From f77d973b229678f92cbf44666d92c4d01e974013 Mon Sep 17 00:00:00 2001 From: spektr Date: Fri, 30 Oct 2026 15:12:58 +0100 Subject: [PATCH] =?UTF-8?q?CT-101=20Samba:=20Check-Mode-Guards=20und=20sel?= =?UTF-8?q?f-contained=20Inventory=20f=C3=BCr=20site.yml?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - group_vars spiegelt samba_smb_config_file/passdb_file sowie samba_access_admin_user/ssh_dropin, damit backup.yml/verify-production.yml ohne geladene Rolle laufen (CT-100/102-Konvention); alle drei Inventare byte-identisch - samba_lxc_baseline: unattended-upgrades.service nach dem apt-Install enable+starten, Task mit when: not ansible_check_mode - samba_nfs: artifact_source_root auf playbook_dir/../.. korrigiert (Artifacts liegen in ct-101-samba/, nicht in ansible/); gn-media-Probe mit failed_when: false und Assert-Guard für den ersten Check-Mode-Lauf; Ganesha-Restart-Handler mit when: not ansible_check_mode - site.yml --check --diff gegen CT 101 grün: ok=100 changed=20 failed=0 Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe --- .../ansible/inventories/agent/group_vars/samba_hosts.yml | 9 +++++++++ .../inventories/bootstrap/group_vars/samba_hosts.yml | 9 +++++++++ .../inventories/production/group_vars/samba_hosts.yml | 9 +++++++++ .../ansible/roles/samba_lxc_baseline/tasks/main.yml | 1 + .../ansible/roles/samba_nfs/defaults/main.yml | 4 ++-- .../ansible/roles/samba_nfs/handlers/main.yml | 1 + .../ct-101-samba/ansible/roles/samba_nfs/tasks/main.yml | 2 ++ 7 files changed, 33 insertions(+), 2 deletions(-) diff --git a/proxmox/lxc/ct-101-samba/ansible/inventories/agent/group_vars/samba_hosts.yml b/proxmox/lxc/ct-101-samba/ansible/inventories/agent/group_vars/samba_hosts.yml index f486c16..c45ed2b 100644 --- a/proxmox/lxc/ct-101-samba/ansible/inventories/agent/group_vars/samba_hosts.yml +++ b/proxmox/lxc/ct-101-samba/ansible/inventories/agent/group_vars/samba_hosts.yml @@ -33,6 +33,10 @@ samba_firewall_nfs_ports: - 2049 samba_access_source_networks: 10.0.0.0/24,10.8.0.0/24 +# Mirrored from the samba_access role defaults so that verify-production.yml +# runs with a self-contained inventory (CT 100/102 convention): +samba_access_admin_user: ghost +samba_access_ssh_dropin: /etc/ssh/sshd_config.d/99-security.conf samba_media_group_name: gn-media samba_media_group_gid: 970 @@ -74,6 +78,11 @@ samba_media_mount_points: - /media/datenhdd3 samba_smb_workgroup: Ghost.net +# Mirrored from the samba_smb role defaults so that the playbooks +# (backup.yml/verify-production.yml) run with a self-contained inventory +# (CT 100/102 convention): +samba_smb_config_file: /etc/samba/smb.conf +samba_smb_passdb_file: /var/lib/samba/private/passdb.tdb samba_smb_service_units: - smbd.service - nmbd.service diff --git a/proxmox/lxc/ct-101-samba/ansible/inventories/bootstrap/group_vars/samba_hosts.yml b/proxmox/lxc/ct-101-samba/ansible/inventories/bootstrap/group_vars/samba_hosts.yml index f486c16..c45ed2b 100644 --- a/proxmox/lxc/ct-101-samba/ansible/inventories/bootstrap/group_vars/samba_hosts.yml +++ b/proxmox/lxc/ct-101-samba/ansible/inventories/bootstrap/group_vars/samba_hosts.yml @@ -33,6 +33,10 @@ samba_firewall_nfs_ports: - 2049 samba_access_source_networks: 10.0.0.0/24,10.8.0.0/24 +# Mirrored from the samba_access role defaults so that verify-production.yml +# runs with a self-contained inventory (CT 100/102 convention): +samba_access_admin_user: ghost +samba_access_ssh_dropin: /etc/ssh/sshd_config.d/99-security.conf samba_media_group_name: gn-media samba_media_group_gid: 970 @@ -74,6 +78,11 @@ samba_media_mount_points: - /media/datenhdd3 samba_smb_workgroup: Ghost.net +# Mirrored from the samba_smb role defaults so that the playbooks +# (backup.yml/verify-production.yml) run with a self-contained inventory +# (CT 100/102 convention): +samba_smb_config_file: /etc/samba/smb.conf +samba_smb_passdb_file: /var/lib/samba/private/passdb.tdb samba_smb_service_units: - smbd.service - nmbd.service diff --git a/proxmox/lxc/ct-101-samba/ansible/inventories/production/group_vars/samba_hosts.yml b/proxmox/lxc/ct-101-samba/ansible/inventories/production/group_vars/samba_hosts.yml index f486c16..c45ed2b 100644 --- a/proxmox/lxc/ct-101-samba/ansible/inventories/production/group_vars/samba_hosts.yml +++ b/proxmox/lxc/ct-101-samba/ansible/inventories/production/group_vars/samba_hosts.yml @@ -33,6 +33,10 @@ samba_firewall_nfs_ports: - 2049 samba_access_source_networks: 10.0.0.0/24,10.8.0.0/24 +# Mirrored from the samba_access role defaults so that verify-production.yml +# runs with a self-contained inventory (CT 100/102 convention): +samba_access_admin_user: ghost +samba_access_ssh_dropin: /etc/ssh/sshd_config.d/99-security.conf samba_media_group_name: gn-media samba_media_group_gid: 970 @@ -74,6 +78,11 @@ samba_media_mount_points: - /media/datenhdd3 samba_smb_workgroup: Ghost.net +# Mirrored from the samba_smb role defaults so that the playbooks +# (backup.yml/verify-production.yml) run with a self-contained inventory +# (CT 100/102 convention): +samba_smb_config_file: /etc/samba/smb.conf +samba_smb_passdb_file: /var/lib/samba/private/passdb.tdb samba_smb_service_units: - smbd.service - nmbd.service diff --git a/proxmox/lxc/ct-101-samba/ansible/roles/samba_lxc_baseline/tasks/main.yml b/proxmox/lxc/ct-101-samba/ansible/roles/samba_lxc_baseline/tasks/main.yml index 42286de..2d446aa 100644 --- a/proxmox/lxc/ct-101-samba/ansible/roles/samba_lxc_baseline/tasks/main.yml +++ b/proxmox/lxc/ct-101-samba/ansible/roles/samba_lxc_baseline/tasks/main.yml @@ -98,6 +98,7 @@ enabled: true state: started daemon_reload: true + when: not ansible_check_mode - name: Set the local timezone database link ansible.builtin.file: diff --git a/proxmox/lxc/ct-101-samba/ansible/roles/samba_nfs/defaults/main.yml b/proxmox/lxc/ct-101-samba/ansible/roles/samba_nfs/defaults/main.yml index faf327e..d8741f7 100644 --- a/proxmox/lxc/ct-101-samba/ansible/roles/samba_nfs/defaults/main.yml +++ b/proxmox/lxc/ct-101-samba/ansible/roles/samba_nfs/defaults/main.yml @@ -1,10 +1,10 @@ --- -samba_nfs_artifact_source_root: "{{ playbook_dir }}/.." +samba_nfs_artifact_source_root: "{{ playbook_dir }}/../.." samba_nfs_quadlet_directory: /etc/containers/systemd samba_nfs_build_directory: /var/lib/ghostnet/samba/build samba_nfs_config_directory: /etc/ghostnet/samba/ganesha samba_nfs_state_directory: /var/lib/ghostnet/samba/ganesha -# Reviewed checksum of ../Containerfile.ganesha (sha256sum, 2026-10-20): +# Reviewed checksum of ../../Containerfile.ganesha (sha256sum, 2026-10-20): samba_nfs_containerfile_sha256: >- 0fdbe6b5fe542f22ed291c4cabe505e0da472024f0186e2414fd002b751f784f samba_nfs_source_image: >- diff --git a/proxmox/lxc/ct-101-samba/ansible/roles/samba_nfs/handlers/main.yml b/proxmox/lxc/ct-101-samba/ansible/roles/samba_nfs/handlers/main.yml index 3e351c6..5b15a14 100644 --- a/proxmox/lxc/ct-101-samba/ansible/roles/samba_nfs/handlers/main.yml +++ b/proxmox/lxc/ct-101-samba/ansible/roles/samba_nfs/handlers/main.yml @@ -7,3 +7,4 @@ ansible.builtin.systemd_service: name: ghostnet-samba-nfs.service state: restarted + when: not ansible_check_mode diff --git a/proxmox/lxc/ct-101-samba/ansible/roles/samba_nfs/tasks/main.yml b/proxmox/lxc/ct-101-samba/ansible/roles/samba_nfs/tasks/main.yml index 9298f63..b586bbe 100644 --- a/proxmox/lxc/ct-101-samba/ansible/roles/samba_nfs/tasks/main.yml +++ b/proxmox/lxc/ct-101-samba/ansible/roles/samba_nfs/tasks/main.yml @@ -19,6 +19,7 @@ - "{{ samba_media_group_name }}" check_mode: false changed_when: false + failed_when: false register: samba_nfs_media_group - name: Fail closed when the media group is missing @@ -32,6 +33,7 @@ The group {{ samba_media_group_name }} (GID {{ samba_media_group_gid }}) is missing or carries a different GID. Run the samba_media role first; the export root must be group-writable for the pipeline identities. + when: not ansible_check_mode or not samba_media_group_task.changed | default(false) | bool - name: Create the NFS export root with the pipeline group ansible.builtin.file: