From 5d2569106ef436be537b0f07833661a6c68b91be Mon Sep 17 00:00:00 2001
From: David <david@datajack.org>
Date: Thu, 29 Oct 2026 22:55:26 +0000
Subject: [PATCH] Add upgrade playbook and wrapper script for apt dist-upgrade
 on all nodes

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 ansible/upgrade.sh  | 13 +++++++++++++
 ansible/upgrade.yml | 29 +++++++++++++++++++++++++++++
 2 files changed, 42 insertions(+)
 create mode 100755 ansible/upgrade.sh
 create mode 100644 ansible/upgrade.yml

diff --git a/ansible/upgrade.sh b/ansible/upgrade.sh
new file mode 100755
index 0000000..8e78764
--- /dev/null
+++ b/ansible/upgrade.sh
@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+# Wrapper for upgrade.yml.
+# Usage: ./upgrade.sh [--reboot] [ansible-playbook args, e.g. --limit dm-edworth --ask-become-pass]
+set -euo pipefail
+cd "$(dirname "$0")"
+
+EXTRA=()
+if [[ "${1:-}" == "--reboot" ]]; then
+  EXTRA=(-e reboot=true)
+  shift
+fi
+
+exec ansible-playbook upgrade.yml "${EXTRA[@]}" "$@"
diff --git a/ansible/upgrade.yml b/ansible/upgrade.yml
new file mode 100644
index 0000000..120f868
--- /dev/null
+++ b/ansible/upgrade.yml
@@ -0,0 +1,29 @@
+---
+# apt update + dist-upgrade on meshcore nodes, one host at a time.
+#   ansible-playbook upgrade.yml [--limit dm-edworth]
+#   ansible-playbook upgrade.yml -e reboot=true   # reboot only nodes that need it
+- name: Upgrade packages
+  hosts: meshcore
+  become: true
+  serial: 1
+  vars:
+    reboot: false
+  tasks:
+    - name: apt update and dist-upgrade
+      ansible.builtin.apt:
+        update_cache: true
+        upgrade: dist
+        autoremove: true
+
+    - name: Check whether a reboot is required
+      ansible.builtin.stat:
+        path: /var/run/reboot-required
+      register: reboot_required
+
+    - name: Report reboot status
+      ansible.builtin.debug:
+        msg: "{{ inventory_hostname }}: reboot {{ 'required' if reboot_required.stat.exists else 'not required' }}"
+
+    - name: Reboot if required
+      ansible.builtin.reboot:
+      when: reboot | bool and reboot_required.stat.exists