Manage routine operations through Ansible

ansible/playbooks/baseline.yml

@@ -1,7 +1,9 @@
 ---
 # Baseline starts audit-only. Opt-in variables are deliberately false by default.
 - name: Apply controlled common baseline
-  hosts: managed
+  # The baseline role is OS-level and does not assume Docker Compose, so it
+  # applies to the Matrix K3s node as well as the Compose hosts.
+  hosts: all
   become: true
   gather_facts: false
   roles:

ansible/playbooks/compose-reconcile.yml

@@ -0,0 +1,12 @@
+---
+# Intentional, narrowly scoped Compose reconciliation. This never changes
+# compose files, images, secrets, DNS, or databases. It is gated because a
+# container recreate can briefly interrupt a public service.
+- name: Reconcile explicitly selected Docker Compose services
+  hosts: docker_hosts
+  become: true
+  gather_facts: false
+  serial: 1
+  roles:
+    - role: compose_reconcile
+      tags: [compose, reconcile, mutating]

ansible/playbooks/health-report.yml

@@ -0,0 +1,50 @@
+---
+# Execute the already-installed, sanitized local health checks on demand.
+# This is read-only with respect to the managed applications; the scripts only
+# inspect state and update their own health result files/logs.
+- name: Report Docker Compose service health
+  hosts: managed
+  become: true
+  gather_facts: false
+  tasks:
+    - name: Run the deployed service health check
+      ansible.builtin.command:
+        argv:
+          - /usr/local/lib/vps-health/run
+      register: service_health_report
+      changed_when: false
+      failed_when: service_health_report.rc not in [0, 1, 2]
+
+    - name: Display sanitized service health result
+      ansible.builtin.debug:
+        msg: "{{ service_health_report.stdout | default(service_health_report.stderr, true) }}"
+
+    - name: Fail when service health is degraded
+      ansible.builtin.fail:
+        msg: "Health check reported a degraded state on {{ inventory_hostname }}."
+      when: service_health_report.rc != 0
+
+- name: Report Matrix health
+  hosts: matrix
+  become: true
+  gather_facts: false
+  tasks:
+    - name: Run the deployed Matrix health check
+      ansible.builtin.command:
+        argv:
+          - "{{ matrix_healthcheck_script_path | default('/usr/local/lib/vps-health/matrix-k3s') }}"
+      register: matrix_health_report
+      changed_when: false
+
+    - name: Parse Matrix health result
+      ansible.builtin.set_fact:
+        matrix_health_result: "{{ matrix_health_report.stdout | from_json }}"
+
+    - name: Display Matrix health result
+      ansible.builtin.debug:
+        var: matrix_health_result
+
+    - name: Fail when Matrix health is degraded
+      ansible.builtin.fail:
+        msg: "Matrix health is {{ matrix_health_result.status }} on {{ inventory_hostname }}."
+      when: matrix_health_result.status != 'ok'

ansible/playbooks/maintenance-preview.yml

@@ -2,7 +2,9 @@
 # Preview only. This playbook does not install updates, restart services, or
 # change DNS/secrets. A separate, manually reviewed change is required to act.
 - name: Preview pending maintenance without changes
-  hosts: managed
+  # Package/reboot inspection is host-level and is safe for both Compose and
+  # K3s nodes.
+  hosts: all
   become: true
   gather_facts: false
   tasks: