fix idempotency across roles

- firewall: remove ufw reset on every run; pre-check state before enable/disable/rule tasks
- debian: add regexp to fstab lineinfile; clean stale mariadb 12.2 repo
- librenms: use mariadb 11.8 (trixie-compatible)
- mailcow: idempotent git config, docker compose down/pull/up
- tailscale: don't redownload gpg key every run

ansible/roles/debian/tasks/main.yml

@@ -1,3 +1,23 @@
+- name: "Disable Proxmox enterprise repository (requires paid subscription)"
+  ansible.builtin.command:
+    cmd: mv /etc/apt/sources.list.d/pve-enterprise.list /etc/apt/sources.list.d/pve-enterprise.list.disabled
+    removes: /etc/apt/sources.list.d/pve-enterprise.list
+  changed_when: true
+
+- name: "Read MariaDB repo file (if present)"
+  ansible.builtin.slurp:
+    path: /etc/apt/sources.list.d/mariadb.sources
+  register: _mariadb_repo_content
+  ignore_errors: true
+
+- name: "Remove stale MariaDB 12.2 repo (not available for trixie)"
+  ansible.builtin.file:
+    path: /etc/apt/sources.list.d/mariadb.sources
+    state: absent
+  when:
+    - _mariadb_repo_content.content is defined
+    - "'repo/12.2/debian' in (_mariadb_repo_content.content | b64decode)"
+
 - name: "Install updates"
   ansible.builtin.apt:
     name: "*"
@@ -12,4 +32,5 @@
   ansible.builtin.lineinfile:
     path: /etc/fstab
     state: present
+    regexp: '^tmpfs\s+/run/shm\s+'
     line: "tmpfs /run/shm tmpfs defaults,noexec,nosuid 0 0"

ansible/roles/firewall/tasks/main.yml

@@ -60,6 +60,16 @@
     - ansible_os_family == "RedHat"
     - firewall_allow_rules | length > 0
 
+# --- UFW (Debian/Ubuntu) - Check current state ---
+
+- name: "Check ufw status"
+  ansible.builtin.command: ufw status
+  register: _fw_ufw_active
+  changed_when: false
+  failed_when: false
+  check_mode: false
+  when: ansible_os_family == "Debian"
+
 # --- UFW (Debian/Ubuntu) - Disable when firewall not managed ---
 
 - name: Disable ufw
@@ -68,16 +78,11 @@
   when:
     - ansible_os_family == "Debian"
     - not (firewall_enabled | default(true))
+    - _fw_ufw_active.stdout is defined
+    - "'Status: active' in _fw_ufw_active.stdout"
 
 # --- UFW (Debian/Ubuntu) - Configure when firewall managed ---
 
-- name: Reset ufw to defaults
-  ufw:
-    state: reset
-  when:
-    - ansible_os_family == "Debian"
-    - firewall_enabled | default(true)
-
 - name: Set default incoming policy to deny
   ufw:
     direction: incoming
@@ -102,6 +107,18 @@
     - ansible_os_family == "Debian"
     - firewall_enabled | default(true)
 
+- name: "Capture existing ufw rules"
+  ansible.builtin.command: ufw status verbose
+  register: _fw_ufw_rules
+  changed_when: false
+  failed_when: false
+  check_mode: false
+  when:
+    - ansible_os_family == "Debian"
+    - firewall_enabled | default(true)
+    - _fw_ufw_active.stdout is defined
+    - "'Status: active' in _fw_ufw_active.stdout"
+
 - name: Allow all traffic from trusted subnets
   ufw:
     rule: allow
@@ -111,6 +128,7 @@
   when:
     - ansible_os_family == "Debian"
     - firewall_enabled | default(true)
+    - _fw_ufw_rules.skipped | default(true) or item.subnet not in _fw_ufw_rules.stdout
 
 - name: Allow SSH from specific IPs
   ufw:
@@ -124,6 +142,7 @@
     - ansible_os_family == "Debian"
     - firewall_enabled | default(true)
     - firewall_ssh_allow_from | length > 0
+    - _fw_ufw_rules.skipped | default(true) or item.ip not in _fw_ufw_rules.stdout
 
 - name: Allow per-host public services
   ufw:
@@ -137,6 +156,7 @@
     - ansible_os_family == "Debian"
     - firewall_enabled | default(true)
     - firewall_allow_rules | length > 0
+    - _fw_ufw_rules.skipped | default(true) or (item.port | string + '/' + item.proto) not in _fw_ufw_rules.stdout
 
 - name: Enable IP forwarding
   ansible.posix.sysctl:
@@ -173,3 +193,5 @@
   when:
     - ansible_os_family == "Debian"
     - firewall_enabled | default(true)
+    - _fw_ufw_active.stdout is defined
+    - "'Status: active' not in _fw_ufw_active.stdout"

ansible/roles/librenms/tasks/main.yml

@@ -3,7 +3,7 @@
   ansible.builtin.deb822_repository:
     name: mariadb
     types: deb
-    uris: https://mirror.rackspace.com/mariadb/repo/12.2/debian
+    uris: https://mirror.rackspace.com/mariadb/repo/11.8/debian
     suites: trixie
     components: main
     signed_by: https://mariadb.org/mariadb_release_signing_key.pgp

ansible/roles/mailcow/tasks/main.yml

@@ -59,7 +59,15 @@
   when: not mailcow_repo.stat.exists
 
 - name: Add Mailcow directory to git safe directories
-  command: git config --global --add safe.directory {{ mailcow_base_path }}
+  ansible.builtin.shell: |
+    if git config --global --get safe.directory {{ mailcow_base_path }} >/dev/null 2>&1; then
+      echo "already_present"
+    else
+      git config --global --add safe.directory {{ mailcow_base_path }}
+      echo "added"
+    fi
+  register: git_safe_dir
+  changed_when: "'added' in git_safe_dir.stdout"
   when: mailcow_repo.stat.exists
 
 - name: Update Mailcow repository
@@ -141,6 +149,7 @@
   args:
     chdir: "{{ mailcow_base_path }}"
   failed_when: false
+  changed_when: false
 
 - name: Prune unused Docker networks
   command: docker network prune -f
@@ -150,11 +159,15 @@
   command: docker compose pull
   args:
     chdir: "{{ mailcow_base_path }}"
+  register: mailcow_pull_result
+  changed_when: "'Pulling' in mailcow_pull_result.stdout or 'Downloaded' in mailcow_pull_result.stderr"
 
 - name: Start Mailcow services
   command: docker compose up -d
   args:
     chdir: "{{ mailcow_base_path }}"
+  register: mailcow_up_result
+  changed_when: "'Created' in mailcow_up_result.stdout or 'Starting' in mailcow_up_result.stdout"
 
 - name: Check if ufw is installed
   command: which ufw

ansible/roles/tailscale/tasks/main.yml

@@ -4,7 +4,7 @@
     url: https://pkgs.tailscale.com/stable/debian/bookworm.noarmor.gpg
     dest: /usr/share/keyrings/tailscale-archive-keyring.gpg
     mode: '0644'
-    force: true
+    force: false
 
 - name: Add Tailscale repository
   ansible.builtin.deb822_repository: