Manage routine operations through Ansible

ansible/roles/compose_reconcile/defaults/main.yml

@@ -0,0 +1,6 @@
+---
+# Both variables must be supplied explicitly by the operator. Allowed services
+# and their safe Compose flags belong in inventory, not on the command line.
+service_reconcile_confirm: false
+service_reconcile_targets: []
+service_reconcile_restart_traefik: false

ansible/roles/compose_reconcile/tasks/main.yml

@@ -0,0 +1,69 @@
+---
+- name: Require explicit confirmation and selected services
+  ansible.builtin.assert:
+    that:
+      - service_reconcile_confirm | bool
+      - service_reconcile_targets | length > 0
+    fail_msg: >-
+      This operation can recreate containers. Supply
+      service_reconcile_confirm=true and a non-empty
+      service_reconcile_targets list after reviewing the change.
+
+- name: Require a host-specific reconciliation policy
+  ansible.builtin.assert:
+    that:
+      - service_reconcile_services is defined
+    fail_msg: "No reconciliation policy is defined for {{ inventory_hostname }}."
+
+- name: Validate selected services are allowed on this host
+  ansible.builtin.assert:
+    that:
+      - item in service_reconcile_services
+    fail_msg: "{{ item }} is not an allowed reconciliation target on {{ inventory_hostname }}."
+  loop: "{{ service_reconcile_targets }}"
+
+- name: Validate optional Traefik restart scope
+  ansible.builtin.assert:
+    that:
+      - >-
+        not (service_reconcile_restart_traefik | bool) or
+        (service_reconcile_targets
+         | select('in', service_reconcile_traefik_restart_targets | default([]))
+         | list | length > 0)
+    fail_msg: >-
+      Traefik may only be restarted as the explicit post-reconcile action for
+      an inventory-approved service on this host.
+
+- name: Reconcile approved Compose services
+  ansible.builtin.command:
+    argv: >-
+      {{ ['docker', 'compose', '--project-directory', compose_project_dir, 'up', '-d']
+         + service_reconcile_services[item].compose_args
+         + ([] if item == 'all' else [item]) }}
+  loop: "{{ service_reconcile_targets }}"
+  register: service_reconcile_result
+  changed_when: true
+  loop_control:
+    label: "{{ item }}"
+
+- name: Restart Traefik after approved reconciliation when requested
+  ansible.builtin.command:
+    argv: [docker, restart, traefik]
+  when: service_reconcile_restart_traefik | bool
+  changed_when: true
+
+- name: Report reconciled Compose state
+  ansible.builtin.command:
+    argv:
+      - docker
+      - compose
+      - --project-directory
+      - "{{ compose_project_dir }}"
+      - ps
+      - --all
+  changed_when: false
+  register: service_reconcile_ps
+
+- name: Display reconciled Compose state
+  ansible.builtin.debug:
+    var: service_reconcile_ps.stdout_lines

ansible/roles/matrix_healthcheck/defaults/main.yml

@@ -6,7 +6,9 @@ matrix_healthcheck_service_name: matrix-k3s-healthcheck.service
 matrix_healthcheck_timer_name: matrix-k3s-healthcheck.timer
 matrix_healthcheck_timer_on_calendar: '*-*-* 06:00:00 UTC'
 matrix_healthcheck_timer_randomized_delay_sec: 15m
-matrix_healthcheck_namespace: matrix-system
+# ESS workloads live in this namespace; matrix-system only has supporting
+# chart-independent resources.
+matrix_healthcheck_namespace: ess
 matrix_healthcheck_backup_path: /var/backups/matrix
 matrix_healthcheck_backup_max_age_hours: 30
 matrix_healthcheck_warn_percent: 80