From 241a668f3c2a41f454f5811f9ec2004b5444141a Mon Sep 17 00:00:00 2001
From: Vuong Hoang <vh@phasefinal.com>
Date: Sat, 3 Oct 2026 15:52:44 -0700
Subject: [PATCH] ops(esh-nas-pve): PVE 9 upgrade playbook (snapshot, trixie
 sources, detached dist-upgrade)

---
 playbooks/esh-nas-pve-pve9-upgrade.yaml | 63 +++++++++++++++++++++++++
 1 file changed, 63 insertions(+)
 create mode 100644 playbooks/esh-nas-pve-pve9-upgrade.yaml

diff --git a/playbooks/esh-nas-pve-pve9-upgrade.yaml b/playbooks/esh-nas-pve-pve9-upgrade.yaml
new file mode 100644
index 0000000..a416277
--- /dev/null
+++ b/playbooks/esh-nas-pve-pve9-upgrade.yaml
@@ -0,0 +1,63 @@
+# esh-nas-pve: PVE 8.4.21 → 9 upgrade, the package half (Prime go 2026-10-03, on site). Does NOT reboot.
+#   scripts/elway infra-ops@10.0.50.55 --playbook playbooks/esh-nas-pve-pve9-upgrade.yaml
+# Prereq: playbooks/esh-nas-pve-pve9-prep.yaml, then the PVE 8 reboot test (done 2026-10-03 1533-1546).
+# The dist-upgrade runs DETACHED (systemd-run → /root/pve9-upgrade.log), so a dropped ssh cannot kill it mid-dpkg.
+# Poll: sudo tail /root/pve9-upgrade.log ; systemctl status pve9-dist-upgrade
+# Rollback: zfs rollback -r nvme/ROOT/pve-1@pre-pve9 from a rescue boot. NEVER `zpool upgrade nvme` (GRUB reads it).
+steps:
+  - name: retire the two old de-nag hooks (they cannot patch the PVE 9 toolkit); pve-nag-patch replaces them
+    sudo: true
+    shell: |
+      set -e
+      mkdir -p /root/pve9-prep-20261003
+      if [ -f /etc/apt/apt.conf.d/86pve-nags ]; then mv /etc/apt/apt.conf.d/86pve-nags /root/pve9-prep-20261003/86pve-nags.retired; fi
+      if [ -f /etc/apt/apt.conf.d/no-nag-script ]; then mv /etc/apt/apt.conf.d/no-nag-script /root/pve9-prep-20261003/no-nag-script.retired; fi
+    when: "test -f /etc/apt/apt.conf.d/86pve-nags || test -f /etc/apt/apt.conf.d/no-nag-script"
+
+  - name: install pve-nag-patch + its apt hook (patches the new toolkit after the upgrade)
+    sudo: true
+    upload:
+      src: services/pve-nag-patch/pve-nag-patch
+      dest: /usr/local/sbin/pve-nag-patch
+      mode: "0755"
+  - name: pve-nag-patch apt hook
+    sudo: true
+    upload:
+      src: services/pve-nag-patch/86pve-nag-patch
+      dest: /etc/apt/apt.conf.d/86pve-nag-patch
+      mode: "0644"
+
+  - name: root snapshot for rollback
+    sudo: true
+    shell: zfs snapshot -r nvme/ROOT@pre-pve9
+    when: "! zfs list -H -t snapshot nvme/ROOT/pve-1@pre-pve9 >/dev/null 2>&1"
+
+  - name: switch apt sources bookworm → trixie (Debian + pve-no-subscription)
+    sudo: true
+    shell: |
+      set -e
+      sed -i 's/bookworm/trixie/g' /etc/apt/sources.list /etc/apt/sources.list.d/pve-install-repo.list
+    when: "grep -q bookworm /etc/apt/sources.list /etc/apt/sources.list.d/pve-install-repo.list"
+
+  - name: apt update on trixie (must be clean)
+    sudo: true
+    shell: |
+      ! apt-get update -q 2>&1 | grep -E '^(E|Err):'
+    changed_when: "false"
+
+  - name: start the dist-upgrade DETACHED (log /root/pve9-upgrade.log)
+    sudo: true
+    shell: |
+      systemd-run --unit=pve9-dist-upgrade --setenv=DEBIAN_FRONTEND=noninteractive \
+        /bin/sh -c 'apt-get dist-upgrade -y -q -o Dpkg::Options::=--force-confdef -o Dpkg::Options::=--force-confold > /root/pve9-upgrade.log 2>&1; echo "EXIT $?" >> /root/pve9-upgrade.log'
+    when: "! test -f /root/pve9-upgrade.log"
+
+verify:
+  - name: snapshot exists
+    sudo: true
+    shell: zfs list -H -t snapshot nvme/ROOT/pve-1@pre-pve9
+    changed_when: "false"
+  - name: sources are trixie
+    sudo: true
+    shell: "! grep -q bookworm /etc/apt/sources.list /etc/apt/sources.list.d/pve-install-repo.list"
+    changed_when: "false"