From 6c670a10b96f989a5c3d91e56a7e30f4d846b3e9 Mon Sep 17 00:00:00 2001
From: pavel <pavel.larkin@ikeja.co.za>
Date: Wed, 5 Nov 2025 16:41:21 +0200
Subject: [PATCH] 16:41

---
 files/ansible-playbooks/update-indoor.yml | 58 +++++++++++++++++++----
 1 file changed, 48 insertions(+), 10 deletions(-)

diff --git a/files/ansible-playbooks/update-indoor.yml b/files/ansible-playbooks/update-indoor.yml
index d0304b3..a2badd9 100644
--- a/files/ansible-playbooks/update-indoor.yml
+++ b/files/ansible-playbooks/update-indoor.yml
@@ -69,6 +69,31 @@
           - "afterupgrade_routing_key={{ afterupgrade_routing_key | default('UNSET') }}"
           - "inventory_hostname={{ inventory_hostname }}"
 
+    # ====== NEW: pick up force-upgrade flag from CLI and TEMP override ======
+    - name: Read force-upgrade flag from CLI (supports -e force-upgrade=yes)
+      delegate_to: localhost
+      ansible.builtin.set_fact:
+        force_upgrade_raw: "{{ (vars['force-upgrade'] if ('force-upgrade' in vars) else (force_upgrade | default(''))) | string | lower }}"
+
+    # >>> TEMPORARY OVERRIDE (REMOVE THIS TASK LATER) <<<
+    - name: TEMPORARILY set force-upgrade to yes (REMOVE BEFORE COMMITTING)
+      delegate_to: localhost
+      ansible.builtin.set_fact:
+        force_upgrade_raw: "yes"
+    # <<< END TEMPORARY >>>
+
+    - name: Normalize force-upgrade flag to boolean
+      delegate_to: localhost
+      ansible.builtin.set_fact:
+        force_upgrade: "{{ force_upgrade_raw in ['y','yes','1','true'] }}"
+
+    - name: Debug force-upgrade effective
+      delegate_to: localhost
+      ansible.builtin.debug:
+        msg:
+          - "force_upgrade_raw={{ force_upgrade_raw | default('') }}"
+          - "force_upgrade={{ force_upgrade | default(false) }}"
+
     - name: Stop early if connected DEV1 hostname != inventory
       ansible.builtin.meta: end_host
       when: (dev1_host_read.stdout | trim | length > 0) and
@@ -617,7 +642,7 @@
       ansible.builtin.debug:
         msg: "DEV2 firmux={{ (dev2_firmux.stdout | default('')) | trim }}"
 
-    # --- PRE-FLIGHT: derive target core and compare with current; block if equal ---
+    # ===== NEW: derive expected & current firmware cores and block if equal (unless force-upgrade) =====
     - name: Derive expected target_version core (early, from image filename)
       delegate_to: localhost
       ansible.builtin.set_fact:
@@ -647,14 +672,23 @@
           {{ '' }}
           {%- endif %}
 
-    - name: Soft-block if current firmware already matches target (skip staging/write/flip)
+    - name: Debug version comparison (current vs expected; force-override)
+      delegate_to: localhost
+      ansible.builtin.debug:
+        msg:
+          - "expected_fw_core_early={{ expected_fw_core_early | default('') }}"
+          - "current_fw_core={{ current_fw_core | default('') }}"
+          - "force_upgrade={{ force_upgrade | default(false) }}"
+
+    - name: Soft-block if current firmware already matches target and not forced
       when:
+        - not (force_upgrade | default(false))
         - (expected_fw_core_early | length) > 0
         - (current_fw_core | length) > 0
         - current_fw_core == expected_fw_core_early
       ansible.builtin.set_fact:
         _blocked: true
-        _journal: "{{ (_journal | default([])) + [ 'Device already running target image: ' ~ current_fw_core ~ ' — skipping write/flip' ] }}"
+        _journal: "{{ (_journal | default([])) + [ 'Device already running target image: ' ~ current_fw_core ~ ' — skipping write/flip (use force-upgrade=yes to override)' ] }}"
 
     # ---------------------------- Normalize rebootin early (HOURS) ----------------------------
     # Strict: rebootin is integer HOURS only. Always add +20s grace to the schedule.
@@ -775,13 +809,14 @@
       register: local_md5
       changed_when: false
 
-    # **** CHANGE: MD5 mismatch becomes SOFT-BLOCK (no assert) ****
-    - name: Soft-block if local md5 does not match expected
-      when: local_img.stat.exists and ((local_md5.stdout | trim) != image_md5)
-      ansible.builtin.set_fact:
-        _blocked: true
-        _prep_blocked: true
-        _journal: "{{ _journal + [ 'Local md5 mismatch: have=' ~ (local_md5.stdout | trim) ~ ' expected=' ~ image_md5 ] }}"
+    - name: Verify local md5 matches expected
+      when: local_img.stat.exists
+      delegate_to: localhost
+      ansible.builtin.assert:
+        that:
+          - (local_md5.stdout | trim) == image_md5
+        fail_msg: "Local md5 does not match expected got {{ local_md5.stdout | trim }} expected {{ image_md5 }}"
+        success_msg: "Local md5 matches expected"
 
     # Optional SHA256 local
     - name: Compute local sha256 of the image (if provided)
@@ -1371,6 +1406,9 @@
         msg:
           - "dev2_passfile_used={{ dev2_passfile_used }}"
           - "dev2_firmux={{ (dev2_firmux.stdout | default('')) | trim }}"
+          - "expected_fw_core_early={{ expected_fw_core_early | default('') }}"
+          - "current_fw_core={{ current_fw_core | default('') }}"
+          - "force_upgrade={{ force_upgrade | default(false) }}"
           - "local_image_present={{ local_img.stat.exists | default(false) }}"
           - "local_md5={{ (local_md5.stdout | default('NA')) | trim }}"
           - "dev2_md5_before={{ (dev2_md5_before.stdout | default('NA')) | trim }}"