---
- name: Weekly OS & Security Patching with Rolling Safety Gates
  hosts: all:!synology_nas
  serial: 1
  gather_facts: true

  tasks:
    - name: Update apt cache
      ansible.builtin.apt:
        update_cache: true
        cache_valid_time: 3600
      when: ansible_os_family == "Debian"

    - name: Perform dist-upgrade
      ansible.builtin.apt:
        upgrade: dist
        autoremove: true
        autoclean: true
      when: ansible_os_family == "Debian"

    - name: Check if system reboot is required
      ansible.builtin.stat:
        path: /var/run/reboot-required
      register: reboot_required_file

    - name: Rolling Reboot with Connection Verification
      when: reboot_required_file.stat.exists
      block:
        - name: Reboot host gracefully
          ansible.builtin.reboot:
            msg: "Automated rolling maintenance reboot via AWX"
            reboot_timeout: 300
            connect_timeout: 30
            test_command: uptime

        - name: Verify systemd-timesyncd is active after reboot
          ansible.builtin.systemd:
            name: systemd-timesyncd
            state: started
          ignore_errors: true

        - name: Verify zabbix-agent2 is active after reboot
          ansible.builtin.systemd:
            name: zabbix-agent2
            state: started
          ignore_errors: true