Manage routine operations through Ansible

runbooks/pdns-health.md

@@ -4,7 +4,15 @@ Read-only checks for the `/opt/pdns` stack on **hk2.chans.xyz** (`ns1.wsvc.info`
 
 Facts: [hosts/hk2.chans.xyz.md](../hosts/hk2.chans.xyz.md) · Upstream: [docs/pdns-upstream.md](../docs/pdns-upstream.md)
 
-## Quick remote
+Prefer the Ansible health report (`ansible/playbooks/health-report.yml` with
+`--limit powerdns`) for routine checks. Keep the SSH commands below for focused
+diagnosis, especially direct authoritative DNS queries.
+
+## Focused SSH diagnostics
+
+Use these only after the Ansible health report needs investigation.
+
+### Quick remote
 
 ```bash
 ssh -4 windy@hk2.chans.xyz 'cd /opt/pdns && docker compose ps -a'
@@ -12,7 +20,7 @@ ssh -4 windy@hk2.chans.xyz 'cd /opt/pdns && docker compose ps -a'
 
 Expect `auth`, `db`, `poweradmin` healthy; `backup` Up; `pgweb` Up. Ignore stopped orphan `powerdns-admin` unless cleaning orphans.
 
-## Version / security poll
+### Version / security poll
 
 Expect Authoritative **5.0.6** (or newer). Startup logs should **not** show a Mandatory `Security Update` banner. If they do, check https://doc.powerdns.com/authoritative/security-advisories/ and bump the `powerdns/pdns-auth-50` image pin in `/opt/pdns/compose.yml`.
 
@@ -21,7 +29,7 @@ ssh -4 windy@hk2.chans.xyz 'docker logs pdns-auth 2>&1 | grep -i "Security Updat
 ssh -4 windy@hk2.chans.xyz 'docker inspect pdns-auth --format "{{.Config.Image}}"'
 ```
 
-## DNS (from laptop / WSL)
+### DNS (from laptop / WSL)
 
 Prefer querying auth/secondary IPs directly (local stub / public resolvers may be flaky or cached):
 
@@ -40,7 +48,7 @@ dig @$NS1 +short A ns2.wsvc.info   # expect 202.91.35.141
 
 Served SOA serial can differ from the backend/API serial when `SOA-EDIT=INCEPTION-INCREMENT` is active — compare **ns1 vs ns2 served SOA**, not dig vs `pdnsutil`/API.
 
-## API (on host)
+### API (on host)
 
 ```bash
 ssh -4 windy@hk2.chans.xyz 'cd /opt/pdns && docker compose exec -T auth \
@@ -49,7 +57,7 @@ ssh -4 windy@hk2.chans.xyz 'cd /opt/pdns && docker compose exec -T auth \
 
 Or use host loopback with the key from `.env` (do not paste the key into chat/logs).
 
-## Web UIs
+### Web UIs
 
 ```bash
 # If local stub DNS is flaky, pin SNI to the auth IP:
@@ -57,7 +65,7 @@ curl -4 -sS -o /dev/null -w "%{http_code}\n" --resolve pdns.wsvc.info:443:154.36
 curl -4 -sS -o /dev/null -w "%{http_code}\n" --resolve pgweb.wsvc.info:443:154.36.174.161 https://pgweb.wsvc.info/  # 401 without basic auth
 ```
 
-## Backup
+### Backup
 
 ```bash
 ssh -4 windy@hk2.chans.xyz 'cd /opt/pdns && ./scripts/manual-backup.sh && ls -lt backup/*.sql.gz | head'
@@ -66,7 +74,7 @@ ssh -4 windy@hk2.chans.xyz 'tail -30 /opt/pdns/backup/backup.log'
 
 Scheduler should log `scheduler started … (daily 03:00)`. If you see `can't execute 'bash'` or Alpine `apk` errors, the backup image/entrypoint was reverted — see [hosts/hk2.chans.xyz.md](../hosts/hk2.chans.xyz.md).
 
-## Config sanity (docs-aligned)
+### Config sanity (docs-aligned)
 
 ```bash
 ssh -4 windy@hk2.chans.xyz 'grep -E "^(primary|also-notify|only-notify|allow-axfr-ips|gpgsql-dnssec|default-soa-edit)" /opt/pdns/auth/pdns.conf'
@@ -81,6 +89,6 @@ The sanitized Ansible health profile is `pdns` (`ansible/playbooks/healthchecks.
 
 ## After config changes
 
-- `auth/pdns.conf`, `auth/templates.d/secrets.j2`, or auth-related `.env` → `docker compose up -d --force-recreate auth`
-- Poweradmin env / Traefik labels → `docker compose up -d --no-deps --force-recreate poweradmin` (restart Traefik if UI 404s)
-- backup schedule / retention env → `docker compose up -d --force-recreate --no-deps backup`
+- `auth/pdns.conf`, `auth/templates.d/secrets.j2`, or auth-related `.env` → use the Ansible Compose reconcile playbook with target `auth`
+- Poweradmin env / Traefik labels → use the Ansible Compose reconcile playbook with target `poweradmin`; add `service_reconcile_restart_traefik=true` only if its UI returns 404
+- backup schedule / retention env → use the Ansible Compose reconcile playbook with target `backup`