pavel/ansible-worker
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

0937

Browse Source
This commit is contained in:
pavel
2026-01-20 09:37:24 +02:00
parent 0edc30dffc
commit 56a1abb898
1 changed files with 45 additions and 64 deletions
Download Patch File Download Diff File Expand all files Collapse all files

109
files/ansible-playbooks/ptsd-migrate.yml
View File

@@ -1,10 +1,10 @@
# ptsd-migration.yml — PPPoE to super DHCP (phase 0: connectivity prove-out) # ptsd-migration.yml — PPPoE to super DHCP (phase 0: connectivity prove-out)
# Goal: reliably connect to DEV2 using: # Focus: reliable connectivity to DEV2
# 1) direct LLDP IPv4 (10.x) if available and auth works # Paths:
# 2) tunnel via DEV1 (default / primary) # A) direct LLDP IPv4 (10.x) if available and auth works
# 3) LLDP IPv4 (10.x) fallback if tunnel auth fails # B) tunnel via DEV1 (default)
# 4) LLDP IPv6 fallback via DEV1 (nested ssh to [ip6%iface]) if all else fails # C) LLDP IPv4 (10.x) fallback if tunnel auth fails
# # D) LLDP IPv6 fallback via DEV1 (nested ssh to [ip6%iface]) if all else fails
# After connection: run "uptime" on DEV2 and print it. # After connection: run "uptime" on DEV2 and print it.
- name: PPPoE to super DHCP | Phase 0 | Prove reliable DEV2 connectivity + uptime - name: PPPoE to super DHCP | Phase 0 | Prove reliable DEV2 connectivity + uptime
@@ -12,30 +12,26 @@
gather_facts: no gather_facts: no
vars: vars:
# Busybox-safe PATH prefix for all DEV1 raw calls
pathprefix: "PATH=/sbin:/usr/sbin:/bin:/usr/bin:$PATH; " pathprefix: "PATH=/sbin:/usr/sbin:/bin:/usr/bin:$PATH; "
# DEV1 credentials # DEV1 credentials
dev1_user: "root" dev1_user: "root"
dev1_pass: "wavewave" dev1_pass: "wavewave"
# DEV2 "default" behind DEV1 # DEV2 default behind DEV1
dev2_host: "192.168.1.1" dev2_host: "192.168.1.1"
dev2_port: 22 dev2_port: 22
# Temp IP we add to DEV1 so it can reach DEV2 # Temp IP we add to DEV1 so it can reach DEV2
dev2_side_ip: "192.168.1.11/24" dev2_side_ip: "192.168.1.11/24"
dev2_side_ip_addr: "{{ dev2_side_ip.split('/')[0] }}" dev2_side_ip_addr: "{{ dev2_side_ip.split('/')[0] }}"
dev1_iface: "br-wan" # used for temp IP, ARP, and IPv6 scope-id (link-local) dev1_iface: "br-wan" # also used as IPv6 scope-id
arping_iface: "eth0" # optional refresh on DEV1 arping_iface: "eth0"
# DEV2 credentials # DEV2 credentials
dev2_ssh_user: "root" dev2_ssh_user: "root"
dev2_passfiles: dev2_passfiles: [ "basicpass", "basicpass2" ]
- "basicpass"
- "basicpass2"
# SSH options used from controller (and outer hop to DEV1)
ssh_opts_common: >- ssh_opts_common: >-
-o PreferredAuthentications=password -o PreferredAuthentications=password
-o PubkeyAuthentication=no -o PubkeyAuthentication=no
@@ -44,19 +40,15 @@
-o NumberOfPasswordPrompts=1 -o NumberOfPasswordPrompts=1
-o ConnectTimeout=30 -o ConnectTimeout=30
# Debug toggle
debugging: true debugging: true
# Final connection outputs (set dynamically) # Connection state
dev2_conn_method: "" dev2_conn_method: ""
dev2_passfile_used: "NONE" # for tunnel or direct-lldp dev2_passfile_used: "NONE" # tunnel or direct_lldp primary
dev2_passfile_used_lldp: "NONE" # for direct LLDP IPv4 fallback dev2_passfile_used_lldp: "NONE" # LLDP IPv4 fallback
dev2_passfile_used_lldp6: "NONE" # for IPv6 via DEV1 fallback dev2_passfile_used_lldp6: "NONE" # LLDP IPv6 via DEV1 fallback
dev2_ssh_host: ""
dev2_ssh_port: ""
pre_tasks: pre_tasks:
# ------------------------------- DEV1 hostname sanity -------------------------------
- name: Read DEV1 hostname (busybox-safe) - name: Read DEV1 hostname (busybox-safe)
ansible.builtin.raw: > ansible.builtin.raw: >
{{ pathprefix }} {{ pathprefix }}
@@ -130,7 +122,6 @@
- "LLDP IPv4 class={{ lldp_ip_class | default('none') }}" - "LLDP IPv4 class={{ lldp_ip_class | default('none') }}"
- "LLDP IPv6 candidate={{ lldp_dev2_ip6 | default('<none>') }}" - "LLDP IPv6 candidate={{ lldp_dev2_ip6 | default('<none>') }}"
# -------------------- If LLDP shows 192.168.x, override dev2_host for tunnel target --------------------
- name: Override dev2_host from LLDP when candidate is 192.168.x.x - name: Override dev2_host from LLDP when candidate is 192.168.x.x
when: (lldp_ip_class | trim) == "192_168" and (lldp_dev2_ip | trim | length > 0) when: (lldp_ip_class | trim) == "192_168" and (lldp_dev2_ip | trim | length > 0)
delegate_to: localhost delegate_to: localhost
@@ -138,7 +129,7 @@
dev2_host: "{{ lldp_dev2_ip | trim }}" dev2_host: "{{ lldp_dev2_ip | trim }}"
changed_when: false changed_when: false
# ============================ PATH 1: DIRECT LLDP IPv4 (10.x) IF IT WORKS ============================ # ============================ PATH A: DIRECT LLDP IPv4 (10.x) PRIMARY ============================
- name: Try DEV2 login via direct LLDP IPv4 (10.x) with basicpass - name: Try DEV2 login via direct LLDP IPv4 (10.x) with basicpass
when: (lldp_ip_class | trim) == "10" when: (lldp_ip_class | trim) == "10"
delegate_to: localhost delegate_to: localhost
@@ -151,8 +142,7 @@
-o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \ -o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \
-o ConnectTimeout=30 \ -o ConnectTimeout=30 \
"{{ dev2_ssh_user }}@${HOST}" echo OK >/dev/null 2>&1 "{{ dev2_ssh_user }}@${HOST}" echo OK >/dev/null 2>&1
args: args: { executable: /bin/bash }
executable: /bin/bash
register: direct_lldp_try_basicpass register: direct_lldp_try_basicpass
changed_when: false changed_when: false
ignore_errors: true ignore_errors: true
@@ -179,8 +169,7 @@
-o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \ -o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \
-o ConnectTimeout=30 \ -o ConnectTimeout=30 \
"{{ dev2_ssh_user }}@${HOST}" echo OK >/dev/null 2>&1 "{{ dev2_ssh_user }}@${HOST}" echo OK >/dev/null 2>&1
args: args: { executable: /bin/bash }
executable: /bin/bash
register: direct_lldp_try_basicpass2 register: direct_lldp_try_basicpass2
changed_when: false changed_when: false
ignore_errors: true ignore_errors: true
@@ -195,7 +184,7 @@
dev2_ssh_port: 22 dev2_ssh_port: 22
changed_when: false changed_when: false
# ============================ PATH 2: TUNNEL VIA DEV1 (PRIMARY DEFAULT) ============================ # ============================ PATH B: TUNNEL VIA DEV1 (DEFAULT) ============================
- name: Set connection method to tunnel if not already direct LLDP - name: Set connection method to tunnel if not already direct LLDP
when: dev2_conn_method != "direct_lldp" when: dev2_conn_method != "direct_lldp"
delegate_to: localhost delegate_to: localhost
@@ -279,8 +268,7 @@
return 1 return 1
} }
pick pick
args: args: { executable: /bin/bash }
executable: /bin/bash
register: pick_port register: pick_port
changed_when: false changed_when: false
@@ -288,13 +276,21 @@
when: dev2_conn_method == "tunnel" and (pick_port.stdout | trim | length) == 0 when: dev2_conn_method == "tunnel" and (pick_port.stdout | trim | length) == 0
ansible.builtin.meta: end_host ansible.builtin.meta: end_host
- name: Record chosen local port and create control dir for SSH ControlMaster # ---- FIX: create ctrl dir first, then derive sock ----
- name: Create control dir for SSH ControlMaster
when: dev2_conn_method == "tunnel"
delegate_to: localhost
ansible.builtin.set_fact:
_ctrl_dir: "{{ lookup('ansible.builtin.pipe', 'mktemp -d') }}"
changed_when: false
- name: Record chosen local port and build ControlMaster socket path
when: dev2_conn_method == "tunnel" when: dev2_conn_method == "tunnel"
delegate_to: localhost delegate_to: localhost
ansible.builtin.set_fact: ansible.builtin.set_fact:
_local_port: "{{ pick_port.stdout | trim }}" _local_port: "{{ pick_port.stdout | trim }}"
_ctrl_dir: "{{ lookup('ansible.builtin.pipe', 'mktemp -d') }}"
_ctrl_sock: "{{ _ctrl_dir }}/ssh_tunnel_ctl" _ctrl_sock: "{{ _ctrl_dir }}/ssh_tunnel_ctl"
changed_when: false
- name: Start SSH ControlMaster and forward 127.0.0.1:local_port → DEV2:22 via DEV1 - name: Start SSH ControlMaster and forward 127.0.0.1:local_port → DEV2:22 via DEV1
when: dev2_conn_method == "tunnel" when: dev2_conn_method == "tunnel"
@@ -307,8 +303,7 @@
-M -S "{{ _ctrl_sock }}" \ -M -S "{{ _ctrl_sock }}" \
-L "127.0.0.1:{{ _local_port }}:{{ dev2_host }}:{{ dev2_port }}" \ -L "127.0.0.1:{{ _local_port }}:{{ dev2_host }}:{{ dev2_port }}" \
"${USER}@${HOST}" "${USER}@${HOST}"
args: args: { executable: /bin/bash }
executable: /bin/bash
register: start_tunnel register: start_tunnel
changed_when: true changed_when: true
@@ -318,8 +313,7 @@
ansible.builtin.shell: | ansible.builtin.shell: |
set -e set -e
nc -z -w5 127.0.0.1 "{{ _local_port }}" nc -z -w5 127.0.0.1 "{{ _local_port }}"
args: args: { executable: /bin/bash }
executable: /bin/bash
register: nc_probe register: nc_probe
changed_when: false changed_when: false
ignore_errors: true ignore_errors: true
@@ -340,8 +334,7 @@
-o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \ -o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \
-o ConnectTimeout=30 \ -o ConnectTimeout=30 \
-p "$PORT" "{{ dev2_ssh_user }}@127.0.0.1" echo OK >/dev/null 2>&1 -p "$PORT" "{{ dev2_ssh_user }}@127.0.0.1" echo OK >/dev/null 2>&1
args: args: { executable: /bin/bash }
executable: /bin/bash
register: dev2_try_basicpass register: dev2_try_basicpass
changed_when: false changed_when: false
ignore_errors: true ignore_errors: true
@@ -367,8 +360,7 @@
-o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \ -o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \
-o ConnectTimeout=30 \ -o ConnectTimeout=30 \
-p "$PORT" "{{ dev2_ssh_user }}@127.0.0.1" echo OK >/dev/null 2>&1 -p "$PORT" "{{ dev2_ssh_user }}@127.0.0.1" echo OK >/dev/null 2>&1
args: args: { executable: /bin/bash }
executable: /bin/bash
register: dev2_try_basicpass2 register: dev2_try_basicpass2
changed_when: false changed_when: false
ignore_errors: true ignore_errors: true
@@ -382,7 +374,6 @@
dev2_ssh_port: "{{ _local_port }}" dev2_ssh_port: "{{ _local_port }}"
changed_when: false changed_when: false
# -------------------- Safety guard: validate tunnel reached correct device by MAC (if discovered) --------------------
- name: Read remote eth0 MAC via tunnel (guard) - name: Read remote eth0 MAC via tunnel (guard)
when: dev2_conn_method == "tunnel" and dev2_passfile_used != "NONE" and (dev2_mac | default('') | trim | length > 0) when: dev2_conn_method == "tunnel" and dev2_passfile_used != "NONE" and (dev2_mac | default('') | trim | length > 0)
delegate_to: localhost delegate_to: localhost
@@ -396,8 +387,7 @@
-o ConnectTimeout=30 \ -o ConnectTimeout=30 \
-p "$PORT" "{{ dev2_ssh_user }}@127.0.0.1" \ -p "$PORT" "{{ dev2_ssh_user }}@127.0.0.1" \
"cat /sys/class/net/eth0/address 2>/dev/null || echo" "cat /sys/class/net/eth0/address 2>/dev/null || echo"
args: args: { executable: /bin/bash }
executable: /bin/bash
register: dev2_eth0_mac_read register: dev2_eth0_mac_read
changed_when: false changed_when: false
failed_when: false failed_when: false
@@ -411,7 +401,7 @@
expected_dev2_mac={{ dev2_mac | trim }}, expected_dev2_mac={{ dev2_mac | trim }},
remote_eth0_mac={{ dev2_eth0_mac_read.stdout | default('') | trim }}. remote_eth0_mac={{ dev2_eth0_mac_read.stdout | default('') | trim }}.
# ============================ FALLBACK 3: DIRECT LLDP IPv4 (10.x) IF TUNNEL AUTH FAILED ============================ # ============================ FALLBACK C: DIRECT LLDP IPv4 (10.x) ============================
- name: Try DEV2 login via LLDP IPv4 10.x (fallback if tunnel auth failed) - name: Try DEV2 login via LLDP IPv4 10.x (fallback if tunnel auth failed)
when: when:
- dev2_conn_method == "tunnel" - dev2_conn_method == "tunnel"
@@ -432,8 +422,7 @@
fi fi
done done
exit 1 exit 1
args: args: { executable: /bin/bash }
executable: /bin/bash
register: dev2_auth_lldp register: dev2_auth_lldp
changed_when: false changed_when: false
ignore_errors: true ignore_errors: true
@@ -448,7 +437,7 @@
dev2_passfile_used_lldp: "{{ (dev2_auth_lldp.rc == 0) | ternary((dev2_auth_lldp.stdout | trim), 'NONE') }}" dev2_passfile_used_lldp: "{{ (dev2_auth_lldp.rc == 0) | ternary((dev2_auth_lldp.stdout | trim), 'NONE') }}"
changed_when: false changed_when: false
# ============================ FALLBACK 4: IPv6 LLDP VIA DEV1 (LAST RESORT) ============================ # ============================ FALLBACK D: IPv6 LLDP VIA DEV1 (LAST RESORT) ============================
- name: Copy DEV2 passfiles to DEV1 for IPv6 nested SSH (last resort) - name: Copy DEV2 passfiles to DEV1 for IPv6 nested SSH (last resort)
when: when:
- dev2_conn_method == "tunnel" - dev2_conn_method == "tunnel"
@@ -486,8 +475,7 @@
fi fi
done done
exit 1 exit 1
args: args: { executable: /bin/bash }
executable: /bin/bash
register: dev2_auth_lldp6 register: dev2_auth_lldp6
changed_when: false changed_when: false
ignore_errors: true ignore_errors: true
@@ -504,7 +492,7 @@
changed_when: false changed_when: false
# ============================ FINAL CONNECTION RESOLUTION ============================ # ============================ FINAL CONNECTION RESOLUTION ============================
- name: Decide final DEV2 connection mode (tunnel > lldp4 > lldp6) - name: Decide final DEV2 connection mode (direct_lldp > tunnel > lldp4 > lldp6)
delegate_to: localhost delegate_to: localhost
ansible.builtin.set_fact: ansible.builtin.set_fact:
dev2_conn_final: >- dev2_conn_final: >-
@@ -541,7 +529,7 @@
- "lldp ipv4={{ lldp_dev2_ip | default('<none>') }}" - "lldp ipv4={{ lldp_dev2_ip | default('<none>') }}"
- "lldp ipv6={{ lldp_dev2_ip6 | default('<none>') }}" - "lldp ipv6={{ lldp_dev2_ip6 | default('<none>') }}"
# ============================ ACTION (PHASE 0): DEV2 UPTIME ============================ # ============================ PHASE 0 ACTION: DEV2 UPTIME ============================
- name: DEV2 | uptime (tunnel) - name: DEV2 | uptime (tunnel)
when: dev2_conn_final == "tunnel" when: dev2_conn_final == "tunnel"
delegate_to: localhost delegate_to: localhost
@@ -550,11 +538,9 @@
PORT="{{ _local_port }}" PORT="{{ _local_port }}"
sshpass -f "{{ dev2_passfile_used }}" ssh {{ ssh_opts_common }} \ sshpass -f "{{ dev2_passfile_used }}" ssh {{ ssh_opts_common }} \
-o AddressFamily=inet \ -o AddressFamily=inet \
-o ConnectTimeout=30 \
-p "$PORT" "{{ dev2_ssh_user }}@127.0.0.1" \ -p "$PORT" "{{ dev2_ssh_user }}@127.0.0.1" \
"uptime 2>/dev/null || true" "uptime 2>/dev/null || true"
args: args: { executable: /bin/bash }
executable: /bin/bash
register: dev2_uptime register: dev2_uptime
changed_when: false changed_when: false
@@ -563,14 +549,12 @@
delegate_to: localhost delegate_to: localhost
ansible.builtin.shell: | ansible.builtin.shell: |
set -e set -e
HOST="{{ dev2_ssh_host }}" HOST="{{ lldp_dev2_ip }}"
sshpass -f "{{ dev2_passfile_used }}" ssh {{ ssh_opts_common }} \ sshpass -f "{{ dev2_passfile_used }}" ssh {{ ssh_opts_common }} \
-o AddressFamily=inet \ -o AddressFamily=inet \
-o ConnectTimeout=30 \
"{{ dev2_ssh_user }}@${HOST}" \ "{{ dev2_ssh_user }}@${HOST}" \
"uptime 2>/dev/null || true" "uptime 2>/dev/null || true"
args: args: { executable: /bin/bash }
executable: /bin/bash
register: dev2_uptime register: dev2_uptime
changed_when: false changed_when: false
@@ -582,11 +566,9 @@
HOST="{{ lldp_dev2_ip }}" HOST="{{ lldp_dev2_ip }}"
sshpass -f "{{ dev2_passfile_used_lldp }}" ssh {{ ssh_opts_common }} \ sshpass -f "{{ dev2_passfile_used_lldp }}" ssh {{ ssh_opts_common }} \
-o AddressFamily=inet \ -o AddressFamily=inet \
-o ConnectTimeout=30 \
"{{ dev2_ssh_user }}@${HOST}" \ "{{ dev2_ssh_user }}@${HOST}" \
"uptime 2>/dev/null || true" "uptime 2>/dev/null || true"
args: args: { executable: /bin/bash }
executable: /bin/bash
register: dev2_uptime register: dev2_uptime
changed_when: false changed_when: false
@@ -605,8 +587,7 @@
-o ConnectTimeout=30 \ -o ConnectTimeout=30 \
'{{ dev2_ssh_user }}@\[${IP6}%{{ dev1_iface }}\]' \ '{{ dev2_ssh_user }}@\[${IP6}%{{ dev1_iface }}\]' \
'uptime 2>/dev/null || true'" 'uptime 2>/dev/null || true'"
args: args: { executable: /bin/bash }
executable: /bin/bash
register: dev2_uptime register: dev2_uptime
changed_when: false changed_when: false