Initial VPS operations handbook

ansible/playbooks/maintenance-preview.yml

@@ -0,0 +1,30 @@
+---
+# Preview only. This playbook does not install updates, restart services, or
+# change DNS/secrets. A separate, manually reviewed change is required to act.
+- name: Preview pending maintenance without changes
+  hosts: managed
+  become: true
+  gather_facts: false
+  tasks:
+    - name: Check reboot requirement marker
+      ansible.builtin.stat:
+        path: /var/run/reboot-required
+      register: maintenance_reboot_marker
+
+    - name: Preview available package updates on Debian-family hosts
+      ansible.builtin.command:
+        argv:
+          - apt-get
+          - --just-print
+          - upgrade
+      register: maintenance_apt_preview
+      changed_when: false
+      failed_when: false
+      when: ansible_facts.os_family | default('Debian') == 'Debian'
+
+    - name: Report maintenance preview
+      ansible.builtin.debug:
+        msg:
+          host: "{{ inventory_hostname }}"
+          reboot_required: "{{ maintenance_reboot_marker.stat.exists }}"
+          package_preview: "{{ maintenance_apt_preview.stdout_lines | default([]) }}"