semaphore/playbooks/update-homarr-checked.yml

---
# ============================================================================
# update-homarr-checked.yml — gated update: pre-flight → update → verify back up
# ============================================================================
# End-to-end safe updater:
#   PLAY 1 (runner)   fetch deploy SSH key from Infisical.
#   PLAY 2 (target)   PRE-FLIGHT — SSH + docker + homarr running + HTTP OK.
#                     Aborts before any change if the stack is already broken.
#   PLAY 3 (target)   UPDATE — pull latest image, recreate, verify HTTP back up,
#                     prune the old dangling image.
#   PLAY 4 (runner)   cleanup temp key.
#
# Differs from update-homarr.yml by adding an explicit reachability GATE before
# the pull (won't touch a host that's already down) and a firm post-update
# health confirmation with the before/after image digest reported.
#
# Prereq: host deployed via deploy-homarr.yml (compose stack exists).
# Connects AS the `ansible` user via the Infisical-injected deploy key.
#
# Usage: playbook playbooks/update-homarr-checked.yml, extra vars: target=racknerd1
# ============================================================================

- name: "PRECHECK — fetch deploy SSH key from Infisical"
  hosts: localhost
  gather_facts: false
  vars:
    infisical_url: "{{ lookup('env','INFISICAL_URL') | default('http://192.168.122.41:8080', true) }}"
    infisical_env_slug: "{{ lookup('env','INFISICAL_ENV_SLUG') | default('dev', true) }}"
  tasks:
    - name: "[precheck] Infisical auth vars present?"
      ansible.builtin.assert:
        that:
          - lookup('env','INFISICAL_CLIENT_ID') | length > 0
          - lookup('env','INFISICAL_CLIENT_SECRET') | length > 0
          - lookup('env','INFISICAL_PROJECT_ID') | length > 0
        fail_msg: "Missing INFISICAL_CLIENT_ID / _SECRET / _PROJECT_ID in Semaphore Environment."

    - name: "[precheck] Login to Infisical"
      infisical.vault.login:
        url: "{{ infisical_url }}"
        auth_method: universal_auth
        universal_auth_client_id: "{{ lookup('env','INFISICAL_CLIENT_ID') }}"
        universal_auth_client_secret: "{{ lookup('env','INFISICAL_CLIENT_SECRET') }}"
      register: infisical_login

    - name: "[precheck] Read secrets"
      infisical.vault.read_secrets:
        login_data: "{{ infisical_login.login_data }}"
        project_id: "{{ lookup('env','INFISICAL_PROJECT_ID') }}"
        env_slug: "{{ infisical_env_slug }}"
        path: "/"
        as_dict: true
      register: infisical_secrets

    - name: "[precheck] stash SSH key"
      ansible.builtin.set_fact:
        pc_ssh_privkey: "{{ infisical_secrets.secrets.SSH_PRIVATE_KEY }}"
      no_log: true

    - name: "[precheck] write deploy private key to runner temp (0600)"
      ansible.builtin.copy:
        dest: "/tmp/homarr_deploy_key"
        content: "{{ pc_ssh_privkey }}\n"
        mode: "0600"
      no_log: true

- name: "PRE-FLIGHT — verify reachable + healthy BEFORE touching anything"
  hosts: "{{ target | default('racknerd1') }}"
  gather_facts: false
  vars:
    deploy_user: ansible
    homarr_dir: "/home/{{ deploy_user }}/docker/homarr"
    homarr_port: 7575
    ansible_user: ansible
    ansible_ssh_private_key_file: "/tmp/homarr_deploy_key"
    ansible_ssh_common_args: "-o StrictHostKeyChecking=accept-new -o IdentitiesOnly=yes"
  tasks:
    - name: "[pre] SSH reachable as ansible user?"
      ansible.builtin.ping:

    - name: Reset connection so docker group membership is active in this session
      ansible.builtin.meta: reset_connection

    - name: "[pre] Rootless docker usable?"
      ansible.builtin.command: docker version
      register: dv
      changed_when: false
      failed_when: dv.rc != 0

    - name: "[pre] Compose stack present?"
      ansible.builtin.stat:
        path: "{{ homarr_dir }}/docker-compose.yml"
      register: compose_file

    - name: "[pre] Fail early if stack not deployed"
      ansible.builtin.assert:
        that:
          - compose_file.stat.exists
        fail_msg: >-
          No docker-compose.yml at {{ homarr_dir }} — run deploy-homarr.yml first.          

    - name: "[pre] Homarr answering HTTP before update?"
      ansible.builtin.uri:
        url: "http://127.0.0.1:{{ homarr_port }}/"
        status_code: [200, 302, 307]
      register: pre_health
      retries: 6
      delay: 5
      until: pre_health.status is defined and pre_health.status in [200, 302, 307]

    - name: "[pre] PRE-FLIGHT PASSED"
      ansible.builtin.debug:
        msg: "Reachable + healthy (HTTP {{ pre_health.status }}). Proceeding to update."

- name: "UPDATE — pull latest image + recreate, then confirm back up"
  hosts: "{{ target | default('racknerd1') }}"
  gather_facts: false
  vars:
    deploy_user: ansible
    homarr_dir: "/home/{{ deploy_user }}/docker/homarr"
    homarr_port: 7575
    ansible_user: ansible
    ansible_ssh_private_key_file: "/tmp/homarr_deploy_key"
    ansible_ssh_common_args: "-o StrictHostKeyChecking=accept-new -o IdentitiesOnly=yes"
  tasks:
    - name: Reset connection so docker group membership is active in this session
      ansible.builtin.meta: reset_connection

    - name: Gather facts (after connection reset)
      ansible.builtin.setup:

    - name: Record image digest before update
      ansible.builtin.command:
        cmd: docker inspect --format '{{ '{{' }}.Image{{ '}}' }}' homarr
      register: img_before
      changed_when: false
      failed_when: false

    - name: Pull latest image + recreate (compose preserved as-is)
      community.docker.docker_compose_v2:
        project_src: "{{ homarr_dir }}"
        pull: always
        state: present
        recreate: auto

    - name: Record image digest after update
      ansible.builtin.command:
        cmd: docker inspect --format '{{ '{{' }}.Image{{ '}}' }}' homarr
      register: img_after
      changed_when: false

    - name: "POST-CHECK — Homarr back up + reachable?"
      ansible.builtin.uri:
        url: "http://127.0.0.1:{{ homarr_port }}/"
        status_code: [200, 302, 307]
      register: post_health
      retries: 18
      delay: 5
      until: post_health.status is defined and post_health.status in [200, 302, 307]

    - name: Prune the now-dangling old image (best effort)
      ansible.builtin.command: docker image prune -f
      register: prune
      changed_when: "'Total reclaimed space: 0B' not in prune.stdout"
      failed_when: false

    - name: Result
      ansible.builtin.debug:
        msg: >-
          Homarr on {{ inventory_hostname }}:{{ homarr_port }} back up — HTTP {{ post_health.status }}.
          {{ 'Image updated.' if img_before.stdout != img_after.stdout else 'Already up to date (no image change).' }}          

- name: "Cleanup runner temp key"
  hosts: localhost
  gather_facts: false
  tasks:
    - name: "remove temp deploy key from runner"
      ansible.builtin.file:
        path: /tmp/homarr_deploy_key
        state: absent