first commit

files/ansible-playbooks/system-check-version.yml

@@ -0,0 +1,152 @@
+---
+- name: System firmware version check (banner probe + journal)
+  hosts: all
+  gather_facts: no
+
+  # RabbitMQ (match your existing defaults)
+  vars:
+    rmq_host: "10.210.12.2"
+    rmq_port: 15672
+    rmq_user: "admin"
+    rmq_pass: "change_me"
+    rmq_vhost: "app"
+    rmq_exchange: "controls"
+    control_queue: "queue_controls"
+
+    # Probing/SSH defaults (kept identical to your afterupgrade_check.yml)
+    tcp_port: 22
+    nc_timeout: 5
+    ssh_user: "{{ ansible_user | default('root') }}"
+    ssh_pass: "{{ ansible_ssh_pass | default('wavewave') }}"
+    ssh_timeout: 10
+
+  tasks:
+    # -------- Fast TCP reachability probe (controller-side), unchanged style --------
+    - name: Check if TCP/{{ tcp_port }} is reachable with nc
+      delegate_to: localhost
+      ansible.builtin.shell: |
+        nc -z -w{{ nc_timeout }} {{ ansible_host | default(inventory_hostname) }} {{ tcp_port }}
+      register: nc_probe
+      changed_when: false
+      ignore_errors: true
+
+    # If TCP failed → emit a single journal line and stop
+    - name: Build TCP-fail journal payload
+      when: nc_probe.rc != 0
+      delegate_to: localhost
+      ansible.builtin.set_fact:
+        tcp_fail_payload:
+          inscope_device: "{{ ansible_hostname | default(inventory_hostname) }}"
+          task_name: "journal_add"
+          task_result: >-
+            system check: TCP {{ tcp_port }} unreachable (nc failed)
+
+    - name: Publish TCP-fail journal
+      when: tcp_fail_payload is defined
+      delegate_to: localhost
+      ansible.builtin.uri:
+        url: "http://{{ rmq_host }}:{{ rmq_port }}/api/exchanges/{{ rmq_vhost | urlencode }}/{{ rmq_exchange | urlencode }}/publish"
+        method: POST
+        user: "{{ rmq_user }}"
+        password: "{{ rmq_pass }}"
+        force_basic_auth: true
+        status_code: 200
+        headers:
+          content-type: "application/json"
+        body_format: json
+        body:
+          properties:
+            content_type: "application/json"
+          routing_key: "{{ control_queue }}"
+          payload: "{{ tcp_fail_payload | to_json }}"
+          payload_encoding: "string"
+      register: rmq_tcp_fail_resp
+      changed_when: (rmq_tcp_fail_resp.json is defined) and (rmq_tcp_fail_resp.json.routed | default(false) | bool)
+
+    - name: Stop host after TCP failure
+      when: nc_probe.rc != 0
+      ansible.builtin.meta: end_host
+
+    # -------- SSH banner probe (controller-side), EXACT command reused --------
+    - name: Probe banner via SSH from controller (classic extraction)
+      delegate_to: localhost
+      ansible.builtin.shell: |
+        set -e
+        USER="{{ ssh_user }}"
+        HOST="{{ ansible_host | default(inventory_hostname) }}"
+        sshpass -p '{{ ssh_pass }}' \
+        ssh -o StrictHostKeyChecking=no -o PubkeyAuthentication=no -o ConnectTimeout={{ ssh_timeout }} \
+          "${USER}@${HOST}" \
+          "PATH=/sbin:/usr/sbin:/bin:/usr/bin:$PATH; cat /etc/banner | grep -i rev | head -n1"
+      register: banner_probe
+      changed_when: false
+      ignore_errors: true
+
+    # SSH error → journal and stop
+    - name: Build SSH-fail journal payload
+      when: banner_probe.rc != 0
+      delegate_to: localhost
+      ansible.builtin.set_fact:
+        ssh_fail_payload:
+          inscope_device: "{{ ansible_hostname | default(inventory_hostname) }}"
+          task_name: "journal_add"
+          task_result: >-
+            system check: SSH error - {{ (banner_probe.stderr | default('') | trim) }}
+
+    - name: Publish SSH-fail journal
+      when: ssh_fail_payload is defined
+      delegate_to: localhost
+      ansible.builtin.uri:
+        url: "http://{{ rmq_host }}:{{ rmq_port }}/api/exchanges/{{ rmq_vhost | urlencode }}/{{ rmq_exchange | urlencode }}/publish"
+        method: POST
+        user: "{{ rmq_user }}"
+        password: "{{ rmq_pass }}"
+        force_basic_auth: true
+        status_code: 200
+        headers:
+          content-type: "application/json"
+        body_format: json
+        body:
+          properties:
+            content_type: "application/json"
+          routing_key: "{{ control_queue }}"
+          payload: "{{ ssh_fail_payload | to_json }}"
+          payload_encoding: "string"
+      register: rmq_ssh_fail_resp
+      changed_when: (rmq_ssh_fail_resp.json is defined) and (rmq_ssh_fail_resp.json.routed | default(false) | bool)
+
+    - name: Stop host after SSH failure
+      when: banner_probe.rc != 0
+      ansible.builtin.meta: end_host
+
+    # -------- Success: banner line captured → journal with "system check:" prefix --------
+    - name: Build success journal payload (banner captured)
+      delegate_to: localhost
+      ansible.builtin.set_fact:
+        sc_success_payload:
+          inscope_device: "{{ ansible_hostname | default(inventory_hostname) }}"
+          task_name: "journal_add"
+          task_result: >-
+            system check: Banner='{{ (banner_probe.stdout | default('') | trim) }}'
+
+    - name: Publish success journal
+      delegate_to: localhost
+      ansible.builtin.uri:
+        url: "http://{{ rmq_host }}:{{ rmq_port }}/api/exchanges/{{ rmq_vhost | urlencode }}/{{ rmq_exchange | urlencode }}/publish"
+        method: POST
+        user: "{{ rmq_user }}"
+        password: "{{ rmq_pass }}"
+        force_basic_auth: true
+        status_code: 200
+        headers:
+          content-type: "application/json"
+        body_format: json
+        body:
+          properties:
+            content_type: "application/json"
+          routing_key: "{{ control_queue }}"
+          payload: "{{ sc_success_payload | to_json }}"
+          payload_encoding: "string"
+      register: rmq_sc_success_resp
+      changed_when: (rmq_sc_success_resp.json is defined) and (rmq_sc_success_resp.json.routed | default(false) | bool)
+