From 0edc30dffceee206906aecb1c341f8844474da9d Mon Sep 17 00:00:00 2001 From: pavel Date: Tue, 20 Jan 2026 09:31:17 +0200 Subject: [PATCH] 0931 --- files/ansible-playbooks/ptsd-migrate.yml | 661 +++++++++++++++++++++++ 1 file changed, 661 insertions(+) create mode 100644 files/ansible-playbooks/ptsd-migrate.yml diff --git a/files/ansible-playbooks/ptsd-migrate.yml b/files/ansible-playbooks/ptsd-migrate.yml new file mode 100644 index 0000000..9fdd295 --- /dev/null +++ b/files/ansible-playbooks/ptsd-migrate.yml @@ -0,0 +1,661 @@ +# ptsd-migration.yml — PPPoE to super DHCP (phase 0: connectivity prove-out) +# Goal: reliably connect to DEV2 using: +# 1) direct LLDP IPv4 (10.x) if available and auth works +# 2) tunnel via DEV1 (default / primary) +# 3) LLDP IPv4 (10.x) fallback if tunnel auth fails +# 4) LLDP IPv6 fallback via DEV1 (nested ssh to [ip6%iface]) if all else fails +# +# After connection: run "uptime" on DEV2 and print it. + +- name: PPPoE to super DHCP | Phase 0 | Prove reliable DEV2 connectivity + uptime + hosts: all + gather_facts: no + + vars: + # Busybox-safe PATH prefix for all DEV1 raw calls + pathprefix: "PATH=/sbin:/usr/sbin:/bin:/usr/bin:$PATH; " + + # DEV1 credentials + dev1_user: "root" + dev1_pass: "wavewave" + + # DEV2 "default" behind DEV1 + dev2_host: "192.168.1.1" + dev2_port: 22 + + # Temp IP we add to DEV1 so it can reach DEV2 + dev2_side_ip: "192.168.1.11/24" + dev2_side_ip_addr: "{{ dev2_side_ip.split('/')[0] }}" + dev1_iface: "br-wan" # used for temp IP, ARP, and IPv6 scope-id (link-local) + arping_iface: "eth0" # optional refresh on DEV1 + + # DEV2 credentials + dev2_ssh_user: "root" + dev2_passfiles: + - "basicpass" + - "basicpass2" + + # SSH options used from controller (and outer hop to DEV1) + ssh_opts_common: >- + -o PreferredAuthentications=password + -o PubkeyAuthentication=no + -o StrictHostKeyChecking=no + -o UserKnownHostsFile=/dev/null + -o NumberOfPasswordPrompts=1 + -o ConnectTimeout=30 + + # Debug toggle + debugging: true + + # Final connection outputs (set dynamically) + dev2_conn_method: "" + dev2_passfile_used: "NONE" # for tunnel or direct-lldp + dev2_passfile_used_lldp: "NONE" # for direct LLDP IPv4 fallback + dev2_passfile_used_lldp6: "NONE" # for IPv6 via DEV1 fallback + dev2_ssh_host: "" + dev2_ssh_port: "" + + pre_tasks: + # ------------------------------- DEV1 hostname sanity ------------------------------- + - name: Read DEV1 hostname (busybox-safe) + ansible.builtin.raw: > + {{ pathprefix }} + (cat /proc/sys/kernel/hostname 2>/dev/null || echo "") + register: dev1_host_read + changed_when: false + + - name: Stop early if connected DEV1 hostname != inventory (guard) + ansible.builtin.meta: end_host + when: (dev1_host_read.stdout | trim | length > 0) and + ((dev1_host_read.stdout | trim) != (inventory_hostname | string)) + + tasks: + # ============================ LLDP DISCOVERY (DEV1) ============================ + - name: Compute hostname digits key for LLDP lookup (DEV2) + ansible.builtin.set_fact: + dev2_lldp_digits: "{{ (inventory_hostname | string) | regex_replace('[^0-9]', '') }}" + changed_when: false + + - name: Discover DEV2 candidate IPv4 via LLDP on DEV1 (best-effort) + ansible.builtin.raw: > + {{ pathprefix }} + DIGITS="{{ dev2_lldp_digits }}"; + cat /var/run/lldp_server.json 2>/dev/null + | grep "${DIGITS}" -A 15 + | grep address + | grep -vE 'subtype|ipv6' + | awk -F'"' '{ print $4 }' + | head -n1 + register: dev2_lldp_ip_raw + changed_when: false + failed_when: false + + - name: Discover DEV2 candidate IPv6 via LLDP on DEV1 (best-effort) + ansible.builtin.raw: > + {{ pathprefix }} + DIGITS="{{ dev2_lldp_digits }}"; + cat /var/run/lldp_server.json 2>/dev/null + | grep "${DIGITS}" -A 15 + | grep 'address_ipv6' + | awk -F'"' '{ print $4 }' + | head -n1 + register: dev2_lldp_ip6_raw + changed_when: false + failed_when: false + + - name: Capture LLDP-derived DEV2 IP facts + ansible.builtin.set_fact: + lldp_dev2_ip: "{{ (dev2_lldp_ip_raw.stdout | default('')) | trim }}" + lldp_dev2_ip6: "{{ (dev2_lldp_ip6_raw.stdout | default('')) | trim }}" + changed_when: false + + - name: Classify LLDP IPv4 candidate + delegate_to: localhost + ansible.builtin.set_fact: + lldp_ip_class: >- + {% set ip = (lldp_dev2_ip | default('')) %} + {% if ip == '' %}none + {% elif ip.startswith('10.') %}10 + {% elif ip.startswith('192.168.') %}192_168 + {% else %}other{% endif %} + changed_when: false + + - name: Debug LLDP candidates + when: debugging | bool + delegate_to: localhost + ansible.builtin.debug: + msg: + - "LLDP digits={{ dev2_lldp_digits }}" + - "LLDP IPv4 candidate={{ lldp_dev2_ip | default('') }}" + - "LLDP IPv4 class={{ lldp_ip_class | default('none') }}" + - "LLDP IPv6 candidate={{ lldp_dev2_ip6 | default('') }}" + + # -------------------- If LLDP shows 192.168.x, override dev2_host for tunnel target -------------------- + - name: Override dev2_host from LLDP when candidate is 192.168.x.x + when: (lldp_ip_class | trim) == "192_168" and (lldp_dev2_ip | trim | length > 0) + delegate_to: localhost + ansible.builtin.set_fact: + dev2_host: "{{ lldp_dev2_ip | trim }}" + changed_when: false + + # ============================ PATH 1: DIRECT LLDP IPv4 (10.x) IF IT WORKS ============================ + - name: Try DEV2 login via direct LLDP IPv4 (10.x) with basicpass + when: (lldp_ip_class | trim) == "10" + delegate_to: localhost + ansible.builtin.shell: | + set -e + HOST="{{ lldp_dev2_ip }}" + sshpass -f basicpass ssh \ + -o AddressFamily=inet \ + -o StrictHostKeyChecking=no -o PubkeyAuthentication=no \ + -o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \ + -o ConnectTimeout=30 \ + "{{ dev2_ssh_user }}@${HOST}" echo OK >/dev/null 2>&1 + args: + executable: /bin/bash + register: direct_lldp_try_basicpass + changed_when: false + ignore_errors: true + + - name: Select basicpass for direct LLDP if succeeded + when: (lldp_ip_class | trim) == "10" and direct_lldp_try_basicpass.rc == 0 + delegate_to: localhost + ansible.builtin.set_fact: + dev2_conn_method: "direct_lldp" + dev2_passfile_used: "basicpass" + dev2_ssh_host: "{{ lldp_dev2_ip }}" + dev2_ssh_port: 22 + changed_when: false + + - name: Try DEV2 login via direct LLDP IPv4 (10.x) with basicpass2 (only if first failed) + when: (lldp_ip_class | trim) == "10" and dev2_conn_method != "direct_lldp" + delegate_to: localhost + ansible.builtin.shell: | + set -e + HOST="{{ lldp_dev2_ip }}" + sshpass -f basicpass2 ssh \ + -o AddressFamily=inet \ + -o StrictHostKeyChecking=no -o PubkeyAuthentication=no \ + -o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \ + -o ConnectTimeout=30 \ + "{{ dev2_ssh_user }}@${HOST}" echo OK >/dev/null 2>&1 + args: + executable: /bin/bash + register: direct_lldp_try_basicpass2 + changed_when: false + ignore_errors: true + + - name: Select basicpass2 for direct LLDP if succeeded + when: (lldp_ip_class | trim) == "10" and dev2_conn_method != "direct_lldp" and direct_lldp_try_basicpass2.rc == 0 + delegate_to: localhost + ansible.builtin.set_fact: + dev2_conn_method: "direct_lldp" + dev2_passfile_used: "basicpass2" + dev2_ssh_host: "{{ lldp_dev2_ip }}" + dev2_ssh_port: 22 + changed_when: false + + # ============================ PATH 2: TUNNEL VIA DEV1 (PRIMARY DEFAULT) ============================ + - name: Set connection method to tunnel if not already direct LLDP + when: dev2_conn_method != "direct_lldp" + delegate_to: localhost + ansible.builtin.set_fact: + dev2_conn_method: "tunnel" + changed_when: false + + - name: Add temporary IP on DEV1 (tolerate 'File exists') + when: dev2_conn_method == "tunnel" + ansible.builtin.raw: > + {{ pathprefix }} + ip a add {{ dev2_side_ip }} dev {{ dev1_iface }} + register: add_ip + changed_when: add_ip.rc == 0 + failed_when: > + add_ip.rc != 0 + and ('File exists' not in (add_ip.stdout | default(''))) + and ('File exists' not in (add_ip.stderr | default(''))) + + - name: Discover DEV2 MAC via bridge fdb on DEV1 (best-effort) + when: dev2_conn_method == "tunnel" + ansible.builtin.raw: > + {{ pathprefix }} + bridge fdb show {{ dev1_iface }} | grep eth0 | grep -v permanent | grep master | awk '{print $1}' | head -n1 + register: dev2_mac_scan + changed_when: false + failed_when: false + + - name: Capture discovered DEV2 MAC (if any) + when: dev2_conn_method == "tunnel" + ansible.builtin.set_fact: + dev2_mac: "{{ (dev2_mac_scan.stdout | default('')) | trim }}" + changed_when: false + + - name: Clear existing ARP entry for DEV2 on DEV1 (best-effort) + when: dev2_conn_method == "tunnel" + ansible.builtin.raw: > + {{ pathprefix }} + ip neigh del {{ dev2_host }} dev {{ dev1_iface }} 2>/dev/null || true + changed_when: false + failed_when: false + + - name: Add static ARP entry on DEV1 (if MAC discovered; tolerate 'File exists') + when: dev2_conn_method == "tunnel" and (dev2_mac | default('') | length > 0) + ansible.builtin.raw: > + {{ pathprefix }} + ip neigh add {{ dev2_host }} lladdr {{ dev2_mac }} dev {{ dev1_iface }} nud permanent + register: dev2_arp_add + changed_when: dev2_arp_add.rc == 0 + failed_when: > + dev2_arp_add.rc != 0 + and ('File exists' not in (dev2_arp_add.stdout | default(''))) + and ('File exists' not in (dev2_arp_add.stderr | default(''))) + + - name: Refresh ARP (best-effort) + when: dev2_conn_method == "tunnel" + ansible.builtin.raw: > + {{ pathprefix }} + arping -U -I {{ arping_iface }} {{ dev2_side_ip_addr }} -c 2 2>/dev/null || true + changed_when: false + failed_when: false + + - name: Pick a free local TCP port for the tunnel (controller side) + when: dev2_conn_method == "tunnel" + delegate_to: localhost + ansible.builtin.shell: | + set -e + pick() { + for i in $(seq 1 25); do + p="$(shuf -i 20000-39999 -n 1)" + if command -v ss >/dev/null 2>&1; then + if ! ss -ltn | awk '{print $4}' | grep -qE "(:|\.)${p}$"; then + echo "$p"; return 0 + fi + else + if ! nc -z 127.0.0.1 "$p" >/dev/null 2>&1; then + echo "$p"; return 0 + fi + fi + done + return 1 + } + pick + args: + executable: /bin/bash + register: pick_port + changed_when: false + + - name: Stop if no free local port was found + when: dev2_conn_method == "tunnel" and (pick_port.stdout | trim | length) == 0 + ansible.builtin.meta: end_host + + - name: Record chosen local port and create control dir for SSH ControlMaster + when: dev2_conn_method == "tunnel" + delegate_to: localhost + ansible.builtin.set_fact: + _local_port: "{{ pick_port.stdout | trim }}" + _ctrl_dir: "{{ lookup('ansible.builtin.pipe', 'mktemp -d') }}" + _ctrl_sock: "{{ _ctrl_dir }}/ssh_tunnel_ctl" + + - name: Start SSH ControlMaster and forward 127.0.0.1:local_port → DEV2:22 via DEV1 + when: dev2_conn_method == "tunnel" + delegate_to: localhost + ansible.builtin.shell: | + set -e + USER="{{ dev1_user }}" + HOST="{{ ansible_host | default(inventory_hostname) }}" + sshpass -p '{{ dev1_pass }}' ssh -f -N {{ ssh_opts_common }} \ + -M -S "{{ _ctrl_sock }}" \ + -L "127.0.0.1:{{ _local_port }}:{{ dev2_host }}:{{ dev2_port }}" \ + "${USER}@${HOST}" + args: + executable: /bin/bash + register: start_tunnel + changed_when: true + + - name: Probe TCP reachability to DEV2 through the tunnel (nc) + when: dev2_conn_method == "tunnel" + delegate_to: localhost + ansible.builtin.shell: | + set -e + nc -z -w5 127.0.0.1 "{{ _local_port }}" + args: + executable: /bin/bash + register: nc_probe + changed_when: false + ignore_errors: true + + - name: Stop if tunnel TCP probe failed + when: dev2_conn_method == "tunnel" and nc_probe.rc != 0 + ansible.builtin.meta: end_host + + - name: Try DEV2 login through tunnel with basicpass + when: dev2_conn_method == "tunnel" + delegate_to: localhost + ansible.builtin.shell: | + set -e + PORT="{{ _local_port }}" + sshpass -f basicpass ssh \ + -o AddressFamily=inet \ + -o StrictHostKeyChecking=no -o PubkeyAuthentication=no \ + -o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \ + -o ConnectTimeout=30 \ + -p "$PORT" "{{ dev2_ssh_user }}@127.0.0.1" echo OK >/dev/null 2>&1 + args: + executable: /bin/bash + register: dev2_try_basicpass + changed_when: false + ignore_errors: true + + - name: Select basicpass if tunnel login succeeded + when: dev2_conn_method == "tunnel" and dev2_try_basicpass.rc == 0 + delegate_to: localhost + ansible.builtin.set_fact: + dev2_passfile_used: "basicpass" + dev2_ssh_host: "127.0.0.1" + dev2_ssh_port: "{{ _local_port }}" + changed_when: false + + - name: Try DEV2 login through tunnel with basicpass2 (only if first failed) + when: dev2_conn_method == "tunnel" and dev2_passfile_used == "NONE" + delegate_to: localhost + ansible.builtin.shell: | + set -e + PORT="{{ _local_port }}" + sshpass -f basicpass2 ssh \ + -o AddressFamily=inet \ + -o StrictHostKeyChecking=no -o PubkeyAuthentication=no \ + -o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \ + -o ConnectTimeout=30 \ + -p "$PORT" "{{ dev2_ssh_user }}@127.0.0.1" echo OK >/dev/null 2>&1 + args: + executable: /bin/bash + register: dev2_try_basicpass2 + changed_when: false + ignore_errors: true + + - name: Select basicpass2 if tunnel login succeeded + when: dev2_conn_method == "tunnel" and dev2_passfile_used == "NONE" and dev2_try_basicpass2.rc == 0 + delegate_to: localhost + ansible.builtin.set_fact: + dev2_passfile_used: "basicpass2" + dev2_ssh_host: "127.0.0.1" + dev2_ssh_port: "{{ _local_port }}" + changed_when: false + + # -------------------- Safety guard: validate tunnel reached correct device by MAC (if discovered) -------------------- + - name: Read remote eth0 MAC via tunnel (guard) + when: dev2_conn_method == "tunnel" and dev2_passfile_used != "NONE" and (dev2_mac | default('') | trim | length > 0) + delegate_to: localhost + ansible.builtin.shell: | + set -e + PORT="{{ _local_port }}" + sshpass -f "{{ dev2_passfile_used }}" ssh \ + -o AddressFamily=inet \ + -o StrictHostKeyChecking=no -o PubkeyAuthentication=no \ + -o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \ + -o ConnectTimeout=30 \ + -p "$PORT" "{{ dev2_ssh_user }}@127.0.0.1" \ + "cat /sys/class/net/eth0/address 2>/dev/null || echo" + args: + executable: /bin/bash + register: dev2_eth0_mac_read + changed_when: false + failed_when: false + + - name: Abort if remote eth0 MAC != discovered DEV2 MAC + when: dev2_conn_method == "tunnel" and dev2_passfile_used != "NONE" and (dev2_mac | default('') | trim | length > 0) and + ((dev2_eth0_mac_read.stdout | default('') | trim | lower) != (dev2_mac | trim | lower)) + ansible.builtin.fail: + msg: > + Safety stop: tunnel reached wrong device. + expected_dev2_mac={{ dev2_mac | trim }}, + remote_eth0_mac={{ dev2_eth0_mac_read.stdout | default('') | trim }}. + + # ============================ FALLBACK 3: DIRECT LLDP IPv4 (10.x) IF TUNNEL AUTH FAILED ============================ + - name: Try DEV2 login via LLDP IPv4 10.x (fallback if tunnel auth failed) + when: + - dev2_conn_method == "tunnel" + - dev2_passfile_used == "NONE" + - (lldp_dev2_ip | default('')) is match('^10\.') + delegate_to: localhost + ansible.builtin.shell: | + set -e + HOST="{{ lldp_dev2_ip }}" + for f in basicpass basicpass2; do + if sshpass -f "$f" ssh \ + -o AddressFamily=inet \ + -o StrictHostKeyChecking=no -o PubkeyAuthentication=no \ + -o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \ + -o ConnectTimeout=20 \ + "{{ dev2_ssh_user }}@${HOST}" echo OK >/dev/null 2>&1; then + echo "$f"; exit 0 + fi + done + exit 1 + args: + executable: /bin/bash + register: dev2_auth_lldp + changed_when: false + ignore_errors: true + + - name: Record LLDP IPv4 fallback decision + when: + - dev2_conn_method == "tunnel" + - dev2_passfile_used == "NONE" + - (lldp_dev2_ip | default('')) is match('^10\.') + delegate_to: localhost + ansible.builtin.set_fact: + dev2_passfile_used_lldp: "{{ (dev2_auth_lldp.rc == 0) | ternary((dev2_auth_lldp.stdout | trim), 'NONE') }}" + changed_when: false + + # ============================ FALLBACK 4: IPv6 LLDP VIA DEV1 (LAST RESORT) ============================ + - name: Copy DEV2 passfiles to DEV1 for IPv6 nested SSH (last resort) + when: + - dev2_conn_method == "tunnel" + - dev2_passfile_used == "NONE" + - (dev2_passfile_used_lldp | default('NONE')) == "NONE" + - (lldp_dev2_ip6 | default('') | length) > 0 + ansible.builtin.copy: + src: "{{ item }}" + dest: "/tmp/{{ item }}" + mode: "0600" + loop: "{{ dev2_passfiles }}" + ignore_errors: true + + - name: Try DEV2 login via LLDP IPv6 (nested SSH through DEV1; last resort) + when: + - dev2_conn_method == "tunnel" + - dev2_passfile_used == "NONE" + - (dev2_passfile_used_lldp | default('NONE')) == "NONE" + - (lldp_dev2_ip6 | default('') | length) > 0 + delegate_to: localhost + ansible.builtin.shell: | + set -e + IP6="{{ lldp_dev2_ip6 }}" + for f in {{ dev2_passfiles | join(' ') }}; do + if sshpass -p '{{ dev1_pass }}' ssh {{ ssh_opts_common }} \ + "{{ dev1_user }}@{{ ansible_host|default(inventory_hostname) }}" \ + "timeout 30s sshpass -f '/tmp/${f}' ssh \ + -o StrictHostKeyChecking=no -o PubkeyAuthentication=no \ + -o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \ + -o ConnectTimeout=30 \ + '{{ dev2_ssh_user }}@\[${IP6}%{{ dev1_iface }}\]' \ + 'echo OK'" \ + >/dev/null 2>&1; then + echo "$f"; exit 0 + fi + done + exit 1 + args: + executable: /bin/bash + register: dev2_auth_lldp6 + changed_when: false + ignore_errors: true + + - name: Record LLDP IPv6 fallback decision + when: + - dev2_conn_method == "tunnel" + - dev2_passfile_used == "NONE" + - (dev2_passfile_used_lldp | default('NONE')) == "NONE" + - (lldp_dev2_ip6 | default('') | length) > 0 + delegate_to: localhost + ansible.builtin.set_fact: + dev2_passfile_used_lldp6: "{{ (dev2_auth_lldp6.rc == 0) | ternary((dev2_auth_lldp6.stdout | trim), 'NONE') }}" + changed_when: false + + # ============================ FINAL CONNECTION RESOLUTION ============================ + - name: Decide final DEV2 connection mode (tunnel > lldp4 > lldp6) + delegate_to: localhost + ansible.builtin.set_fact: + dev2_conn_final: >- + {%- if (dev2_conn_method == 'direct_lldp') and (dev2_passfile_used != 'NONE') -%} + direct_lldp + {%- elif (dev2_conn_method == 'tunnel') and (dev2_passfile_used != 'NONE') -%} + tunnel + {%- elif (dev2_passfile_used_lldp | default('NONE')) != 'NONE' -%} + lldp4_fallback + {%- elif (dev2_passfile_used_lldp6 | default('NONE')) != 'NONE' -%} + lldp6_via_dev1 + {%- else -%} + none + {%- endif -%} + changed_when: false + + - name: Abort if all DEV2 connection methods failed + when: dev2_conn_final == "none" + ansible.builtin.fail: + msg: > + DEV2 unreachable: tunnel auth failed, LLDP IPv4 fallback failed, and LLDP IPv6 fallback failed. + lldp_ipv4='{{ lldp_dev2_ip | default('') }}', lldp_ipv6='{{ lldp_dev2_ip6 | default('') }}'. + + - name: Debug final connectivity decision + when: debugging | bool + delegate_to: localhost + ansible.builtin.debug: + msg: + - "dev2_conn_final={{ dev2_conn_final }}" + - "tunnel passfile={{ dev2_passfile_used }}" + - "lldp4 passfile={{ dev2_passfile_used_lldp }}" + - "lldp6 passfile={{ dev2_passfile_used_lldp6 }}" + - "tunnel target={{ dev2_host }}:{{ dev2_port }} (forwarded to 127.0.0.1:{{ _local_port | default('n/a') }})" + - "lldp ipv4={{ lldp_dev2_ip | default('') }}" + - "lldp ipv6={{ lldp_dev2_ip6 | default('') }}" + + # ============================ ACTION (PHASE 0): DEV2 UPTIME ============================ + - name: DEV2 | uptime (tunnel) + when: dev2_conn_final == "tunnel" + delegate_to: localhost + ansible.builtin.shell: | + set -e + PORT="{{ _local_port }}" + sshpass -f "{{ dev2_passfile_used }}" ssh {{ ssh_opts_common }} \ + -o AddressFamily=inet \ + -o ConnectTimeout=30 \ + -p "$PORT" "{{ dev2_ssh_user }}@127.0.0.1" \ + "uptime 2>/dev/null || true" + args: + executable: /bin/bash + register: dev2_uptime + changed_when: false + + - name: DEV2 | uptime (direct LLDP IPv4 primary) + when: dev2_conn_final == "direct_lldp" + delegate_to: localhost + ansible.builtin.shell: | + set -e + HOST="{{ dev2_ssh_host }}" + sshpass -f "{{ dev2_passfile_used }}" ssh {{ ssh_opts_common }} \ + -o AddressFamily=inet \ + -o ConnectTimeout=30 \ + "{{ dev2_ssh_user }}@${HOST}" \ + "uptime 2>/dev/null || true" + args: + executable: /bin/bash + register: dev2_uptime + changed_when: false + + - name: DEV2 | uptime (LLDP IPv4 fallback) + when: dev2_conn_final == "lldp4_fallback" + delegate_to: localhost + ansible.builtin.shell: | + set -e + HOST="{{ lldp_dev2_ip }}" + sshpass -f "{{ dev2_passfile_used_lldp }}" ssh {{ ssh_opts_common }} \ + -o AddressFamily=inet \ + -o ConnectTimeout=30 \ + "{{ dev2_ssh_user }}@${HOST}" \ + "uptime 2>/dev/null || true" + args: + executable: /bin/bash + register: dev2_uptime + changed_when: false + + - name: DEV2 | uptime (LLDP IPv6 via DEV1 nested) + when: dev2_conn_final == "lldp6_via_dev1" + delegate_to: localhost + ansible.builtin.shell: | + set -e + IP6="{{ lldp_dev2_ip6 }}" + F="{{ dev2_passfile_used_lldp6 }}" + sshpass -p '{{ dev1_pass }}' ssh {{ ssh_opts_common }} \ + "{{ dev1_user }}@{{ ansible_host|default(inventory_hostname) }}" \ + "sshpass -f '/tmp/${F}' ssh \ + -o StrictHostKeyChecking=no -o PubkeyAuthentication=no \ + -o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \ + -o ConnectTimeout=30 \ + '{{ dev2_ssh_user }}@\[${IP6}%{{ dev1_iface }}\]' \ + 'uptime 2>/dev/null || true'" + args: + executable: /bin/bash + register: dev2_uptime + changed_when: false + + - name: Output DEV2 uptime (stdout) + delegate_to: localhost + ansible.builtin.debug: + msg: + - "DEV2 uptime via {{ dev2_conn_final }}:" + - "{{ (dev2_uptime.stdout | default('') | trim) if (dev2_uptime is defined) else '' }}" + + post_tasks: + - name: Cleanup (always) + block: + - ansible.builtin.debug: + msg: "Cleanup: closing tunnel, removing temp IP, removing staged passfiles (best-effort)" + delegate_to: localhost + changed_when: false + always: + - name: Close SSH ControlMaster (best-effort) + when: dev2_conn_method == "tunnel" + delegate_to: localhost + ansible.builtin.shell: | + ssh -S "{{ _ctrl_sock | default('/dev/null') }}" -O exit 2>/dev/null || true + changed_when: false + ignore_errors: true + + - name: Remove tunnel control dir (best-effort) + when: dev2_conn_method == "tunnel" + delegate_to: localhost + ansible.builtin.file: + path: "{{ _ctrl_dir | default('/tmp/none') }}" + state: absent + ignore_errors: true + + - name: Remove staged passfiles from DEV1 (best-effort) + ansible.builtin.raw: > + {{ pathprefix }} + rm -f /tmp/basicpass /tmp/basicpass2 2>/dev/null || true + changed_when: false + failed_when: false + + - name: Remove temporary IP on DEV1 (tolerate 'Cannot assign requested address') + when: dev2_conn_method == "tunnel" + ansible.builtin.raw: > + {{ pathprefix }} + ip a del {{ dev2_side_ip }} dev {{ dev1_iface }} + register: del_ip + changed_when: del_ip.rc == 0 + failed_when: > + del_ip.rc != 0 + and ('Cannot assign requested address' not in (del_ip.stdout | default(''))) + and ('Cannot assign requested address' not in (del_ip.stderr | default('')))