Add ipfabric to excluded hosts

Add `excluded` host group and skip offline hosts
Fix UFW service initialization command for Alpine Linux

README.md

@@ -0,0 +1,33 @@
+# homelab-ansible
+
+Ansible playbook to align my homelab VMs — Alpine & Debian.
+
+## Roles
+
+| #   | Role      | Purpose                                                       |
+| --- | --------- | ------------------------------------------------------------- |
+| 1   | `ufw`     | Install UFW, deny incoming by default, allow only Tailscale   |
+| 2   | `repos`   | Set Alpine repos to `edge`                                    |
+| 3   | `upgrade` | Upgrade all packages (handles Tailscale SSH drops gracefully) |
+
+## Usage
+
+```sh
+# Full playbook
+ansible-playbook homelab.yml
+
+# Single role
+ansible-playbook homelab.yml --tags ufw
+
+# Dry-run
+ansible-playbook homelab.yml --check --diff
+```
+
+## Inventory
+
+- `inventory/tailscale_inventory.py` — dynamic inventory from local `tailscale status`, filtered by `tag:homelab`
+- `inventory/static_groups.yml` — static group assignments (Alpine vs Debian)
+
+## Vars
+
+Per-role defaults live in `roles/*/defaults/main.yml`. Per-group overrides in `group_vars/`.

group_vars/damien_hosts.yml

@@ -0,0 +1,5 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/ansible/ansible-lint/main/src/ansiblelint/schemas/vars.json
+---
+ansible_user: damien
+ansible_become: true
+ansible_become_method: sudo

homelab.yml

@@ -1,11 +1,32 @@
 # yaml-language-server: $schema=https://raw.githubusercontent.com/ansible/ansible-lint/main/src/ansiblelint/schemas/playbook.json
 ---
 - name: Homelab alignment
-  hosts: online
+  hosts: managed:!excluded
   become: true
+  gather_facts: false
+  environment:
+    PATH: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+
+  pre_tasks:
+    - name: Test connectivity
+      ansible.builtin.ping:
+      ignore_unreachable: true
+      register: ping_result
+
+    - name: Skip offline hosts
+      ansible.builtin.meta: end_host
+      when: ping_result.unreachable | default(false)
+
+    - name: Gather facts
+      ansible.builtin.setup:
+      tags: always
 
   roles:
-    - role: repos
-    - role: common
     - role: ufw
+      tags: ufw
+
+    - role: repos
+      tags: repos
+
     - role: upgrade
+      tags: upgrade

inventory/static_groups.yml

@@ -5,25 +5,29 @@ all:
   children:
     root_hosts:
       hosts:
-        ipfabric:
         grafana:
         gitea:
         prometheus:
         prometheus-pve-exporter:
         gitea-runner:
         openbao:
-        komodo:
+        pve01:
 
     debian_hosts:
       hosts:
         proxy:
 
+    damien_hosts:
+      hosts:
+        komodo:
+
     managed:
       children:
         root_hosts:
         debian_hosts:
+        damien_hosts:
 
     excluded:
-      children:
       hosts:
         pve01:
+        ipfabric:

roles/repos/tasks/main.yml

@@ -0,0 +1,13 @@
+---
+# roles/repos/tasks/main.yml
+
+- name: Set Alpine repositories to edge
+  ansible.builtin.copy:
+    dest: /etc/apk/repositories
+    content: |
+      http://dl-cdn.alpinelinux.org/alpine/edge/main
+      http://dl-cdn.alpinelinux.org/alpine/edge/community
+    owner: root
+    group: root
+    mode: "0644"
+  when: ansible_facts['os_family'] == "Alpine"

roles/ufw/defaults/main.yml

@@ -1,4 +1,5 @@
 # roles/ufw/defaults/main.yml
 ---
+ufw_default_incoming_policy: deny
+ufw_default_outgoing_policy: allow
 ufw_tailscale_interface: tailscale0
-ufw_extra_rules: []

roles/ufw/tasks/main.yml

@@ -0,0 +1,46 @@
+---
+# roles/ufw/tasks/main.yml
+
+- name: Install UFW (Alpine)
+  community.general.apk:
+    name: ufw
+    state: present
+    update_cache: true
+  when: ansible_facts['os_family'] == "Alpine"
+
+- name: Install UFW (Debian)
+  ansible.builtin.apt:
+    name: ufw
+    state: present
+    update_cache: true
+  when: ansible_facts['os_family'] == "Debian"
+
+- name: Add UFW to default runlevel (Alpine)
+  ansible.builtin.command:
+    cmd: /sbin/rc-update add ufw default
+  register: ufw_rc_update_result
+  changed_when: >- # " >- : transform multiple lines into one line"
+    'already' not in ufw_rc_update_result.stdout
+    and 'already' not in ufw_rc_update_result.stderr
+  failed_when: ufw_rc_update_result.rc != 0
+  when: ansible_facts['os_family'] == "Alpine"
+
+- name: Set default incoming policy
+  community.general.ufw:
+    default: "{{ ufw_default_incoming_policy }}"
+    direction: incoming
+
+- name: Set default outgoing policy
+  community.general.ufw:
+    default: "{{ ufw_default_outgoing_policy }}"
+    direction: outgoing
+
+- name: Enable UFW
+  community.general.ufw:
+    state: enabled
+
+- name: Allow all traffic on Tailscale interface
+  community.general.ufw:
+    rule: allow
+    interface: "{{ ufw_tailscale_interface }}"
+    direction: in

roles/upgrade/README.md

@@ -0,0 +1,55 @@
+# Upgrade role
+
+Upgrades all packages using the native package manager (`apk` or `apt`).
+
+## Problem
+
+Tailscale may be updated during the upgrade. When its service restarts, the SSH tunnel drops and Ansible loses connectivity, causing a fatal `UNREACHABLE`.
+
+## Solution — async + poll
+
+Instead of a blocking upgrade, we fire the job in the background and poll for completion, tolerating temporary unreachability.
+
+```mermaid
+sequenceDiagram
+    participant A as Ansible
+    participant T as Target
+
+    A->>T: apk upgrade (async, poll: 0)
+    T-->>A: job ID: 42
+    Note over T: 🔄 upgrade en cours...
+    A->>T: async_status jid=42
+    T-->>A: finished: false
+    Note over A: FAILED-RETRYING (normal)
+    A-->>A: sleep 10s
+    A->>T: async_status jid=42
+    T-->>A: finished: false
+    Note over A: FAILED-RETRYING (normal)
+    A-->>A: sleep 10s
+    A->>T: async_status jid=42
+    T-->>A: finished: true ✅
+    Note over A: ok
+```
+
+- **`async: 3600` + `poll: 0`** — fire and forget. Ansible gets a job ID and moves on.
+- **`async_status` with `until: finished`** — polls every 10s for up to 60 retries (~10 min).
+- **`ignore_unreachable: true`** — if Tailscale dropped SSH, Ansible doesn't crash. It retries until the host is back.
+- The `FAILED - RETRYING` messages are normal — they just mean the `until` condition isn't met yet.
+
+## Idempotency
+
+A task with `async` + `poll: 0` always reports `changed: true` by default, even when nothing happened. To fix this:
+
+```mermaid
+graph LR
+    A["Fire: changed_when: false"] --> B["Package manager runs in background"]
+    B --> C["Wait: polls every 10s"]
+    C -->|finished| D["async_status reads real changed value"]
+    D -->|"packages updated"| E["changed ✅"]
+    D -->|"nothing to do"| F["ok"]
+```
+
+- The **fire** task has `changed_when: false` — it never claims change.
+- The **wait** task reads `changed_when: async_result.changed` — it propagates the real status from the package manager once the job finishes.
+
+Second run with nothing to upgrade → `changed=0` on all hosts.

roles/upgrade/tasks/main.yml

@@ -0,0 +1,59 @@
+---
+# roles/upgrade/tasks/main.yml
+#
+# Async pattern: Tailscale may restart during upgrade, dropping SSH.
+# Fire and forget → poll status with unreachable tolerance + retries.
+
+- name: Upgrade all packages (Alpine)
+  community.general.apk:
+    upgrade: true
+    update_cache: true
+  async: 3600
+  poll: 0
+  register: upgrade_alpine_job
+  # By default async job return change: true
+  # Force adapting the change condition for idempotency
+  changed_when: false
+  when: ansible_facts['os_family'] == "Alpine"
+
+- name: Wait for Alpine upgrade
+  ansible.builtin.async_status:
+    jid: "{{ upgrade_alpine_job.ansible_job_id }}"
+  register: upgrade_alpine_result
+  until: upgrade_alpine_result.finished
+  retries: 60
+  delay: 10
+  # By default async job return change: true
+  # Force adapting the change condition for idempotency
+  changed_when: upgrade_alpine_result.changed | default(false)
+  ignore_unreachable: true
+  when:
+    - ansible_facts['os_family'] == "Alpine"
+    - upgrade_alpine_job.ansible_job_id is defined
+
+- name: Upgrade all packages (Debian)
+  ansible.builtin.apt:
+    upgrade: full
+    update_cache: true
+  async: 3600
+  poll: 0
+  register: upgrade_debian_job
+  # By default async job return change: true
+  # Force adapting the change condition for idempotency
+  changed_when: false
+  when: ansible_facts['os_family'] == "Debian"
+
+- name: Wait for Debian upgrade
+  ansible.builtin.async_status:
+    jid: "{{ upgrade_debian_job.ansible_job_id }}"
+  register: upgrade_debian_result
+  until: upgrade_debian_result.finished
+  retries: 60
+  delay: 10
+  # By default async job return change: true
+  # Force adapting the change condition for idempotency
+  changed_when: upgrade_debian_result.changed | default(false)
+  ignore_unreachable: true
+  when:
+    - ansible_facts['os_family'] == "Debian"
+    - upgrade_debian_job.ansible_job_id is defined