Ansible

All Ansible commands run from the ansible/ directory, with credentials loaded from .env into the shell:

cd ansible
export $(cat .env | grep -v '^#' | xargs)

Two inventories

Inventory	Use
`inventory/proxmox.proxmox.yml`	Dynamic — every VM and LXC, discovered from the Proxmox API
`inventory/hosts.ini`	Static localhost, for playbooks that run on the controller

Guests are grouped by Proxmox node and by Proxmox tag, so a guest tagged docker lands in tag_docker. restart-docker-stacks.yml targets proxmox_all_running.

Full detail: Inventory.

Playbooks

Playbook	What it does
`restart-docker-stacks.yml`	Restarts every running Compose stack with BWS secrets injected
`setup_new_machine.yml`	Baseline configuration for a freshly created guest
`setup-step-ca-client.yml`	Trusts the internal CA on a host
`distribute-bws-token.yml`	Installs `/etc/bws/token` so `bws` works on the host
`system-update.yml`	Package updates across the fleet
`prune-docker-images.yml`	Reclaims disk from unused images
`configure-lxc-mounts.yml`	Applies LXC bind-mount configuration
`clear-bash-history.yml`	Clears shell history on target hosts
`test-playbook.yml` / `test-proxmox-hosts.yml`	Connectivity and inventory checks

# Fleet-wide
ansible-playbook -i inventory/proxmox.proxmox.yml playbooks/<playbook>.yml

# Scoped
ansible-playbook -i inventory/proxmox.proxmox.yml playbooks/<playbook>.yml --limit arcane
ansible-playbook -i inventory/proxmox.proxmox.yml playbooks/<playbook>.yml --limit 'arcane,traefik'

# Dry run
ansible-playbook -i inventory/proxmox.proxmox.yml playbooks/<playbook>.yml --check --diff

Restarting Docker stacks

This is the playbook that matters most day to day, because it is the supported way to apply secrets:

ansible-playbook -i inventory/proxmox.proxmox.yml playbooks/restart-docker-stacks.yml

# One host, no secret injection
ansible-playbook -i inventory/proxmox.proxmox.yml playbooks/restart-docker-stacks.yml \
  --limit traefik -e bws_inject_secrets=false

Variable	Default	Meaning
`restart_timeout`	`600`	Per-stack timeout in seconds
`bws_inject_secrets`	`true`	Wrap each restart in `bws run`
`bws_project_id`	—	Limit injection to one BWS project UUID

docker compose ls is called without a status filter; its default output already includes only stacks with at least one running container.

Roles

Three custom roles, all idempotent and safe to re-run:

step_ca_client — internal CA trust
custom_apt_repo — Nexus APT source and GPG key
bitwarden — bw and bws CLIs

Defaults worth knowing

From ansible/ansible.cfg: remote user is unknown224, become is off by default (pass --become or set become: true in the play), facts are cached as JSON in /tmp/ansible_facts for one hour, and logs are written to ansible/ansible.log.