From 4f5f51c59d49bdbad053471a8c9f5d162800fe05 Mon Sep 17 00:00:00 2001
From: pavel <pavel.larkin@ikeja.co.za>
Date: Fri, 7 Nov 2025 07:23:39 +0200
Subject: [PATCH] 07:23

---
 files/ansible-playbooks/sot-updater.yml | 52 ++++++++++++-------------
 1 file changed, 25 insertions(+), 27 deletions(-)

diff --git a/files/ansible-playbooks/sot-updater.yml b/files/ansible-playbooks/sot-updater.yml
index 4769ee2..dba4abf 100644
--- a/files/ansible-playbooks/sot-updater.yml
+++ b/files/ansible-playbooks/sot-updater.yml
@@ -380,33 +380,6 @@
       set_fact:
         tunnel_ok: "{{ nc_probe.rc == 0 }}"
 
-    # ----------------------- Fallback hint: LLDP IP debug when tunnel is down -----------------------
-    - name: Dev1 | Try LLDP-derived Dev2 IP (tunnel unavailable)
-      when: not (tunnel_ok | default(false))
-      delegate_to: localhost
-      shell: |
-        DIGITS="{{ inventory_hostname | regex_replace('[^0-9]', '') }}"
-        sshpass -p '{{ dev1_pass }}' ssh {{ ssh_opts_common }} \
-        "{{ dev1_user }}@{{ ansible_host|default(inventory_hostname) }}" \
-        "cat /var/run/lldp_server.json 2>/dev/null | grep ${DIGITS} -A 10 | grep address | grep -vE 'subtype|ipv6' | awk -F'\"' '{ print \$4 }' | head -n1"
-      register: lldp_ip_raw
-      changed_when: false
-      failed_when: false
-      ignore_errors: true
-
-    - name: Dev1 | Debug LLDP candidate IP for Dev2
-      when: not (tunnel_ok | default(false))
-      delegate_to: localhost
-      set_fact:
-        lldp_dev2_ip: "{{ lldp_ip_raw.stdout | default('') | trim }}"
-
-    - name: Dev1 | Show LLDP candidate IP (Dev2)
-      when: not (tunnel_ok | default(false))
-      delegate_to: localhost
-      debug:
-        msg:
-          - "LLDP-derived Dev2 IP (best-effort): {{ (lldp_dev2_ip | default('') | trim) if (lldp_dev2_ip | default('') | trim | length) > 0 else '<none>' }}"
-
     # ----------------------- Dev1 banner -----------------------
     - name: Dev1 | Probe banner
       delegate_to: localhost
@@ -543,6 +516,31 @@
       set_fact:
         dev2_passfile_used: "{{ (dev2_auth.rc == 0)|ternary(dev2_auth.stdout|trim,'NONE') }}"
 
+    # ------ New: LLDP candidate IP when Dev2 login failed (tunnel up but Dev2 unreachable) ------
+    - name: Dev1 | Try LLDP-derived Dev2 IP (auth to Dev2 failed)
+      when:
+        - tunnel_ok | default(false)
+        - dev2_passfile_used == 'NONE'
+      delegate_to: localhost
+      shell: |
+        DIGITS="{{ inventory_hostname | regex_replace('[^0-9]', '') }}"
+        sshpass -p '{{ dev1_pass }}' ssh {{ ssh_opts_common }} \
+        "{{ dev1_user }}@{{ ansible_host|default(inventory_hostname) }}" \
+        "cat /var/run/lldp_server.json 2>/dev/null | grep ${DIGITS} -A 10 | grep address | grep -vE 'subtype|ipv6' | awk -F'\"' '{ print \$4 }' | head -n1"
+      register: lldp_ip_raw
+      changed_when: false
+      failed_when: false
+      ignore_errors: true
+
+    - name: Dev1 | Show LLDP candidate IP (Dev2, after SSH auth failure)
+      when:
+        - tunnel_ok | default(false)
+        - dev2_passfile_used == 'NONE'
+      delegate_to: localhost
+      debug:
+        msg:
+          - "LLDP-derived Dev2 IP (best-effort): {{ (lldp_ip_raw.stdout | default('') | trim) if ((lldp_ip_raw.stdout | default('') | trim | length) > 0) else '<none>' }}"
+
     - name: Dev2 | Read firmux
       when: tunnel_ok|default(false) and dev2_passfile_used != 'NONE'
       delegate_to: localhost