0747

files/ansible-playbooks/indoor-restart-cloudagent.yml

@@ -428,36 +428,6 @@
           expected_dev2_mac={{ dev2_mac | trim }},
           remote_eth0_mac={{ dev2_eth0_mac_read.stdout | default('') | trim }}.
 
-
-    # -------------------- CHANGE 2: safety guard using dev2_mac (only if we actually discovered one) --------------------
-    - name: Read remote eth0 MAC via selected connection (guard: ensure this is DEV2)
-      when: dev2_conn_method == "tunnel" and dev2_passfile_used != "NONE" and (dev2_mac | default('') | trim | length > 0)
-      delegate_to: localhost
-      ansible.builtin.shell: |
-        set -e
-        HOST="{{ dev2_ssh_host }}"
-        PORT="{{ dev2_ssh_port }}"
-        sshpass -f "{{ dev2_passfile_used }}" ssh \
-          -o AddressFamily=inet \
-          -o StrictHostKeyChecking=no -o PubkeyAuthentication=no \
-          -o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \
-          -o ConnectTimeout=30 \
-          -p "$PORT" "{{ dev2_ssh_user }}@${HOST}" \
-          "cat /sys/class/net/eth0/address 2>/dev/null || echo"
-      args:
-        executable: /bin/bash
-      register: dev2_eth0_mac_read
-      changed_when: false
-
-    - name: Abort if remote eth0 MAC != discovered DEV2 MAC
-      when: dev2_conn_method == "tunnel" and dev2_passfile_used != "NONE" and (dev2_mac | default('') | trim | length > 0)
-      ansible.builtin.fail:
-        msg: >
-          Safety stop: tunnel reached wrong device.
-          expected_dev2_mac={{ dev2_mac | trim }},
-          remote_eth0_mac={{ dev2_eth0_mac_read.stdout | trim }}
-      failed_when: (dev2_eth0_mac_read.stdout | trim | lower) != (dev2_mac | trim | lower)
-
     # ============================ DEV2 HOSTNAME GUARD ============================
     - name: Stop and journal if DEV2 auth failed (no passfile worked)
       when: dev2_passfile_used == "NONE"