windyboy
e7296e664a
Inventory now declares the plural healthcheck_profiles list per host (hk2 runs pdns, rustdesk, hk2aux) instead of a single healthcheck_profile, and carries the rustdesk server vars (rustdesk_compose_dir/relay/image) plus the rustdesk host group. The restic role relied on the removed singular healthcheck_profile var; it now uses its own restic_backup_profile (set per host to vaultwarden on us2 and pdns on hk2), so the health-check rename no longer breaks it. audit.yml's summary labels the host's profile list instead of the singular var.
74 lines
2.1 KiB
YAML
74 lines
2.1 KiB
YAML
---
|
|
# Read-only control-plane audit. This play intentionally contains no package,
|
|
# file, service, container, or configuration mutation tasks.
|
|
- name: Audit managed VPS hosts without changes
|
|
hosts: managed
|
|
gather_facts: true
|
|
become: false
|
|
any_errors_fatal: false
|
|
tasks:
|
|
- name: Verify Docker Compose command is available
|
|
ansible.builtin.command:
|
|
argv:
|
|
- docker
|
|
- compose
|
|
- version
|
|
changed_when: false
|
|
|
|
- name: Inspect configured Compose project
|
|
ansible.builtin.command:
|
|
argv:
|
|
- docker
|
|
- compose
|
|
- --project-directory
|
|
- "{{ compose_project_dir }}"
|
|
- ps
|
|
- --all
|
|
register: audit_compose_ps
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: Inspect failed systemd units
|
|
ansible.builtin.command:
|
|
argv:
|
|
- systemctl
|
|
- --failed
|
|
- --no-legend
|
|
- --no-pager
|
|
register: audit_failed_units
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: Inspect filesystem capacity
|
|
ansible.builtin.command:
|
|
argv:
|
|
- df
|
|
- -P
|
|
- -x
|
|
- tmpfs
|
|
- -x
|
|
- devtmpfs
|
|
register: audit_filesystems
|
|
changed_when: false
|
|
|
|
- name: Inspect active listeners
|
|
ansible.builtin.command:
|
|
argv:
|
|
- ss
|
|
- -lntup
|
|
register: audit_listeners
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: Report sanitized audit summary
|
|
ansible.builtin.debug:
|
|
msg:
|
|
host: "{{ inventory_hostname }}"
|
|
profiles: "{{ healthcheck_profiles | default([]) | join(', ') }}"
|
|
os: "{{ ansible_distribution }} {{ ansible_distribution_version }}"
|
|
kernel: "{{ ansible_kernel }}"
|
|
compose_rc: "{{ audit_compose_ps.rc }}"
|
|
failed_units: "{{ audit_failed_units.stdout_lines | default([]) }}"
|
|
filesystem_lines: "{{ audit_filesystems.stdout_lines | default([]) }}"
|
|
listener_lines: "{{ audit_listeners.stdout_lines | default([]) }}"
|