Backport fixes from version in production

Per file detail:
backup.yml
      - Added role defaults loading with proper precedence (inventory > vars > defaults)
      - Fixed pg_dump permissions: now dumps to /tmp first, then moves to backup directory
update.yml
      - Added role defaults loading with proper precedence
      - Fixed docker exec commands to use --user {{ forgejo_user }}
      - Added monitoring compose file detection and handling
restore.yml
      - Added role defaults loading with proper precedence
      - Added monitoring compose file detection and handling
      - Fixed docker exec for doctor command to use --user {{ forgejo_user }}
Makefile
       - Updated .PHONY with new targets
       - Replaced auto-generated help with structured categorized help
       - Added backup-cron and backup-cron-s3 targets for non-interactive backups
       - Added cron job example in help output

ansible/playbooks/backup.yml

@@ -17,6 +17,18 @@
     upload_to_s3: "{{ forgejo_backup_to_s3 | default(false) }}"
   
   pre_tasks:
+    - name: Load role defaults as fallback
+      ansible.builtin.include_vars:
+        file: ../roles/forgejo/defaults/main.yml
+        name: role_defaults
+
+    - name: Apply all role defaults for undefined variables
+      ansible.builtin.set_fact:
+        "{{ item.key }}": "{{ vars[item.key] | default(item.value) }}"
+      loop: "{{ role_defaults | dict2items }}"
+      loop_control:
+        label: "{{ item.key }}"
+
     - name: Display backup information
       ansible.builtin.debug:
         msg: |
@@ -37,10 +49,15 @@
       community.postgresql.postgresql_db:
         name: "{{ forgejo_db_name }}"
         state: dump
-        target: "{{ forgejo_backup_path }}/database-{{ backup_timestamp }}.sql"
+        target: "/tmp/database-{{ backup_timestamp }}.sql"
       become_user: postgres
       when: forgejo_db_type == 'postgres'
-    
+
+    - name: Move database backup to backup directory
+      ansible.builtin.command:
+        cmd: mv /tmp/database-{{ backup_timestamp }}.sql {{ forgejo_backup_path }}/database-{{ backup_timestamp }}.sql
+      when: forgejo_db_type == 'postgres'
+
     - name: Compress database backup
       community.general.archive:
         path: "{{ forgejo_backup_path }}/database-{{ backup_timestamp }}.sql"

ansible/playbooks/restore.yml

@@ -18,6 +18,18 @@
     force_restore: false
   
   pre_tasks:
+    - name: Load role defaults as fallback
+      ansible.builtin.include_vars:
+        file: ../roles/forgejo/defaults/main.yml
+        name: role_defaults
+
+    - name: Apply all role defaults for undefined variables
+      ansible.builtin.set_fact:
+        "{{ item.key }}": "{{ vars[item.key] | default(item.value) }}"
+      loop: "{{ role_defaults | dict2items }}"
+      loop_control:
+        label: "{{ item.key }}"
+
     - name: Validate backup timestamp
       ansible.builtin.fail:
         msg: "Please provide backup_timestamp via --extra-vars 'backup_timestamp=20240115T120000'"
@@ -100,11 +112,17 @@
       register: db_backup
       failed_when: not db_backup.stat.exists
     
+    - name: Check if monitoring compose file exists
+      ansible.builtin.stat:
+        path: "{{ forgejo_base_path }}/docker-compose.monitoring.yml"
+      register: monitoring_compose
+
     - name: Stop Forgejo service
       community.docker.docker_compose_v2:
         project_src: "{{ forgejo_base_path }}"
+        files: "{{ ['docker-compose.yml', 'docker-compose.monitoring.yml'] if monitoring_compose.stat.exists else ['docker-compose.yml'] }}"
         state: stopped
-    
+
     - name: Restore PostgreSQL database
       when: forgejo_db_type == 'postgres'
       block:
@@ -180,8 +198,9 @@
     - name: Start Forgejo service
       community.docker.docker_compose_v2:
         project_src: "{{ forgejo_base_path }}"
+        files: "{{ ['docker-compose.yml', 'docker-compose.monitoring.yml'] if monitoring_compose.stat.exists else ['docker-compose.yml'] }}"
         state: present
-    
+
     - name: Wait for Forgejo to be ready
       ansible.builtin.uri:
         url: "http://localhost:{{ forgejo_http_port }}"
@@ -193,7 +212,7 @@
     
     - name: Run integrity checks
       ansible.builtin.command:
-        cmd: docker exec forgejo forgejo doctor check --all
+        cmd: docker exec --user {{ forgejo_user }} forgejo forgejo doctor check --all
       register: integrity_check
       failed_when: false
     

ansible/playbooks/update.yml

@@ -16,15 +16,27 @@
     skip_backup: false  # Override with --extra-vars "skip_backup=true"
   
   pre_tasks:
+    - name: Load role defaults as fallback
+      ansible.builtin.include_vars:
+        file: ../roles/forgejo/defaults/main.yml
+        name: role_defaults
+
+    - name: Apply all role defaults for undefined variables
+      ansible.builtin.set_fact:
+        "{{ item.key }}": "{{ vars[item.key] | default(item.value) }}"
+      loop: "{{ role_defaults | dict2items }}"
+      loop_control:
+        label: "{{ item.key }}"
+
     - name: Display update information
       ansible.builtin.debug:
         msg: |
           Updating Forgejo from {{ forgejo_version }}
           Backup will be created: {{ backup_before_update and not skip_backup }}
-    
+
     - name: Check current Forgejo version
       ansible.builtin.command:
-        cmd: docker exec forgejo forgejo --version
+        cmd: docker exec --user {{ forgejo_user }} forgejo forgejo --version
       register: current_version
       changed_when: false
       failed_when: false
@@ -46,11 +58,17 @@
           ansible.builtin.debug:
             msg: "Backup completed: {{ backup_result.stdout_lines[-1] if backup_result.stdout_lines else 'No output' }}"
     
+    - name: Check if monitoring compose file exists
+      ansible.builtin.stat:
+        path: "{{ forgejo_base_path }}/docker-compose.monitoring.yml"
+      register: monitoring_compose
+
     - name: Stop Forgejo service
       community.docker.docker_compose_v2:
         project_src: "{{ forgejo_base_path }}"
+        files: "{{ ['docker-compose.yml', 'docker-compose.monitoring.yml'] if monitoring_compose.stat.exists else ['docker-compose.yml'] }}"
         state: stopped
-    
+
     - name: Pull latest Forgejo image
       community.docker.docker_image:
         name: "{{ forgejo_docker_image }}:{{ forgejo_version }}"
@@ -68,6 +86,7 @@
     - name: Start Forgejo service
       community.docker.docker_compose_v2:
         project_src: "{{ forgejo_base_path }}"
+        files: "{{ ['docker-compose.yml', 'docker-compose.monitoring.yml'] if monitoring_compose.stat.exists else ['docker-compose.yml'] }}"
         state: present
         pull: always
     
@@ -82,7 +101,7 @@
     
     - name: Check updated version
       ansible.builtin.command:
-        cmd: docker exec forgejo forgejo --version
+        cmd: docker exec --user {{ forgejo_user }} forgejo forgejo --version
       register: updated_version
       changed_when: false
     
@@ -92,7 +111,7 @@
     
     - name: Run database migrations
       ansible.builtin.command:
-        cmd: docker exec forgejo forgejo migrate
+        cmd: docker exec --user {{ forgejo_user }} forgejo forgejo migrate
       register: migrate_result
       changed_when: "'No migration needed' not in migrate_result.stdout"