0745

files/ansible-playbooks/indoor-restart-cloudagent.yml

@@ -400,6 +400,35 @@
         dev2_ssh_port: "{{ _local_port }}"
       changed_when: false
 
+    # -------------------- CHANGE 2: safety guard using dev2_mac (only if we actually discovered one) --------------------
+    - name: Read remote eth0 MAC via selected connection (guard: ensure this is DEV2)
+      when: dev2_conn_method == "tunnel" and dev2_passfile_used != "NONE" and (dev2_mac | default('') | trim | length > 0)
+      delegate_to: localhost
+      ansible.builtin.shell: |
+        set -e
+        HOST="{{ dev2_ssh_host }}"
+        PORT="{{ dev2_ssh_port }}"
+        sshpass -f "{{ dev2_passfile_used }}" ssh \
+          -o AddressFamily=inet \
+          -o StrictHostKeyChecking=no -o PubkeyAuthentication=no \
+          -o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \
+          -o ConnectTimeout=30 \
+          -p "$PORT" "{{ dev2_ssh_user }}@${HOST}" \
+          "cat /sys/class/net/eth0/address 2>/dev/null || echo"
+      args:
+        executable: /bin/bash
+      register: dev2_eth0_mac_read
+      changed_when: false
+
+    - name: Abort if remote eth0 MAC != discovered DEV2 MAC
+      when: dev2_conn_method == "tunnel" and dev2_passfile_used != "NONE" and (dev2_mac | default('') | trim | length > 0) and ((dev2_eth0_mac_read.stdout | default('') | trim | lower) != (dev2_mac | trim | lower))
+      ansible.builtin.fail:
+        msg: >
+          Safety stop: tunnel reached wrong device.
+          expected_dev2_mac={{ dev2_mac | trim }},
+          remote_eth0_mac={{ dev2_eth0_mac_read.stdout | default('') | trim }}.
+
+
     # -------------------- CHANGE 2: safety guard using dev2_mac (only if we actually discovered one) --------------------
     - name: Read remote eth0 MAC via selected connection (guard: ensure this is DEV2)
       when: dev2_conn_method == "tunnel" and dev2_passfile_used != "NONE" and (dev2_mac | default('') | trim | length > 0)