    scm: git
+    version: "v0.2.11"
   - src: https://git.mgrote.net/ansible-role-mirrors/ansible-role-unattended-upgrades
-    scm: git
+    version: "v4.1.0"
   - src: https://git.mgrote.net/ansible-role-mirrors/ansible-role-pip
-    scm: git
+    version: "3.0.3"
   - src: https://git.mgrote.net/ansible-role-mirrors/ansible-role-nfs
-    scm: git
+    version: "2.0.0"
   - src: https://git.mgrote.net/ansible-role-mirrors/ansible-role-docker
-    scm: git
+    version: "7.1.0"
   - src: https://git.mgrote.net/ansible-role-mirrors/ansible_role_ctop
-    scm: git
+    version: "1.1.6"
   - src: https://git.mgrote.net/ansible-role-mirrors/ansible_role_gitea
-    scm: git
+    version: "v3.4.2"
   - src: https://git.mgrote.net/ansible-role-mirrors/ansible-role-postgresql
-    scm: git
+    version: "3.5.1"

roles/mgrote_cv4pve_autosnap/README.md

@@ -1,11 +0,0 @@
-## mgrote.cv4pve
-
-### Beschreibung
-Installiert [cv4pve-autosnap](https://github.com/Corsinvest/cv4pve-autosnap).
-Legt einen systemd-timer.
-
-### getestet auf
-- [x] ProxMox 7*
-
-### Variablen + Defaults
-- see [defaults](./defaults/main.yml)

roles/mgrote_cv4pve_autosnap/defaults/main.yml

@@ -3,7 +3,7 @@
 cv4pve_cron_minute: "39"
 cv4pve_cron_hour: "5"
 # proxmox api-token and user
-cv4pve_api_token: "XXXXXXXXXXXXXXXXXXXXXX"
+cv4pve_api_token: "supersecret"
 cv4pve_api_user: "root@pam!test2"
 # which vm to snapshot
 cv4pve_vmid: all
@@ -12,3 +12,7 @@ cv4pve_keep_snapshots: 3
 # under which user the script is run
 cv4pve_user_group: cv4pve
 cv4pve_user: cv4pve
+# url
+cv4pve_dl_link: https://github.com/Corsinvest/cv4pve-autosnap/releases/download/{{ cv4pve_version }}/cv4pve-autosnap-linux-x64.zip
+cv4pve_version: "v1.14.8"
+cv4pve_base_path: /usr/local/bin/cv4pve

roles/mgrote_cv4pve_autosnap/tasks/install.yml

@@ -0,0 +1,42 @@
+---
+- name: Ensure needed directories exist
+  ansible.builtin.file:
+    path: "{{ cv4pve_base_path }}"
+    state: directory
+    owner: "{{ cv4pve_user }}"
+    group: "{{ cv4pve_user_group }}"
+    mode: "0644"
+
+- name: Download specified version
+  ansible.builtin.unarchive:
+    src: "{{ cv4pve_dl_link }}"
+    dest: "{{ cv4pve_base_path }}"
+    mode: '0755'
+    owner: "{{ cv4pve_user }}"
+    group: "{{ cv4pve_user_group }}"
+    remote_src: true
+    creates: "{{ cv4pve_base_path }}/cv4pve-autosnap-{{ cv4pve_version }}"
+    list_files: true
+  register: download
+
+- name: Rename binary # noqa no-changed-when no-handler
+  ansible.builtin.command: |
+    mv "{{ cv4pve_base_path }}/cv4pve-autosnap" "{{ cv4pve_base_path }}/cv4pve-autosnap-{{ cv4pve_version }}"
+  when: download.changed
+
+# https://stackoverflow.com/questions/20252057/using-ansible-how-would-i-delete-all-items-except-for-a-specified-set-in-a-dire
+- name: Find old versions
+  ansible.builtin.find:
+    paths: "{{ cv4pve_base_path }}"
+    file_type: file
+    use_regex: false
+    excludes:
+      - "cv4pve-autosnap-{{ cv4pve_version }}"
+  register: found_files
+
+- name: Ensure old versions are absent
+  ansible.builtin.file:
+    path: "{{ item.path }}"
+    state: absent
+  with_items: "{{ found_files['files'] }}"
+...

roles/mgrote_cv4pve_autosnap/tasks/main.yml

@@ -2,74 +2,9 @@
 - name: include user tasks
   ansible.builtin.include_tasks: user.yml
 
+- name: include install tasks
+  ansible.builtin.include_tasks: install.yml
 
-- name: create directories
-  become: true
-  ansible.builtin.file:
-    path: "{{ item }}"
-    state: directory
-    owner: "{{ cv4pve_user }}"
-    group: "{{ cv4pve_user_group }}"
-    mode: "0644"
-  loop:
-    - '/tmp/cv4pve'
-    - '/usr/local/bin/cv4pve'
-
-- name: download archives
-  become: true
-  ansible.builtin.get_url:
-    url: "{{ cv4pve_dl_link }}"
-    dest: /tmp/cv4pve/cv4pve-autosnap-linux-x64.zip
-    mode: '0775'
-    owner: "{{ cv4pve_user }}"
-    group: "{{ cv4pve_user_group }}"
-
-- name: extract archives
-  become: true
-  ansible.builtin.unarchive:
-    src: /tmp/cv4pve/cv4pve-autosnap-linux-x64.zip
-    dest: /usr/local/bin/cv4pve
-    remote_src: true
-    mode: a+x
-    owner: "{{ cv4pve_user }}"
-    group: "{{ cv4pve_user_group }}"
-
-- name: template cv4pve.service
-  become: true
-  ansible.builtin.template:
-    src: cv4pve.service.j2
-    dest: /etc/systemd/system/cv4pve.service
-    owner: root
-    group: root
-    mode: "0644"
-  notify:
-    - systemctl daemon-reload
-
-- name: template cv4pve_mail.service
-  become: true
-  ansible.builtin.template:
-    src: cv4pve_mail.service.j2
-    dest: /etc/systemd/system/cv4pve_mail.service
-    owner: root
-    group: root
-    mode: "0644"
-  notify:
-    - systemctl daemon-reload
-
-- name: template cv4pve.timer
-  become: true
-  ansible.builtin.template:
-    src: cv4pve.timer.j2
-    dest: /etc/systemd/system/cv4pve.timer
-    owner: root
-    group: root
-    mode: "0644"
-  notify:
-    - systemctl daemon-reload
-
-- name: systemctl start cv4pve.timer
-  become: true
-  ansible.builtin.systemd:
-    name: cv4pve.timer
-    state: started
-    enabled: true
+- name: include systemd tasks
+  ansible.builtin.include_tasks: systemd.yml
+...

roles/mgrote_cv4pve_autosnap/tasks/systemd.yml

@@ -0,0 +1,38 @@
+---
+- name: Ensure service-unit (cv4pve) is templated
+  ansible.builtin.template:
+    src: cv4pve.service.j2
+    dest: /etc/systemd/system/cv4pve.service
+    owner: root
+    group: root
+    mode: "0644"
+  no_log: true
+  notify:
+    - systemctl daemon-reload
+
+- name: Ensure service-unit (mail) is templated
+  ansible.builtin.template:
+    src: cv4pve_mail.service.j2
+    dest: /etc/systemd/system/cv4pve_mail.service
+    owner: root
+    group: root
+    mode: "0644"
+  notify:
+    - systemctl daemon-reload
+
+- name: Ensure service-unit (timer) is templated
+  ansible.builtin.template:
+    src: cv4pve.timer.j2
+    dest: /etc/systemd/system/cv4pve.timer
+    owner: root
+    group: root
+    mode: "0644"
+  notify:
+    - systemctl daemon-reload
+
+- name: Ensure timer is started is templated
+  ansible.builtin.systemd:
+    name: cv4pve.timer
+    state: started
+    enabled: true
+...

roles/mgrote_cv4pve_autosnap/tasks/user.yml

@@ -1,5 +1,5 @@
 ---
-- name: ensure group exists
+- name: Ensure group exists
   become: true
   ansible.builtin.group:
     name: "{{ cv4pve_user_group }}"
@@ -7,7 +7,7 @@
   when:
     - cv4pve_user_group is defined
 
-- name: ensure user exists
+- name: Ensure user exists
   become: true
   ansible.builtin.user:
     name: "{{ cv4pve_user }}"
@@ -17,3 +17,4 @@
   when:
     - cv4pve_user_group is defined
     - cv4pve_user is defined
+...

roles/mgrote_cv4pve_autosnap/templates/cv4pve.service.j2

@@ -6,4 +6,4 @@ OnFailure=cv4pve_mail.service
 
 [Service]
 Type=simple
-ExecStart=/usr/local/bin/cv4pve/cv4pve-autosnap --host=127.0.0.1 --api-token {{ cv4pve_api_user }}={{ cv4pve_api_token }} --vmid="{{ cv4pve_vmid }}" snap --label='daily' --keep="{{ cv4pve_keep_snapshots }}" --state
+ExecStart={{ cv4pve_base_path }}/cv4pve-autosnap-{{ cv4pve_version }} --host=127.0.0.1 --api-token {{ cv4pve_api_user }}={{ cv4pve_api_token }} --vmid="{{ cv4pve_vmid }}" snap --label='daily' --keep="{{ cv4pve_keep_snapshots }}" --state

roles/mgrote_cv4pve_autosnap/templates/cv4pve.timer.j2

@@ -6,6 +6,5 @@ Description=Timer: Trigger VM-Snapshots in PVE with cv4pve.
 OnCalendar=*-*-* {{ cv4pve_cron_hour }}:{{ cv4pve_cron_minute }}:00
 RandomizedDelaySec=10 min
 
-
 [Install]
 WantedBy=timers.target multi-user.target

roles/mgrote_cv4pve_autosnap/templates/cv4pve_mail.service.j2

@@ -1,5 +1,4 @@
 {{ file_header | default () }}
-
 [Unit]
 Description=Send a Mail in case of an error in cv4pve.service.
 

roles/mgrote_gitea_setup/tasks/admin.yml

@@ -4,19 +4,31 @@
 # - https://github.com/lldap/lldap/blob/main/example_configs/gitea.md
 # und
 # den jeweiligen group/host-Vars!
-- name: Ensure Admin-User exists
+
+- name: Check if Admin-User exists
   no_log: true
   become_user: gitea
   become: true
+  ansible.builtin.command: |
+    forgejo admin user list \
+      --config "{{ gitea_configuration_path }}/gitea.ini"
+  register: check
+  changed_when: false
+
+- name: Ensure Admin-User exists
+  #no_log: true
+  become_user: gitea
+  become: true
   ansible.builtin.command: |
     forgejo admin user create \
-      --config /etc/gitea/gitea.ini
+      --config "{{ gitea_configuration_path }}/gitea.ini" \
       --username "{{ gitea_admin_user }}" \
       --password "{{ gitea_admin_user_pass }}" \
       --email "{{ gitea_admin_user }}@mgrote.net" \
       --admin
-  register: setup_admin
-  ignore_errors: true
-  failed_when: 'not "Command error: CreateUser: user already exists [name: mg]" in setup_admin.stderr' # fail Task wenn LDAP schon konfiguriert ist
-  changed_when: "setup_admin.rc == 0" # chnaged nur wenn Task rc 0 hat, sollte nur beim ersten lauf vorkommen; ungetestet
+  when: 'not "{{ gitea_admin_user }}@mgrote.net" in check.stdout'
+
+- name: Show existing users
+  ansible.builtin.debug:
+    msg: "{{ check.stdout_lines }}"
 ...

roles/mgrote_zfs_sanoid/tasks/main.yml

@@ -10,6 +10,7 @@
       - lzop
       - libcapture-tiny-perl
       - pv
+      - libconfig-ini-perl
     state: present
 
 - name: install packages from self-build

roles/mgrote_zfs_sanoid/templates/syncoid_mail.service.j2

@@ -5,4 +5,4 @@ Description=Send a Mail for sanoid service after error or success sanoid.service
 
 [Service]
 Type=oneshot
-ExecStart=/bin/bash -c '/usr/bin/journalctl -u syncoid.service -n 20| mail -s "syncoid - %H" {{ my_mail }}'
+ExecStart=/bin/bash -c '/usr/bin/journalctl -u syncoid.service -n 30 | mail -s "syncoid - %H" {{ my_mail }}'