initial commit

playbooks/apt-updates.yaml

@@ -0,0 +1,14 @@
+---
+- name: Update and upgrade Linux servers
+  hosts: all
+  become: true
+
+  tasks:
+    - name: Update apt package cache
+      ansible.builtin.apt:
+        update_cache: true
+        cache_valid_time: 3600
+
+    - name: Upgrade installed packages
+      ansible.builtin.apt:
+        upgrade: yes

playbooks/hermes-update.yml

@@ -0,0 +1,71 @@
+---
+# Update Hermes Agent on every host in the Ansible `hermes` group.
+# Run with: ansible-playbook -i inventory.yml hermes-update.yml
+
+- name: Update Hermes Agent
+  hosts: hermes
+  gather_facts: true
+  serial: 1  # update one Hermes instance at a time so both are not down together
+
+  vars:
+    # Override per-host/group if Hermes is installed somewhere else.
+    hermes_bin: "{{ ansible_env.HOME }}/.local/bin/hermes"
+    hermes_branch: main
+    # Use true for a full HERMES_HOME backup before updating; false keeps Hermes' default quick snapshot.
+    hermes_full_backup: true
+
+  tasks:
+    - name: Check Hermes launcher exists
+      ansible.builtin.stat:
+        path: "{{ hermes_bin }}"
+      register: hermes_launcher
+
+    - name: Fail if Hermes launcher is missing
+      ansible.builtin.fail:
+        msg: "Hermes launcher not found at {{ hermes_bin }}. Set hermes_bin for this host/group."
+      when: not hermes_launcher.stat.exists
+
+    - name: Show current Hermes version and install info
+      ansible.builtin.command: "{{ hermes_bin }} --version"
+      register: hermes_version_before
+      changed_when: false
+
+    - name: Show Hermes update plan
+      ansible.builtin.command: "{{ hermes_bin }} update --plan --branch {{ hermes_branch }}"
+      register: hermes_update_plan
+      changed_when: false
+
+    - name: Check whether Hermes update is available
+      ansible.builtin.command: "{{ hermes_bin }} update --check --branch {{ hermes_branch }}"
+      register: hermes_update_check
+      changed_when: false
+
+    - name: Update Hermes when needed
+      ansible.builtin.command: >-
+        {{ hermes_bin }} update --yes --branch {{ hermes_branch }}
+        {{ '--backup' if hermes_full_backup else '' }}
+      register: hermes_update_result
+      when: "'Update available' in hermes_update_check.stdout"
+      changed_when: true
+
+    - name: Verify Hermes is now current
+      ansible.builtin.command: "{{ hermes_bin }} update --check --branch {{ hermes_branch }}"
+      register: hermes_update_verify
+      changed_when: false
+      failed_when: >-
+        hermes_update_verify.rc != 0 or
+        ('Update available' in hermes_update_verify.stdout)
+
+    - name: Show final Hermes version and install info
+      ansible.builtin.command: "{{ hermes_bin }} --version"
+      register: hermes_version_after
+      changed_when: false
+
+    - name: Print Hermes update summary
+      ansible.builtin.debug:
+        msg:
+          host: "{{ inventory_hostname }}"
+          before: "{{ hermes_version_before.stdout_lines }}"
+          updated: "{{ 'Update available' in hermes_update_check.stdout }}"
+          after: "{{ hermes_version_after.stdout_lines }}"
+          verify: "{{ hermes_update_verify.stdout_lines }}"