version: 11.0.1

.github/workflows/release.yml

@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Cloning the repository repo...
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           fetch-tags: true

nova/core/galaxy.yml

@@ -1,6 +1,6 @@
 namespace: nova
 name: core
-version: 11.0.0
+version: 11.0.1
 readme: README.md
 authors:
   - https://github.com/novateams

nova/core/roles/accounts/tasks/unix_create.yml

@@ -123,7 +123,7 @@
       become: true
 
     - name: Restarting SSHD... # noqa: no-handler
-      ansible.builtin.systemd:
+      ansible.builtin.service:
         name: "{{ accounts_os_family_service_name[ansible_facts.os_family] | default('sshd') }}"
         state: restarted
       when: maxauthtries.changed

nova/core/roles/caddy/tasks/install.yml

@@ -23,7 +23,6 @@
     state: directory
     recurse: true
   loop:
-    - "{{ caddy_config_folder }}"
     - "{{ caddy_config_folder }}/etc"
     - "{{ caddy_config_folder }}/data"
     - "{{ caddy_config_folder }}/config"
@@ -33,7 +32,7 @@
 
 - name: Templating Caddy configuration files for {{ inventory_hostname }}...
   ansible.builtin.template:
-    src: caddy.yml
+    src: docker-compose.yml
     dest: "{{ caddy_config_folder }}/docker-compose.yml"
     mode: "0644"
     lstrip_blocks: true

nova/core/roles/caddy/templates/docker-compose.yml

@@ -0,0 +1,78 @@
+---
+services:
+  caddy:
+    image: caddy:{{ caddy_version }}
+    hostname: caddy
+    container_name: caddy
+    restart: unless-stopped
+    {% if caddy_enable_api %}
+    command: caddy run --resume
+    environment:
+      - CADDY_ADMIN=0.0.0.0:2019
+    {% endif %}
+    ports:
+      {% if caddy_enable_api %}
+      {% for port in caddy_api_container_ports %}
+      - "{{ port }}"
+      {% endfor %}
+      {% else %}
+      {% for port in caddy_container_ports %}
+      - "{{ port }}"
+      {% endfor %}
+      {% endif %}
+    volumes:
+      - caddy_etc:/etc/caddy
+      - caddy_data:/data/caddy
+      - caddy_config:/config/caddy
+      - caddy_logs:/srv/logs
+      - caddy_www:/srv/www
+      - caddy_certs:/srv/certs
+      - /etc/ssl/certs/ca-certificates.crt:/etc/ssl/certs/ca-certificates.crt
+
+volumes:
+  caddy_etc:
+    driver: local
+    driver_opts:
+      type: none
+      o: bind
+      device: "{{ caddy_config_folder }}/etc"
+
+  caddy_data:
+    driver: local
+    driver_opts:
+      type: none
+      o: bind
+      device: "{{ caddy_config_folder }}/data"
+
+  caddy_config:
+    driver: local
+    driver_opts:
+      type: none
+      o: bind
+      device: "{{ caddy_config_folder }}/config"
+
+  caddy_logs:
+    driver: local
+    driver_opts:
+      type: none
+      o: bind
+      device: "{{ caddy_config_folder }}/logs"
+
+  caddy_www:
+    driver: local
+    driver_opts:
+      type: none
+      o: bind
+      device: "{{ caddy_config_folder }}/www"
+
+  caddy_certs:
+    driver: local
+    driver_opts:
+      type: none
+      o: bind
+      device: "{{ caddy_certificates_folder }}"
+
+networks:
+  default:
+    name: "{{ caddy_docker_network }}"
+    external: true

nova/core/roles/configure_networking/tasks/vsphere/interfaces_alpine.yml

@@ -126,9 +126,29 @@
             keys_send:
               - ENTER
 
+        - name: Detecting DHCP address for {{ custom_vm_name | default(vm_name) }}...
+          community.vmware.vmware_guest_info:
+            datacenter: "{{ datacenter }}"
+            name: "{{ custom_vm_name | default(vm_name) }}"
+            folder: "{{ folder }}"
+            properties:
+              - guest.ipAddress
+            schema: vsphere
+          delegate_to: localhost
+          become: false
+          register: detect_dhcp
+          until:
+            - detect_dhcp.instance.guest.ipAddress != none
+            - detect_dhcp.instance.guest.ipAddress != "0.0.0.0"
+            - not (detect_dhcp.instance.guest.ipAddress | regex_search('169.254.*')) # Protection against APIPA address
+            - not (detect_dhcp.instance.guest.ipAddress | ansible.utils.ipv6) # Protection against IPv6 link-local address
+          retries: 60
+          delay: 5
+          when: connection_mode in ['ipv4_dhcp', 'ipv6_dhcp', 'ipv6_slaac']
+
         - name: Waiting for the network to be configured...
           ansible.builtin.wait_for:
-            host: "{{ connection_address }}"
+            host: "{{ detect_dhcp.instance.guest.ipAddress | default(connection_address) }}"
             port: 22
             timeout: 60
 

nova/core/roles/connection/tasks/vmware_workstation.yml

@@ -1,7 +1,9 @@
 ---
 - name:
-    Connecting as {{ template_username if fresh_deploy else ansible_deployer_username }} to {{ inventory_hostname }} using {{ ansible_connection
-    | upper }} over {{ ansible_host }}... # noqa: name[template]
+    Connecting as {{ template_username if fresh_deploy else ansible_deployer_username }}
+    to {{ inventory_hostname }}
+    using {{ ansible_connection | default('ssh') | upper }}
+    over {{ ansible_host }}...
   ansible.builtin.set_fact:
     ansible_user: "{{ template_username if fresh_deploy else ansible_deployer_username }}"
     ansible_password: "{{ omit if connection_no_password else template_password if fresh_deploy else ansible_deployer_password }}"

nova/core/roles/connection/tasks/vsphere.yml

@@ -32,7 +32,7 @@
     Connecting as {{ template_username if fresh_deploy else ansible_deployer_username }}
     to {{ inventory_hostname }}
     using {{ ansible_connection | default('ssh') | upper }}
-    over {{ connection_address_custom | default(detect_dhcp.instance.guest.ipAddress) | default(connection_address) }}... # noqa: name[template]
+    over {{ connection_address_custom | default(detect_dhcp.instance.guest.ipAddress) | default(connection_address) }}...
   ansible.builtin.set_fact:
     ansible_host: "{{ connection_address_custom | default(detect_dhcp.instance.guest.ipAddress) | default(connection_address) }}"
     ansible_user: "{{ template_username if fresh_deploy else ansible_deployer_username }}"

nova/core/roles/deploy_vars/tasks/main.yml

@@ -48,4 +48,4 @@
         - aws_defaults.secret_key is ansible.builtin.truthy
 # # Uncomment to debug variables
 # - ansible.builtin.debug: msg="{{  }}"
-# - meta: end_play
+# - meta: end_host

nova/core/roles/gitlab/defaults/main.yml

@@ -1,6 +1,6 @@
 ---
 ### gitlab general
-gitlab_version: 19.0.1-ee.0
+gitlab_version: 19.1.1-ee.0
 gitlab_ssh_port: 10022
 # Increase gitlab ssh MaxAuthTries to avoid connection issues for users with more than 6 keys in their SSH agent set to {} to disable
 gitlab_ssh_max_auth_tries: 20

nova/core/roles/gitlab/tasks/install.yml

@@ -90,5 +90,5 @@
     status_code: 200
   register: gitlab_uri
   until: gitlab_uri.status == 200
-  retries: 12
-  delay: 5
+  retries: 18
+  delay: 10

nova/core/roles/machine_operations/tasks/proxmox/create.yml

@@ -237,6 +237,34 @@
             timeout: "{{ proxmox_machine_operations_operation_timeout }}"
           when: proxmox_ha_resource.json.data | selectattr('sid', 'equalto', 'vm:' ~ machine_operations_proxmox_ha_configuration.sid) == []
 
+    - name: Applying pending configuration for {{ custom_vm_name | default(vm_name) }} VM...
+      when:
+        - machine_operations_reconfigure_vm_on_deploy
+        - not fresh_deploy
+      block:
+        # Using API instead of community.proxmox.proxmox_vm_info module since it reports incorrectly
+        - name: Checking if {{ custom_vm_name | default(vm_name) }} has pending configuration...
+          ansible.builtin.uri:
+            url:
+              "{{ proxmox_api_url }}/nodes/{{ proxmox_vm_exists.proxmox_vms[0].node }}/qemu/{{
+              proxmox_vm_exists.proxmox_vms[0].vmid | default(machine_operations_proxmox_vmid) }}/pending"
+            headers:
+              Authorization: PVEAPIToken={{ proxmox_defaults.api_user }}!{{ proxmox_defaults.api_token_id }}={{ proxmox_defaults.api_token_secret }}
+            method: GET
+            validate_certs: "{{ proxmox_defaults.validate_certs }}"
+            timeout: "{{ proxmox_machine_operations_operation_timeout }}"
+          register: proxmox_vm_pending_info
+          until: proxmox_vm_pending_info is not failed
+          retries: 5
+          delay: 3
+
+        - name: Restarting {{ custom_vm_name | default(vm_name) }} to apply the pending configuration...
+          community.proxmox.proxmox_kvm:
+            name: "{{ custom_vm_name | default(vm_name) }}"
+            state: restarted
+            timeout: "{{ proxmox_machine_operations_operation_timeout }}"
+          when: (proxmox_vm_pending_info.json.data | selectattr('pending', 'defined') | list | length) > 0
+
     - name: Starting {{ custom_vm_name | default(vm_name) }} VM... # noqa: no-handler
       community.proxmox.proxmox_kvm:
         name: "{{ custom_vm_name | default(vm_name) }}"

nova/core/roles/machine_operations/tasks/proxmox/remove.yml

@@ -37,7 +37,44 @@
         purge: true
         state: absent
         timeout: 30
-      retries: 3
+      retries: 5
+
+- name: Removing unreferenced disks...
+  become: false
+  delegate_to: localhost
+  block:
+    # Sometimes during high load the unreferenced disk cleanup can fail in the previous task
+    # So checking if there are unreferenced disks and trying to remove them before finishing the play
+    - name: Listing {{ custom_vm_name | default(vm_name) }} unreferenced disks...
+      community.proxmox.proxmox_storage_contents_info:
+        storage: "{{ proxmox_storage }}"
+        node: "{{ proxmox_vm_exists.proxmox_vms[0].node | default(proxmox_node) }}"
+        vmid: "{{ proxmox_vm_exists.proxmox_vms[0].vmid | default(machine_operations_proxmox_vmid) }}"
+        validate_certs: "{{ proxmox_validate_certs }}"
+      retries: 12
+      delay: 5
+      register: proxmox_unreferenced_disks
+
+    - name: Removing following {{ custom_vm_name | default(vm_name) }} unreferenced disks...
+      ansible.builtin.uri:
+        url:
+          "{{ proxmox_api_url }}/nodes/{{ proxmox_vm_exists.proxmox_vms[0].node
+          | default(proxmox_node) }}/storage/{{ proxmox_storage }}/content/{{ disk.volid }}"
+        headers:
+          Authorization: PVEAPIToken={{ proxmox_defaults.api_user }}!{{ proxmox_defaults.api_token_id }}={{ proxmox_defaults.api_token_secret }}
+        method: DELETE
+        validate_certs: "{{ proxmox_validate_certs }}"
+      loop_control:
+        loop_var: disk
+        label: "{{ disk.volid }}"
+      loop: "{{ proxmox_unreferenced_disks.proxmox_storage_content }}"
+      when: proxmox_unreferenced_disks.proxmox_storage_content != []
+      retries: 12
+      delay: 5
+
+    - name: Re-including remove tasks...
+      ansible.builtin.include_tasks: remove.yml
+      when: proxmox_unreferenced_disks.proxmox_storage_content != []
 
 - name: Stopping play...
   ansible.builtin.meta: end_host

nova/core/roles/template_os_configuration/tasks/windows.yml

@@ -237,6 +237,7 @@
     line: "{{ sshd_config_item.line }}"
   loop_control:
     loop_var: sshd_config_item
+    label: "{{ sshd_config_item.regexp }}"
   loop:
     - regexp: ^.*Match Group administrators$
       line: "#Match Group administrators"

nova/core/roles/vault/defaults/main.yml

@@ -10,7 +10,7 @@ vault_configure: false # Run the initial default configuration for Vault
 vault_configure_ldap: false # Configuring LDAP authentication for Vault
 vault_configuration_uri: "https://{{ fqdn }}" # Defined separately for when configuring multiple Vaults
 vault_config_folder: /srv/vault
-vault_version: 2.0.2 # Default Vault Docker image version
+vault_version: 2.0.3 # Default Vault Docker image version
 vault_container_name: vault
 vault_server_log_level: debug # Debug gives better info about LDAP login failures and their reasons
 vault_audit_logging: false # Enable Vault audit logging