0931

files/ansible-playbooks/ptsd-migrate.yml

@@ -0,0 +1,661 @@
+# ptsd-migration.yml — PPPoE to super DHCP (phase 0: connectivity prove-out)
+# Goal: reliably connect to DEV2 using:
+#   1) direct LLDP IPv4 (10.x) if available and auth works
+#   2) tunnel via DEV1 (default / primary)
+#   3) LLDP IPv4 (10.x) fallback if tunnel auth fails
+#   4) LLDP IPv6 fallback via DEV1 (nested ssh to [ip6%iface]) if all else fails
+#
+# After connection: run "uptime" on DEV2 and print it.
+
+- name: PPPoE to super DHCP | Phase 0 | Prove reliable DEV2 connectivity + uptime
+  hosts: all
+  gather_facts: no
+
+  vars:
+    # Busybox-safe PATH prefix for all DEV1 raw calls
+    pathprefix: "PATH=/sbin:/usr/sbin:/bin:/usr/bin:$PATH; "
+
+    # DEV1 credentials
+    dev1_user: "root"
+    dev1_pass: "wavewave"
+
+    # DEV2 "default" behind DEV1
+    dev2_host: "192.168.1.1"
+    dev2_port: 22
+
+    # Temp IP we add to DEV1 so it can reach DEV2
+    dev2_side_ip: "192.168.1.11/24"
+    dev2_side_ip_addr: "{{ dev2_side_ip.split('/')[0] }}"
+    dev1_iface: "br-wan"          # used for temp IP, ARP, and IPv6 scope-id (link-local)
+    arping_iface: "eth0"          # optional refresh on DEV1
+
+    # DEV2 credentials
+    dev2_ssh_user: "root"
+    dev2_passfiles:
+      - "basicpass"
+      - "basicpass2"
+
+    # SSH options used from controller (and outer hop to DEV1)
+    ssh_opts_common: >-
+      -o PreferredAuthentications=password
+      -o PubkeyAuthentication=no
+      -o StrictHostKeyChecking=no
+      -o UserKnownHostsFile=/dev/null
+      -o NumberOfPasswordPrompts=1
+      -o ConnectTimeout=30
+
+    # Debug toggle
+    debugging: true
+
+    # Final connection outputs (set dynamically)
+    dev2_conn_method: ""
+    dev2_passfile_used: "NONE"         # for tunnel or direct-lldp
+    dev2_passfile_used_lldp: "NONE"    # for direct LLDP IPv4 fallback
+    dev2_passfile_used_lldp6: "NONE"   # for IPv6 via DEV1 fallback
+    dev2_ssh_host: ""
+    dev2_ssh_port: ""
+
+  pre_tasks:
+    # ------------------------------- DEV1 hostname sanity -------------------------------
+    - name: Read DEV1 hostname (busybox-safe)
+      ansible.builtin.raw: >
+        {{ pathprefix }}
+        (cat /proc/sys/kernel/hostname 2>/dev/null || echo "")
+      register: dev1_host_read
+      changed_when: false
+
+    - name: Stop early if connected DEV1 hostname != inventory (guard)
+      ansible.builtin.meta: end_host
+      when: (dev1_host_read.stdout | trim | length > 0) and
+            ((dev1_host_read.stdout | trim) != (inventory_hostname | string))
+
+  tasks:
+    # ============================ LLDP DISCOVERY (DEV1) ============================
+    - name: Compute hostname digits key for LLDP lookup (DEV2)
+      ansible.builtin.set_fact:
+        dev2_lldp_digits: "{{ (inventory_hostname | string) | regex_replace('[^0-9]', '') }}"
+      changed_when: false
+
+    - name: Discover DEV2 candidate IPv4 via LLDP on DEV1 (best-effort)
+      ansible.builtin.raw: >
+        {{ pathprefix }}
+        DIGITS="{{ dev2_lldp_digits }}";
+        cat /var/run/lldp_server.json 2>/dev/null
+        | grep "${DIGITS}" -A 15
+        | grep address
+        | grep -vE 'subtype|ipv6'
+        | awk -F'"' '{ print $4 }'
+        | head -n1
+      register: dev2_lldp_ip_raw
+      changed_when: false
+      failed_when: false
+
+    - name: Discover DEV2 candidate IPv6 via LLDP on DEV1 (best-effort)
+      ansible.builtin.raw: >
+        {{ pathprefix }}
+        DIGITS="{{ dev2_lldp_digits }}";
+        cat /var/run/lldp_server.json 2>/dev/null
+        | grep "${DIGITS}" -A 15
+        | grep 'address_ipv6'
+        | awk -F'"' '{ print $4 }'
+        | head -n1
+      register: dev2_lldp_ip6_raw
+      changed_when: false
+      failed_when: false
+
+    - name: Capture LLDP-derived DEV2 IP facts
+      ansible.builtin.set_fact:
+        lldp_dev2_ip: "{{ (dev2_lldp_ip_raw.stdout | default('')) | trim }}"
+        lldp_dev2_ip6: "{{ (dev2_lldp_ip6_raw.stdout | default('')) | trim }}"
+      changed_when: false
+
+    - name: Classify LLDP IPv4 candidate
+      delegate_to: localhost
+      ansible.builtin.set_fact:
+        lldp_ip_class: >-
+          {% set ip = (lldp_dev2_ip | default('')) %}
+          {% if ip == '' %}none
+          {% elif ip.startswith('10.') %}10
+          {% elif ip.startswith('192.168.') %}192_168
+          {% else %}other{% endif %}
+      changed_when: false
+
+    - name: Debug LLDP candidates
+      when: debugging | bool
+      delegate_to: localhost
+      ansible.builtin.debug:
+        msg:
+          - "LLDP digits={{ dev2_lldp_digits }}"
+          - "LLDP IPv4 candidate={{ lldp_dev2_ip | default('<none>') }}"
+          - "LLDP IPv4 class={{ lldp_ip_class | default('none') }}"
+          - "LLDP IPv6 candidate={{ lldp_dev2_ip6 | default('<none>') }}"
+
+    # -------------------- If LLDP shows 192.168.x, override dev2_host for tunnel target --------------------
+    - name: Override dev2_host from LLDP when candidate is 192.168.x.x
+      when: (lldp_ip_class | trim) == "192_168" and (lldp_dev2_ip | trim | length > 0)
+      delegate_to: localhost
+      ansible.builtin.set_fact:
+        dev2_host: "{{ lldp_dev2_ip | trim }}"
+      changed_when: false
+
+    # ============================ PATH 1: DIRECT LLDP IPv4 (10.x) IF IT WORKS ============================
+    - name: Try DEV2 login via direct LLDP IPv4 (10.x) with basicpass
+      when: (lldp_ip_class | trim) == "10"
+      delegate_to: localhost
+      ansible.builtin.shell: |
+        set -e
+        HOST="{{ lldp_dev2_ip }}"
+        sshpass -f basicpass ssh \
+          -o AddressFamily=inet \
+          -o StrictHostKeyChecking=no -o PubkeyAuthentication=no \
+          -o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \
+          -o ConnectTimeout=30 \
+          "{{ dev2_ssh_user }}@${HOST}" echo OK >/dev/null 2>&1
+      args:
+        executable: /bin/bash
+      register: direct_lldp_try_basicpass
+      changed_when: false
+      ignore_errors: true
+
+    - name: Select basicpass for direct LLDP if succeeded
+      when: (lldp_ip_class | trim) == "10" and direct_lldp_try_basicpass.rc == 0
+      delegate_to: localhost
+      ansible.builtin.set_fact:
+        dev2_conn_method: "direct_lldp"
+        dev2_passfile_used: "basicpass"
+        dev2_ssh_host: "{{ lldp_dev2_ip }}"
+        dev2_ssh_port: 22
+      changed_when: false
+
+    - name: Try DEV2 login via direct LLDP IPv4 (10.x) with basicpass2 (only if first failed)
+      when: (lldp_ip_class | trim) == "10" and dev2_conn_method != "direct_lldp"
+      delegate_to: localhost
+      ansible.builtin.shell: |
+        set -e
+        HOST="{{ lldp_dev2_ip }}"
+        sshpass -f basicpass2 ssh \
+          -o AddressFamily=inet \
+          -o StrictHostKeyChecking=no -o PubkeyAuthentication=no \
+          -o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \
+          -o ConnectTimeout=30 \
+          "{{ dev2_ssh_user }}@${HOST}" echo OK >/dev/null 2>&1
+      args:
+        executable: /bin/bash
+      register: direct_lldp_try_basicpass2
+      changed_when: false
+      ignore_errors: true
+
+    - name: Select basicpass2 for direct LLDP if succeeded
+      when: (lldp_ip_class | trim) == "10" and dev2_conn_method != "direct_lldp" and direct_lldp_try_basicpass2.rc == 0
+      delegate_to: localhost
+      ansible.builtin.set_fact:
+        dev2_conn_method: "direct_lldp"
+        dev2_passfile_used: "basicpass2"
+        dev2_ssh_host: "{{ lldp_dev2_ip }}"
+        dev2_ssh_port: 22
+      changed_when: false
+
+    # ============================ PATH 2: TUNNEL VIA DEV1 (PRIMARY DEFAULT) ============================
+    - name: Set connection method to tunnel if not already direct LLDP
+      when: dev2_conn_method != "direct_lldp"
+      delegate_to: localhost
+      ansible.builtin.set_fact:
+        dev2_conn_method: "tunnel"
+      changed_when: false
+
+    - name: Add temporary IP on DEV1 (tolerate 'File exists')
+      when: dev2_conn_method == "tunnel"
+      ansible.builtin.raw: >
+        {{ pathprefix }}
+        ip a add {{ dev2_side_ip }} dev {{ dev1_iface }}
+      register: add_ip
+      changed_when: add_ip.rc == 0
+      failed_when: >
+        add_ip.rc != 0
+        and ('File exists' not in (add_ip.stdout | default('')))
+        and ('File exists' not in (add_ip.stderr | default('')))
+
+    - name: Discover DEV2 MAC via bridge fdb on DEV1 (best-effort)
+      when: dev2_conn_method == "tunnel"
+      ansible.builtin.raw: >
+        {{ pathprefix }}
+        bridge fdb show {{ dev1_iface }} | grep eth0 | grep -v permanent | grep master | awk '{print $1}' | head -n1
+      register: dev2_mac_scan
+      changed_when: false
+      failed_when: false
+
+    - name: Capture discovered DEV2 MAC (if any)
+      when: dev2_conn_method == "tunnel"
+      ansible.builtin.set_fact:
+        dev2_mac: "{{ (dev2_mac_scan.stdout | default('')) | trim }}"
+      changed_when: false
+
+    - name: Clear existing ARP entry for DEV2 on DEV1 (best-effort)
+      when: dev2_conn_method == "tunnel"
+      ansible.builtin.raw: >
+        {{ pathprefix }}
+        ip neigh del {{ dev2_host }} dev {{ dev1_iface }} 2>/dev/null || true
+      changed_when: false
+      failed_when: false
+
+    - name: Add static ARP entry on DEV1 (if MAC discovered; tolerate 'File exists')
+      when: dev2_conn_method == "tunnel" and (dev2_mac | default('') | length > 0)
+      ansible.builtin.raw: >
+        {{ pathprefix }}
+        ip neigh add {{ dev2_host }} lladdr {{ dev2_mac }} dev {{ dev1_iface }} nud permanent
+      register: dev2_arp_add
+      changed_when: dev2_arp_add.rc == 0
+      failed_when: >
+        dev2_arp_add.rc != 0
+        and ('File exists' not in (dev2_arp_add.stdout | default('')))
+        and ('File exists' not in (dev2_arp_add.stderr | default('')))
+
+    - name: Refresh ARP (best-effort)
+      when: dev2_conn_method == "tunnel"
+      ansible.builtin.raw: >
+        {{ pathprefix }}
+        arping -U -I {{ arping_iface }} {{ dev2_side_ip_addr }} -c 2 2>/dev/null || true
+      changed_when: false
+      failed_when: false
+
+    - name: Pick a free local TCP port for the tunnel (controller side)
+      when: dev2_conn_method == "tunnel"
+      delegate_to: localhost
+      ansible.builtin.shell: |
+        set -e
+        pick() {
+          for i in $(seq 1 25); do
+            p="$(shuf -i 20000-39999 -n 1)"
+            if command -v ss >/dev/null 2>&1; then
+              if ! ss -ltn | awk '{print $4}' | grep -qE "(:|\.)${p}$"; then
+                echo "$p"; return 0
+              fi
+            else
+              if ! nc -z 127.0.0.1 "$p" >/dev/null 2>&1; then
+                echo "$p"; return 0
+              fi
+            fi
+          done
+          return 1
+        }
+        pick
+      args:
+        executable: /bin/bash
+      register: pick_port
+      changed_when: false
+
+    - name: Stop if no free local port was found
+      when: dev2_conn_method == "tunnel" and (pick_port.stdout | trim | length) == 0
+      ansible.builtin.meta: end_host
+
+    - name: Record chosen local port and create control dir for SSH ControlMaster
+      when: dev2_conn_method == "tunnel"
+      delegate_to: localhost
+      ansible.builtin.set_fact:
+        _local_port: "{{ pick_port.stdout | trim }}"
+        _ctrl_dir: "{{ lookup('ansible.builtin.pipe', 'mktemp -d') }}"
+        _ctrl_sock: "{{ _ctrl_dir }}/ssh_tunnel_ctl"
+
+    - name: Start SSH ControlMaster and forward 127.0.0.1:local_port → DEV2:22 via DEV1
+      when: dev2_conn_method == "tunnel"
+      delegate_to: localhost
+      ansible.builtin.shell: |
+        set -e
+        USER="{{ dev1_user }}"
+        HOST="{{ ansible_host | default(inventory_hostname) }}"
+        sshpass -p '{{ dev1_pass }}' ssh -f -N {{ ssh_opts_common }} \
+          -M -S "{{ _ctrl_sock }}" \
+          -L "127.0.0.1:{{ _local_port }}:{{ dev2_host }}:{{ dev2_port }}" \
+          "${USER}@${HOST}"
+      args:
+        executable: /bin/bash
+      register: start_tunnel
+      changed_when: true
+
+    - name: Probe TCP reachability to DEV2 through the tunnel (nc)
+      when: dev2_conn_method == "tunnel"
+      delegate_to: localhost
+      ansible.builtin.shell: |
+        set -e
+        nc -z -w5 127.0.0.1 "{{ _local_port }}"
+      args:
+        executable: /bin/bash
+      register: nc_probe
+      changed_when: false
+      ignore_errors: true
+
+    - name: Stop if tunnel TCP probe failed
+      when: dev2_conn_method == "tunnel" and nc_probe.rc != 0
+      ansible.builtin.meta: end_host
+
+    - name: Try DEV2 login through tunnel with basicpass
+      when: dev2_conn_method == "tunnel"
+      delegate_to: localhost
+      ansible.builtin.shell: |
+        set -e
+        PORT="{{ _local_port }}"
+        sshpass -f basicpass ssh \
+          -o AddressFamily=inet \
+          -o StrictHostKeyChecking=no -o PubkeyAuthentication=no \
+          -o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \
+          -o ConnectTimeout=30 \
+          -p "$PORT" "{{ dev2_ssh_user }}@127.0.0.1" echo OK >/dev/null 2>&1
+      args:
+        executable: /bin/bash
+      register: dev2_try_basicpass
+      changed_when: false
+      ignore_errors: true
+
+    - name: Select basicpass if tunnel login succeeded
+      when: dev2_conn_method == "tunnel" and dev2_try_basicpass.rc == 0
+      delegate_to: localhost
+      ansible.builtin.set_fact:
+        dev2_passfile_used: "basicpass"
+        dev2_ssh_host: "127.0.0.1"
+        dev2_ssh_port: "{{ _local_port }}"
+      changed_when: false
+
+    - name: Try DEV2 login through tunnel with basicpass2 (only if first failed)
+      when: dev2_conn_method == "tunnel" and dev2_passfile_used == "NONE"
+      delegate_to: localhost
+      ansible.builtin.shell: |
+        set -e
+        PORT="{{ _local_port }}"
+        sshpass -f basicpass2 ssh \
+          -o AddressFamily=inet \
+          -o StrictHostKeyChecking=no -o PubkeyAuthentication=no \
+          -o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \
+          -o ConnectTimeout=30 \
+          -p "$PORT" "{{ dev2_ssh_user }}@127.0.0.1" echo OK >/dev/null 2>&1
+      args:
+        executable: /bin/bash
+      register: dev2_try_basicpass2
+      changed_when: false
+      ignore_errors: true
+
+    - name: Select basicpass2 if tunnel login succeeded
+      when: dev2_conn_method == "tunnel" and dev2_passfile_used == "NONE" and dev2_try_basicpass2.rc == 0
+      delegate_to: localhost
+      ansible.builtin.set_fact:
+        dev2_passfile_used: "basicpass2"
+        dev2_ssh_host: "127.0.0.1"
+        dev2_ssh_port: "{{ _local_port }}"
+      changed_when: false
+
+    # -------------------- Safety guard: validate tunnel reached correct device by MAC (if discovered) --------------------
+    - name: Read remote eth0 MAC via tunnel (guard)
+      when: dev2_conn_method == "tunnel" and dev2_passfile_used != "NONE" and (dev2_mac | default('') | trim | length > 0)
+      delegate_to: localhost
+      ansible.builtin.shell: |
+        set -e
+        PORT="{{ _local_port }}"
+        sshpass -f "{{ dev2_passfile_used }}" ssh \
+          -o AddressFamily=inet \
+          -o StrictHostKeyChecking=no -o PubkeyAuthentication=no \
+          -o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \
+          -o ConnectTimeout=30 \
+          -p "$PORT" "{{ dev2_ssh_user }}@127.0.0.1" \
+          "cat /sys/class/net/eth0/address 2>/dev/null || echo"
+      args:
+        executable: /bin/bash
+      register: dev2_eth0_mac_read
+      changed_when: false
+      failed_when: false
+
+    - name: Abort if remote eth0 MAC != discovered DEV2 MAC
+      when: dev2_conn_method == "tunnel" and dev2_passfile_used != "NONE" and (dev2_mac | default('') | trim | length > 0) and
+            ((dev2_eth0_mac_read.stdout | default('') | trim | lower) != (dev2_mac | trim | lower))
+      ansible.builtin.fail:
+        msg: >
+          Safety stop: tunnel reached wrong device.
+          expected_dev2_mac={{ dev2_mac | trim }},
+          remote_eth0_mac={{ dev2_eth0_mac_read.stdout | default('') | trim }}.
+
+    # ============================ FALLBACK 3: DIRECT LLDP IPv4 (10.x) IF TUNNEL AUTH FAILED ============================
+    - name: Try DEV2 login via LLDP IPv4 10.x (fallback if tunnel auth failed)
+      when:
+        - dev2_conn_method == "tunnel"
+        - dev2_passfile_used == "NONE"
+        - (lldp_dev2_ip | default('')) is match('^10\.')
+      delegate_to: localhost
+      ansible.builtin.shell: |
+        set -e
+        HOST="{{ lldp_dev2_ip }}"
+        for f in basicpass basicpass2; do
+          if sshpass -f "$f" ssh \
+              -o AddressFamily=inet \
+              -o StrictHostKeyChecking=no -o PubkeyAuthentication=no \
+              -o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \
+              -o ConnectTimeout=20 \
+              "{{ dev2_ssh_user }}@${HOST}" echo OK >/dev/null 2>&1; then
+            echo "$f"; exit 0
+          fi
+        done
+        exit 1
+      args:
+        executable: /bin/bash
+      register: dev2_auth_lldp
+      changed_when: false
+      ignore_errors: true
+
+    - name: Record LLDP IPv4 fallback decision
+      when:
+        - dev2_conn_method == "tunnel"
+        - dev2_passfile_used == "NONE"
+        - (lldp_dev2_ip | default('')) is match('^10\.')
+      delegate_to: localhost
+      ansible.builtin.set_fact:
+        dev2_passfile_used_lldp: "{{ (dev2_auth_lldp.rc == 0) | ternary((dev2_auth_lldp.stdout | trim), 'NONE') }}"
+      changed_when: false
+
+    # ============================ FALLBACK 4: IPv6 LLDP VIA DEV1 (LAST RESORT) ============================
+    - name: Copy DEV2 passfiles to DEV1 for IPv6 nested SSH (last resort)
+      when:
+        - dev2_conn_method == "tunnel"
+        - dev2_passfile_used == "NONE"
+        - (dev2_passfile_used_lldp | default('NONE')) == "NONE"
+        - (lldp_dev2_ip6 | default('') | length) > 0
+      ansible.builtin.copy:
+        src: "{{ item }}"
+        dest: "/tmp/{{ item }}"
+        mode: "0600"
+      loop: "{{ dev2_passfiles }}"
+      ignore_errors: true
+
+    - name: Try DEV2 login via LLDP IPv6 (nested SSH through DEV1; last resort)
+      when:
+        - dev2_conn_method == "tunnel"
+        - dev2_passfile_used == "NONE"
+        - (dev2_passfile_used_lldp | default('NONE')) == "NONE"
+        - (lldp_dev2_ip6 | default('') | length) > 0
+      delegate_to: localhost
+      ansible.builtin.shell: |
+        set -e
+        IP6="{{ lldp_dev2_ip6 }}"
+        for f in {{ dev2_passfiles | join(' ') }}; do
+          if sshpass -p '{{ dev1_pass }}' ssh {{ ssh_opts_common }} \
+              "{{ dev1_user }}@{{ ansible_host|default(inventory_hostname) }}" \
+              "timeout 30s sshpass -f '/tmp/${f}' ssh \
+                 -o StrictHostKeyChecking=no -o PubkeyAuthentication=no \
+                 -o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \
+                 -o ConnectTimeout=30 \
+                 '{{ dev2_ssh_user }}@\[${IP6}%{{ dev1_iface }}\]' \
+                 'echo OK'" \
+              >/dev/null 2>&1; then
+            echo "$f"; exit 0
+          fi
+        done
+        exit 1
+      args:
+        executable: /bin/bash
+      register: dev2_auth_lldp6
+      changed_when: false
+      ignore_errors: true
+
+    - name: Record LLDP IPv6 fallback decision
+      when:
+        - dev2_conn_method == "tunnel"
+        - dev2_passfile_used == "NONE"
+        - (dev2_passfile_used_lldp | default('NONE')) == "NONE"
+        - (lldp_dev2_ip6 | default('') | length) > 0
+      delegate_to: localhost
+      ansible.builtin.set_fact:
+        dev2_passfile_used_lldp6: "{{ (dev2_auth_lldp6.rc == 0) | ternary((dev2_auth_lldp6.stdout | trim), 'NONE') }}"
+      changed_when: false
+
+    # ============================ FINAL CONNECTION RESOLUTION ============================
+    - name: Decide final DEV2 connection mode (tunnel > lldp4 > lldp6)
+      delegate_to: localhost
+      ansible.builtin.set_fact:
+        dev2_conn_final: >-
+          {%- if (dev2_conn_method == 'direct_lldp') and (dev2_passfile_used != 'NONE') -%}
+            direct_lldp
+          {%- elif (dev2_conn_method == 'tunnel') and (dev2_passfile_used != 'NONE') -%}
+            tunnel
+          {%- elif (dev2_passfile_used_lldp | default('NONE')) != 'NONE' -%}
+            lldp4_fallback
+          {%- elif (dev2_passfile_used_lldp6 | default('NONE')) != 'NONE' -%}
+            lldp6_via_dev1
+          {%- else -%}
+            none
+          {%- endif -%}
+      changed_when: false
+
+    - name: Abort if all DEV2 connection methods failed
+      when: dev2_conn_final == "none"
+      ansible.builtin.fail:
+        msg: >
+          DEV2 unreachable: tunnel auth failed, LLDP IPv4 fallback failed, and LLDP IPv6 fallback failed.
+          lldp_ipv4='{{ lldp_dev2_ip | default('') }}', lldp_ipv6='{{ lldp_dev2_ip6 | default('') }}'.
+
+    - name: Debug final connectivity decision
+      when: debugging | bool
+      delegate_to: localhost
+      ansible.builtin.debug:
+        msg:
+          - "dev2_conn_final={{ dev2_conn_final }}"
+          - "tunnel passfile={{ dev2_passfile_used }}"
+          - "lldp4 passfile={{ dev2_passfile_used_lldp }}"
+          - "lldp6 passfile={{ dev2_passfile_used_lldp6 }}"
+          - "tunnel target={{ dev2_host }}:{{ dev2_port }} (forwarded to 127.0.0.1:{{ _local_port | default('n/a') }})"
+          - "lldp ipv4={{ lldp_dev2_ip | default('<none>') }}"
+          - "lldp ipv6={{ lldp_dev2_ip6 | default('<none>') }}"
+
+    # ============================ ACTION (PHASE 0): DEV2 UPTIME ============================
+    - name: DEV2 | uptime (tunnel)
+      when: dev2_conn_final == "tunnel"
+      delegate_to: localhost
+      ansible.builtin.shell: |
+        set -e
+        PORT="{{ _local_port }}"
+        sshpass -f "{{ dev2_passfile_used }}" ssh {{ ssh_opts_common }} \
+          -o AddressFamily=inet \
+          -o ConnectTimeout=30 \
+          -p "$PORT" "{{ dev2_ssh_user }}@127.0.0.1" \
+          "uptime 2>/dev/null || true"
+      args:
+        executable: /bin/bash
+      register: dev2_uptime
+      changed_when: false
+
+    - name: DEV2 | uptime (direct LLDP IPv4 primary)
+      when: dev2_conn_final == "direct_lldp"
+      delegate_to: localhost
+      ansible.builtin.shell: |
+        set -e
+        HOST="{{ dev2_ssh_host }}"
+        sshpass -f "{{ dev2_passfile_used }}" ssh {{ ssh_opts_common }} \
+          -o AddressFamily=inet \
+          -o ConnectTimeout=30 \
+          "{{ dev2_ssh_user }}@${HOST}" \
+          "uptime 2>/dev/null || true"
+      args:
+        executable: /bin/bash
+      register: dev2_uptime
+      changed_when: false
+
+    - name: DEV2 | uptime (LLDP IPv4 fallback)
+      when: dev2_conn_final == "lldp4_fallback"
+      delegate_to: localhost
+      ansible.builtin.shell: |
+        set -e
+        HOST="{{ lldp_dev2_ip }}"
+        sshpass -f "{{ dev2_passfile_used_lldp }}" ssh {{ ssh_opts_common }} \
+          -o AddressFamily=inet \
+          -o ConnectTimeout=30 \
+          "{{ dev2_ssh_user }}@${HOST}" \
+          "uptime 2>/dev/null || true"
+      args:
+        executable: /bin/bash
+      register: dev2_uptime
+      changed_when: false
+
+    - name: DEV2 | uptime (LLDP IPv6 via DEV1 nested)
+      when: dev2_conn_final == "lldp6_via_dev1"
+      delegate_to: localhost
+      ansible.builtin.shell: |
+        set -e
+        IP6="{{ lldp_dev2_ip6 }}"
+        F="{{ dev2_passfile_used_lldp6 }}"
+        sshpass -p '{{ dev1_pass }}' ssh {{ ssh_opts_common }} \
+          "{{ dev1_user }}@{{ ansible_host|default(inventory_hostname) }}" \
+          "sshpass -f '/tmp/${F}' ssh \
+             -o StrictHostKeyChecking=no -o PubkeyAuthentication=no \
+             -o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \
+             -o ConnectTimeout=30 \
+             '{{ dev2_ssh_user }}@\[${IP6}%{{ dev1_iface }}\]' \
+             'uptime 2>/dev/null || true'"
+      args:
+        executable: /bin/bash
+      register: dev2_uptime
+      changed_when: false
+
+    - name: Output DEV2 uptime (stdout)
+      delegate_to: localhost
+      ansible.builtin.debug:
+        msg:
+          - "DEV2 uptime via {{ dev2_conn_final }}:"
+          - "{{ (dev2_uptime.stdout | default('') | trim) if (dev2_uptime is defined) else '<no output>' }}"
+
+  post_tasks:
+    - name: Cleanup (always)
+      block:
+        - ansible.builtin.debug:
+            msg: "Cleanup: closing tunnel, removing temp IP, removing staged passfiles (best-effort)"
+          delegate_to: localhost
+          changed_when: false
+      always:
+        - name: Close SSH ControlMaster (best-effort)
+          when: dev2_conn_method == "tunnel"
+          delegate_to: localhost
+          ansible.builtin.shell: |
+            ssh -S "{{ _ctrl_sock | default('/dev/null') }}" -O exit 2>/dev/null || true
+          changed_when: false
+          ignore_errors: true
+
+        - name: Remove tunnel control dir (best-effort)
+          when: dev2_conn_method == "tunnel"
+          delegate_to: localhost
+          ansible.builtin.file:
+            path: "{{ _ctrl_dir | default('/tmp/none') }}"
+            state: absent
+          ignore_errors: true
+
+        - name: Remove staged passfiles from DEV1 (best-effort)
+          ansible.builtin.raw: >
+            {{ pathprefix }}
+            rm -f /tmp/basicpass /tmp/basicpass2 2>/dev/null || true
+          changed_when: false
+          failed_when: false
+
+        - name: Remove temporary IP on DEV1 (tolerate 'Cannot assign requested address')
+          when: dev2_conn_method == "tunnel"
+          ansible.builtin.raw: >
+            {{ pathprefix }}
+            ip a del {{ dev2_side_ip }} dev {{ dev1_iface }}
+          register: del_ip
+          changed_when: del_ip.rc == 0
+          failed_when: >
+            del_ip.rc != 0
+            and ('Cannot assign requested address' not in (del_ip.stdout | default('')))
+            and ('Cannot assign requested address' not in (del_ip.stderr | default('')))