modified: roles/k3s/tasks/registries_cache_mysetup.yaml

modified:   roles/k3s/templates/registries_cache_mysetup.j2

playbooks/host_maintenance/os_update.yaml

@@ -4,4 +4,4 @@
   tasks:
     - ansible.builtin.include_role:
         name: mylimbo.globals.host_maintenance
-        tasks_from: os_update
+        tasks_from: os_dist_upgrade

playbooks/host_maintenance/resolv_conf.yaml

@@ -0,0 +1,7 @@
+- name: host maintenance - setup resolv.conf
+  hosts: '{{target|default("all")}}'
+  become: true
+  tasks:
+    - ansible.builtin.include_role:
+        name: mylimbo.globals.host_maintenance
+        tasks_from: resolv_conf

playbooks/host_maintenance/systemd_mount.yaml

@@ -0,0 +1,7 @@
+- name: mount - data disks
+  hosts: '{{target|default("all")}}'
+  become: true
+  tasks:
+    - ansible.builtin.include_role:
+        name: mylimbo.globals.host_maintenance
+        tasks_from: systemd_mount

playbooks/k3s/registries_cache_mysetup.yaml

@@ -0,0 +1,7 @@
+- name: setup k3s cache registries
+  hosts: '{{target|default("all")}}'
+  become: true
+  tasks:
+    - ansible.builtin.include_role:
+        name: mylimbo.globals.k3s
+        tasks_from: registries_cache_mysetup

roles/host_maintenance/README.md

@@ -0,0 +1,21 @@
+
+systemd_mount vars task example:
+
+``` yaml
+host_maintenance_disk_mounts:
+    - source: /dev/disk/by-uuid/xxxxxxx
+        target: /var/lib/rancher
+        mount_type: ext4
+        unit_before: k3s.service
+        unit_conflicts: umount.target
+        mount_options:
+        - defaults
+    - source: /dev/disk/by-uuid/xxxxx
+        target: /var/lib/rancher/k3s/storage 
+        unit_before: k3s.service
+        unit_conflicts: umount.target
+        mount_type: ext4
+        mount_options:
+        - defaults
+
+```

roles/host_maintenance/tasks/os_dist_upgrade.yaml

@@ -0,0 +1,29 @@
+- ansible.builtin.import_tasks:
+    file: os_info.yaml
+
+- name: Update all Packages to their latest version
+  ansible.builtin.apt:
+    update_cache: true
+    force_apt_get: true
+
+- name: Upgrade all packages on servers (dist upgrade)
+  ansible.builtin.apt:
+    upgrade: dist 
+    force_apt_get: true
+
+- name: Check if a reboot is needed
+  register: reboot_required_file
+  stat: path=/var/run/reboot-required
+
+- name: Reboot server
+  reboot:
+    msg: "Reboot initiated by Ansible due to kernel updates"
+    connect_timeout: 5
+    reboot_timeout: 300
+    pre_reboot_delay: 0
+    post_reboot_delay: 30
+    test_command: uptime
+  when: reboot_required_file.stat.exists
+
+- ansible.builtin.import_tasks:
+    file: os_info.yaml

roles/host_maintenance/tasks/os_upgrade.yaml

@@ -0,0 +1,29 @@
+- ansible.builtin.import_tasks:
+    file: os_info.yaml
+
+- name: Update all Packages to their latest version
+  ansible.builtin.apt:
+    update_cache: true
+    force_apt_get: true
+
+- name: Upgrade packages on servers (upgrade)
+  ansible.builtin.apt:
+    upgrade: yes 
+    force_apt_get: true
+
+- name: Check if a reboot is needed
+  register: reboot_required_file
+  stat: path=/var/run/reboot-required
+
+- name: Reboot server
+  reboot:
+    msg: "Reboot initiated by Ansible due to kernel updates"
+    connect_timeout: 5
+    reboot_timeout: 300
+    pre_reboot_delay: 0
+    post_reboot_delay: 30
+    test_command: uptime
+  when: reboot_required_file.stat.exists
+
+- ansible.builtin.import_tasks:
+    file: os_info.yaml

roles/host_maintenance/tasks/resolv_conf.yaml

@@ -0,0 +1,17 @@
+# source https://oneuptime.com/blog/post/2026-02-21-how-to-use-ansible-to-manage-etc-resolv-conf/view
+# vars:
+#   resolv_conf:
+#       nameservers:
+#         - x.x.x.x
+#       search_domains:
+#         - local.lan
+- name: Deploy resolv.conf
+  ansible.builtin.template:
+    src: templates/resolv.conf.j2
+    dest: /etc/resolv.conf
+    mode: '0644'
+  when: "resolv_conf is defined"
+
+# todo tasks:
+# systemd-resolvd:systemctl restart systemd-resolved
+# clear cache: resolvectl flush-caches

roles/host_maintenance/tasks/systemd_mount.yaml

@@ -0,0 +1,31 @@
+- ansible.builtin.assert:
+    that:
+      - item.source is defined
+      - item.target is defined
+      - item.mount_type is defined
+    fail_msg: "All of source, target, and mount_type must be defined for each disk entry."
+
+  loop: "{{ host_maintenance_disk_mounts }}"
+- name: check target folders
+  ansible.builtin.file:
+    path: "{{ item.target }}"
+    state: directory
+    mode: '0755'
+  loop: "{{ host_maintenance_disk_mounts }}"
+
+- name: set systemd mount
+  ansible.builtin.template:
+    src: templates/systemd_mount.j2
+    dest: "/etc/systemd/system/{{ item.target | regex_replace('^/', '') | regex_replace('/', '-') }}.mount"
+    mode: '0644'
+  loop: "{{ host_maintenance_disk_mounts }}"
+  register: systemd_mount_files
+
+
+- name: reload systemd
+  ansible.builtin.systemd_service:
+    name: "{{ item.target | regex_replace('^/', '') | regex_replace('/', '-') }}.mount"
+    daemon_reload: "{{ systemd_mount_files.changed }}"
+    enabled: true
+    state: started
+  loop: "{{ host_maintenance_disk_mounts }}"

roles/host_maintenance/templates/resolv.conf.j2

@@ -0,0 +1,17 @@
+# templates/resolv.conf.j2
+# Managed by Ansible - DO NOT EDIT MANUALLY
+# Changes will be overwritten on next Ansible run
+
+{% if resolv_conf.nameservers is defined and resolv_conf.nameservers | length > 0 %}
+{% for ns in resolv_conf.nameservers %}
+nameserver {{ ns }}
+{% endfor %}
+{% endif %}
+
+{% if resolv_conf.search_domains is defined and resolv_conf.search_domains | length > 0 %}
+search {{ resolv_conf.search_domains | join(' ') }}
+{% endif %}
+
+{% if resolv_conf.resolver_options is defined and resolv_conf.resolver_options | length > 0 %}
+options {{ resolv_conf.resolver_options | join(' ') }}
+{% endif %}

roles/host_maintenance/templates/systemd_mount.j2

@@ -0,0 +1,26 @@
+# set by ansible role mylimbo.globals.host_maintenance role, do not edit manually
+[Unit]
+Description=Mount {{ item.target }} managed by mylimbo.globals collections, host_maintenance role 
+
+{% if item.unit_after is defined %}
+# After dependencies
+After={{ item.unit_after }}
+{% endif %}
+
+{% if item.unit_before is defined %}
+# Before dependencies
+Before={{ item.unit_before }}
+{% endif %}
+
+[Mount]
+What={{ item.source }}
+Where={{ item.target }}
+Type={{ item.mount_type }}
+
+{% if item.mount_options is defined %}
+# Mount options, if specified
+Options={{ item.mount_options | join(',') }}
+{% endif %}
+
+[Install]
+WantedBy=multi-user.target

roles/k3s/tasks/registries_cache_mysetup.yaml

@@ -0,0 +1,10 @@
+# requires host/group vars
+# oci_cache:
+#  domain: cache.oci.test.com
+#  auth_username: xxxxx
+#  auth_password: Ixxxx
+
+- name:  k3s - setup cache registries
+  ansible.builtin.template:
+    src: templates/registries_cache_mysetup.j2
+    dest: /etc/rancher/k3s/registries.yaml

roles/k3s/templates/registries_cache_mysetup.j2

@@ -0,0 +1,65 @@
+mirrors:
+  # --- Docker Hub (all aliases → docker-mirror) ---
+  docker.io:
+    endpoint:
+      - https://{{oci_cache.domain}}/v2/docker-mirror
+  registry-1.docker.io:
+    endpoint:
+      - https://{{oci_cache.domain}}/v2/docker-mirror
+  index.docker.io:
+    endpoint:
+      - https://{{oci_cache.domain}}/v2/docker-mirror
+
+  # --- GHCR ---
+  ghcr.io:
+    endpoint:
+      - https://{{oci_cache.domain}}/v2/ghcr-mirror
+
+  # --- Quay.io ---
+  quay.io:
+    endpoint:
+      - https://{{oci_cache.domain}}/v2/quay-mirror
+
+  # --- Kubernetes official registry ---
+  registry.k8s.io:
+    endpoint:
+      - https://{{oci_cache.domain}}/v2/k8s-mirror
+
+  # --- Google Container Registry
+  gcr.io:
+    endpoint:
+      - https://{{oci_cache.domain}}/v2/grc-mirror
+
+  # --- AWS Public ECR ---
+  public.ecr.aws:
+    endpoint:
+      - https://{{oci_cache.domain}}/v2/aws-mirror
+
+  # --- Microsoft Container Registry ---
+  mcr.microsoft.com:
+    endpoint:
+      - https://{{oci_cache.domain}}/v2/mcr-proxy
+
+  # --- GitLab Container Registry ---
+  registry.gitlab.com:
+    endpoint:
+      - https://{{oci_cache.domain}}/v2/gitlab-mirror
+
+  # --- Bitnami (namespace under Docker Hub) ---
+  docker.io/bitnami:
+    endpoint:
+      - https://{{oci_cache.domain}}/v2/bitnami-mirror
+
+  # --- Red Hat registry ---
+  registry.redhat.io:
+    endpoint:
+      - https://{{oci_cache.domain}}/v2/readheat-mirror
+      
+
+configs:
+  {{oci_cache.domain}}:
+    auth:
+      username:  {{oci_cache.auth_username }}
+      password:  {{oci_cache.auth_password }}
+    tls:
+      insecure_skip_verify: false