fix(roles): detect new image on podman pull and restart services

Same bug as immich (556fae8): 'Writing manifest' goes to stderr, so
changed_when never matched and the restart handlers never fired after
image upgrades. Compare local image IDs before/after pull instead, and
notify the restart handler only on a genuinely new image.

Applies to fdroid, gitea, metabase, ntfy, unifi, uptime-kuma.

roles/fdroid/tasks/main.yml

@@ -54,13 +54,22 @@
     mode: "0600"
   notify: Restart fdroid
 
-- name: Pull fdroid container image
+- name: Get current fdroid image ID
-  ansible.builtin.command: "podman pull {{ fdroid_image }}:{{ fdroid_version }}"
+  ansible.builtin.command: "podman image inspect --format {% raw %}{{.Id}}{% endraw %} {{ fdroid_image }}:{{ fdroid_version }}"
-  changed_when: pull_result.stdout is search('Writing manifest')
+  register: fdroid_image_id_before
-  register: pull_result
+  failed_when: false # image may not exist yet on first deploy
+  changed_when: false
   become: false
   become_user: "{{ ansible_user }}"
 
+- name: Pull fdroid container image
+  ansible.builtin.command: "podman pull --quiet {{ fdroid_image }}:{{ fdroid_version }}"
+  register: pull_result
+  changed_when: pull_result.stdout != fdroid_image_id_before.stdout
+  become: false
+  become_user: "{{ ansible_user }}"
+  notify: Restart fdroid
+
 - name: Deploy Kubernetes YAML for fdroid
   ansible.builtin.template:
     src: fdroid.yaml.j2

roles/gitea/tasks/main.yml

@@ -79,13 +79,22 @@
     group: "{{ ansible_user }}"
     mode: "0755"
 
-- name: Pull Gitea container image
+- name: Get current gitea image ID
-  ansible.builtin.command: "podman pull {{ gitea_image }}:{{ gitea_version }}"
+  ansible.builtin.command: "podman image inspect --format {% raw %}{{.Id}}{% endraw %} {{ gitea_image }}:{{ gitea_version }}"
-  changed_when: pull_result.stdout is search('Writing manifest')
+  register: gitea_image_id_before
-  register: pull_result
+  failed_when: false # image may not exist yet on first deploy
+  changed_when: false
   become: false
   become_user: "{{ ansible_user }}"
 
+- name: Pull Gitea container image
+  ansible.builtin.command: "podman pull --quiet {{ gitea_image }}:{{ gitea_version }}"
+  register: pull_result
+  changed_when: pull_result.stdout != gitea_image_id_before.stdout
+  become: false
+  become_user: "{{ ansible_user }}"
+  notify: Restart gitea
+
 - name: Deploy Kubernetes YAML for Gitea
   ansible.builtin.template:
     src: gitea.yaml.j2

roles/metabase/tasks/main.yml

@@ -51,13 +51,22 @@
     group: "{{ ansible_user }}"
     mode: "0755"
 
-- name: Pull Metabase container image
+- name: Get current metabase image ID
-  ansible.builtin.command: "podman pull {{ metabase_image }}:{{ metabase_version }}"
+  ansible.builtin.command: "podman image inspect --format {% raw %}{{.Id}}{% endraw %} {{ metabase_image }}:{{ metabase_version }}"
-  register: pull_result
+  register: metabase_image_id_before
-  changed_when: pull_result.stdout is search('Writing manifest')
+  failed_when: false # image may not exist yet on first deploy
+  changed_when: false
   become: false
   become_user: "{{ ansible_user }}"
 
+- name: Pull Metabase container image
+  ansible.builtin.command: "podman pull --quiet {{ metabase_image }}:{{ metabase_version }}"
+  register: pull_result
+  changed_when: pull_result.stdout != metabase_image_id_before.stdout
+  become: false
+  become_user: "{{ ansible_user }}"
+  notify: Restart Metabase
+
 - name: Deploy Kubernetes YAML for Metabase
   ansible.builtin.template:
     src: metabase.yaml.j2

roles/ntfy/tasks/main.yml

@@ -37,13 +37,22 @@
     mode: "0644"
   notify: Restart ntfy
 
-- name: Pull ntfy container image
+- name: Get current ntfy image ID
-  ansible.builtin.command: "podman pull {{ ntfy_image }}:{{ ntfy_version }}"
+  ansible.builtin.command: "podman image inspect --format {% raw %}{{.Id}}{% endraw %} {{ ntfy_image }}:{{ ntfy_version }}"
-  changed_when: pull_result.stdout is search('Writing manifest')
+  register: ntfy_image_id_before
-  register: pull_result
+  failed_when: false # image may not exist yet on first deploy
+  changed_when: false
   become: false
   become_user: "{{ ansible_user }}"
 
+- name: Pull ntfy container image
+  ansible.builtin.command: "podman pull --quiet {{ ntfy_image }}:{{ ntfy_version }}"
+  register: pull_result
+  changed_when: pull_result.stdout != ntfy_image_id_before.stdout
+  become: false
+  become_user: "{{ ansible_user }}"
+  notify: Restart ntfy
+
 - name: Deploy Kubernetes YAML for ntfy
   ansible.builtin.template:
     src: ntfy.yaml.j2

roles/unifi/tasks/main.yml

@@ -25,13 +25,22 @@
     group: "{{ ansible_user }}"
     mode: "0755"
 
-- name: Pull UniFi container image
+- name: Get current unifi image ID
-  ansible.builtin.command: "podman pull {{ unifi_image }}:{{ unifi_version }}"
+  ansible.builtin.command: "podman image inspect --format {% raw %}{{.Id}}{% endraw %} {{ unifi_image }}:{{ unifi_version }}"
-  changed_when: pull_result.stdout is search('Writing manifest')
+  register: unifi_image_id_before
-  register: pull_result
+  failed_when: false # image may not exist yet on first deploy
+  changed_when: false
   become: false
   become_user: "{{ ansible_user }}"
 
+- name: Pull UniFi container image
+  ansible.builtin.command: "podman pull --quiet {{ unifi_image }}:{{ unifi_version }}"
+  register: pull_result
+  changed_when: pull_result.stdout != unifi_image_id_before.stdout
+  become: false
+  become_user: "{{ ansible_user }}"
+  notify: Restart unifi
+
 - name: Deploy Kubernetes YAML for unifi
   ansible.builtin.template:
     src: unifi.yaml.j2

roles/uptime_kuma/tasks/main.yml

@@ -15,13 +15,22 @@
     group: "{{ ansible_user }}"
     mode: "0755"
 
-- name: Pull Uptime Kuma container image
+- name: Get current uptime_kuma image ID
-  ansible.builtin.command: "podman pull {{ uptime_kuma_image }}:{{ uptime_kuma_version }}"
+  ansible.builtin.command: "podman image inspect --format {% raw %}{{.Id}}{% endraw %} {{ uptime_kuma_image }}:{{ uptime_kuma_version }}"
-  changed_when: pull_result.stdout is search('Writing manifest')
+  register: uptime_kuma_image_id_before
-  register: pull_result
+  failed_when: false # image may not exist yet on first deploy
+  changed_when: false
   become: false
   become_user: "{{ ansible_user }}"
 
+- name: Pull Uptime Kuma container image
+  ansible.builtin.command: "podman pull --quiet {{ uptime_kuma_image }}:{{ uptime_kuma_version }}"
+  register: pull_result
+  changed_when: pull_result.stdout != uptime_kuma_image_id_before.stdout
+  become: false
+  become_user: "{{ ansible_user }}"
+  notify: Restart uptime-kuma
+
 - name: Deploy Kubernetes YAML for uptime-kuma
   ansible.builtin.template:
     src: uptime-kuma.yaml.j2