feat(infra): Phase 3 & 4 completion, deploy AWX playbooks & Zabbix monitoring

ansible/playbooks/weekly_os_patching.yml

@@ -0,0 +1,46 @@
+---
+- name: Weekly OS & Security Patching with Rolling Safety Gates
+  hosts: all:!synology_nas
+  serial: 1
+  gather_facts: true
+
+  tasks:
+    - name: Update apt cache
+      ansible.builtin.apt:
+        update_cache: true
+        cache_valid_time: 3600
+      when: ansible_os_family == "Debian"
+
+    - name: Perform dist-upgrade
+      ansible.builtin.apt:
+        upgrade: dist
+        autoremove: true
+        autoclean: true
+      when: ansible_os_family == "Debian"
+
+    - name: Check if system reboot is required
+      ansible.builtin.stat:
+        path: /var/run/reboot-required
+      register: reboot_required_file
+
+    - name: Rolling Reboot with Connection Verification
+      when: reboot_required_file.stat.exists
+      block:
+        - name: Reboot host gracefully
+          ansible.builtin.reboot:
+            msg: "Automated rolling maintenance reboot via AWX"
+            reboot_timeout: 300
+            connect_timeout: 30
+            test_command: uptime
+
+        - name: Verify systemd-timesyncd is active after reboot
+          ansible.builtin.systemd:
+            name: systemd-timesyncd
+            state: started
+          ignore_errors: true
+
+        - name: Verify zabbix-agent2 is active after reboot
+          ansible.builtin.systemd:
+            name: zabbix-agent2
+            state: started
+          ignore_errors: true