pavel/ansible-worker
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

first commit

Browse Source
This commit is contained in:
ansible user
2025-10-22 14:11:49 +02:00
commit 110301f862
75 changed files with 20802 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

826
files/ansible-playbooks/multissidfix-changessid.yml Normal file
View File

@@ -0,0 +1,826 @@
---
- name: "Multi-SSID fix (phase 1: persist + runtime apply)"
hosts: all
gather_facts: false
vars:
ssh_user: "{{ ansible_user | default('root') }}"
ssh_pass: "{{ ansible_password | default(ansible_ssh_pass) }}"
# RabbitMQ (same contract as wifidebug16.yml)
rmq_host: "{{ lookup('env','RMQ_HOST') | default('10.210.12.2', true) }}"
rmq_port: "{{ lookup('env','RMQ_PORT') | default('15672', true) }}"
rmq_user: "{{ lookup('env','RMQ_USER') | default('admin', true) }}"
rmq_pass: "{{ lookup('env','RMQ_PASS') | default('change_me', true) }}"
rmq_vhost: "{{ lookup('env','RMQ_VHOST') | default('app', true) }}"
rmq_exchange: "{{ lookup('env','RMQ_EXCHANGE') | default('controls', true) }}"
control_queue: "{{ lookup('env','CONTROL_QUEUE') | default('queue_controls', true) }}"
# Reboot parachute delay (seconds)
parachute_delay_s: 600
# Local working paths (controller)
local_cfg: "/tmp/{{ inventory_hostname }}_config.json"
local_new: "/tmp/{{ inventory_hostname }}_config.json.new"
local_step: "/tmp/{{ inventory_hostname }}_config.step"
local_diff: "/tmp/{{ inventory_hostname }}_config.diff"
local_dd: "/tmp/{{ inventory_hostname }}_dd.json"
# External scripts/filters (next to wifidebug.sh in your repo)
dd_script_src: "files/wirelessduediligence.sh"
f_1vap0_src: "files/filter_1vap_id0.jq"
f_1vap1_src: "files/filter_1vap_id1.jq"
f_2_01_src: "files/filter_2vaps_0_1.jq"
f_2_10_src: "files/filter_2vaps_1_0.jq"
# Controller tmp destinations
dd_script: "/tmp/wirelessduediligence.sh"
f_1vap0: "/tmp/filter_1vap_id0.jq"
f_1vap1: "/tmp/filter_1vap_id1.jq"
f_2_01: "/tmp/filter_2vaps_0_1.jq"
f_2_10: "/tmp/filter_2vaps_1_0.jq"
# Remote (device)
remote_cfg: "/tmp/config.json"
remote_new: "/tmp/config.json.new"
remote_backup: "/tmp/config.json.multissidfix1.backup"
# Optional new SSID name (set via env NEW_SSID to trigger rename)
new_ssid_name: "{{ lookup('env','NEW_SSID') | default('ikeja R5 a day hotspot', true) }}"
tasks:
##########################################################################
# a) Connectivity + basic sanity
##########################################################################
- name: SSH reachability probe
raw: "echo ping"
register: ping_result
ignore_errors: true
- name: Stop if SSH unreachable (soft-fail)
when: ping_result is failed
block:
- name: Journal soft-fail (no SSH)
delegate_to: localhost
uri:
url: "http://{{ rmq_host }}:{{ rmq_port }}/api/exchanges/{{ rmq_vhost | urlencode }}/{{ rmq_exchange | urlencode }}/publish"
method: POST
user: "{{ rmq_user }}"
password: "{{ rmq_pass }}"
force_basic_auth: true
status_code: 200
headers: { content-type: "application/json" }
body_format: json
body:
properties: { content_type: "application/json" }
routing_key: "{{ control_queue }}"
payload: "{{ {
'inscope_device': (ansible_hostname | default(inventory_hostname)),
'task_name': 'journal_add',
'task_result': 'multissidfix: soft-fail — SSH not reachable'
} | to_json }}"
payload_encoding: "string"
changed_when: false
- meta: end_host
- name: Ensure remote /tmp/config.json exists
raw: "test -s {{ remote_cfg }}"
register: remote_cfg_check
changed_when: false
- name: Stop if /tmp/config.json missing (soft-fail)
when: remote_cfg_check.rc != 0
block:
- name: Journal soft-fail (missing config.json)
delegate_to: localhost
uri:
url: "http://{{ rmq_host }}:{{ rmq_port }}/api/exchanges/{{ rmq_vhost | urlencode }}/{{ rmq_exchange | urlencode }}/publish"
method: POST
user: "{{ rmq_user }}"
password: "{{ rmq_pass }}"
force_basic_auth: true
status_code: 200
headers: { content-type: "application/json" }
body_format: json
body:
properties: { content_type: "application/json" }
routing_key: "{{ control_queue }}"
payload: "{{ {
'inscope_device': (ansible_hostname | default(inventory_hostname)),
'task_name': 'journal_add',
'task_result': 'multissidfix: soft-fail — missing /tmp/config.json'
} | to_json }}"
payload_encoding: "string"
changed_when: false
- meta: end_host
- name: Check controller tools (jq/sshpass/diff/sha256sum)
delegate_to: localhost
shell: |
command -v jq >/dev/null 2>&1 \
&& command -v sshpass >/dev/null 2>&1 \
&& command -v diff >/dev/null 2>&1 \
&& (command -v sha256sum >/dev/null 2>&1 || command -v busybox >/dev/null 2>&1)
args: { executable: /bin/bash }
register: ctrl_tools
changed_when: false
- name: Stop if controller tools missing (soft-fail)
when: ctrl_tools.rc != 0
block:
- name: Journal soft-fail (missing tools)
delegate_to: localhost
uri:
url: "http://{{ rmq_host }}:{{ rmq_port }}/api/exchanges/{{ rmq_vhost | urlencode }}/{{ rmq_exchange | urlencode }}/publish"
method: POST
user: "{{ rmq_user }}"
password: "{{ rmq_pass }}"
force_basic_auth: true
status_code: 200
headers: { content-type: "application/json" }
body_format: json
body:
properties: { content_type: "application/json" }
routing_key: "{{ control_queue }}"
payload: "{{ {
'inscope_device': (ansible_hostname | default(inventory_hostname)),
'task_name': 'journal_add',
'task_result': 'multissidfix: soft-fail — controller missing jq/sshpass/diff/sha256sum'
} | to_json }}"
payload_encoding: "string"
changed_when: false
- meta: end_host
##########################################################################
# b) Due diligence (external script, run on controller)
##########################################################################
- name: Copy due diligence script to controller tmp
delegate_to: localhost
copy:
src: "{{ dd_script_src }}"
dest: "{{ dd_script }}"
mode: "0755"
- name: Pull /tmp/config.json from device to controller
delegate_to: localhost
command: >
sshpass -p {{ ssh_pass | quote }}
scp -q -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null
{{ ssh_user }}@{{ ansible_host }}:{{ remote_cfg }}
{{ local_cfg }}
- name: Run due diligence on controller
delegate_to: localhost
shell: "sh {{ dd_script | quote }} {{ local_cfg | quote }} > {{ local_dd | quote }}"
args: { executable: /bin/sh }
changed_when: false
- name: Parse due diligence JSON
delegate_to: localhost
set_fact:
dd: "{{ lookup('file', local_dd) | from_json }}"
# Normalize types for robust `when:` checks
- name: Extract & normalize dd facts
delegate_to: localhost
set_fact:
w0_total_i: "{{ (dd.radios.wifi0.vaps_total | int) }}"
w1_total_i: "{{ (dd.radios.wifi1.vaps_total | int) }}"
w0_idx_i: "{{ (dd.radios.wifi0.indices | map('int') | list) }}"
w1_idx_i: "{{ (dd.radios.wifi1.indices | map('int') | list) }}"
##########################################################################
# c) Soft-fail: layout policy checks (one journal)
##########################################################################
- name: Init soft-fail reasons (policy)
delegate_to: localhost
set_fact:
softfail_reasons: []
- name: wifi0 — add reason if ONE_VAP but index not 0/1
delegate_to: localhost
when: (w0_total_i | int) == 1 and (0 not in w0_idx_i and 1 not in w0_idx_i)
set_fact:
softfail_reasons: "{{ softfail_reasons + [ 'wifi0 ONE_VAP but index not 0/1 (indices=' ~ (w0_idx_i | string) ~ ')' ] }}"
- name: wifi0 — add reason if TWO_VAPS but indices not (0,1)/(1,0)
delegate_to: localhost
when: (w0_total_i | int) == 2 and (w0_idx_i | sort not in [[0,1],[1,0]])
set_fact:
softfail_reasons: "{{ softfail_reasons + [ 'wifi0 TWO_VAPS but indices not (0,1)/(1,0) (indices=' ~ (w0_idx_i | string) ~ ')' ] }}"
- name: wifi0 — add reason if MORE_THAN_TWO_VAPS
delegate_to: localhost
when: (w0_total_i | int) > 2
set_fact:
softfail_reasons: "{{ softfail_reasons + [ 'wifi0 MORE_THAN_TWO_VAPS (indices=' ~ (w0_idx_i | string) ~ ')' ] }}"
- name: wifi1 — add reason if ONE_VAP but index not 0/1
delegate_to: localhost
when: (w1_total_i | int) == 1 and (0 not in w1_idx_i and 1 not in w1_idx_i)
set_fact:
softfail_reasons: "{{ softfail_reasons + [ 'wifi1 ONE_VAP but index not 0/1 (indices=' ~ (w1_idx_i | string) ~ ')' ] }}"
- name: wifi1 — add reason if TWO_VAPS but indices not (0,1)/(1,0)
delegate_to: localhost
when: (w1_total_i | int) == 2 and (w1_idx_i | sort not in [[0,1],[1,0]])
set_fact:
softfail_reasons: "{{ softfail_reasons + [ 'wifi1 TWO_VAPS but indices not (0,1)/(1,0) (indices=' ~ (w1_idx_i | string) ~ ')' ] }}"
- name: wifi1 — add reason if MORE_THAN_TWO_VAPS
delegate_to: localhost
when: (w1_total_i | int) > 2
set_fact:
softfail_reasons: "{{ softfail_reasons + [ 'wifi1 MORE_THAN_TWO_VAPS (indices=' ~ (w1_idx_i | string) ~ ')' ] }}"
- name: Publish soft-fail journal & stop host (policy)
when: (softfail_reasons | length) > 0
block:
- name: Journal soft-fail (policy)
delegate_to: localhost
uri:
url: "http://{{ rmq_host }}:{{ rmq_port }}/api/exchanges/{{ rmq_vhost | urlencode }}/{{ rmq_exchange | urlencode }}/publish"
method: POST
user: "{{ rmq_user }}"
password: "{{ rmq_pass }}"
force_basic_auth: true
status_code: 200
headers: { content-type: "application/json" }
body_format: json
body:
properties: { content_type: "application/json" }
routing_key: "{{ control_queue }}"
payload: "{{ {
'inscope_device': (ansible_hostname | default(inventory_hostname)),
'task_name': 'journal_add',
'task_result': 'multissidfix: soft-fail (policy) — ' ~ (softfail_reasons | join('; '))
} | to_json }}"
payload_encoding: "string"
changed_when: false
- meta: end_host
##########################################################################
# d) Filters to controller tmp + candidate generation (per radio)
##########################################################################
- name: Copy jq filters to controller tmp
delegate_to: localhost
copy:
src: "{{ item.src }}"
dest: "{{ item.dest }}"
mode: "0644"
loop:
- { src: "{{ f_1vap0_src }}", dest: "{{ f_1vap0 }}" }
- { src: "{{ f_1vap1_src }}", dest: "{{ f_1vap1 }}" }
- { src: "{{ f_2_01_src }}", dest: "{{ f_2_01 }}" }
- { src: "{{ f_2_10_src }}", dest: "{{ f_2_10 }}" }
- name: Start from current config as working file
delegate_to: localhost
copy:
src: "{{ local_cfg }}"
dest: "{{ local_step }}"
mode: "0644"
# wifi0 choice
- name: wifi0 — apply filter 1vap_id0
delegate_to: localhost
shell: "jq --arg r wifi0 -f {{ f_1vap0 | quote }} {{ local_step | quote }} > {{ local_step | quote }}.next && mv {{ local_step | quote }}.next {{ local_step | quote }}"
args: { executable: /bin/bash }
when: (w0_total_i | int) == 1 and (0 in w0_idx_i)
changed_when: true
- name: wifi0 — apply filter 1vap_id1 (Policy B)
delegate_to: localhost
shell: "jq --arg r wifi0 -f {{ f_1vap1 | quote }} {{ local_step | quote }} > {{ local_step | quote }}.next && mv {{ local_step | quote }}.next {{ local_step | quote }}"
args: { executable: /bin/bash }
when: (w0_total_i | int) == 1 and (1 in w0_idx_i)
changed_when: true
- name: wifi0 — apply filter 2vaps_0_1
delegate_to: localhost
shell: "jq --arg r wifi0 -f {{ f_2_01 | quote }} {{ local_step | quote }} > {{ local_step | quote }}.next && mv {{ local_step | quote }}.next {{ local_step | quote }}"
args: { executable: /bin/bash }
when: (w0_total_i | int) == 2 and (w0_idx_i | sort == [0,1])
changed_when: true
- name: wifi0 — apply filter 2vaps_1_0 (actual order 1,0)
delegate_to: localhost
shell: "jq --arg r wifi0 -f {{ f_2_10 | quote }} {{ local_step | quote }} > {{ local_step | quote }}.next && mv {{ local_step | quote }}.next {{ local_step | quote }}"
args: { executable: /bin/bash }
when: (w0_total_i | int) == 2 and (w0_idx_i == [1,0])
changed_when: true
# wifi1 choice
- name: wifi1 — apply filter 1vap_id0
delegate_to: localhost
shell: "jq --arg r wifi1 -f {{ f_1vap0 | quote }} {{ local_step | quote }} > {{ local_step | quote }}.next && mv {{ local_step | quote }}.next {{ local_step | quote }}"
args: { executable: /bin/bash }
when: (w1_total_i | int) == 1 and (0 in w1_idx_i)
changed_when: true
- name: wifi1 — apply filter 1vap_id1 (Policy B)
delegate_to: localhost
shell: "jq --arg r wifi1 -f {{ f_1vap1 | quote }} {{ local_step | quote }} > {{ local_step | quote }}.next && mv {{ local_step | quote }}.next {{ local_step | quote }}"
args: { executable: /bin/bash }
when: (w1_total_i | int) == 1 and (1 in w1_idx_i)
changed_when: true
- name: wifi1 — apply filter 2vaps_0_1
delegate_to: localhost
shell: "jq --arg r wifi1 -f {{ f_2_01 | quote }} {{ local_step | quote }} > {{ local_step | quote }}.next && mv {{ local_step | quote }}.next {{ local_step | quote }}"
args: { executable: /bin/bash }
when: (w1_total_i | int) == 2 and (w1_idx_i | sort == [0,1])
changed_when: true
- name: wifi1 — apply filter 2vaps_1_0 (actual order 1,0)
delegate_to: localhost
shell: "jq --arg r wifi1 -f {{ f_2_10 | quote }} {{ local_step | quote }} > {{ local_step | quote }}.next && mv {{ local_step | quote }}.next {{ local_step | quote }}"
args: { executable: /bin/bash }
when: (w1_total_i | int) == 2 and (w1_idx_i == [1,0])
changed_when: true
# Optional SSID rename (only if new_ssid_name is defined)
- name: Set SSID for the single enabled AP VAP per radio (wifi0 & wifi1)
delegate_to: localhost
shell: |
jq --arg SSID "{{ new_ssid_name }}" '
.wireless.radios |=
with_entries(
.value.vaps =
((.value.vaps // []) | map(
if (.mode=="ap" and (.enabled==true)) then
(.ssid = $SSID)
else .
end
))
)
' {{ local_step | quote }} > {{ local_step | quote }}.next && mv {{ local_step | quote }}.next {{ local_step | quote }}
args: { executable: /bin/bash }
when: new_ssid_name is defined
changed_when: true
- name: Debug normalized types
delegate_to: localhost
debug:
msg:
- "w0_total_i(type)={{ w0_total_i | type_debug }} value={{ w0_total_i }}"
- "w1_total_i(type)={{ w1_total_i | type_debug }} value={{ w1_total_i }}"
- name: Move working file to final candidate
delegate_to: localhost
copy:
src: "{{ local_step }}"
dest: "{{ local_new }}"
mode: "0644"
##########################################################################
# e) Candidate checks — accumulate reasons; soft-fail once if any
##########################################################################
- name: Init soft-fail reasons (candidate)
delegate_to: localhost
set_fact:
cand_reasons: []
- name: Check JSON validity
delegate_to: localhost
shell: "jq -e '.' {{ local_new | quote }} >/dev/null"
args: { executable: /bin/bash }
register: json_valid
changed_when: false
failed_when: false
- name: Add reason if JSON invalid
delegate_to: localhost
when: json_valid.rc != 0
set_fact:
cand_reasons: "{{ cand_reasons + [ 'invalid JSON syntax in candidate' ] }}"
- name: Semantic — wifi0 exactly one enabled AP VAP
delegate_to: localhost
shell: |
jq -e '(.wireless.radios.wifi0.vaps // [])
| map(select(.mode=="ap" and (.enabled==true))) | length == 1' {{ local_new | quote }} >/dev/null
args: { executable: /bin/bash }
register: sem_w0
changed_when: false
failed_when: false
- name: Add reason if wifi0 semantic fails
delegate_to: localhost
when: sem_w0.rc != 0
set_fact:
cand_reasons: "{{ cand_reasons + [ 'wifi0 must have exactly one enabled AP VAP' ] }}"
- name: Semantic — wifi1 exactly one enabled AP VAP
delegate_to: localhost
shell: |
jq -e '(.wireless.radios.wifi1.vaps // [])
| map(select(.mode=="ap" and (.enabled==true))) | length == 1' {{ local_new | quote }} >/dev/null
args: { executable: /bin/bash }
register: sem_w1
changed_when: false
failed_when: false
- name: Add reason if wifi1 semantic fails
delegate_to: localhost
when: sem_w1.rc != 0
set_fact:
cand_reasons: "{{ cand_reasons + [ 'wifi1 must have exactly one enabled AP VAP' ] }}"
- name: Semantic — wifi0 enabled AP VAP has lbd=true
delegate_to: localhost
shell: |
jq -e '(.wireless.radios.wifi0.vaps // [])
| map(select(.mode=="ap" and (.enabled==true) and (.lbd==true))) | length == 1' {{ local_new | quote }} >/dev/null
args: { executable: /bin/bash }
register: sem_w0_lbd
changed_when: false
failed_when: false
- name: Add reason if wifi0 lbd check fails
delegate_to: localhost
when: sem_w0_lbd.rc != 0
set_fact:
cand_reasons: "{{ cand_reasons + [ 'wifi0 enabled AP VAP must have lbd=true' ] }}"
- name: Semantic — wifi1 enabled AP VAP has lbd=true
delegate_to: localhost
shell: |
jq -e '(.wireless.radios.wifi1.vaps // [])
| map(select(.mode=="ap" and (.enabled==true) and (.lbd==true))) | length == 1' {{ local_new | quote }} >/dev/null
args: { executable: /bin/bash }
register: sem_w1_lbd
changed_when: false
failed_when: false
- name: Add reason if wifi1 lbd check fails
delegate_to: localhost
when: sem_w1_lbd.rc != 0
set_fact:
cand_reasons: "{{ cand_reasons + [ 'wifi1 enabled AP VAP must have lbd=true' ] }}"
- name: Get original file size
delegate_to: localhost
stat:
path: "{{ local_cfg }}"
register: stat_old
changed_when: false
- name: Get new file size
delegate_to: localhost
stat:
path: "{{ local_new }}"
register: stat_new
changed_when: false
- name: Add reason if size delta > 2%
delegate_to: localhost
when: stat_old.stat.size | int == 0 or
( ((stat_new.stat.size | int) - (stat_old.stat.size | int)) | abs ) > ( (stat_old.stat.size | int) * 0.02 )
set_fact:
cand_reasons: "{{ cand_reasons + [ 'candidate size delta >2% (old=' ~ (stat_old.stat.size | string) ~ ', new=' ~ (stat_new.stat.size | string) ~ ')' ] }}"
- name: Build unified diff (first 200 lines)
delegate_to: localhost
shell: "diff -u {{ local_cfg | quote }} {{ local_new | quote }} | sed -n '1,200p' > {{ local_diff | quote }} || true"
args: { executable: /bin/bash }
changed_when: false
- name: Show unified diff (first 200 lines)
delegate_to: localhost
debug:
msg: "{{ lookup('file', local_diff) | default('(no diff output)') }}"
- name: sha256 (controller) of candidate
delegate_to: localhost
command: sha256sum {{ local_new }}
register: sha_local
changed_when: false
- name: Copy candidate to device temp
delegate_to: localhost
command: >
sshpass -p {{ ssh_pass | quote }}
scp -q -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null
{{ local_new }}
{{ ssh_user }}@{{ ansible_host }}:{{ remote_new }}
register: scp_new
changed_when: true
- name: sha256 (remote) of candidate
raw: "sha256sum {{ remote_new }} || busybox sha256sum {{ remote_new }}"
register: sha_remote
changed_when: false
- name: Add reason if sha256 mismatch
delegate_to: localhost
when: (sha_local.stdout.split()[0]) != (sha_remote.stdout.split()[0])
set_fact:
cand_reasons: "{{ cand_reasons + [ 'sha256 mismatch controller vs remote' ] }}"
- name: Detect SSIDs with NBSP (informational)
delegate_to: localhost
shell: |
nbsp="$(printf '\302\240')"
jq -r '..|objects|.ssid? // empty' {{ local_new | quote }} | grep -F "$nbsp" || true
args: { executable: /bin/bash }
register: nbsp_lines
changed_when: false
- name: Save NBSP report lines
set_fact:
ssid_nbsp_lines: "{{ nbsp_lines.stdout_lines | default([]) }}"
- name: Publish soft-fail journal & stop host (candidate issues)
when: (cand_reasons | length) > 0
block:
- name: Journal soft-fail (candidate)
delegate_to: localhost
uri:
url: "http://{{ rmq_host }}:{{ rmq_port }}/api/exchanges/{{ rmq_vhost | urlencode }}/{{ rmq_exchange | urlencode }}/publish"
method: POST
user: "{{ rmq_user }}"
password: "{{ rmq_pass }}"
force_basic_auth: true
status_code: 200
headers: { content-type: "application/json" }
body_format: json
body:
properties: { content_type: "application/json" }
routing_key: "{{ control_queue }}"
payload: "{{ {
'inscope_device': (ansible_hostname | default(inventory_hostname)),
'task_name': 'journal_add',
'task_result': 'multissidfix: soft-fail (candidate) — ' ~ (cand_reasons | join('; '))
} | to_json }}"
payload_encoding: "string"
changed_when: false
- meta: end_host
##########################################################################
# f) Backup, parachute, promote, persist, apply, outcome
##########################################################################
- name: Backup current config on device
raw: "cp -a {{ remote_cfg }} {{ remote_backup }}"
changed_when: true
# --- PRE-APPLY HEADS-UP ---
- name: Journal — candidate validated, will promote/persist/apply shortly
delegate_to: localhost
uri:
url: "http://{{ rmq_host }}:{{ rmq_port }}/api/exchanges/{{ rmq_vhost | urlencode }}/{{ rmq_exchange | urlencode }}/publish"
method: POST
user: "{{ rmq_user }}"
password: "{{ rmq_pass }}"
force_basic_auth: true
status_code: 200
headers: { content-type: "application/json" }
body_format: json
body:
properties: { content_type: "application/json" }
routing_key: "{{ control_queue }}"
payload: "{{ {
'inscope_device': (ansible_hostname | default(inventory_hostname)),
'task_name': 'journal_add',
'task_result': (
'multissidfix: candidate passed checks; proceeding to backup + parachute + promote + sysconf -w + system-stop/start. '
~ 'size(old/new)=' ~ stat_old.stat.size|string ~ '/' ~ stat_new.stat.size|string
)
} | to_json }}"
payload_encoding: "string"
changed_when: false
- name: Arm reboot parachute (BusyBox reboot -d {{ parachute_delay_s }})
raw: "sh -c 'trap \"\" HUP; reboot -d {{ parachute_delay_s }} </dev/null >/dev/null 2>&1 &'"
changed_when: true
ignore_errors: true
- name: Promote candidate to active config
raw: "mv {{ remote_new }} {{ remote_cfg }} && chown root:root {{ remote_cfg }} && chmod 0644 {{ remote_cfg }}"
changed_when: true
# IMPORTANT: persist BEFORE runtime restart
- name: Persist config to flash (sysconf -w)
raw: "sysconf -w"
register: sysconf_write
changed_when: true
failed_when: false
# --- PRE-RESTART COMMIT ---
- name: Pre-restart journal (promoted & persisted; about to restart from controller)
delegate_to: localhost
uri:
url: "http://{{ rmq_host }}:{{ rmq_port }}/api/exchanges/{{ rmq_vhost | urlencode }}/{{ rmq_exchange | urlencode }}/publish"
method: POST
user: "{{ rmq_user }}"
password: "{{ rmq_pass }}"
force_basic_auth: true
status_code: 200
headers: { content-type: "application/json" }
body_format: json
body:
properties: { content_type: "application/json" }
routing_key: "{{ control_queue }}"
payload: "{{ {
'inscope_device': (ansible_hostname | default(inventory_hostname)),
'task_name': 'journal_add',
'task_result': (
'multissidfix: promoted candidate, persisted (sysconf -w rc=' ~ (sysconf_write.rc | default('n/a')) | string ~ '), '
~ 'system-stop/start launching from controller with 10s cap; '
~ 'parachute -d ' ~ parachute_delay_s|string ~ 's armed. '
~ 'size(old/new)=' ~ stat_old.stat.size|string ~ '/' ~ stat_new.stat.size|string
~ ', nbsp_ssids=' ~ (ssid_nbsp_lines|length)|string
)
} | to_json }}"
payload_encoding: "string"
changed_when: false
- name: Launch restart from controller with 10s cap (SSH command)
delegate_to: localhost
shell: "timeout 10s sshpass -p {{ ssh_pass | quote }} ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ServerAliveInterval=2 -o ServerAliveCountMax=1 {{ ssh_user }}@{{ ansible_host }} '/usr/sbin/system-stop ; sleep 1 ; /usr/sbin/system-start'"
args:
executable: /bin/bash
register: restart_kick
changed_when: true
failed_when: false
- name: Note restart_kick result (debug)
delegate_to: localhost
debug:
msg:
- "restart_kick.rc={{ restart_kick.rc }}"
- "stdout(last 5 lines): {{ (restart_kick.stdout_lines | default([]))[-5:] | default([]) }}"
- "stderr(last 5 lines): {{ (restart_kick.stderr_lines | default([]))[-5:] | default([]) }}"
# probe SSH with nc: up to 24 tries, 5s each (nc timeout -w 3)
- name: Probe SSH with nc (24 tries, 5s each)
delegate_to: localhost
shell: "nc -z -w 3 {{ ansible_host }} 22"
register: nc_probe
retries: 24
delay: 5
until: nc_probe.rc == 0
changed_when: false
failed_when: false
- name: Set ssh_up fact
delegate_to: localhost
set_fact:
ssh_up: "{{ (nc_probe.rc | default(1)) == 0 }}"
# --- SUCCESS PATH ---
- name: Post-return actions (only if SSH came back)
when: ssh_up | bool
block:
- name: Disarm delayed reboot if present
raw: "pgrep -x reboot && kill -9 $(pgrep -x reboot) || true"
changed_when: true
ignore_errors: true
register: disarm_reboot
# Re-run simple semantic checks on the active config
- name: Device semantic — wifi0 exactly one enabled AP VAP
raw: |
jq -e '(.wireless.radios.wifi0.vaps // [])
| map(select(.mode=="ap" and (.enabled==true))) | length == 1' {{ remote_cfg }} >/dev/null
register: dev_sem_w0
changed_when: false
failed_when: false
- name: Device semantic — wifi1 exactly one enabled AP VAP
raw: |
jq -e '(.wireless.radios.wifi1.vaps // [])
| map(select(.mode=="ap" and (.enabled==true))) | length == 1' {{ remote_cfg }} >/dev/null
register: dev_sem_w1
changed_when: false
failed_when: false
- name: Device semantic — wifi0 enabled AP VAP has lbd=true
raw: |
jq -e '(.wireless.radios.wifi0.vaps // [])
| map(select(.mode=="ap" and (.enabled==true) and (.lbd==true))) | length == 1' {{ remote_cfg }} >/dev/null
register: dev_sem_w0_lbd
changed_when: false
failed_when: false
- name: Device semantic — wifi1 enabled AP VAP has lbd=true
raw: |
jq -e '(.wireless.radios.wifi1.vaps // [])
| map(select(.mode=="ap" and (.enabled==true) and (.lbd==true))) | length == 1' {{ remote_cfg }} >/dev/null
register: dev_sem_w1_lbd
changed_when: false
failed_when: false
- name: sha256 (remote) of current active config (post-return)
raw: "sha256sum {{ remote_cfg }} || busybox sha256sum {{ remote_cfg }}"
register: sha_remote_after
changed_when: false
failed_when: false
- name: Decide post-return checks summary (controller side)
delegate_to: localhost
set_fact:
multissid_post_summary:
reboot_disarmed: "{{ (disarm_reboot is defined) and (disarm_reboot.rc is defined) and (disarm_reboot.rc in [0]) }}"
persisted_ok: "{{ (sysconf_write.rc | default(0)) == 0 }}"
dev_sem_ok:
w0_one: "{{ (dev_sem_w0.rc | default(1)) == 0 }}"
w1_one: "{{ (dev_sem_w1.rc | default(1)) == 0 }}"
w0_lbd: "{{ (dev_sem_w0_lbd.rc | default(1)) == 0 }}"
w1_lbd: "{{ (dev_sem_w1_lbd.rc | default(1)) == 0 }}"
cfg_hash_match: "{{ (sha_remote_after.stdout.split()[0] | default('')) == (sha_remote.stdout.split()[0] | default('')) }}"
old_size: "{{ stat_old.stat.size | default('n/a') }}"
new_size: "{{ stat_new.stat.size | default('n/a') }}"
nbsp_count: "{{ (ssid_nbsp_lines | default([])) | length }}"
- name: Publish final success journal (device returned; persisted; checks pass)
delegate_to: localhost
uri:
url: "http://{{ rmq_host }}:{{ rmq_port }}/api/exchanges/{{ rmq_vhost | urlencode }}/{{ rmq_exchange | urlencode }}/publish"
method: POST
user: "{{ rmq_user }}"
password: "{{ rmq_pass }}"
force_basic_auth: true
status_code: 200
headers: { content-type: "application/json" }
body_format: json
body:
properties: { content_type: "application/json" }
routing_key: "{{ control_queue }}"
payload: "{{ {
'inscope_device': (ansible_hostname | default(inventory_hostname)),
'task_name': 'journal_add',
'task_result':
(
'multissidfix: success — device is back; '
~ (multissid_post_summary.reboot_disarmed | ternary('parachute disarmed; ', 'parachute was not armed; '))
~ (multissid_post_summary.persisted_ok | ternary('persisted (sysconf -w); ', 'persist failed; '))
~ 'semantics: '
~ 'w0_one=' ~ (multissid_post_summary.dev_sem_ok.w0_one | string) ~ ', '
~ 'w1_one=' ~ (multissid_post_summary.dev_sem_ok.w1_one | string) ~ ', '
~ 'w0_lbd=' ~ (multissid_post_summary.dev_sem_ok.w0_lbd | string) ~ ', '
~ 'w1_lbd=' ~ (multissid_post_summary.dev_sem_ok.w1_lbd | string) ~ '; '
~ 'cfg_match=' ~ (multissid_post_summary.cfg_hash_match | string) ~ '; '
~ 'size(old/new)=' ~ (multissid_post_summary.old_size | string) ~ '/' ~ (multissid_post_summary.new_size | string) ~ '; '
~ 'nbsp_ssids=' ~ (multissid_post_summary.nbsp_count | string)
)
} | to_json }}"
payload_encoding: "string"
changed_when: false
- name: Set NetBox custom field multissidfix=v1.1
delegate_to: localhost
uri:
url: "http://{{ rmq_host }}:{{ rmq_port }}/api/exchanges/{{ rmq_vhost | urlencode }}/{{ rmq_exchange | urlencode }}/publish"
method: POST
user: "{{ rmq_user }}"
password: "{{ rmq_pass }}"
force_basic_auth: true
status_code: 200
headers: { content-type: "application/json" }
body_format: json
body:
properties: { content_type: "application/json" }
routing_key: "{{ control_queue }}"
payload: "{{ {
'inscope_device': (ansible_hostname | default(inventory_hostname)),
'task_name': 'custom_field_set',
'task_add1': 'multissidfix',
'task_result': 'v1.1'
} | to_json }}"
payload_encoding: "string"
changed_when: false
# --- FAILURE PATH (device did not return) ---
- name: Journal — restart/SSH probe failed
when: not ssh_up
delegate_to: localhost
uri:
url: "http://{{ rmq_host }}:{{ rmq_port }}/api/exchanges/{{ rmq_vhost | urlencode }}/{{ rmq_exchange | urlencode }}/publish"
method: POST
user: "{{ rmq_user }}"
password: "{{ rmq_pass }}"
force_basic_auth: true
status_code: 200
headers: { content-type: "application/json" }
body_format: json
body:
properties: { content_type: "application/json" }
routing_key: "{{ control_queue }}"
payload: "{{ {
'inscope_device': (ansible_hostname | default(inventory_hostname)),
'task_name': 'journal_add',
'task_result': (
'multissidfix: restart issued; SSH did not return after 24 x 5s checks — leaving parachute active.'
)
} | to_json }}"
payload_encoding: "string"
changed_when: false
- name: Stop host after failed SSH probe
when: not ssh_up
meta: end_host