implemented max-attempts

COMMON_APPLICATIONS.md

@@ -40,6 +40,7 @@ Enhances system security with roles focused on security measures, user configura
 - **[User Alarm](./roles/user-alarm/)**: Manages the alarm user.
 - **[PC SSH](./roles/pc-ssh/)**: Configuration of SSH for secure remote access.
 - **[SSHD](./roles/sshd/)**: Configures SSH daemon settings.
+- **[System Maintenance Service Freezer](./roles/system-maintenance-service-freezer)**: Freezes and defrost maintenance services to prevent dangerous inteactions between services
 
 ## Virtual Private Network (VPN)
 Centers on VPN configurations for secure and efficient network connectivity, particularly crucial for remote server access and end-users needing secure connections.

README.md

@@ -74,7 +74,7 @@ Contact me for more details:
 ## Showcases
 The following list showcases the extensive range of solutions that CyMaIS incorporates, each playing a vital role in providing a comprehensive, efficient, and secure IT infrastructure setup:
 
-[ELK Stack](./roles/docker-elk), [Intel Driver](./roles/driver-intel), [Nginx Docker Reverse Proxy](./roles/nginx-docker-reverse-proxy), [Sudo](./roles/sudo), [Funkwhale](./roles/docker-funkwhale), [MSI Keyboard Color Driver](./roles/driver-msi-keyboard-color), [Nginx Domain Redirect](./roles/nginx-domain-redirect), [GnuCash](./roles/pc-gnucash), [Backup Data to USB](./roles/backup-data-to-usb), [Gitea](./roles/docker-gitea), [Non-Free Driver](./roles/driver-non-free), [Nginx Homepage](./roles/nginx-homepage), [Jrnl](./roles/pc-jrnl), [Systemd Notifier](./roles/systemd-notifier), [Backup Docker to Local](./roles/backup-docker-to-local), [Jenkins](./roles/docker-jenkins), [Git](./roles/git), [Nginx HTTPS](./roles/nginx-https), [Latex](./roles/pc-latex), [Email Notifier](./roles/systemd-notifier-email), [Remote to Local Backup Solution](./roles/backup-remote-to-local), [Joomla](./roles/docker-joomla), [Heal Defect Docker Installations](./roles/heal-docker), [Nginx Matomo Tracking](./roles/nginx-matomo-tracking), [LibreOffice](./roles/pc-libreoffice), [Telegram Notifier](./roles/systemd-notifier-telegram), [Listmonk](./roles/docker-listmonk), [Btrfs Health Check](./roles/health-btrfs), [Nginx WWW Redirect](./roles/nginx-www-redirect), [Network Analyze Tools](./roles/pc-network-analyze-tools), [System Security](./roles/system-security), [Mailu](./roles/docker-mailu), [Disc Space Health Check](./roles/health-disc-space), [Administrator Tools](./roles/pc-administrator-tools), [Nextcloud](./roles/pc-nextcloud), [Swapfile Setup](./roles/system-swapfile), [Backups Cleanup](./roles/cleanup-backups-service), [Mastodon](./roles/docker-mastodon), [Docker Container Health Checker](./roles/health-docker-container), [Blu-ray Player Tools](./roles/pc-bluray-player-tools), [Office](./roles/pc-office), [Update Solutions](./roles/update), [Matomo](./roles/docker-matomo), [Docker Volumes Health Checker](./roles/health-docker-volumes), [Caffeine](./roles/pc-caffeine), [Qbittorrent](./roles/pc-qbittorrent), [Update Apt](./roles/update-apt), [Disc Space Cleanup](./roles/cleanup-disc-space), [Matrix](./roles/docker-matrix), [Health Journalctl](./roles/health-journalctl), [Designer Tools](./roles/pc-designer-tools), [Security Tools](./roles/pc-security-tools), [Update Docker](./roles/update-docker), [Failed Docker Backups Cleanup](./roles/cleanup-failed-docker-backups), [MediaWiki](./roles/docker-mediawiki), [Nginx Health Checker](./roles/health-nginx), [Developer Tools](./roles/pc-developer-tools), [Spotify](./roles/pc-spotify), [Update Pacman](./roles/update-pacman), [Client Wireguard](./roles/client-wireguard), [MyBB](./roles/docker-mybb), [Developer Tools for Arduino](./roles/pc-developer-tools-arduino), [SSH](./roles/pc-ssh), [Update Yay](./roles/update-yay), [Client Setup for Wireguard Behind Firewall](./roles/client-wireguard-behind-firewall), [Nextcloud](./roles/docker-nextcloud), [Hunspell](./roles/hunspell), [Developer Tools for Bash](./roles/pc-developer-tools-bash), [Streaming Tools](./roles/pc-streaming-tools), [Administrator](./roles/user-administrator), [Docker](./roles/docker), [Peertube](./roles/docker-peertube), [Java](./roles/java), [Developer Tools for Java](./roles/pc-developer-tools-java), [Tor Browser](./roles/pc-torbrowser), [Video Conference](./roles/pc-video-conference), [Wireguard](./roles/wireguard), [Akaunting](./roles/docker-akaunting), [Pixelfed](./roles/docker-pixelfed), [Journalctl](./roles/journalctl), [Developer Tools for PHP](./roles/pc-developer-tools-php), [Virtual Box](./roles/pc-virtual-box), [Postfix](./roles/postfix), [Attendize](./roles/docker-attendize), [Wordpress](./roles/docker-wordpress), [Locales](./roles/locales), [Docker for End Users](./roles/pc-docker), [Games](./roles/pc-games), [Python Pip](./roles/python-pip), [Discourse](./roles/docker-discourse), [Epson Multiprinter Driver](./roles/driver-epson-multiprinter), [Nginx Certbot](./roles/nginx-certbot), [Git](./roles/pc-git), [SSHD](./roles/sshd), [YOURLS](./roles/docker-yourls), [BigBlueButton](./roles/docker-bigbluebutton)...
+[ELK Stack](./roles/docker-elk), [Intel Driver](./roles/driver-intel), [Nginx Docker Reverse Proxy](./roles/nginx-docker-reverse-proxy), [Sudo](./roles/sudo), [Funkwhale](./roles/docker-funkwhale), [MSI Keyboard Color Driver](./roles/driver-msi-keyboard-color), [Nginx Domain Redirect](./roles/nginx-domain-redirect), [GnuCash](./roles/pc-gnucash), [Backup Data to USB](./roles/backup-data-to-usb), [Gitea](./roles/docker-gitea), [Non-Free Driver](./roles/driver-non-free), [Nginx Homepage](./roles/nginx-homepage), [Jrnl](./roles/pc-jrnl), [Systemd Notifier](./roles/systemd-notifier), [Backup Docker to Local](./roles/backup-docker-to-local), [Jenkins](./roles/docker-jenkins), [Git](./roles/git), [Nginx HTTPS](./roles/nginx-https), [Latex](./roles/pc-latex), [Email Notifier](./roles/systemd-notifier-email), [Remote to Local Backup Solution](./roles/backup-remote-to-local), [Joomla](./roles/docker-joomla), [Heal Defect Docker Installations](./roles/heal-docker), [Nginx Matomo Tracking](./roles/nginx-matomo-tracking), [LibreOffice](./roles/pc-libreoffice), [Telegram Notifier](./roles/systemd-notifier-telegram), [Listmonk](./roles/docker-listmonk), [Btrfs Health Check](./roles/health-btrfs), [Nginx WWW Redirect](./roles/nginx-www-redirect), [Network Analyze Tools](./roles/pc-network-analyze-tools), [System Security](./roles/system-security), [Mailu](./roles/docker-mailu), [Disc Space Health Check](./roles/health-disc-space), [Administrator Tools](./roles/pc-administrator-tools), [Nextcloud](./roles/pc-nextcloud), [Swapfile Setup](./roles/system-swapfile), [Backups Cleanup](./roles/cleanup-backups-service), [Mastodon](./roles/docker-mastodon), [Docker Container Health Checker](./roles/health-docker-container), [Blu-ray Player Tools](./roles/pc-bluray-player-tools), [Office](./roles/pc-office), [Update Solutions](./roles/update), [Matomo](./roles/docker-matomo), [Docker Volumes Health Checker](./roles/health-docker-volumes), [Caffeine](./roles/pc-caffeine), [Qbittorrent](./roles/pc-qbittorrent), [Update Apt](./roles/update-apt), [Disc Space Cleanup](./roles/cleanup-disc-space), [Matrix](./roles/docker-matrix), [Health Journalctl](./roles/health-journalctl), [Designer Tools](./roles/pc-designer-tools), [Security Tools](./roles/pc-security-tools), [Update Docker](./roles/update-docker), [Failed Docker Backups Cleanup](./roles/cleanup-failed-docker-backups), [MediaWiki](./roles/docker-mediawiki), [Nginx Health Checker](./roles/health-nginx), [Developer Tools](./roles/pc-developer-tools), [Spotify](./roles/pc-spotify), [Update Pacman](./roles/update-pacman), [Client Wireguard](./roles/client-wireguard), [MyBB](./roles/docker-mybb), [Developer Tools for Arduino](./roles/pc-developer-tools-arduino), [SSH](./roles/pc-ssh), [Update Yay](./roles/update-yay), [Client Setup for Wireguard Behind Firewall](./roles/client-wireguard-behind-firewall), [Nextcloud](./roles/docker-nextcloud), [Hunspell](./roles/hunspell), [Developer Tools for Bash](./roles/pc-developer-tools-bash), [Streaming Tools](./roles/pc-streaming-tools), [Administrator](./roles/user-administrator), [Docker](./roles/docker), [Peertube](./roles/docker-peertube), [Java](./roles/java), [Developer Tools for Java](./roles/pc-developer-tools-java), [Tor Browser](./roles/pc-torbrowser), [Video Conference](./roles/pc-video-conference), [Wireguard](./roles/wireguard), [Akaunting](./roles/docker-akaunting), [Pixelfed](./roles/docker-pixelfed), [Journalctl](./roles/journalctl), [Developer Tools for PHP](./roles/pc-developer-tools-php), [Virtual Box](./roles/pc-virtual-box), [Postfix](./roles/postfix), [Attendize](./roles/docker-attendize), [Wordpress](./roles/docker-wordpress), [Locales](./roles/locales), [Docker for End Users](./roles/pc-docker), [Games](./roles/pc-games), [Python Pip](./roles/python-pip), [Discourse](./roles/docker-discourse), [Epson Multiprinter Driver](./roles/driver-epson-multiprinter), [Nginx Certbot](./roles/nginx-certbot), [Git](./roles/pc-git), [SSHD](./roles/sshd), [YOURLS](./roles/docker-yourls), [BigBlueButton](./roles/docker-bigbluebutton),[System Maintenance Service Freezer](./roles/system-maintenance-service-freezer)...
 
 ## License
 

group_vars/all

@@ -33,10 +33,10 @@ path_docker_compose_instances:                  "{{path_administrator_home}}dock
 path_system_maintenance_service_freezer_script: "{{path_administrator_scripts}}system-maintenance-service-freezer.py"
 
 # Runtime Variables
-activate_all_timers:    false   # Activates all timers, independend if the handlers had been triggered
+activate_all_timers:          false   # Activates all timers, independend if the handlers had been triggered
-nginx_matomo_tracking:  false   # Activates matomo tracking on all html pages
+nginx_matomo_tracking:        false   # Activates matomo tracking on all html pages
-nginx_www_redirect:     true    # Implements an redirect from all www. domains to the main domain 
+execute_updates:              true    # Executes updates
-execute_updates:        true    # Executes updates
+force_backup_before_update:   true    # Activates the backup before the update procedure
 
 # Domain Names
 domain_akaunting:               "akaunting.{{top_domain}}"

roles/backup-docker-to-local/templates/backup-docker-to-local.service.j2

@@ -1,9 +1,9 @@
 [Unit]
-Description=docker volume backup
+Description=backup docker volumes to local folder
 OnFailure=systemd-notifier@%n.service cleanup-failed-docker-backups.service
 
 [Service]
 Type=oneshot
-ExecStartPre=/bin/sh -c '/usr/bin/python {{ path_system_maintenance_service_freezer_script }} freeze "{{ system_maintenance_services | reject('equalto', "backup-docker-to-local") | join(',') }}"'
+ExecStartPre=/bin/sh -c '/usr/bin/python {{ path_system_maintenance_service_freezer_script }} freeze "{{ system_maintenance_services }}" --ignore "backup-docker-to-local,backup-remote-to-local,backup-data-to-usb" --max_attempts 600'
 ExecStart=/usr/bin/python {{backup_docker_to_local_folder}}backup-docker-to-local.py
 ExecStartPost=/bin/sh -c 'systemctl start system-maintenance-service-defrost.service'

roles/backup-remote-to-local/templates/backup-remote-to-local.service.j2

@@ -4,6 +4,6 @@ OnFailure=systemd-notifier@%n.service cleanup-failed-docker-backups.service
 
 [Service]
 Type=oneshot
-ExecStartPre=/bin/sh -c '/usr/bin/python {{ path_system_maintenance_service_freezer_script }} freeze "{{ system_maintenance_services | reject('equalto', "backup-remote-to-local") | join(',') }}"'
+ExecStartPre=/bin/sh -c '/usr/bin/python {{ path_system_maintenance_service_freezer_script }} freeze "{{ system_maintenance_services }}" --ignore "backup-docker-to-local,backup-remote-to-local,backup-data-to-usb" --max_attempts 600'
 ExecStart=/usr/bin/bash {{docker_backup_remote_to_local_folder}}backups-remote-to-local.sh
 ExecStartPost=/bin/sh -c 'systemctl start system-maintenance-service-defrost.service'

roles/docker-funkwhale/templates/docker-compose.yml.j2

@@ -6,7 +6,7 @@ services:
     env_file: .env
     environment:
       - "POSTGRES_HOST_AUTH_METHOD=trust"
-    image: postgres:alpine
+    image: postgres:15-alpine
     volumes:
       - database:/var/lib/postgresql/data
 

roles/docker-listmonk/templates/docker-compose.yml.j2

@@ -11,7 +11,7 @@ x-application-defaults: &application-defaults
     - TZ=Etc/UTC
 
 x-database-defaults: &database-defaults
-  image: postgres:alpine
+  image: postgres:13-alpine
   ports:
     - "9432:5432"
   networks:

roles/docker-mastodon/templates/docker-compose.yml.j2

@@ -2,7 +2,7 @@ version: '3'
 services:
   database:
     restart: always
-    image: postgres:alpine
+    image: postgres:14-alpine
     shm_size: 256mb
     networks:
       - internal_network

roles/docker-matrix/templates/docker-compose.yml.j2

@@ -4,7 +4,7 @@ services:
   
   synapse:
     image: matrixdotorg/synapse:latest
-    restart: unless-stopped
+    restart: always
     logging:
       driver: journald
     volumes:
@@ -18,24 +18,24 @@ services:
       - "127.0.0.1:{{http_port}}:8008"
     depends_on:
       - database
-
   database:
     logging:
-        driver: journald
+      driver: journald
-    image: postgres:alpine
+    image: mariadb
-    restart: unless-stopped
+    restart: always
-    volumes:
-      - database:/var/lib/postgresql/data
     environment:
-      - POSTGRES_DB=matrix
+      MYSQL_DATABASE: "matrix"
-      - POSTGRES_USER=matrix
+      MYSQL_USER: "matrix"
-      - POSTGRES_PASSWORD={{matrix_database_password}}
+      MYSQL_PASSWORD: "{{matrix_database_password}}"
-      - POSTGRES_INITDB_ARGS=--encoding=UTF8 --locale=C
+      MYSQL_ROOT_PASSWORD: "{{matrix_database_password}}"
+      MARIADB_AUTO_UPGRADE: "1"
+    volumes:
+      - database:/var/lib/mysql
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U matrix"]
+      test: "/usr/bin/mariadb --user=matrix --password={{matrix_database_password}} --execute \"SHOW DATABASES;\""
-      interval: 10s
+      interval: 3s
-      timeout: 5s
+      timeout: 1s
-      retries: 6
+      retries: 5
 
   # bridges
   #mautrix-telegram:

roles/docker-matrix/templates/homeserver.yaml.j2

@@ -9,7 +9,7 @@ listeners:
       - names: [client, federation]
         compress: false
 database:
-  name: psycopg2
+  name: mysql
   args:
     user: matrix
     password: {{matrix_database_password}}

roles/docker-mybb/templates/docker-compose.yml.j2

@@ -28,21 +28,21 @@ services:
   database:
     logging:
       driver: journald
-      options:
+    image: mariadb
-        tag: "mybb_database"
-    environment:
-      POSTGRES_DB: mybb
-      POSTGRES_PASSWORD: "{{mybb_database_password}}"
-      POSTGRES_USER: mybb
-    image: postgres:alpine
-    volumes:
-    - database:/var/lib/postgresql/data:rw
     restart: always
+    environment:
+      MYSQL_DATABASE: "mybb"
+      MYSQL_USER: "mybb"
+      MYSQL_PASSWORD: "{{mybb_database_password}}"
+      MYSQL_ROOT_PASSWORD: "{{mybb_database_password}}"
+      MARIADB_AUTO_UPGRADE: "1"
+    volumes:
+      - database:/var/lib/mysql
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U mybb"]
+      test: "/usr/bin/mariadb --user=mybb --password={{mybb_database_password}} --execute \"SHOW DATABASES;\""
-      interval: 10s
+      interval: 3s
-      timeout: 5s
+      timeout: 1s
-      retries: 6
+      retries: 5
 volumes:
   database:
   data:

roles/docker-peertube/templates/docker-compose.yml.j2

@@ -17,7 +17,7 @@ services:
       - redis
     restart: "always"
   database:
-    image: postgres:alpine
+    image: postgres:13-alpine
     env_file:
       - .env
     volumes:

roles/system-maintenance-service-freezer/files/system-maintenance-service-freezer.py

@@ -1,71 +1,90 @@
 import argparse
 import subprocess
 import time
+import os
 
+def service_file_exists(service_name, service_type="service"):
+    """Check if a systemd service file exists."""
+    # Paths where service files can be stored
+    path = "/etc/systemd/system/"
+    service_file_name = service_name + "." + service_type
+    full_path = os.path.join(path, service_file_name)
+    
+    print(f"Checking {full_path}")  # Added debug output
+    if os.path.isfile(full_path):
+        return True
+    else:
+        print(f"File not found.")  # Debug output if file is not found
 
 def check_service_active(service_name):
-    """Check if a service is active."""
+    """Check if a service is active or activating."""
     result = subprocess.run(['systemctl', 'is-active', service_name], stdout=subprocess.PIPE)
-    return result.stdout.decode('utf-8').strip() == 'active'
+    service_status = result.stdout.decode('utf-8').strip()
+    return service_status in ['active', 'activating']
 
-def service_exists(service_name):
+def freeze(services_to_wait_for, ignored_services, max_attempts):
-    """Check if a service exists."""
-    result = subprocess.run(['systemctl', 'status', service_name], stdout=subprocess.PIPE, stderr=subprocess.PIPE)
-    return result.returncode == 0
-
-def freeze(services_to_wait_for, ignored_services):
     # Filter services that exist and are not in the ignored list
-    active_services = [service for service in services_to_wait_for if service_exists(service) and service not in ignored_services]
+    for service in services_to_wait_for:
-
+        print(f"\nFreezing: {service}")
-    while active_services:
+        if service in ignored_services:
-        for service in active_services:
+            print(f"{service} will be ignored.")
-            if not check_service_active(service):
+        else:
-                print(f"{service} stopped.")
+            attempt=0
-                # Disable the service
+            break_time_sec=5
-                subprocess.run(['systemctl', 'disable', service])
+            while check_service_active(service):
-                print(f"{service} disabled.")
+                attempt += 1
-
+                print(f"({attempt}/{max_attempts}) Waiting for {break_time_sec} seconds for {service} to stop...")
-                # Stop and disable the corresponding timer, if it exists
+                time.sleep(break_time_sec)
+                if attempt > max_attempts:
+                    raise Exception(f"Error: Maximum attempts ({max_attempts}) reached. Exit.")
+                    
+            # Stop and disable the corresponding timer, if it exists
+            if service_file_exists(service,"timer"):
                 timer_name = service + ".timer"
-                timer_check = subprocess.run(['systemctl', 'list-timers', '--all', timer_name], stdout=subprocess.PIPE)
+                subprocess.run(['systemctl', 'stop', timer_name])
-                if timer_name in timer_check.stdout.decode():
+                subprocess.run(['systemctl', 'disable', timer_name])
-                    subprocess.run(['systemctl', 'stop', timer_name])
+                print(f"{timer_name} stopped and disabled.")
-                    subprocess.run(['systemctl', 'disable', timer_name])
-                    print(f"{timer_name} stopped and disabled.")
-                active_services.remove(service)
             else:
-                print(f"Waiting for {service} to stop...")
+                print(f"Skipped.")
-        time.sleep(5)
+                
-    print("All required services have stopped.")
+    print("\nAll required services have stopped.")
 
 def defrost(services_to_wait_for, ignored_services):
     for service in services_to_wait_for:
-        if service not in ignored_services and service_exists(service):
+        print(f"\nUnfreezing: {service}")
-            # Enable the service
+        if service in ignored_services:
-            subprocess.run(['systemctl', 'enable', service])
+            print(f"{service} will be ignored.")
-            print(f"{service} enabled.")
+        elif service_file_exists(service,"timer"):
-
             # Start and enable the corresponding timer, if it exists
             timer_name = service + ".timer"
-            timer_check = subprocess.run(['systemctl', 'list-timers', '--all', timer_name], stdout=subprocess.PIPE)
+            subprocess.run(['systemctl', 'start', timer_name])
-            if timer_name in timer_check.stdout.decode():
+            subprocess.run(['systemctl', 'enable', timer_name])
-                subprocess.run(['systemctl', 'start', timer_name])
+            print(f"{timer_name} started and enabled.")
-                subprocess.run(['systemctl', 'enable', timer_name])
+        else:
-                print(f"{timer_name} started and enabled.")
+            print(f"Skipped.")
+    print("\nAll required services are started.")
 
-def main(services_to_wait_for, ignored_services, action):
+def main(services_to_wait_for, ignored_services, action, max_attempts):
+    print(f"Services to wait for: {services_to_wait_for}")
+    print(f"Services to ignore: {ignored_services}")
     if action == 'freeze':
-        # Code to handle freeze action
+        print("Freezing services.");
-        freeze(services_to_wait_for, ignored_services)
+        freeze(services_to_wait_for, ignored_services, max_attempts)
     elif action == 'defrost':
+        print("Unfreezing services.");
         defrost(services_to_wait_for, ignored_services)
+    print('\nOverview:')
+    subprocess.run(['systemctl', 'list-timers'])
 
 if __name__ == "__main__":
     parser = argparse.ArgumentParser(description='freezes and defrost systemctl services and timers')
     parser.add_argument('action', choices=['freeze', 'defrost'], help='Action to perform: freeze or defrost services.')
     parser.add_argument('services', help='Comma-separated list of services to apply the action to')
     parser.add_argument('--ignore', help='Comma-separated list of services to ignore in the action', default='')
+    parser.add_argument('--max_attempts', type=int, default=60, help='Maximum number of attempts for freezing services')
+
     args = parser.parse_args()
     services_to_wait_for = args.services.split(',')
     ignored_services = args.ignore.split(',') if args.ignore else []
-    main(services_to_wait_for, ignored_services,args.action)
+    max_attempts = args.max_attempts
+    main(services_to_wait_for, ignored_services,args.action,max_attempts)

roles/system-maintenance-service-freezer/handlers/main.yml

@@ -1,9 +0,0 @@
-- name: "reload system-maintenance-service-freeze.service"
-  systemd:
-    name: system-maintenance-service-freeze.service
-    daemon_reload: yes
-
-- name: "reload system-maintenance-service-defrost.service"
-  systemd:
-    name: system-maintenance-service-defrost.service
-    daemon_reload: yes

roles/system-maintenance-service-freezer/tasks/main.yml

@@ -5,16 +5,6 @@
     dest: "{{path_system_maintenance_service_freezer_script}}"
   when: run_once_system_maintenance_service_freeze is not defined
 
-- name: Configure system-maintenance-service for each action
-  loop:
-    - freeze
-    - defrost
-  template:
-    src: system-maintenance-service-freezer.service.j2
-    dest: "/etc/systemd/system/system-maintenance-service-{{ item }}.service"
-  notify: "reload system-maintenance-service-{{ item }} service"
-  when: run_once_system_maintenance_service_freeze is not defined
-
 - name: run the system_maintenance_service_freezer tasks once
   set_fact:
     run_once_system_maintenance_service_freeze: true
@@ -23,7 +13,7 @@
 - name: "restart system-maintenance-service.service"
   systemd:
     name: system-maintenance-service-{{system_maintenance_service_freeze_action}}.service
-    state: restart
+    state: restarted
     enabled: yes
     daemon_reload: yes
   when: maintenance_service_freeze_action_last is not defined or maintenance_service_freeze_action_last != system_maintenance_service_freeze_action

roles/system-maintenance-service-freezer/templates/system-maintenance-service-freezer.service.j2

@@ -1,5 +1,5 @@
 [Unit]
-Description={{item}} systemctl maintanance services
+Description={{item}} systemctl maintenance services
 OnFailure=systemd-notifier@%n.service
 
 [Service]

roles/update-docker/templates/update-docker.service.j2

@@ -4,6 +4,7 @@ OnFailure=systemd-notifier@%n.service
 
 [Service]
 Type=oneshot
+{% if force_backup_before_update | bool %}ExecStartPre=/bin/sh -c 'systemctl start backup-docker-to-local.service'{% endif %}
 ExecStartPre=/bin/sh -c '/usr/bin/python {{ path_system_maintenance_service_freezer_script }} freeze "{{ system_maintenance_services | reject('equalto', "update-docker") | join(',') }}"'
 ExecStart=/bin/sh -c '/usr/bin/python {{update_docker_script}} {{path_docker_compose_instances}}'
 ExecStartPost=/bin/sh -c 'systemctl start system-maintenance-service-defrost.service'

servers.yml

@@ -236,10 +236,9 @@
         domain_mappings: "{{redirect_domain_mappings}}"
 
 - name: setup www redirect 
-  hosts: all
+  hosts: www_redirect
   become: true
   roles:
    -  role: nginx-www-redirect
-      when: nginx_www_redirect | bool
 
 - import_playbook: destructor.yml