From 11d26572cf1ca04bfc7ac34e27bde9a22aaad9c9 Mon Sep 17 00:00:00 2001 From: pavel Date: Tue, 20 Jan 2026 10:15:46 +0200 Subject: [PATCH] 1015 --- files/ansible-playbooks/ptsd-migrate.yml | 55 ++++++++---------------- 1 file changed, 19 insertions(+), 36 deletions(-) diff --git a/files/ansible-playbooks/ptsd-migrate.yml b/files/ansible-playbooks/ptsd-migrate.yml index 267172d..fefdc52 100644 --- a/files/ansible-playbooks/ptsd-migrate.yml +++ b/files/ansible-playbooks/ptsd-migrate.yml @@ -1,39 +1,31 @@ # ptsd-migration.yml — PPPoE to super DHCP # Phase 0: connectivity + safe identity guard -# Phase 1: wrapper (no device changes yet; uptime will be introduced later) +# Phase 1: wrapper only (no device commands yet) - name: "PPPoE to super DHCP | Phase 0+1 | Reliable DEV2 connectivity + wrapper" hosts: all gather_facts: no vars: - # Busybox-safe PATH prefix for all remote raw calls on DEV1 / DEV2 pathprefix: "PATH=/sbin:/usr/sbin:/bin:/usr/bin:$PATH; " - # DEV1 credentials dev1_user: "root" dev1_pass: "wavewave" - # DEV2 behind DEV1 (default tunnel target; may be overridden by LLDP 192.168.*) dev2_host: "192.168.1.1" dev2_port: 22 - # Temp IP we add to DEV1 so it can reach DEV2 dev2_side_ip: "192.168.1.11/24" dev2_side_ip_addr: "{{ dev2_side_ip.split('/')[0] }}" dev1_iface: "br-wan" - # ARP refresh interface (as in sot-updater) arping_iface: "eth0" - # DEV2 login candidates dev2_ssh_user: "root" dev2_passfiles: - "basicpass" - "basicpass2" - # SSH options used from controller - # LogLevel=ERROR is critical: suppresses hostkey "Permanently added..." lines that poison parsing. ssh_opts_common: >- -o PreferredAuthentications=password -o PubkeyAuthentication=no @@ -44,13 +36,19 @@ -o ConnectionAttempts=1 -o LogLevel=ERROR - # Debugging toggle debugging: true - - # ssh timeout for nested / probes ssh_timeout: 30 pre_tasks: + - name: Initialize passfile facts defensively (avoid undefined vars later) + delegate_to: localhost + ansible.builtin.set_fact: + dev2_passfile_used_direct: "NONE" + dev2_passfile_used_tunnel: "NONE" + dev2_passfile_used_lldp4: "NONE" + dev2_passfile_used_lldp6: "NONE" + changed_when: false + - name: Read DEV1 hostname (busybox-safe) ansible.builtin.raw: > {{ pathprefix }} @@ -124,7 +122,7 @@ - "LLDP IPv4 class={{ lldp_ip_class | default('none') }}" - "LLDP IPv6 candidate={{ lldp_dev2_ip6 | default('') }}" - # ============================ PRIMARY PATH DECISION (same as indoor-restart-cloudagent) ============================ + # ============================ PRIMARY PATH DECISION ============================ - name: Override dev2_host from LLDP when candidate is 192.168.x.x when: (lldp_ip_class | trim) == "192_168" and (lldp_dev2_ip | trim | length > 0) delegate_to: localhost @@ -161,7 +159,7 @@ changed_when: false - name: Try DEV2 login via direct LLDP IPv4 (10.x) with basicpass2 (only if first failed) - when: dev2_conn_method == "direct_lldp" and (dev2_passfile_used_direct is not defined) + when: dev2_conn_method == "direct_lldp" and (dev2_passfile_used_direct == "NONE") delegate_to: localhost ansible.builtin.shell: | set -e @@ -175,19 +173,12 @@ ignore_errors: true - name: Select basicpass2 for direct LLDP if succeeded - when: dev2_conn_method == "direct_lldp" and dev2_passfile_used_direct is not defined and dev2_lldp_try_basicpass2.rc == 0 + when: dev2_conn_method == "direct_lldp" and dev2_passfile_used_direct == "NONE" and dev2_lldp_try_basicpass2.rc == 0 delegate_to: localhost ansible.builtin.set_fact: dev2_passfile_used_direct: "basicpass2" changed_when: false - - name: Mark direct LLDP auth as NONE if both failed - when: dev2_conn_method == "direct_lldp" and dev2_passfile_used_direct is not defined - delegate_to: localhost - ansible.builtin.set_fact: - dev2_passfile_used_direct: "NONE" - changed_when: false - # ============================ TUNNEL PREP (DEV1 temp IP + ARP + tunnel) ============================ - name: Add temporary IP on DEV1 (tolerate 'File exists') when: dev2_conn_method == "tunnel" @@ -342,7 +333,7 @@ changed_when: false - name: Try DEV2 login through tunnel with basicpass2 (only if first failed) - when: dev2_conn_method == "tunnel" and (dev2_passfile_used_tunnel is not defined) + when: dev2_conn_method == "tunnel" and (dev2_passfile_used_tunnel == "NONE") delegate_to: localhost ansible.builtin.shell: | set -e @@ -356,19 +347,12 @@ ignore_errors: true - name: Select basicpass2 if tunnel login succeeded - when: dev2_conn_method == "tunnel" and dev2_passfile_used_tunnel is not defined and dev2_try_basicpass2.rc == 0 + when: dev2_conn_method == "tunnel" and dev2_passfile_used_tunnel == "NONE" and dev2_try_basicpass2.rc == 0 delegate_to: localhost ansible.builtin.set_fact: dev2_passfile_used_tunnel: "basicpass2" changed_when: false - - name: Mark tunnel auth as NONE if both attempts failed - when: dev2_conn_method == "tunnel" and dev2_passfile_used_tunnel is not defined - delegate_to: localhost - ansible.builtin.set_fact: - dev2_passfile_used_tunnel: "NONE" - changed_when: false - # ============================ SAFETY GUARD: MAC CHECK (only if tunnel auth succeeded) ============================ - name: Read remote eth0 MAC via tunnel (guard, sanitized) when: @@ -418,7 +402,7 @@ Safety stop: tunnel reached wrong device. expected_dev2_mac={{ dev2_mac }}, remote_eth0_mac={{ remote_eth0_mac }} - # ============================ FALLBACKS (only if tunnel/direct failed) ============================ + # ============================ FALLBACKS (only if tunnel auth failed) ============================ - name: Try DEV2 login via LLDP IPv4 10.x (fallback if tunnel auth failed) when: - dev2_conn_method == "tunnel" @@ -457,7 +441,7 @@ when: - dev2_conn_method == "tunnel" - dev2_passfile_used_tunnel == "NONE" - - (dev2_passfile_used_lldp4 is not defined or dev2_passfile_used_lldp4 == "NONE") + - dev2_passfile_used_lldp4 == "NONE" - (lldp_dev2_ip6 | default('') | length) > 0 ansible.builtin.copy: src: "{{ item }}" @@ -470,7 +454,7 @@ when: - dev2_conn_method == "tunnel" - dev2_passfile_used_tunnel == "NONE" - - (dev2_passfile_used_lldp4 is not defined or dev2_passfile_used_lldp4 == "NONE") + - dev2_passfile_used_lldp4 == "NONE" - (lldp_dev2_ip6 | default('') | length) > 0 delegate_to: localhost ansible.builtin.shell: | @@ -500,7 +484,7 @@ when: - dev2_conn_method == "tunnel" - dev2_passfile_used_tunnel == "NONE" - - (dev2_passfile_used_lldp4 is not defined or dev2_passfile_used_lldp4 == "NONE") + - dev2_passfile_used_lldp4 == "NONE" - (lldp_dev2_ip6 | default('') | length) > 0 delegate_to: localhost ansible.builtin.set_fact: @@ -548,7 +532,6 @@ - "lldp ipv4={{ lldp_dev2_ip | default('') }}" - "lldp ipv6={{ lldp_dev2_ip6 | default('') }}" - # ---- Wrapper: produce a single executable snippet in dev2_exec_cmd (for Phase 1 commands later) ---- - name: Build DEV2 exec wrapper (controller-side) for Phase 1 commands delegate_to: localhost ansible.builtin.set_fact: