pavel/ansible-worker
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

1015

Browse Source
This commit is contained in:
pavel
2026-01-20 10:15:46 +02:00
parent 1d269d343f
commit 11d26572cf
1 changed files with 19 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files

55
files/ansible-playbooks/ptsd-migrate.yml
View File

@@ -1,39 +1,31 @@
# ptsd-migration.yml — PPPoE to super DHCP
# Phase 0: connectivity + safe identity guard
# Phase 1: wrapper (no device changes yet; uptime will be introduced later)
# Phase 1: wrapper only (no device commands yet)
- name: "PPPoE to super DHCP | Phase 0+1 | Reliable DEV2 connectivity + wrapper"
hosts: all
gather_facts: no
vars:
# Busybox-safe PATH prefix for all remote raw calls on DEV1 / DEV2
pathprefix: "PATH=/sbin:/usr/sbin:/bin:/usr/bin:$PATH; "
# DEV1 credentials
dev1_user: "root"
dev1_pass: "wavewave"
# DEV2 behind DEV1 (default tunnel target; may be overridden by LLDP 192.168.*)
dev2_host: "192.168.1.1"
dev2_port: 22
# Temp IP we add to DEV1 so it can reach DEV2
dev2_side_ip: "192.168.1.11/24"
dev2_side_ip_addr: "{{ dev2_side_ip.split('/')[0] }}"
dev1_iface: "br-wan"
# ARP refresh interface (as in sot-updater)
arping_iface: "eth0"
# DEV2 login candidates
dev2_ssh_user: "root"
dev2_passfiles:
- "basicpass"
- "basicpass2"
# SSH options used from controller
# LogLevel=ERROR is critical: suppresses hostkey "Permanently added..." lines that poison parsing.
ssh_opts_common: >-
-o PreferredAuthentications=password
-o PubkeyAuthentication=no
@@ -44,13 +36,19 @@
-o ConnectionAttempts=1
-o LogLevel=ERROR
# Debugging toggle
debugging: true
# ssh timeout for nested / probes
ssh_timeout: 30
pre_tasks:
- name: Initialize passfile facts defensively (avoid undefined vars later)
delegate_to: localhost
ansible.builtin.set_fact:
dev2_passfile_used_direct: "NONE"
dev2_passfile_used_tunnel: "NONE"
dev2_passfile_used_lldp4: "NONE"
dev2_passfile_used_lldp6: "NONE"
changed_when: false
- name: Read DEV1 hostname (busybox-safe)
ansible.builtin.raw: >
{{ pathprefix }}
@@ -124,7 +122,7 @@
- "LLDP IPv4 class={{ lldp_ip_class | default('none') }}"
- "LLDP IPv6 candidate={{ lldp_dev2_ip6 | default('<none>') }}"
# ============================ PRIMARY PATH DECISION (same as indoor-restart-cloudagent) ============================
# ============================ PRIMARY PATH DECISION ============================
- name: Override dev2_host from LLDP when candidate is 192.168.x.x
when: (lldp_ip_class | trim) == "192_168" and (lldp_dev2_ip | trim | length > 0)
delegate_to: localhost
@@ -161,7 +159,7 @@
changed_when: false
- name: Try DEV2 login via direct LLDP IPv4 (10.x) with basicpass2 (only if first failed)
when: dev2_conn_method == "direct_lldp" and (dev2_passfile_used_direct is not defined)
when: dev2_conn_method == "direct_lldp" and (dev2_passfile_used_direct == "NONE")
delegate_to: localhost
ansible.builtin.shell: |
set -e
@@ -175,19 +173,12 @@
ignore_errors: true
- name: Select basicpass2 for direct LLDP if succeeded
when: dev2_conn_method == "direct_lldp" and dev2_passfile_used_direct is not defined and dev2_lldp_try_basicpass2.rc == 0
when: dev2_conn_method == "direct_lldp" and dev2_passfile_used_direct == "NONE" and dev2_lldp_try_basicpass2.rc == 0
delegate_to: localhost
ansible.builtin.set_fact:
dev2_passfile_used_direct: "basicpass2"
changed_when: false
- name: Mark direct LLDP auth as NONE if both failed
when: dev2_conn_method == "direct_lldp" and dev2_passfile_used_direct is not defined
delegate_to: localhost
ansible.builtin.set_fact:
dev2_passfile_used_direct: "NONE"
changed_when: false
# ============================ TUNNEL PREP (DEV1 temp IP + ARP + tunnel) ============================
- name: Add temporary IP on DEV1 (tolerate 'File exists')
when: dev2_conn_method == "tunnel"
@@ -342,7 +333,7 @@
changed_when: false
- name: Try DEV2 login through tunnel with basicpass2 (only if first failed)
when: dev2_conn_method == "tunnel" and (dev2_passfile_used_tunnel is not defined)
when: dev2_conn_method == "tunnel" and (dev2_passfile_used_tunnel == "NONE")
delegate_to: localhost
ansible.builtin.shell: |
set -e
@@ -356,19 +347,12 @@
ignore_errors: true
- name: Select basicpass2 if tunnel login succeeded
when: dev2_conn_method == "tunnel" and dev2_passfile_used_tunnel is not defined and dev2_try_basicpass2.rc == 0
when: dev2_conn_method == "tunnel" and dev2_passfile_used_tunnel == "NONE" and dev2_try_basicpass2.rc == 0
delegate_to: localhost
ansible.builtin.set_fact:
dev2_passfile_used_tunnel: "basicpass2"
changed_when: false
- name: Mark tunnel auth as NONE if both attempts failed
when: dev2_conn_method == "tunnel" and dev2_passfile_used_tunnel is not defined
delegate_to: localhost
ansible.builtin.set_fact:
dev2_passfile_used_tunnel: "NONE"
changed_when: false
# ============================ SAFETY GUARD: MAC CHECK (only if tunnel auth succeeded) ============================
- name: Read remote eth0 MAC via tunnel (guard, sanitized)
when:
@@ -418,7 +402,7 @@
Safety stop: tunnel reached wrong device.
expected_dev2_mac={{ dev2_mac }}, remote_eth0_mac={{ remote_eth0_mac }}
# ============================ FALLBACKS (only if tunnel/direct failed) ============================
# ============================ FALLBACKS (only if tunnel auth failed) ============================
- name: Try DEV2 login via LLDP IPv4 10.x (fallback if tunnel auth failed)
when:
- dev2_conn_method == "tunnel"
@@ -457,7 +441,7 @@
when:
- dev2_conn_method == "tunnel"
- dev2_passfile_used_tunnel == "NONE"
- (dev2_passfile_used_lldp4 is not defined or dev2_passfile_used_lldp4 == "NONE")
- dev2_passfile_used_lldp4 == "NONE"
- (lldp_dev2_ip6 | default('') | length) > 0
ansible.builtin.copy:
src: "{{ item }}"
@@ -470,7 +454,7 @@
when:
- dev2_conn_method == "tunnel"
- dev2_passfile_used_tunnel == "NONE"
- (dev2_passfile_used_lldp4 is not defined or dev2_passfile_used_lldp4 == "NONE")
- dev2_passfile_used_lldp4 == "NONE"
- (lldp_dev2_ip6 | default('') | length) > 0
delegate_to: localhost
ansible.builtin.shell: |
@@ -500,7 +484,7 @@
when:
- dev2_conn_method == "tunnel"
- dev2_passfile_used_tunnel == "NONE"
- (dev2_passfile_used_lldp4 is not defined or dev2_passfile_used_lldp4 == "NONE")
- dev2_passfile_used_lldp4 == "NONE"
- (lldp_dev2_ip6 | default('') | length) > 0
delegate_to: localhost
ansible.builtin.set_fact:
@@ -548,7 +532,6 @@
- "lldp ipv4={{ lldp_dev2_ip | default('') }}"
- "lldp ipv6={{ lldp_dev2_ip6 | default('') }}"
# ---- Wrapper: produce a single executable snippet in dev2_exec_cmd (for Phase 1 commands later) ----
- name: Build DEV2 exec wrapper (controller-side) for Phase 1 commands
delegate_to: localhost
ansible.builtin.set_fact: