From 02565c0d6f68b067a7677b443273ddc127c5ec83 Mon Sep 17 00:00:00 2001 From: pavel Date: Fri, 17 Apr 2026 09:31:26 +0300 Subject: [PATCH] 0931 --- files/ansible-playbooks/ptsd-migrate-auto.yml | 1264 +++++++++++++++++ 1 file changed, 1264 insertions(+) create mode 100644 files/ansible-playbooks/ptsd-migrate-auto.yml diff --git a/files/ansible-playbooks/ptsd-migrate-auto.yml b/files/ansible-playbooks/ptsd-migrate-auto.yml new file mode 100644 index 0000000..750a43d --- /dev/null +++ b/files/ansible-playbooks/ptsd-migrate-auto.yml @@ -0,0 +1,1264 @@ +# ptsd-migration.yml — PPPoE to super DHCP +# Phase 0: reliable DEV2 connectivity + wrapper build (no DEV2 commands) +# Phase 1: DEV2 commands via wrapper (initially uptime) + +- name: "PPPoE to super DHCP | Phase 0+1 | Reliable DEV2 connectivity + wrapper + uptime" + hosts: all + gather_facts: no + + vars: + pathprefix: "PATH=/sbin:/usr/sbin:/bin:/usr/bin:$PATH; " + + dev1_user: "root" + dev1_pass: "wavewave" + + dev2_host: "192.168.1.1" + dev2_port: 22 + + dev2_side_ip: "192.168.1.11/24" + dev2_side_ip_addr: "{{ dev2_side_ip.split('/')[0] }}" + dev1_iface: "br-wan" + + arping_iface: "eth0" + + dev2_ssh_user: "root" + dev2_passfiles: + - "basicpass" + - "basicpass2" + + ssh_opts_common: >- + -o PreferredAuthentications=password + -o PubkeyAuthentication=no + -o StrictHostKeyChecking=no + -o UserKnownHostsFile=/dev/null + -o NumberOfPasswordPrompts=1 + -o ConnectTimeout=30 + -o ConnectionAttempts=1 + -o LogLevel=ERROR + + debugging: true + ssh_timeout: 30 + + pre_tasks: + - name: Initialize passfile facts defensively (avoid undefined vars later) + delegate_to: localhost + ansible.builtin.set_fact: + dev2_passfile_used_direct: "NONE" + dev2_passfile_used_tunnel: "NONE" + dev2_passfile_used_lldp4: "NONE" + dev2_passfile_used_lldp6: "NONE" + changed_when: false + + - name: Report init migrate accumulator + delegate_to: localhost + ansible.builtin.set_fact: + ptsd_migrate_report: "" + changed_when: false + + - name: Read DEV1 hostname (busybox-safe) + ansible.builtin.raw: > + {{ pathprefix }} + (cat /proc/sys/kernel/hostname 2>/dev/null || echo "") + register: dev1_host_read + changed_when: false + + - name: Stop early if connected DEV1 hostname != inventory (guard) + ansible.builtin.meta: end_host + when: (dev1_host_read.stdout | trim | length > 0) and + ((dev1_host_read.stdout | trim) != (inventory_hostname | string)) + + tasks: + # ============================ PHASE 0: LLDP DISCOVERY (IPv4 + IPv6) ============================ + - name: Compute hostname digits key for LLDP lookup (DEV2) + ansible.builtin.set_fact: + dev2_lldp_digits: "{{ (inventory_hostname | string) | regex_replace('[^0-9]', '') }}" + changed_when: false + + - name: Discover DEV2 candidate IPv4 via LLDP on DEV1 (best-effort) + ansible.builtin.raw: > + {{ pathprefix }} + DIGITS="{{ dev2_lldp_digits }}"; + cat /var/run/lldp_server.json 2>/dev/null \ + | grep "${DIGITS}" -A 10 \ + | grep address \ + | grep -vE 'subtype|ipv6' \ + | awk -F'"' '{ print $4 }' \ + | head -n1 + register: dev2_lldp_ip_raw + changed_when: false + failed_when: false + + - name: Discover DEV2 candidate IPv6 via LLDP on DEV1 (best-effort) + ansible.builtin.raw: > + {{ pathprefix }} + DIGITS="{{ dev2_lldp_digits }}"; + cat /var/run/lldp_server.json 2>/dev/null \ + | grep "${DIGITS}" -A 15 \ + | grep 'address_ipv6' \ + | awk -F'"' '{ print $4 }' \ + | head -n1 + register: dev2_lldp_ip6_raw + changed_when: false + failed_when: false + + - name: Capture LLDP-derived DEV2 IP facts + ansible.builtin.set_fact: + lldp_dev2_ip: "{{ (dev2_lldp_ip_raw.stdout | default('')) | trim }}" + lldp_dev2_ip6: "{{ (dev2_lldp_ip6_raw.stdout | default('')) | trim }}" + changed_when: false + + - name: Classify LLDP IPv4 candidate + delegate_to: localhost + ansible.builtin.set_fact: + lldp_ip_class: >- + {% set ip = (lldp_dev2_ip | default('')) %} + {% if ip == '' %}none + {% elif ip.startswith('10.') %}10 + {% elif ip.startswith('192.168.') %}192_168 + {% else %}other{% endif %} + changed_when: false + + - name: Debug LLDP candidates + when: debugging | bool + delegate_to: localhost + ansible.builtin.debug: + msg: + - "LLDP digits={{ dev2_lldp_digits | default('') }}" + - "LLDP IPv4 candidate={{ lldp_dev2_ip | default('') }}" + - "LLDP IPv4 class={{ lldp_ip_class | default('none') }}" + - "LLDP IPv6 candidate={{ lldp_dev2_ip6 | default('') }}" + + # ============================ PHASE 0: PRIMARY PATH DECISION ============================ + - name: Override dev2_host from LLDP when candidate is 192.168.x.x + when: (lldp_ip_class | trim) == "192_168" and (lldp_dev2_ip | trim | length > 0) + delegate_to: localhost + ansible.builtin.set_fact: + dev2_host: "{{ lldp_dev2_ip | trim }}" + changed_when: false + + - name: Set connection method initial (direct_lldp if 10.x else tunnel) + delegate_to: localhost + ansible.builtin.set_fact: + dev2_conn_method: "{{ 'direct_lldp' if ((lldp_ip_class | trim) == '10') else 'tunnel' }}" + changed_when: false + + # ============================ PHASE 0: DIRECT LLDP IPv4 AUTH (10.x) ============================ + - name: Try DEV2 login via direct LLDP IPv4 (10.x) with basicpass + when: dev2_conn_method == "direct_lldp" + delegate_to: localhost + ansible.builtin.shell: | + set -e + HOST="{{ lldp_dev2_ip }}" + sshpass -f basicpass ssh {{ ssh_opts_common }} \ + -o AddressFamily=inet \ + "{{ dev2_ssh_user }}@${HOST}" echo OK >/dev/null 2>&1 + args: { executable: /bin/bash } + register: dev2_lldp_try_basicpass + changed_when: false + ignore_errors: true + + - name: Select basicpass for direct LLDP if succeeded + when: dev2_conn_method == "direct_lldp" and dev2_lldp_try_basicpass.rc == 0 + delegate_to: localhost + ansible.builtin.set_fact: + dev2_passfile_used_direct: "basicpass" + changed_when: false + + - name: Try DEV2 login via direct LLDP IPv4 (10.x) with basicpass2 (only if first failed) + when: dev2_conn_method == "direct_lldp" and (dev2_passfile_used_direct == "NONE") + delegate_to: localhost + ansible.builtin.shell: | + set -e + HOST="{{ lldp_dev2_ip }}" + sshpass -f basicpass2 ssh {{ ssh_opts_common }} \ + -o AddressFamily=inet \ + "{{ dev2_ssh_user }}@${HOST}" echo OK >/dev/null 2>&1 + args: { executable: /bin/bash } + register: dev2_lldp_try_basicpass2 + changed_when: false + ignore_errors: true + + - name: Select basicpass2 for direct LLDP if succeeded + when: dev2_conn_method == "direct_lldp" and dev2_passfile_used_direct == "NONE" and dev2_lldp_try_basicpass2.rc == 0 + delegate_to: localhost + ansible.builtin.set_fact: + dev2_passfile_used_direct: "basicpass2" + changed_when: false + + # ============================ PHASE 0: TUNNEL PREP (DEV1 temp IP + ARP + tunnel) ============================ + - name: Add temporary IP on DEV1 (tolerate 'File exists') + when: dev2_conn_method == "tunnel" + ansible.builtin.raw: > + {{ pathprefix }} + ip a add {{ dev2_side_ip }} dev {{ dev1_iface }} + register: add_ip + changed_when: add_ip.rc == 0 + failed_when: > + add_ip.rc != 0 + and ('File exists' not in (add_ip.stdout | default(''))) + and ('File exists' not in (add_ip.stderr | default(''))) + + - name: Discover DEV2 MAC via bridge fdb on DEV1 (best-effort) + when: dev2_conn_method == "tunnel" + ansible.builtin.raw: > + {{ pathprefix }} + bridge fdb show {{ dev1_iface }} | grep eth0 | grep -v permanent | grep master | awk '{print $1}' | head -n1 + register: dev2_mac_scan + changed_when: false + failed_when: false + + - name: Capture discovered DEV2 MAC (if any) + when: dev2_conn_method == "tunnel" + ansible.builtin.set_fact: + dev2_mac: "{{ (dev2_mac_scan.stdout | default('') ) | trim }}" + changed_when: false + + - name: Clear existing ARP entry for DEV2 on DEV1 (best-effort) + when: dev2_conn_method == "tunnel" + ansible.builtin.raw: > + {{ pathprefix }} + ip neigh del {{ dev2_host }} dev {{ dev1_iface }} 2>/dev/null || true + changed_when: false + failed_when: false + + - name: Add static ARP entry on DEV1 (if MAC discovered; tolerate 'File exists') + when: dev2_conn_method == "tunnel" and (dev2_mac | default('') | length > 0) + ansible.builtin.raw: > + {{ pathprefix }} + ip neigh add {{ dev2_host }} lladdr {{ dev2_mac }} dev {{ dev1_iface }} nud permanent + register: dev2_arp_add + changed_when: dev2_arp_add.rc == 0 + failed_when: > + dev2_arp_add.rc != 0 + and ('File exists' not in (dev2_arp_add.stdout | default(''))) + and ('File exists' not in (dev2_arp_add.stderr | default(''))) + + - name: Refresh ARP (best-effort) + when: dev2_conn_method == "tunnel" + ansible.builtin.raw: > + {{ pathprefix }} + arping -U -I {{ arping_iface }} {{ dev2_side_ip_addr }} -c 3 + changed_when: false + failed_when: false + + - name: Pick a free local TCP port for the tunnel (controller side) + when: dev2_conn_method == "tunnel" + delegate_to: localhost + ansible.builtin.shell: | + set -e + pick() { + for i in $(seq 1 25); do + p="$(shuf -i 20000-39999 -n 1)" + if command -v ss >/dev/null 2>&1; then + if ! ss -ltn | awk '{print $4}' | grep -qE "(:|\.)${p}$"; then + echo "$p"; return 0 + fi + else + if ! nc -z 127.0.0.1 "$p" >/dev/null 2>&1; then + echo "$p"; return 0 + fi + fi + done + return 1 + } + pick + args: { executable: /bin/bash } + register: pick_port + changed_when: false + + - name: Stop if no free local port was found + when: dev2_conn_method == "tunnel" and (pick_port.stdout | trim | length) == 0 + ansible.builtin.meta: end_host + + - name: Create control dir for SSH ControlMaster + when: dev2_conn_method == "tunnel" + delegate_to: localhost + ansible.builtin.shell: "mktemp -d" + args: { executable: /bin/bash } + register: mktemp_dir + changed_when: false + + - name: Record chosen local port and build ControlMaster socket path + when: dev2_conn_method == "tunnel" + delegate_to: localhost + ansible.builtin.set_fact: + _local_port: "{{ pick_port.stdout | trim }}" + _ctrl_dir: "{{ mktemp_dir.stdout | trim }}" + _ctrl_sock: "{{ (mktemp_dir.stdout | trim) }}/ssh_tunnel_ctl" + changed_when: false + + - name: Start SSH ControlMaster and forward 127.0.0.1:local_port → DEV2:22 via DEV1 + when: dev2_conn_method == "tunnel" + delegate_to: localhost + ansible.builtin.shell: | + set -e + USER="{{ dev1_user }}" + HOST="{{ ansible_host | default(inventory_hostname) }}" + sshpass -p '{{ dev1_pass }}' ssh -f -N {{ ssh_opts_common }} \ + -M -S "{{ _ctrl_sock }}" \ + -L "127.0.0.1:{{ _local_port }}:{{ dev2_host }}:{{ dev2_port }}" \ + "${USER}@${HOST}" + args: { executable: /bin/bash } + register: start_tunnel + changed_when: true + + - name: Probe TCP reachability to DEV2 through the tunnel (nc) + when: dev2_conn_method == "tunnel" + delegate_to: localhost + ansible.builtin.shell: | + set -e + nc -z -w5 127.0.0.1 "{{ _local_port }}" + args: { executable: /bin/bash } + register: nc_probe + changed_when: false + ignore_errors: true + + - name: Stop if tunnel TCP probe failed + when: dev2_conn_method == "tunnel" and nc_probe.rc != 0 + ansible.builtin.meta: end_host + + - name: Pick DEV2 password for root (tunnel) try basicpass + when: dev2_conn_method == "tunnel" + delegate_to: localhost + ansible.builtin.shell: | + set -e + PORT="{{ _local_port }}" + sshpass -f basicpass ssh {{ ssh_opts_common }} \ + -o AddressFamily=inet \ + -p "$PORT" root@127.0.0.1 echo OK >/dev/null 2>&1 + args: { executable: /bin/bash } + register: dev2_try_basicpass + changed_when: false + ignore_errors: true + + - name: Select basicpass if tunnel login succeeded + when: dev2_conn_method == "tunnel" and dev2_try_basicpass.rc == 0 + delegate_to: localhost + ansible.builtin.set_fact: + dev2_passfile_used_tunnel: "basicpass" + changed_when: false + + - name: Try DEV2 login through tunnel with basicpass2 (only if first failed) + when: dev2_conn_method == "tunnel" and (dev2_passfile_used_tunnel == "NONE") + delegate_to: localhost + ansible.builtin.shell: | + set -e + PORT="{{ _local_port }}" + sshpass -f basicpass2 ssh {{ ssh_opts_common }} \ + -o AddressFamily=inet \ + -p "$PORT" root@127.0.0.1 echo OK >/dev/null 2>&1 + args: { executable: /bin/bash } + register: dev2_try_basicpass2 + changed_when: false + ignore_errors: true + + - name: Select basicpass2 if tunnel login succeeded + when: dev2_conn_method == "tunnel" and dev2_passfile_used_tunnel == "NONE" and dev2_try_basicpass2.rc == 0 + delegate_to: localhost + ansible.builtin.set_fact: + dev2_passfile_used_tunnel: "basicpass2" + changed_when: false + + # ============================ PHASE 0: SAFETY GUARD (MAC CHECK) ============================ + - name: Read remote eth0 MAC via tunnel (guard, sanitized) + when: + - dev2_conn_method == "tunnel" + - (dev2_passfile_used_tunnel | default('NONE')) != "NONE" + - (dev2_mac | default('') | length) > 0 + delegate_to: localhost + ansible.builtin.shell: | + PORT="{{ _local_port }}" + sshpass -f "{{ dev2_passfile_used_tunnel }}" ssh {{ ssh_opts_common }} \ + -p "$PORT" "{{ dev2_ssh_user }}@127.0.0.1" \ + "cat /sys/class/net/eth0/address 2>/dev/null || ip link show eth0 2>/dev/null" 2>&1 + args: { executable: /bin/bash } + register: dev2_eth0_mac_raw + changed_when: false + failed_when: false + + - name: Normalize remote eth0 MAC (extract last MAC-like token) + when: + - dev2_conn_method == "tunnel" + - (dev2_passfile_used_tunnel | default('NONE')) != "NONE" + - (dev2_mac | default('') | length) > 0 + delegate_to: localhost + ansible.builtin.set_fact: + remote_eth0_mac: >- + {{ + ( + (dev2_eth0_mac_raw.stdout | default('') | regex_replace('\r','')) ~ "\n" ~ + (dev2_eth0_mac_raw.stderr | default('') | regex_replace('\r','')) + ) + | regex_findall('([0-9a-fA-F]{2}(?::[0-9a-fA-F]{2}){5})') + | last + | default('') + | lower + }} + changed_when: false + + - name: Abort if remote eth0 MAC != discovered DEV2 MAC + when: + - dev2_conn_method == "tunnel" + - (dev2_passfile_used_tunnel | default('NONE')) != "NONE" + - (dev2_mac | default('') | length) > 0 + - (remote_eth0_mac | default('') | length) > 0 + - (remote_eth0_mac | lower) != (dev2_mac | lower) + ansible.builtin.fail: + msg: >- + Safety stop: tunnel reached wrong device. + expected_dev2_mac={{ dev2_mac }}, remote_eth0_mac={{ remote_eth0_mac }} + + # ============================ PHASE 0: FALLBACKS (only if tunnel auth failed) ============================ + - name: Try DEV2 login via LLDP IPv4 10.x (fallback if tunnel auth failed) + when: + - dev2_conn_method == "tunnel" + - dev2_passfile_used_tunnel == "NONE" + - (lldp_dev2_ip | default('')) is match('^10\\.') + delegate_to: localhost + ansible.builtin.shell: | + set -e + HOST="{{ lldp_dev2_ip }}" + for f in {{ dev2_passfiles | join(' ') }}; do + if timeout 20s sshpass -f "$f" ssh {{ ssh_opts_common }} \ + -o AddressFamily=inet \ + -o ConnectTimeout=10 \ + "{{ dev2_ssh_user }}@${HOST}" echo OK >/dev/null 2>&1; then + echo "$f"; exit 0 + fi + done + echo "NONE"; exit 1 + args: { executable: /bin/bash } + register: dev2_auth_lldp4 + changed_when: false + failed_when: false + ignore_errors: true + + - name: Record LLDP IPv4 fallback decision + when: + - dev2_conn_method == "tunnel" + - dev2_passfile_used_tunnel == "NONE" + - (lldp_dev2_ip | default('')) is match('^10\\.') + delegate_to: localhost + ansible.builtin.set_fact: + dev2_passfile_used_lldp4: "{{ (dev2_auth_lldp4.rc == 0) | ternary((dev2_auth_lldp4.stdout | trim), 'NONE') }}" + changed_when: false + + - name: Copy DEV2 passfiles to DEV1 for IPv6 nested SSH (last resort) + when: + - dev2_conn_method == "tunnel" + - dev2_passfile_used_tunnel == "NONE" + - dev2_passfile_used_lldp4 == "NONE" + - (lldp_dev2_ip6 | default('') | length) > 0 + ansible.builtin.copy: + src: "{{ item }}" + dest: "/tmp/{{ item }}" + mode: "0600" + loop: "{{ dev2_passfiles }}" + ignore_errors: true + + - name: Try DEV2 login via LLDP IPv6 (nested SSH through DEV1; last resort) + when: + - dev2_conn_method == "tunnel" + - dev2_passfile_used_tunnel == "NONE" + - dev2_passfile_used_lldp4 == "NONE" + - (lldp_dev2_ip6 | default('') | length) > 0 + delegate_to: localhost + ansible.builtin.shell: | + set -e + IP6="{{ lldp_dev2_ip6 }}" + for f in {{ dev2_passfiles | join(' ') }}; do + if sshpass -p '{{ dev1_pass }}' ssh {{ ssh_opts_common }} \ + "{{ dev1_user }}@{{ ansible_host|default(inventory_hostname) }}" \ + "timeout {{ ssh_timeout }}s sshpass -f '/tmp/${f}' ssh \ + -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR \ + -o PubkeyAuthentication=no \ + -o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \ + -o ConnectTimeout={{ ssh_timeout }} \ + '{{ dev2_ssh_user }}@\[${IP6}%{{ dev1_iface }}\]' 'echo OK' " \ + >/dev/null 2>&1; then + echo "$f"; exit 0 + fi + done + echo "NONE"; exit 1 + args: { executable: /bin/bash } + register: dev2_auth_lldp6 + changed_when: false + failed_when: false + ignore_errors: true + + - name: Record LLDP IPv6 fallback decision + when: + - dev2_conn_method == "tunnel" + - dev2_passfile_used_tunnel == "NONE" + - dev2_passfile_used_lldp4 == "NONE" + - (lldp_dev2_ip6 | default('') | length) > 0 + delegate_to: localhost + ansible.builtin.set_fact: + dev2_passfile_used_lldp6: "{{ (dev2_auth_lldp6.rc == 0) | ternary((dev2_auth_lldp6.stdout | trim), 'NONE') }}" + changed_when: false + + # ============================ PHASE 0: FINAL DECISION + WRAPPER FACTS ============================ + - name: Decide final DEV2 connection mode (direct_lldp > tunnel > lldp4 > lldp6) + delegate_to: localhost + ansible.builtin.set_fact: + dev2_conn_final: >- + {%- if dev2_conn_method == 'direct_lldp' and (dev2_passfile_used_direct | default('NONE')) != 'NONE' -%} + direct_lldp + {%- elif dev2_conn_method == 'tunnel' and (dev2_passfile_used_tunnel | default('NONE')) != 'NONE' -%} + tunnel + {%- elif (dev2_passfile_used_lldp4 | default('NONE')) != 'NONE' -%} + lldp4_fallback + {%- elif (dev2_passfile_used_lldp6 | default('NONE')) != 'NONE' -%} + lldp6_via_dev1 + {%- else -%} + none + {%- endif -%} + changed_when: false + + - name: Report record connectivity mode + delegate_to: localhost + ansible.builtin.set_fact: + ptsd_migrate_report: "{{ (ptsd_migrate_report | default('')) ~ (', ' if (ptsd_migrate_report | default('')) != '' else '') ~ ('conn ' ~ dev2_conn_final) }}" + changed_when: false + + - name: Abort if all DEV2 connection methods failed + when: dev2_conn_final == "none" + ansible.builtin.fail: + msg: > + DEV2 unreachable: tunnel auth={{ dev2_passfile_used_tunnel | default('n/a') }}, + direct auth={{ dev2_passfile_used_direct | default('n/a') }}, + lldp4 auth={{ dev2_passfile_used_lldp4 | default('n/a') }}, + lldp6 auth={{ dev2_passfile_used_lldp6 | default('n/a') }}. + + - name: Debug final connectivity decision + when: debugging | bool + delegate_to: localhost + ansible.builtin.debug: + msg: + - "dev2_conn_final={{ dev2_conn_final }}" + - "tunnel passfile={{ dev2_passfile_used_tunnel | default('n/a') }}" + - "direct passfile={{ dev2_passfile_used_direct | default('n/a') }}" + - "lldp4 passfile={{ dev2_passfile_used_lldp4 | default('n/a') }}" + - "lldp6 passfile={{ dev2_passfile_used_lldp6 | default('n/a') }}" + - "tunnel target={{ dev2_host }}:{{ dev2_port }} (forwarded to 127.0.0.1:{{ _local_port | default('na') }})" + - "lldp ipv4={{ lldp_dev2_ip | default('') }}" + - "lldp ipv6={{ lldp_dev2_ip6 | default('') }}" + + - name: Build DEV2 exec wrapper (controller-side) for Phase 1 commands + delegate_to: localhost + ansible.builtin.set_fact: + dev2_exec_cmd: | + set -e + MODE="{{ dev2_conn_final }}" + if [ -z "${DEV2_CMD:-}" ]; then + echo "ERROR: DEV2_CMD is empty" >&2 + exit 2 + fi + + case "$MODE" in + tunnel) + PORT="{{ _local_port | default('') }}" + PASS="{{ dev2_passfile_used_tunnel }}" + sshpass -f "$PASS" ssh {{ ssh_opts_common }} \ + -o AddressFamily=inet \ + -p "$PORT" "{{ dev2_ssh_user }}@127.0.0.1" \ + "{{ pathprefix }} ${DEV2_CMD}" 2>&1 + ;; + direct_lldp) + HOST="{{ lldp_dev2_ip }}" + PASS="{{ dev2_passfile_used_direct }}" + sshpass -f "$PASS" ssh {{ ssh_opts_common }} \ + -o AddressFamily=inet \ + "{{ dev2_ssh_user }}@${HOST}" \ + "{{ pathprefix }} ${DEV2_CMD}" 2>&1 + ;; + lldp4_fallback) + HOST="{{ lldp_dev2_ip }}" + PASS="{{ dev2_passfile_used_lldp4 }}" + sshpass -f "$PASS" ssh {{ ssh_opts_common }} \ + -o AddressFamily=inet \ + "{{ dev2_ssh_user }}@${HOST}" \ + "{{ pathprefix }} ${DEV2_CMD}" 2>&1 + ;; + lldp6_via_dev1) + IP6="{{ lldp_dev2_ip6 }}" + F="{{ dev2_passfile_used_lldp6 }}" + sshpass -p "{{ dev1_pass }}" ssh {{ ssh_opts_common }} \ + "{{ dev1_user }}@{{ ansible_host | default(inventory_hostname) }}" \ + "sshpass -f '/tmp/${F}' ssh \ + -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR \ + -o PubkeyAuthentication=no \ + -o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \ + -o ConnectTimeout={{ ssh_timeout }} \ + '{{ dev2_ssh_user }}@\[${IP6}%{{ dev1_iface }}\]' \ + '{{ pathprefix }} '"${DEV2_CMD}" 2>&1" + ;; + *) + echo "ERROR: unknown MODE=$MODE" >&2 + exit 3 + ;; + esac + changed_when: false + + # ============================ PHASE 0 (LAST, BEFORE PPP CHECK): IN-PROGRESS MARKER GUARD ============================ + - name: "PHASE 0 (LAST) | DEV2 check /tmp/ptsd.inprogress marker exists (show-stopper) via wrapper" + delegate_to: localhost + ansible.builtin.shell: | + export DEV2_CMD="test -f /tmp/ptsd.inprogress && echo YES || echo NO" + {{ dev2_exec_cmd }} + args: { executable: /bin/bash } + register: dev2_inprogress_marker + changed_when: false + failed_when: false + + - name: "PHASE 0 (LAST) | Graceful stop if DEV2 in-progress marker is present" + when: (dev2_inprogress_marker.stdout | default('') | trim) == "YES" + delegate_to: localhost + ansible.builtin.debug: + msg: + - "Show-stopper: DEV2 has /tmp/ptsd.inprogress marker present." + - "We shall not continue: concurrent work appears to be in progress." + - "dev2_conn_final={{ dev2_conn_final }}" + changed_when: false + + - name: "PHASE 0 (LAST) | End host if DEV2 in-progress marker is present" + when: (dev2_inprogress_marker.stdout | default('') | trim) == "YES" + ansible.builtin.meta: end_host + + + # ============================ PHASE 0 (LAST): DEV2 STATE GUARD (OLD PPP EXPECTED) ============================ + - name: "PHASE 0 (LAST) | DEV2 check ppp0 has IPv4 (old expected) via wrapper" + delegate_to: localhost + ansible.builtin.shell: | + export DEV2_CMD="ip -4 addr show dev ppp0 2>/dev/null | grep -m1 'inet ' >/dev/null 2>&1 && echo YES || echo NO" + {{ dev2_exec_cmd }} + args: { executable: /bin/bash } + register: dev2_ppp0_has_ipv4 + changed_when: false + failed_when: false + + - name: "PHASE 0 (LAST) | DEV2 check eth0.4000 exists (new/migrated indicator) via wrapper" + delegate_to: localhost + ansible.builtin.shell: | + export DEV2_CMD="ip link show eth0.4000 >/dev/null 2>&1 && echo YES || echo NO" + {{ dev2_exec_cmd }} + args: { executable: /bin/bash } + register: dev2_eth04000_exists + changed_when: false + failed_when: false + + - name: "PHASE 0 (LAST) | Detect mixed state ppp0 present AND eth0.4000 present (should not happen)" + delegate_to: localhost + ansible.builtin.set_fact: + dev2_ppp_present: "{{ (dev2_ppp0_has_ipv4.stdout | default('') | trim) == 'YES' }}" + dev2_eth04000_present: "{{ (dev2_eth04000_exists.stdout | default('') | trim) == 'YES' }}" + dev2_mixed_state: >- + {{ + ((dev2_ppp0_has_ipv4.stdout | default('') | trim) == 'YES') + and + ((dev2_eth04000_exists.stdout | default('') | trim) == 'YES') + }} + changed_when: false + + - name: "PHASE 0 (LAST) | Graceful stop DEV2 has BOTH ppp0 and eth0.4000 (mixed/partial migration)" + when: dev2_mixed_state | bool + delegate_to: localhost + ansible.builtin.debug: + msg: + - "We shall not continue: DEV2 is in mixed state (ppp0 present AND eth0.4000 present)." + - "This suggests partial/failed migration or unexpected config; manual inspection required." + - "ppp0_has_ipv4={{ dev2_ppp_present }}" + - "eth0.4000_exists={{ dev2_eth04000_present }}" + - "dev2_conn_final={{ dev2_conn_final }}" + changed_when: false + + - name: "PHASE 0 (LAST) | End host: mixed/partial migration state" + when: dev2_mixed_state | bool + ansible.builtin.meta: end_host + + - name: "PHASE 0 (LAST) | Summarize DEV2 pre-migration eligibility" + delegate_to: localhost + ansible.builtin.set_fact: + dev2_ppp_old_ok: "{{ (dev2_ppp0_has_ipv4.stdout | default('') | trim) == 'YES' }}" + dev2_eth04000_present: "{{ (dev2_eth04000_exists.stdout | default('') | trim) == 'YES' }}" + dev2_pre_migration_ok: >- + {{ + ((dev2_ppp0_has_ipv4.stdout | default('') | trim) == 'YES') + and + ((dev2_eth04000_exists.stdout | default('') | trim) != 'YES') + }} + changed_when: false + + - name: Report record eligibility + when: dev2_pre_migration_ok | bool + delegate_to: localhost + ansible.builtin.set_fact: + ptsd_migrate_report: "{{ (ptsd_migrate_report | default('')) ~ (', ' if (ptsd_migrate_report | default('')) != '' else '') ~ ('eligible PPP') }}" + changed_when: false + + - name: "PHASE 0 (LAST) | Stop if DEV2 is NOT a pure old PPP device" + when: not (dev2_pre_migration_ok | bool) + delegate_to: localhost + ansible.builtin.debug: + msg: + - "We shall not continue: DEV2 is not a pure old PPP device." + - "ppp0_has_ipv4={{ dev2_ppp_old_ok }}" + - "eth0.4000_exists={{ dev2_eth04000_present }}" + - "dev2_conn_final={{ dev2_conn_final }}" + changed_when: false + + - name: "PHASE 0 (LAST) | End host if DEV2 is NOT a pure old PPP device" + when: not (dev2_pre_migration_ok | bool) + ansible.builtin.meta: end_host + + + + # ============================ PHASE 1: FIRST ON-DEVICE COMMAND (uptime) ============================ + - name: "PHASE 1 | DEV2 uptime via wrapper" + delegate_to: localhost + ansible.builtin.shell: | + export DEV2_CMD="uptime" + {{ dev2_exec_cmd }} + args: { executable: /bin/bash } + register: dev2_uptime + changed_when: false + failed_when: false + + - name: "PHASE 1 | Output DEV2 uptime (stdout)" + delegate_to: localhost + ansible.builtin.debug: + msg: + - "DEV2 uptime via {{ dev2_conn_final }}:" + - "{{ (dev2_uptime.stdout | default('')) | regex_replace('\r','') }}" + + - name: PHASE 1 | Set local download path for DEV2 config.json + delegate_to: localhost + ansible.builtin.set_fact: + dev2_config_local_dir: "{{ _ctrl_dir | default('/tmp') }}" + dev2_config_local_path: "{{ (_ctrl_dir | default('/tmp')) }}/dev2_config_{{ inventory_hostname }}.json" + changed_when: false + + - name: PHASE 1 | DEV2 md5sum of /tmp/config.json via wrapper + delegate_to: localhost + ansible.builtin.shell: | + export DEV2_CMD="md5sum /tmp/config.json 2>/dev/null | awk '{print \$1}'" + {{ dev2_exec_cmd }} + args: { executable: /bin/bash } + register: dev2_config_md5 + changed_when: false + failed_when: false + + - name: PHASE 1 | Abort if DEV2 md5 could not be read + when: (dev2_config_md5.stdout | default('') | trim | length) == 0 + ansible.builtin.fail: + msg: "DEV2 md5sum for /tmp/config.json is empty; file missing or md5sum unavailable." + + - name: PHASE 1 | DEV2 backup original config to /tmp/config-orig.json + delegate_to: localhost + ansible.builtin.shell: | + export DEV2_CMD="cp /tmp/config.json /tmp/config-orig.json" + {{ dev2_exec_cmd }} + args: { executable: /bin/bash } + changed_when: true + + - name: Report record backup + delegate_to: localhost + ansible.builtin.set_fact: + ptsd_migrate_report: "{{ (ptsd_migrate_report | default('')) ~ (', ' if (ptsd_migrate_report | default('')) != '' else '') ~ ('backup config-orig') }}" + changed_when: false + + - name: PHASE 1 | DEV2 set /tmp/ptsd.inprogress marker before controller config copy + delegate_to: localhost + ansible.builtin.shell: | + export DEV2_CMD="touch /tmp/ptsd.inprogress" + {{ dev2_exec_cmd }} + args: { executable: /bin/bash } + changed_when: true + + + - name: Report record inprogress marker + delegate_to: localhost + ansible.builtin.set_fact: + ptsd_migrate_report: "{{ (ptsd_migrate_report | default('')) ~ (', ' if (ptsd_migrate_report | default('')) != '' else '') ~ ('mark inprogress') }}" + changed_when: false + + - name: PHASE 1 | Download /tmp/config.json from DEV2 to controller (tunnel) + when: dev2_conn_final == "tunnel" + delegate_to: localhost + ansible.builtin.shell: | + set -e + PORT="{{ _local_port }}" + PASS="{{ dev2_passfile_used_tunnel }}" + sshpass -f "$PASS" scp {{ ssh_opts_common }} \ + -P "$PORT" "{{ dev2_ssh_user }}@127.0.0.1:/tmp/config.json" \ + "{{ dev2_config_local_path }}" + args: { executable: /bin/bash } + register: scp_tunnel + changed_when: true + failed_when: scp_tunnel.rc != 0 + + - name: PHASE 1 | Download /tmp/config.json from DEV2 to controller (direct LLDP IPv4) + when: dev2_conn_final == "direct_lldp" + delegate_to: localhost + ansible.builtin.shell: | + set -e + HOST="{{ lldp_dev2_ip }}" + PASS="{{ dev2_passfile_used_direct }}" + sshpass -f "$PASS" scp {{ ssh_opts_common }} \ + "{{ dev2_ssh_user }}@${HOST}:/tmp/config.json" \ + "{{ dev2_config_local_path }}" + args: { executable: /bin/bash } + register: scp_direct + changed_when: true + failed_when: scp_direct.rc != 0 + + - name: PHASE 1 | Download /tmp/config.json from DEV2 to controller (LLDP IPv4 fallback) + when: dev2_conn_final == "lldp4_fallback" + delegate_to: localhost + ansible.builtin.shell: | + set -e + HOST="{{ lldp_dev2_ip }}" + PASS="{{ dev2_passfile_used_lldp4 }}" + sshpass -f "$PASS" scp {{ ssh_opts_common }} \ + "{{ dev2_ssh_user }}@${HOST}:/tmp/config.json" \ + "{{ dev2_config_local_path }}" + args: { executable: /bin/bash } + register: scp_lldp4 + changed_when: true + failed_when: scp_lldp4.rc != 0 + + - name: PHASE 1 | Download /tmp/config.json from DEV2 to controller (LLDP IPv6 via DEV1 nested; last resort) + when: dev2_conn_final == "lldp6_via_dev1" + delegate_to: localhost + ansible.builtin.shell: | + set -e + IP6="{{ lldp_dev2_ip6 }}" + F="{{ dev2_passfile_used_lldp6 }}" + TMP_REMOTE="/tmp/config_{{ inventory_hostname }}.json" + + # 1) On DEV1: scp from DEV2 (ipv6 link-local) to DEV1 /tmp + sshpass -p "{{ dev1_pass }}" ssh {{ ssh_opts_common }} \ + "{{ dev1_user }}@{{ ansible_host | default(inventory_hostname) }}" \ + "sshpass -f '/tmp/${F}' scp \ + -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR \ + -o PreferredAuthentications=password -o PubkeyAuthentication=no -o NumberOfPasswordPrompts=1 \ + '{{ dev2_ssh_user }}@\[${IP6}%{{ dev1_iface }}\]':/tmp/config.json '${TMP_REMOTE}'" + + # 2) From DEV1 to controller + sshpass -p "{{ dev1_pass }}" scp {{ ssh_opts_common }} \ + "{{ dev1_user }}@{{ ansible_host | default(inventory_hostname) }}:${TMP_REMOTE}" \ + "{{ dev2_config_local_path }}" + + # 3) Cleanup on DEV1 (best-effort) + sshpass -p "{{ dev1_pass }}" ssh {{ ssh_opts_common }} \ + "{{ dev1_user }}@{{ ansible_host | default(inventory_hostname) }}" \ + "rm -f '${TMP_REMOTE}' 2>/dev/null || true" + args: { executable: /bin/bash } + register: scp_lldp6 + changed_when: true + failed_when: scp_lldp6.rc != 0 + + - name: PHASE 1 | Controller md5sum of downloaded config.json + delegate_to: localhost + ansible.builtin.shell: | + set -e + md5sum "{{ dev2_config_local_path }}" | awk '{print $1}' + args: { executable: /bin/bash } + register: local_config_md5 + changed_when: false + + - name: PHASE 1 | Compare DEV2 vs controller md5sum (fail on mismatch) + delegate_to: localhost + ansible.builtin.fail: + msg: >- + MD5 mismatch for /tmp/config.json: + dev2={{ dev2_config_md5.stdout | trim }}, + local={{ local_config_md5.stdout | trim }}, + file={{ dev2_config_local_path }} + when: (dev2_config_md5.stdout | trim) != (local_config_md5.stdout | trim) + + - name: PHASE 1 | Debug config.json download + md5 + when: debugging | bool + delegate_to: localhost + ansible.builtin.debug: + msg: + - "Downloaded DEV2 /tmp/config.json to {{ dev2_config_local_path }}" + - "DEV2 md5={{ dev2_config_md5.stdout | trim }}" + - "Local md5={{ local_config_md5.stdout | trim }}" + + - name: PHASE 1 | Set controller paths for DHCP conversion + delegate_to: localhost + ansible.builtin.set_fact: + pppoe_to_dhcp_script: "/opt/containers/ansible-worker/app/pppoe_to_dhcp.py" + dev2_config_dhcp_local_path: "{{ dev2_config_local_dir }}/dev2_config_dhcp_{{ inventory_hostname }}.json" + dev2_config_dhcp_remote_path: "/tmp/config-dhcp.json" + changed_when: false + + - name: PHASE 1 | Abort if pppoe_to_dhcp.py is missing on controller + delegate_to: localhost + ansible.builtin.shell: | + test -f "{{ pppoe_to_dhcp_script }}" + args: { executable: /bin/bash } + register: dhcp_script_present + changed_when: false + failed_when: dhcp_script_present.rc != 0 + + - name: PHASE 1 | Convert config.json -> config-dhcp.json (controller) + delegate_to: localhost + ansible.builtin.shell: | + set -e + python3 "{{ pppoe_to_dhcp_script }}" "{{ dev2_config_local_path }}" -o "{{ dev2_config_dhcp_local_path }}" + args: { executable: /bin/bash } + register: convert_run + changed_when: true + failed_when: convert_run.rc != 0 + + - name: PHASE 1 | Controller md5sum of generated config-dhcp.json + delegate_to: localhost + ansible.builtin.shell: | + set -e + md5sum "{{ dev2_config_dhcp_local_path }}" | awk '{print $1}' + args: { executable: /bin/bash } + register: local_dhcp_md5 + changed_when: false + failed_when: (local_dhcp_md5.stdout | trim | length) == 0 + + - name: PHASE 1 | Upload config-dhcp.json to DEV2 (tunnel) + when: dev2_conn_final == "tunnel" + delegate_to: localhost + ansible.builtin.shell: | + set -e + PORT="{{ _local_port }}" + PASS="{{ dev2_passfile_used_tunnel }}" + sshpass -f "$PASS" scp {{ ssh_opts_common }} \ + -P "$PORT" "{{ dev2_config_dhcp_local_path }}" \ + "{{ dev2_ssh_user }}@127.0.0.1:{{ dev2_config_dhcp_remote_path }}" + args: { executable: /bin/bash } + register: scp_up_tunnel + changed_when: true + failed_when: scp_up_tunnel.rc != 0 + + - name: Report record DHCP upload + when: dev2_conn_final == "tunnel" + delegate_to: localhost + ansible.builtin.set_fact: + ptsd_migrate_report: "{{ (ptsd_migrate_report | default('')) ~ (', ' if (ptsd_migrate_report | default('')) != '' else '') ~ ('upload DHCP config') }}" + changed_when: false + + - name: PHASE 1 | Upload config-dhcp.json to DEV2 (direct LLDP IPv4) + when: dev2_conn_final == "direct_lldp" + delegate_to: localhost + ansible.builtin.shell: | + set -e + HOST="{{ lldp_dev2_ip }}" + PASS="{{ dev2_passfile_used_direct }}" + sshpass -f "$PASS" scp {{ ssh_opts_common }} \ + "{{ dev2_config_dhcp_local_path }}" \ + "{{ dev2_ssh_user }}@${HOST}:{{ dev2_config_dhcp_remote_path }}" + args: { executable: /bin/bash } + register: scp_up_direct + changed_when: true + failed_when: scp_up_direct.rc != 0 + + - name: Report record DHCP upload + when: dev2_conn_final == "direct_lldp" + delegate_to: localhost + ansible.builtin.set_fact: + ptsd_migrate_report: "{{ (ptsd_migrate_report | default('')) ~ (', ' if (ptsd_migrate_report | default('')) != '' else '') ~ ('upload DHCP config') }}" + changed_when: false + + - name: PHASE 1 | Upload config-dhcp.json to DEV2 (LLDP IPv4 fallback) + when: dev2_conn_final == "lldp4_fallback" + delegate_to: localhost + ansible.builtin.shell: | + set -e + HOST="{{ lldp_dev2_ip }}" + PASS="{{ dev2_passfile_used_lldp4 }}" + sshpass -f "$PASS" scp {{ ssh_opts_common }} \ + "{{ dev2_config_dhcp_local_path }}" \ + "{{ dev2_ssh_user }}@${HOST}:{{ dev2_config_dhcp_remote_path }}" + args: { executable: /bin/bash } + register: scp_up_lldp4 + changed_when: true + failed_when: scp_up_lldp4.rc != 0 + + - name: Report record DHCP upload + when: dev2_conn_final == "lldp4" + delegate_to: localhost + ansible.builtin.set_fact: + ptsd_migrate_report: "{{ (ptsd_migrate_report | default('')) ~ (', ' if (ptsd_migrate_report | default('')) != '' else '') ~ ('upload DHCP config') }}" + changed_when: false + + - name: PHASE 1 | Upload config-dhcp.json to DEV2 (LLDP IPv6 via DEV1 nested; last resort) + when: dev2_conn_final == "lldp6_via_dev1" + delegate_to: localhost + ansible.builtin.shell: | + set -e + IP6="{{ lldp_dev2_ip6 }}" + F="{{ dev2_passfile_used_lldp6 }}" + STAGE_ON_DEV1="/tmp/config-dhcp_{{ inventory_hostname }}.json" + + sshpass -p "{{ dev1_pass }}" scp {{ ssh_opts_common }} \ + "{{ dev2_config_dhcp_local_path }}" \ + "{{ dev1_user }}@{{ ansible_host | default(inventory_hostname) }}:${STAGE_ON_DEV1}" + + sshpass -p "{{ dev1_pass }}" ssh {{ ssh_opts_common }} \ + "{{ dev1_user }}@{{ ansible_host | default(inventory_hostname) }}" \ + "sshpass -f '/tmp/${F}' scp \ + -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR \ + -o PreferredAuthentications=password -o PubkeyAuthentication=no -o NumberOfPasswordPrompts=1 \ + '${STAGE_ON_DEV1}' '{{ dev2_ssh_user }}@\[${IP6}%{{ dev1_iface }}\]':{{ dev2_config_dhcp_remote_path }}" + + sshpass -p "{{ dev1_pass }}" ssh {{ ssh_opts_common }} \ + "{{ dev1_user }}@{{ ansible_host | default(inventory_hostname) }}" \ + "rm -f '${STAGE_ON_DEV1}' 2>/dev/null || true" + args: { executable: /bin/bash } + register: scp_up_lldp6 + changed_when: true + failed_when: scp_up_lldp6.rc != 0 + + - name: Report record DHCP upload + when: dev2_conn_final == "lldp6_via_dev1" + delegate_to: localhost + ansible.builtin.set_fact: + ptsd_migrate_report: "{{ (ptsd_migrate_report | default('')) ~ (', ' if (ptsd_migrate_report | default('')) != '' else '') ~ ('upload DHCP config') }}" + changed_when: false + + - name: PHASE 1 | DEV2 md5sum of uploaded config-dhcp.json via wrapper + delegate_to: localhost + ansible.builtin.shell: | + export DEV2_CMD="md5sum {{ dev2_config_dhcp_remote_path }} 2>/dev/null | awk '{print \$1}'" + {{ dev2_exec_cmd }} + args: { executable: /bin/bash } + register: dev2_dhcp_md5 + changed_when: false + failed_when: false + + - name: PHASE 1 | Abort if DEV2 md5 for uploaded file is empty + when: (dev2_dhcp_md5.stdout | default('') | trim | length) == 0 + ansible.builtin.fail: + msg: "DEV2 md5sum for {{ dev2_config_dhcp_remote_path }} is empty; upload failed or md5sum unavailable." + + - name: PHASE 1 | Compare controller vs DEV2 md5sum for config-dhcp.json (Ok, to be skipped. fail on mismatch) + delegate_to: localhost + ansible.builtin.fail: + msg: >- + MD5 mismatch for config-dhcp.json: + local={{ local_dhcp_md5.stdout | trim }}, + dev2={{ dev2_dhcp_md5.stdout | trim }}, + local_file={{ dev2_config_dhcp_local_path }}, + remote_file={{ dev2_config_dhcp_remote_path }} + when: (local_dhcp_md5.stdout | trim) != (dev2_dhcp_md5.stdout | trim) + + - name: PHASE 1 | Cleanup controller local config artifacts (only after md5 match) + delegate_to: localhost + ansible.builtin.file: + path: "{{ item }}" + state: absent + loop: + - "{{ dev2_config_local_path }}" + - "{{ dev2_config_dhcp_local_path }}" + ignore_errors: true + + - name: PHASE 1 | Debug DHCP conversion + upload + md5 verification + when: debugging | bool + delegate_to: localhost + ansible.builtin.debug: + msg: + - "Converted DHCP config: {{ dev2_config_dhcp_local_path }}" + - "Uploaded to DEV2: {{ dev2_config_dhcp_remote_path }}" + - "Local md5={{ local_dhcp_md5.stdout | trim }}" + - "DEV2 md5={{ dev2_dhcp_md5.stdout | trim }}" + + + - name: PHASE 1 | DEV2 copy uploaded config to /tmp/config-test.json + delegate_to: localhost + ansible.builtin.shell: | + export DEV2_CMD="cp /tmp/config-dhcp.json /tmp/config-test.json" + {{ dev2_exec_cmd }} + args: { executable: /bin/bash } + changed_when: true + + - name: PHASE 1 | DEV2 arm parachute reboot delayed 600 seconds + delegate_to: localhost + ansible.builtin.shell: | + export DEV2_CMD="reboot -d 600 &" + {{ dev2_exec_cmd }} + args: { executable: /bin/bash } + changed_when: true + + - name: Report record parachute arm + delegate_to: localhost + ansible.builtin.set_fact: + ptsd_migrate_report: "{{ (ptsd_migrate_report | default('')) ~ (', ' if (ptsd_migrate_report | default('')) != '' else '') ~ ('arm parachute') }}" + changed_when: false + + - name: PHASE 1 | DEV2 simulate upgrade marker /tmp/AA_startedupgrade + delegate_to: localhost + ansible.builtin.shell: | + export DEV2_CMD="touch /tmp/AA_startedupgrade" + {{ dev2_exec_cmd }} + args: { executable: /bin/bash } + changed_when: true + + + - name: PHASE 1 | schedule lld-server restart + delegate_to: localhost + ansible.builtin.shell: | + export DEV2_CMD="(sleep 20; killall lldp-server ) &" + {{ dev2_exec_cmd }} + args: { executable: /bin/bash } + changed_when: true + + - name: PHASE 1 | initiating actual upgrade + delegate_to: localhost + ansible.builtin.shell: | + export DEV2_CMD="/usr/sbin/config-test.lua 400 &" + {{ dev2_exec_cmd }} + args: { executable: /bin/bash } + changed_when: true + + - name: Report record activation + delegate_to: localhost + ansible.builtin.set_fact: + ptsd_migrate_report: "{{ (ptsd_migrate_report | default('')) ~ (', ' if (ptsd_migrate_report | default('')) != '' else '') ~ ('activate config-test') }}" + changed_when: false + + post_tasks: + - name: Cleanup note + delegate_to: localhost + ansible.builtin.debug: + msg: "Cleanup: closing tunnel, removing temp IP, removing staged passfiles (best-effort)" + changed_when: false + + - name: Close SSH ControlMaster (best-effort) + when: dev2_conn_method | default('') == "tunnel" + delegate_to: localhost + ansible.builtin.shell: | + ssh -S "{{ _ctrl_sock | default('/dev/null') }}" -O exit 2>/dev/null || true + args: { executable: /bin/bash } + changed_when: false + ignore_errors: true + + - name: Remove tunnel control dir (best-effort) + when: dev2_conn_method | default('') == "tunnel" + delegate_to: localhost + ansible.builtin.file: + path: "{{ _ctrl_dir | default('/tmp/none') }}" + state: absent + ignore_errors: true + + - name: Remove staged passfiles from DEV1 (best-effort) + when: dev2_conn_method | default('') == "tunnel" + ansible.builtin.raw: > + {{ pathprefix }} + rm -f /tmp/basicpass /tmp/basicpass2 2>/dev/null || true + changed_when: false + failed_when: false + + - name: Remove temporary IP on DEV1 (tolerate 'Cannot assign requested address') + when: dev2_conn_method | default('') == "tunnel" + ansible.builtin.raw: > + {{ pathprefix }} + ip a del {{ dev2_side_ip }} dev {{ dev1_iface }} + register: del_ip + changed_when: del_ip.rc == 0 + failed_when: > + del_ip.rc != 0 + and ('Cannot assign requested address' not in (del_ip.stdout | default(''))) + and ('Cannot assign requested address' not in (del_ip.stderr | default(''))) + + - name: Report record cleanup completion + when: dev2_conn_final == "tunnel" + delegate_to: localhost + ansible.builtin.set_fact: + ptsd_migrate_report: "{{ (ptsd_migrate_report | default('')) ~ (', ' if (ptsd_migrate_report | default('')) != '' else '') ~ ('cleanup done') }}" + changed_when: false + +- name: PHASE X | Wait 30 seconds after config activation + hosts: all + gather_facts: false + vars: + rmq_host: "{{ lookup('env','RMQ_HOST') | default('10.210.12.2', true) }}" + rmq_port: "{{ lookup('env','RMQ_PORT') | default('15672', true) }}" + rmq_user: "{{ lookup('env','RMQ_USER') | default('admin', true) }}" + rmq_pass: "{{ lookup('env','RMQ_PASS') | default('change_me', true) }}" + rmq_vhost: "{{ lookup('env','RMQ_VHOST') | default('app', true) }}" + rmq_exchange: "{{ lookup('env','RMQ_EXCHANGE') | default('controls', true) }}" + control_queue: "{{ lookup('env','CONTROL_QUEUE') | default('queue_controls', true) }}" + tasks: + - ansible.builtin.pause: + seconds: 30 + + - name: Report record post activation wait + delegate_to: localhost + ansible.builtin.set_fact: + ptsd_migrate_report: "{{ (ptsd_migrate_report | default('')) ~ (', ' if (ptsd_migrate_report | default('')) != '' else '') ~ ('wait 30s') }}" + changed_when: false + + - name: Final migrate cumulative report + delegate_to: localhost + ansible.builtin.debug: + msg: "{{ ptsd_migrate_report | default('') }}" + changed_when: false + + - name: Publish redirect and block removal journal + delegate_to: localhost + uri: + url: "http://{{ rmq_host }}:{{ rmq_port }}/api/exchanges/{{ rmq_vhost | urlencode }}/{{ rmq_exchange | urlencode }}/publish" + method: POST + user: "{{ rmq_user }}" + password: "{{ rmq_pass }}" + force_basic_auth: true + status_code: 200 + headers: { content-type: "application/json" } + body_format: json + body: + properties: { content_type: "application/json" } + routing_key: "{{ control_queue }}" + payload: "{{ { + 'inscope_device': (ansible_hostname | default(inventory_hostname)), + 'task_name': 'journal_add', + 'task_result': (ptsd_migrate_report | default('')) + } | to_json }}" + payload_encoding: "string" + changed_when: false + + + +- import_playbook: ptsd_reacquire_attempt.yml + +- name: PHASE Y | Set action_next after successful migration + hosts: all + gather_facts: false + vars: + rmq_host: "{{ lookup('env','RMQ_HOST') | default('10.210.12.2', true) }}" + rmq_port: "{{ lookup('env','RMQ_PORT') | default('15672', true) }}" + rmq_user: "{{ lookup('env','RMQ_USER') | default('admin', true) }}" + rmq_pass: "{{ lookup('env','RMQ_PASS') | default('change_me', true) }}" + rmq_vhost: "{{ lookup('env','RMQ_VHOST') | default('app', true) }}" + rmq_exchange: "{{ lookup('env','RMQ_EXCHANGE') | default('controls', true) }}" + control_queue: "{{ lookup('env','CONTROL_QUEUE') | default('queue_controls', true) }}" + tasks: + - name: Publish action_next custom field set + delegate_to: localhost + uri: + url: "http://{{ rmq_host }}:{{ rmq_port }}/api/exchanges/{{ rmq_vhost | urlencode }}/{{ rmq_exchange | urlencode }}/publish" + method: POST + user: "{{ rmq_user }}" + password: "{{ rmq_pass }}" + force_basic_auth: true + status_code: 200 + headers: { content-type: "application/json" } + body_format: json + body: + properties: { content_type: "application/json" } + routing_key: "{{ control_queue }}" + payload: "{{ { + 'inscope_device': (ansible_hostname | default(inventory_hostname)), + 'task_name': 'custom_field_set', + 'task_add1': 'action_next', + 'task_result': 'sot-updater-scheduler' + } | to_json }}" + payload_encoding: "string" + changed_when: false