From 79a4e0d7632f3ec7e37d429657e770b85dd063f0 Mon Sep 17 00:00:00 2001
From: pavel <pavel.larkin@ikeja.co.za>
Date: Tue, 20 Jan 2026 07:45:31 +0200
Subject: [PATCH] 0745

---
 .../indoor-restart-cloudagent.yml             | 29 +++++++++++++++++++
 .../ansible-playbooks/sot-updater-wrapper.yml | 15 ++++++++++
 2 files changed, 44 insertions(+)

diff --git a/files/ansible-playbooks/indoor-restart-cloudagent.yml b/files/ansible-playbooks/indoor-restart-cloudagent.yml
index d23733f..15b3160 100644
--- a/files/ansible-playbooks/indoor-restart-cloudagent.yml
+++ b/files/ansible-playbooks/indoor-restart-cloudagent.yml
@@ -400,6 +400,35 @@
         dev2_ssh_port: "{{ _local_port }}"
       changed_when: false
 
+    # -------------------- CHANGE 2: safety guard using dev2_mac (only if we actually discovered one) --------------------
+    - name: Read remote eth0 MAC via selected connection (guard: ensure this is DEV2)
+      when: dev2_conn_method == "tunnel" and dev2_passfile_used != "NONE" and (dev2_mac | default('') | trim | length > 0)
+      delegate_to: localhost
+      ansible.builtin.shell: |
+        set -e
+        HOST="{{ dev2_ssh_host }}"
+        PORT="{{ dev2_ssh_port }}"
+        sshpass -f "{{ dev2_passfile_used }}" ssh \
+          -o AddressFamily=inet \
+          -o StrictHostKeyChecking=no -o PubkeyAuthentication=no \
+          -o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \
+          -o ConnectTimeout=30 \
+          -p "$PORT" "{{ dev2_ssh_user }}@${HOST}" \
+          "cat /sys/class/net/eth0/address 2>/dev/null || echo"
+      args:
+        executable: /bin/bash
+      register: dev2_eth0_mac_read
+      changed_when: false
+
+    - name: Abort if remote eth0 MAC != discovered DEV2 MAC
+      when: dev2_conn_method == "tunnel" and dev2_passfile_used != "NONE" and (dev2_mac | default('') | trim | length > 0) and ((dev2_eth0_mac_read.stdout | default('') | trim | lower) != (dev2_mac | trim | lower))
+      ansible.builtin.fail:
+        msg: >
+          Safety stop: tunnel reached wrong device.
+          expected_dev2_mac={{ dev2_mac | trim }},
+          remote_eth0_mac={{ dev2_eth0_mac_read.stdout | default('') | trim }}.
+
+
     # -------------------- CHANGE 2: safety guard using dev2_mac (only if we actually discovered one) --------------------
     - name: Read remote eth0 MAC via selected connection (guard: ensure this is DEV2)
       when: dev2_conn_method == "tunnel" and dev2_passfile_used != "NONE" and (dev2_mac | default('') | trim | length > 0)
diff --git a/files/ansible-playbooks/sot-updater-wrapper.yml b/files/ansible-playbooks/sot-updater-wrapper.yml
index d8be764..64c4ac2 100644
--- a/files/ansible-playbooks/sot-updater-wrapper.yml
+++ b/files/ansible-playbooks/sot-updater-wrapper.yml
@@ -90,6 +90,12 @@
           payload_encoding: "string"
       changed_when: false
 
+    - name: "Wrapper | Mark host to skip full scan (cloud-offline)"
+      when: (wrapper_fail_line | default('') | length) > 0
+      set_fact:
+        wrapper_skip_full_scan: true
+
+
     - name: "Wrapper | Stop host after cloud-offline journal (no full scan)"
       when: (wrapper_fail_line | default('') | length) > 0
       meta: end_host
@@ -115,5 +121,14 @@
     - name: "Wrapper | Reset SSH connection context (ensure new ansible_host is used)"
       meta: reset_connection
 
+- name: Phase 3 gate | Skip full scan if cloud-offline
+  hosts: all
+  gather_facts: no
+
+  tasks:
+    - name: "Wrapper | Gate: end_host if wrapper_skip_full_scan is set"
+      when: wrapper_skip_full_scan | default(false)
+      meta: end_host
+
 
 - import_playbook: sot-updater.yml