# esh-nas-pve: PVE 8.4.21 → 9 upgrade, the package half (Prime go 2026-10-03, on site). Does NOT reboot.
#   scripts/elway infra-ops@10.0.50.55 --playbook playbooks/esh-nas-pve-pve9-upgrade.yaml
# Prereq: playbooks/esh-nas-pve-pve9-prep.yaml, then the PVE 8 reboot test (done 2026-10-03 1533-1546).
# The dist-upgrade runs DETACHED (systemd-run → /root/pve9-upgrade.log), so a dropped ssh cannot kill it mid-dpkg.
# Poll: sudo tail /root/pve9-upgrade.log ; systemctl status pve9-dist-upgrade
# Rollback: zfs rollback -r nvme/ROOT/pve-1@pre-pve9 from a rescue boot. NEVER `zpool upgrade nvme` (GRUB reads it).
steps:
  - name: retire the two old de-nag hooks (they cannot patch the PVE 9 toolkit); pve-nag-patch replaces them
    sudo: true
    shell: |
      set -e
      mkdir -p /root/pve9-prep-20261003
      if [ -f /etc/apt/apt.conf.d/86pve-nags ]; then mv /etc/apt/apt.conf.d/86pve-nags /root/pve9-prep-20261003/86pve-nags.retired; fi
      if [ -f /etc/apt/apt.conf.d/no-nag-script ]; then mv /etc/apt/apt.conf.d/no-nag-script /root/pve9-prep-20261003/no-nag-script.retired; fi
    when: "test -f /etc/apt/apt.conf.d/86pve-nags || test -f /etc/apt/apt.conf.d/no-nag-script"

  - name: install pve-nag-patch + its apt hook (patches the new toolkit after the upgrade)
    sudo: true
    upload:
      src: services/pve-nag-patch/pve-nag-patch
      dest: /usr/local/sbin/pve-nag-patch
      mode: "0755"
  - name: pve-nag-patch apt hook
    sudo: true
    upload:
      src: services/pve-nag-patch/86pve-nag-patch
      dest: /etc/apt/apt.conf.d/86pve-nag-patch
      mode: "0644"

  - name: root snapshot for rollback
    sudo: true
    shell: zfs snapshot -r nvme/ROOT@pre-pve9
    when: "! zfs list -H -t snapshot nvme/ROOT/pve-1@pre-pve9 >/dev/null 2>&1"

  - name: switch apt sources bookworm → trixie (Debian + pve-no-subscription)
    sudo: true
    shell: |
      set -e
      sed -i 's/bookworm/trixie/g' /etc/apt/sources.list /etc/apt/sources.list.d/pve-install-repo.list
    when: "grep -q bookworm /etc/apt/sources.list /etc/apt/sources.list.d/pve-install-repo.list"

  - name: apt update on trixie (must be clean)
    sudo: true
    shell: |
      ! apt-get update -q 2>&1 | grep -E '^(E|Err):'
    changed_when: "false"

  - name: start the dist-upgrade DETACHED (log /root/pve9-upgrade.log)
    sudo: true
    shell: |
      systemd-run --unit=pve9-dist-upgrade --setenv=DEBIAN_FRONTEND=noninteractive \
        /bin/sh -c 'apt-get dist-upgrade -y -q -o Dpkg::Options::=--force-confdef -o Dpkg::Options::=--force-confold > /root/pve9-upgrade.log 2>&1; echo "EXIT $?" >> /root/pve9-upgrade.log'
    when: "! test -f /root/pve9-upgrade.log"

verify:
  - name: snapshot exists
    sudo: true
    shell: zfs list -H -t snapshot nvme/ROOT/pve-1@pre-pve9
    changed_when: "false"
  - name: sources are trixie
    sudo: true
    shell: "! grep -q bookworm /etc/apt/sources.list /etc/apt/sources.list.d/pve-install-repo.list"
    changed_when: "false"