Initial VPS operations handbook

2026-08-03 12:26:42 +08:00
commit b73125e5bc
97 changed files with 3641 additions and 0 deletions
@@ -0,0 +1,73 @@
+---
+# Read-only control-plane audit. This play intentionally contains no package,
+# file, service, container, or configuration mutation tasks.
+- name: Audit managed VPS hosts without changes
+  hosts: managed
+  gather_facts: true
+  become: false
+  any_errors_fatal: false
+  tasks:
+    - name: Verify Docker Compose command is available
+      ansible.builtin.command:
+        argv:
+          - docker
+          - compose
+          - version
+      changed_when: false
+
+    - name: Inspect configured Compose project
+      ansible.builtin.command:
+        argv:
+          - docker
+          - compose
+          - --project-directory
+          - "{{ compose_project_dir }}"
+          - ps
+          - --all
+      register: audit_compose_ps
+      changed_when: false
+      failed_when: false
+
+    - name: Inspect failed systemd units
+      ansible.builtin.command:
+        argv:
+          - systemctl
+          - --failed
+          - --no-legend
+          - --no-pager
+      register: audit_failed_units
+      changed_when: false
+      failed_when: false
+
+    - name: Inspect filesystem capacity
+      ansible.builtin.command:
+        argv:
+          - df
+          - -P
+          - -x
+          - tmpfs
+          - -x
+          - devtmpfs
+      register: audit_filesystems
+      changed_when: false
+
+    - name: Inspect active listeners
+      ansible.builtin.command:
+        argv:
+          - ss
+          - -lntup
+      register: audit_listeners
+      changed_when: false
+      failed_when: false
+
+    - name: Report sanitized audit summary
+      ansible.builtin.debug:
+        msg:
+          host: "{{ inventory_hostname }}"
+          profile: "{{ healthcheck_profile }}"
+          os: "{{ ansible_distribution }} {{ ansible_distribution_version }}"
+          kernel: "{{ ansible_kernel }}"
+          compose_rc: "{{ audit_compose_ps.rc }}"
+          failed_units: "{{ audit_failed_units.stdout_lines | default([]) }}"
+          filesystem_lines: "{{ audit_filesystems.stdout_lines | default([]) }}"
+          listener_lines: "{{ audit_listeners.stdout_lines | default([]) }}"