From cd2fb6651f920100efcc29d661cbeb3919d34c2e Mon Sep 17 00:00:00 2001
From: Trey Blancher <trey@blancher.net>
Date: Sun, 13 Sep 2026 14:16:38 -0400
Subject: [PATCH] Moved playbooks here;  zsh dotfiles distro;  new config logs

---
 firewall_upgrade.yml                      | 12 +++
 home_upgrade_all.yml                      | 29 +++++++
 node_deploy.yml                           |  5 ++
 roles/arch_update/files/aur_diff_check.py |  1 +
 roles/arch_update/tasks/pacnew.yaml       | 27 ++++++-
 roles/debian_update/tasks/debnew.yaml     | 42 ++++++++++
 roles/debian_update/tasks/main.yaml       |  3 +
 roles/docker_update/tasks/main.yaml       |  2 +-
 roles/dotfiles/files/colors.zsh           | 12 +++
 roles/dotfiles/files/matugen.conf         | 20 +++++
 roles/dotfiles/tasks/deploy_user.yml      | 94 +++++++++++++++++++++++
 roles/dotfiles/tasks/main.yml             | 10 +++
 smartctl_deploy.yml                       |  5 ++
 13 files changed, 260 insertions(+), 2 deletions(-)
 create mode 100644 firewall_upgrade.yml
 create mode 100644 home_upgrade_all.yml
 create mode 100644 node_deploy.yml
 create mode 100644 roles/debian_update/tasks/debnew.yaml
 create mode 100644 roles/dotfiles/files/colors.zsh
 create mode 100644 roles/dotfiles/files/matugen.conf
 create mode 100644 roles/dotfiles/tasks/deploy_user.yml
 create mode 100644 roles/dotfiles/tasks/main.yml
 create mode 100644 smartctl_deploy.yml

diff --git a/firewall_upgrade.yml b/firewall_upgrade.yml
new file mode 100644
index 0000000..87be49a
--- /dev/null
+++ b/firewall_upgrade.yml
@@ -0,0 +1,12 @@
+---
+- name: Upgrade Arch systems
+  hosts: firewall
+  roles:
+    - arch_update
+    - dotfiles
+
+- name: Process any reboots
+  hosts: "firewall, !control"
+  roles:
+    - reboot
+
diff --git a/home_upgrade_all.yml b/home_upgrade_all.yml
new file mode 100644
index 0000000..5db7f71
--- /dev/null
+++ b/home_upgrade_all.yml
@@ -0,0 +1,29 @@
+---
+- name: Upgrade Arch systems
+  hosts: arch
+  #strategy:  free
+  roles:
+    - arch_update
+    - dotfiles
+
+- name: Upgrade Debian systems
+  hosts: debian
+  roles:
+    - debian_update
+    - dotfiles
+
+- name: Update Docker Stacks
+  hosts: docker
+  roles:
+    - docker_update
+
+- name: Update mailcow Stacks
+  hosts:  mailcow
+  roles:
+    - mailcow_update
+
+- name: Process any reboots
+  hosts: "arch, debian, !control"
+  roles:
+    - reboot
+
diff --git a/node_deploy.yml b/node_deploy.yml
new file mode 100644
index 0000000..c426085
--- /dev/null
+++ b/node_deploy.yml
@@ -0,0 +1,5 @@
+---
+- name: Deploy node_exporter
+  hosts: arch,debian,barbican
+  roles:
+    - node_exporter
diff --git a/roles/arch_update/files/aur_diff_check.py b/roles/arch_update/files/aur_diff_check.py
index 0756899..94fb281 100755
--- a/roles/arch_update/files/aur_diff_check.py
+++ b/roles/arch_update/files/aur_diff_check.py
@@ -63,6 +63,7 @@ def extract_ver(content):
 def strip_volatile_fields(content):
     content = re.sub(r'^pkgver=.*$', '', content, flags=re.MULTILINE)
     content = re.sub(r'^pkgrel=.*$', '', content, flags=re.MULTILINE)
+    content = re.sub(r'^arch=\(.*?\)', '', content, flags=re.MULTILINE | re.DOTALL)
     
     source_vars = set()
     source_matches = re.finditer(r'^source(?:_[a-zA-Z0-9_]+)?=\((.*?)\)', content, flags=re.MULTILINE | re.DOTALL)
diff --git a/roles/arch_update/tasks/pacnew.yaml b/roles/arch_update/tasks/pacnew.yaml
index 54acc45..3620a54 100644
--- a/roles/arch_update/tasks/pacnew.yaml
+++ b/roles/arch_update/tasks/pacnew.yaml
@@ -5,8 +5,33 @@
     recurse: yes
   register: pacnew_files
 
+- name: Ensure pacnew.logs directory exists locally
+  ansible.builtin.file:
+    path: "{{ playbook_dir }}/pacnew.logs"
+    state: directory
+    mode: '0755'
+  delegate_to: localhost
+  run_once: true
+  become: no
+
+- name: Save .pacnew list to file
+  ansible.builtin.copy:
+    content: "{{ pacnew_files.files | map(attribute='path') | join('\n') }}\n"
+    dest: "{{ playbook_dir }}/pacnew.logs/{{ inventory_hostname }}.pacnew"
+    mode: '0644'
+  delegate_to: localhost
+  become: no
+  when: pacnew_files.matched > 0
+
+- name: Clean up old .pacnew list file if no .pacnew files exist
+  ansible.builtin.file:
+    path: "{{ playbook_dir }}/pacnew.logs/{{ inventory_hostname }}.pacnew"
+    state: absent
+  delegate_to: localhost
+  become: no
+  when: pacnew_files.matched == 0
+
 - name: Alert if .pacnew files exist
   ansible.builtin.debug:
     msg: "Warning: The following .pacnew files require merging: {{ pacnew_files.files | map(attribute='path') | list }}"
   when: pacnew_files.matched > 0
-
diff --git a/roles/debian_update/tasks/debnew.yaml b/roles/debian_update/tasks/debnew.yaml
new file mode 100644
index 0000000..aca99f4
--- /dev/null
+++ b/roles/debian_update/tasks/debnew.yaml
@@ -0,0 +1,42 @@
+---
+- name: Check for pending dpkg/ucf config files
+  ansible.builtin.find:
+    paths: /etc
+    patterns: 
+      - "*.dpkg-dist"
+      - "*.dpkg-new"
+      - "*.ucf-dist"
+      - "*.ucf-new"
+    recurse: yes
+  register: debnew_files
+
+- name: Ensure debnew.logs directory exists locally
+  ansible.builtin.file:
+    path: "{{ playbook_dir }}/debnew.logs"
+    state: directory
+    mode: '0755'
+  delegate_to: localhost
+  run_once: true
+  become: no
+
+- name: Save debnew config list to file
+  ansible.builtin.copy:
+    content: "{{ debnew_files.files | map(attribute='path') | join('\n') }}\n"
+    dest: "{{ playbook_dir }}/debnew.logs/{{ inventory_hostname }}.debnew"
+    mode: '0644'
+  delegate_to: localhost
+  become: no
+  when: debnew_files.matched > 0
+
+- name: Clean up old debnew config list file if none exist
+  ansible.builtin.file:
+    path: "{{ playbook_dir }}/debnew.logs/{{ inventory_hostname }}.debnew"
+    state: absent
+  delegate_to: localhost
+  become: no
+  when: debnew_files.matched == 0
+
+- name: Alert if debnew config files exist
+  ansible.builtin.debug:
+    msg: "Warning: The following Debian config files require merging: {{ debnew_files.files | map(attribute='path') | list }}"
+  when: debnew_files.matched > 0
diff --git a/roles/debian_update/tasks/main.yaml b/roles/debian_update/tasks/main.yaml
index 1706f22..0426c08 100644
--- a/roles/debian_update/tasks/main.yaml
+++ b/roles/debian_update/tasks/main.yaml
@@ -4,3 +4,6 @@
   ansible.builtin.apt:
     update_cache: true
     upgrade: full
+
+- name: Report on any Debian config files that need to be merged
+  ansible.builtin.include_tasks: debnew.yaml
diff --git a/roles/docker_update/tasks/main.yaml b/roles/docker_update/tasks/main.yaml
index d0be68c..b6d22fe 100644
--- a/roles/docker_update/tasks/main.yaml
+++ b/roles/docker_update/tasks/main.yaml
@@ -11,7 +11,7 @@
 - name: Pull latest non-buildable service images
   become: true
   ansible.builtin.command:
-    cmd: docker compose pull --ignore-buildable
+    cmd: docker compose pull --ignore-buildable --ignore-pull-failures
     chdir: "{{ item }}"
   loop: "{{ docker_compose_dirs | default([]) }}"
   changed_when: false
diff --git a/roles/dotfiles/files/colors.zsh b/roles/dotfiles/files/colors.zsh
new file mode 100644
index 0000000..4bbb375
--- /dev/null
+++ b/roles/dotfiles/files/colors.zsh
@@ -0,0 +1,12 @@
+# Gruvbox colors for zsh (fallback)
+export MATUGEN_PRIMARY="#83a598"
+export MATUGEN_ON_PRIMARY="#282828"
+export MATUGEN_SECONDARY="#8ec07c"
+export MATUGEN_ON_SECONDARY="#282828"
+export MATUGEN_TERTIARY="#d3869b"
+export MATUGEN_ON_TERTIARY="#282828"
+export MATUGEN_BACKGROUND="#282828"
+export MATUGEN_FOREGROUND="#ebdbb2"
+export MATUGEN_ERROR="#fb4934"
+export MATUGEN_OUTLINE="#928374"
+export MATUGEN_SURFACE_CONTAINER="#3c3836"
diff --git a/roles/dotfiles/files/matugen.conf b/roles/dotfiles/files/matugen.conf
new file mode 100644
index 0000000..5c61f16
--- /dev/null
+++ b/roles/dotfiles/files/matugen.conf
@@ -0,0 +1,20 @@
+# Tmux colors generated by Matugen (Gruvbox fallback)
+
+set -g status-justify "left"
+set -g status "on"
+set -g status-left-style "none"
+set -g message-command-style "fg=#282828,bg=#83a598"
+set -g status-right-style "none"
+set -g pane-active-border-style "fg=#83a598"
+set -g status-style "none,bg=#3c3836"
+set -g message-style "fg=#282828,bg=#83a598"
+set -g pane-border-style "fg=#504945"
+set -g status-right-length "100"
+set -g status-left-length "100"
+setw -g window-status-activity-style "none"
+setw -g window-status-separator ""
+setw -g window-status-style "none,fg=#ebdbb2,bg=#3c3836"
+set -g status-left "#[fg=#282828,bg=#83a598] #S #[fg=#83a598,bg=#3c3836,nobold,nounderscore,noitalics]"
+set -g status-right "#[fg=#504945,bg=#3c3836,nobold,nounderscore,noitalics]#[fg=#ebdbb2,bg=#504945] %Y-%m-%d  %H:%M #[fg=#83a598,bg=#504945,nobold,nounderscore,noitalics]#[fg=#282828,bg=#83a598] #h "
+setw -g window-status-format "#[fg=#ebdbb2,bg=#3c3836] #I #[fg=#ebdbb2,bg=#3c3836] #W "
+setw -g window-status-current-format "#[fg=#3c3836,bg=#504945,nobold,nounderscore,noitalics]#[fg=#ebdbb2,bg=#504945] #I #[fg=#ebdbb2,bg=#504945] #W #[fg=#504945,bg=#3c3836,nobold,nounderscore,noitalics]"
diff --git a/roles/dotfiles/tasks/deploy_user.yml b/roles/dotfiles/tasks/deploy_user.yml
new file mode 100644
index 0000000..02e545e
--- /dev/null
+++ b/roles/dotfiles/tasks/deploy_user.yml
@@ -0,0 +1,94 @@
+---
+- name: "Ensure target config directories exist for {{ target_user.user }}"
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    mode: '0755'
+    owner: "{{ target_user.user }}"
+  loop:
+    - "{{ target_user.home }}/.config/tmux"
+    - "{{ target_user.home }}/.config/zsh"
+    - "{{ target_user.home }}/.vim"
+  become: yes
+
+- name: "Sync tmux config directory for {{ target_user.user }}"
+  ansible.posix.synchronize:
+    src: /home/trey/.config/tmux/
+    dest: "{{ target_user.home }}/.config/tmux/"
+    archive: yes
+    delete: no
+    rsync_opts:
+      - "--exclude=matugen.conf"
+  become: yes
+  become_user: "{{ target_user.user }}"
+
+- name: "Sync zsh config directory for {{ target_user.user }}"
+  ansible.posix.synchronize:
+    src: /home/trey/.config/zsh/
+    dest: "{{ target_user.home }}/.config/zsh/"
+    archive: yes
+    delete: no
+    rsync_opts:
+      - "--exclude=colors.zsh"
+  become: yes
+  become_user: "{{ target_user.user }}"
+
+- name: "Sync vim directory for {{ target_user.user }}"
+  ansible.posix.synchronize:
+    src: /home/trey/.vim/
+    dest: "{{ target_user.home }}/.vim/"
+    archive: yes
+    delete: no
+    rsync_opts:
+      - "--exclude=.git/"
+      - "--exclude=.netrwhist"
+      - "--exclude=swap/"
+      - "--exclude=vimrc"
+  become: yes
+  become_user: "{{ target_user.user }}"
+
+- name: "Deploy static fallback gruvbox colors for zsh for {{ target_user.user }}"
+  ansible.builtin.copy:
+    src: colors.zsh
+    dest: "{{ target_user.home }}/.config/zsh/colors.zsh"
+    mode: '0644'
+    owner: "{{ target_user.user }}"
+  become: yes
+
+- name: "Deploy static fallback gruvbox colors for tmux for {{ target_user.user }}"
+  ansible.builtin.copy:
+    src: matugen.conf
+    dest: "{{ target_user.home }}/.config/tmux/matugen.conf"
+    mode: '0644'
+    owner: "{{ target_user.user }}"
+  become: yes
+
+- name: "Copy .zshrc and modify prompt for root user"
+  ansible.builtin.copy:
+    content: |
+      {% set zshrc_content = lookup('file', '/home/trey/.zshrc') %}
+      {% if target_user.user == 'root' %}
+      {{ zshrc_content | replace("export PS1='%F{$MATUGEN_PRIMARY}%n%F{$MATUGEN_SECONDARY}@%F{$MATUGEN_TERTIARY}%m%f", "export PS1='%F{red}%m%f") }}
+      {% else %}
+      {{ zshrc_content }}
+      {% endif %}
+    dest: "{{ target_user.home }}/.zshrc"
+    mode: '0644'
+    owner: "{{ target_user.user }}"
+  become: yes
+
+- name: "Copy vimrc without matugen for {{ target_user.user }}"
+  ansible.builtin.copy:
+    content: "{{ lookup('file', '/home/trey/.vim/vimrc') | regex_replace('(?m)^colorscheme matugen', 'colorscheme gruvbox') }}"
+    dest: "{{ target_user.home }}/.vim/vimrc"
+    mode: '0644'
+    owner: "{{ target_user.user }}"
+  become: yes
+
+- name: "Ensure .vimrc symlink exists for {{ target_user.user }}"
+  ansible.builtin.file:
+    src: "{{ target_user.home }}/.vim/vimrc"
+    dest: "{{ target_user.home }}/.vimrc"
+    state: link
+    owner: "{{ target_user.user }}"
+  become: yes
diff --git a/roles/dotfiles/tasks/main.yml b/roles/dotfiles/tasks/main.yml
new file mode 100644
index 0000000..d044389
--- /dev/null
+++ b/roles/dotfiles/tasks/main.yml
@@ -0,0 +1,10 @@
+---
+- name: Deploy dotfiles for users
+  ansible.builtin.include_tasks: deploy_user.yml
+  loop:
+    - user: "{{ 'admin' if inventory_hostname == 'bastion' else 'trey' }}"
+      home: "{{ '/home/admin' if inventory_hostname == 'bastion' else '/home/trey' }}"
+    - user: 'root'
+      home: '/root'
+  loop_control:
+    loop_var: target_user
diff --git a/smartctl_deploy.yml b/smartctl_deploy.yml
new file mode 100644
index 0000000..28ecc55
--- /dev/null
+++ b/smartctl_deploy.yml
@@ -0,0 +1,5 @@
+---
+- name: Deploy smartctl_exporter
+  hosts: smartd
+  roles:
+    - smartctl_exporter