0653

files/ansible-playbooks/ptsd-migrate.yml

@@ -399,44 +399,67 @@
         - (remote_eth0_mac | lower) != (dev2_mac | lower)
       ansible.builtin.fail:
         msg: >-
-          Safety stop: tunnel reached wrong device.
-          expected_dev2_mac={{ dev2_mac }}, remote_eth0_mac={{ remote_eth0_mac }}
+          MAC guard failed: remote eth0 MAC={{ remote_eth0_mac }}, expected DEV2 MAC={{ dev2_mac }}.
+          Refusing to proceed.
 
-    # ============================ PHASE 0: FALLBACKS (only if tunnel auth failed) ============================
-    - name: Try DEV2 login via LLDP IPv4 10.x (fallback if tunnel auth failed)
+    # ============================ PHASE 0: LLDP IPv4 FALLBACK AUTH (after tunnel attempt) ============================
+    - name: Try DEV2 login via LLDP IPv4 (fallback) with basicpass
       when:
         - dev2_conn_method == "tunnel"
-        - dev2_passfile_used_tunnel == "NONE"
-        - (lldp_dev2_ip | default('')) is match('^10\\.')
+        - (dev2_passfile_used_tunnel | default('NONE')) == "NONE"
+        - (lldp_dev2_ip | default('') | length) > 0
       delegate_to: localhost
       ansible.builtin.shell: |
         set -e
         HOST="{{ lldp_dev2_ip }}"
-        for f in {{ dev2_passfiles | join(' ') }}; do
-          if timeout 20s sshpass -f "$f" ssh {{ ssh_opts_common }} \
-              -o AddressFamily=inet \
-              -o ConnectTimeout=10 \
-              "{{ dev2_ssh_user }}@${HOST}" echo OK >/dev/null 2>&1; then
-            echo "$f"; exit 0
-          fi
-        done
-        echo "NONE"; exit 1
+        sshpass -f basicpass ssh {{ ssh_opts_common }} \
+          -o AddressFamily=inet \
+          "{{ dev2_ssh_user }}@${HOST}" echo OK >/dev/null 2>&1
       args: { executable: /bin/bash }
       register: dev2_auth_lldp4
       changed_when: false
-      failed_when: false
       ignore_errors: true
 
-    - name: Record LLDP IPv4 fallback decision
+    - name: Select basicpass for LLDP IPv4 fallback if succeeded
       when:
         - dev2_conn_method == "tunnel"
-        - dev2_passfile_used_tunnel == "NONE"
-        - (lldp_dev2_ip | default('')) is match('^10\\.')
+        - (dev2_passfile_used_tunnel | default('NONE')) == "NONE"
+        - dev2_auth_lldp4.rc == 0
       delegate_to: localhost
       ansible.builtin.set_fact:
-        dev2_passfile_used_lldp4: "{{ (dev2_auth_lldp4.rc == 0) | ternary((dev2_auth_lldp4.stdout | trim), 'NONE') }}"
+        dev2_passfile_used_lldp4: "basicpass"
       changed_when: false
 
+    - name: Try DEV2 login via LLDP IPv4 (fallback) with basicpass2 (only if first failed)
+      when:
+        - dev2_conn_method == "tunnel"
+        - (dev2_passfile_used_tunnel | default('NONE')) == "NONE"
+        - (dev2_passfile_used_lldp4 | default('NONE')) == "NONE"
+        - (lldp_dev2_ip | default('') | length) > 0
+      delegate_to: localhost
+      ansible.builtin.shell: |
+        set -e
+        HOST="{{ lldp_dev2_ip }}"
+        sshpass -f basicpass2 ssh {{ ssh_opts_common }} \
+          -o AddressFamily=inet \
+          "{{ dev2_ssh_user }}@${HOST}" echo OK >/dev/null 2>&1
+      args: { executable: /bin/bash }
+      register: dev2_auth_lldp4_2
+      changed_when: false
+      ignore_errors: true
+
+    - name: Select basicpass2 for LLDP IPv4 fallback if succeeded
+      when:
+        - dev2_conn_method == "tunnel"
+        - (dev2_passfile_used_tunnel | default('NONE')) == "NONE"
+        - (dev2_passfile_used_lldp4 | default('NONE')) == "NONE"
+        - dev2_auth_lldp4_2.rc == 0
+      delegate_to: localhost
+      ansible.builtin.set_fact:
+        dev2_passfile_used_lldp4: "basicpass2"
+      changed_when: false
+
+    # ============================ PHASE 0: LLDP IPv6 LAST RESORT (nested via DEV1) ============================
     - name: Copy DEV2 passfiles to DEV1 for IPv6 nested SSH (last resort)
       when:
         - dev2_conn_method == "tunnel"
@@ -750,8 +773,7 @@
       args: { executable: /bin/bash }
       changed_when: true
 
-
-    - name: PHASE 1 | Download /tmp/config.json from DEV2 to controller (tunnel)
+    - name: PHASE 1 | Download /tmp/config.json from DEV2 (tunnel)
       when: dev2_conn_final == "tunnel"
       delegate_to: localhost
       ansible.builtin.shell: |
@@ -766,7 +788,7 @@
       changed_when: true
       failed_when: scp_tunnel.rc != 0
 
-    - name: PHASE 1 | Download /tmp/config.json from DEV2 to controller (direct LLDP IPv4)
+    - name: PHASE 1 | Download /tmp/config.json from DEV2 (direct LLDP IPv4)
       when: dev2_conn_final == "direct_lldp"
       delegate_to: localhost
       ansible.builtin.shell: |
@@ -781,7 +803,7 @@
       changed_when: true
       failed_when: scp_direct.rc != 0
 
-    - name: PHASE 1 | Download /tmp/config.json from DEV2 to controller (LLDP IPv4 fallback)
+    - name: PHASE 1 | Download /tmp/config.json from DEV2 (LLDP IPv4 fallback)
       when: dev2_conn_final == "lldp4_fallback"
       delegate_to: localhost
       ansible.builtin.shell: |
@@ -796,38 +818,36 @@
       changed_when: true
       failed_when: scp_lldp4.rc != 0
 
-    - name: PHASE 1 | Download /tmp/config.json from DEV2 to controller (LLDP IPv6 via DEV1 nested; last resort)
+    - name: PHASE 1 | Download /tmp/config.json from DEV2 (LLDP IPv6 via DEV1 nested; last resort)
       when: dev2_conn_final == "lldp6_via_dev1"
       delegate_to: localhost
       ansible.builtin.shell: |
         set -e
         IP6="{{ lldp_dev2_ip6 }}"
         F="{{ dev2_passfile_used_lldp6 }}"
-        TMP_REMOTE="/tmp/config_{{ inventory_hostname }}.json"
+        OUT="{{ dev2_config_local_path }}"
+        STAGE_ON_DEV1="/tmp/config_{{ inventory_hostname }}.json"
 
-        # 1) On DEV1: scp from DEV2 (ipv6 link-local) to DEV1 /tmp
         sshpass -p "{{ dev1_pass }}" ssh {{ ssh_opts_common }} \
           "{{ dev1_user }}@{{ ansible_host | default(inventory_hostname) }}" \
           "sshpass -f '/tmp/${F}' scp \
              -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR \
              -o PreferredAuthentications=password -o PubkeyAuthentication=no -o NumberOfPasswordPrompts=1 \
-             '{{ dev2_ssh_user }}@\[${IP6}%{{ dev1_iface }}\]':/tmp/config.json '${TMP_REMOTE}'"
+             '/tmp/config.json' '{{ dev2_ssh_user }}@\[${IP6}%{{ dev1_iface }}\]':${STAGE_ON_DEV1}"
 
-        # 2) From DEV1 to controller
         sshpass -p "{{ dev1_pass }}" scp {{ ssh_opts_common }} \
-          "{{ dev1_user }}@{{ ansible_host | default(inventory_hostname) }}:${TMP_REMOTE}" \
-          "{{ dev2_config_local_path }}"
+          "{{ dev1_user }}@{{ ansible_host | default(inventory_hostname) }}:${STAGE_ON_DEV1}" \
+          "${OUT}"
 
-        # 3) Cleanup on DEV1 (best-effort)
         sshpass -p "{{ dev1_pass }}" ssh {{ ssh_opts_common }} \
           "{{ dev1_user }}@{{ ansible_host | default(inventory_hostname) }}" \
-          "rm -f '${TMP_REMOTE}' 2>/dev/null || true"
+          "rm -f '${STAGE_ON_DEV1}' 2>/dev/null || true"
       args: { executable: /bin/bash }
       register: scp_lldp6
       changed_when: true
       failed_when: scp_lldp6.rc != 0
 
-    - name: PHASE 1 | Controller md5sum of downloaded config.json
+    - name: PHASE 1 | md5sum local downloaded config.json
       delegate_to: localhost
       ansible.builtin.shell: |
         set -e
@@ -836,53 +856,48 @@
       register: local_config_md5
       changed_when: false
 
-    - name: PHASE 1 | Compare DEV2 vs controller md5sum (fail on mismatch)
+    - name: PHASE 1 | Compare controller vs DEV2 md5sum for config.json (fail on mismatch)
       delegate_to: localhost
       ansible.builtin.fail:
         msg: >-
-          MD5 mismatch for /tmp/config.json:
-          dev2={{ dev2_config_md5.stdout | trim }},
+          MD5 mismatch for config.json:
           local={{ local_config_md5.stdout | trim }},
-          file={{ dev2_config_local_path }}
+          dev2={{ dev2_config_md5.stdout | trim }},
+          local_file={{ dev2_config_local_path }}
       when: (dev2_config_md5.stdout | trim) != (local_config_md5.stdout | trim)
 
-    - name: PHASE 1 | Debug config.json download + md5
-      when: debugging | bool
-      delegate_to: localhost
-      ansible.builtin.debug:
-        msg:
-          - "Downloaded DEV2 /tmp/config.json to {{ dev2_config_local_path }}"
-          - "DEV2 md5={{ dev2_config_md5.stdout | trim }}"
-          - "Local md5={{ local_config_md5.stdout | trim }}"
-
-    - name: PHASE 1 | Set controller paths for DHCP conversion
-      delegate_to: localhost
-      ansible.builtin.set_fact:
-        pppoe_to_dhcp_script: "/opt/containers/ansible-worker/app/pppoe_to_dhcp.py"
-        dev2_config_dhcp_local_path: "{{ dev2_config_local_dir }}/dev2_config_dhcp_{{ inventory_hostname }}.json"
-        dev2_config_dhcp_remote_path: "/tmp/config-dhcp.json"
-      changed_when: false
-
-    - name: PHASE 1 | Abort if pppoe_to_dhcp.py is missing on controller
-      delegate_to: localhost
-      ansible.builtin.shell: |
-        test -f "{{ pppoe_to_dhcp_script }}"
-      args: { executable: /bin/bash }
-      register: dhcp_script_present
-      changed_when: false
-      failed_when: dhcp_script_present.rc != 0
-
-    - name: PHASE 1 | Convert config.json -> config-dhcp.json (controller)
+    - name: PHASE 1 | Check that dhcp script exists on controller
       delegate_to: localhost
       ansible.builtin.shell: |
         set -e
-        python3 "{{ pppoe_to_dhcp_script }}" "{{ dev2_config_local_path }}" -o "{{ dev2_config_dhcp_local_path }}"
+        test -f ./dhcp_migrate.py && echo YES || echo NO
+      args: { executable: /bin/bash }
+      register: dhcp_script_present
+      changed_when: false
+      failed_when: false
+
+    - name: PHASE 1 | Abort if dhcp_migrate.py is missing
+      when: (dhcp_script_present.stdout | default('') | trim) != "YES"
+      ansible.builtin.fail:
+        msg: "dhcp_migrate.py missing on controller"
+
+    - name: PHASE 1 | Convert config.json to config-dhcp.json on controller
+      delegate_to: localhost
+      ansible.builtin.shell: |
+        set -e
+        ./dhcp_migrate.py "{{ dev2_config_local_path }}" > "{{ dev2_config_local_dir }}/config-dhcp_{{ inventory_hostname }}.json"
       args: { executable: /bin/bash }
       register: convert_run
       changed_when: true
-      failed_when: convert_run.rc != 0
 
-    - name: PHASE 1 | Controller md5sum of generated config-dhcp.json
+    - name: PHASE 1 | Set DHCP config paths (local + remote)
+      delegate_to: localhost
+      ansible.builtin.set_fact:
+        dev2_config_dhcp_local_path: "{{ dev2_config_local_dir }}/config-dhcp_{{ inventory_hostname }}.json"
+        dev2_config_dhcp_remote_path: "/tmp/config-dhcp.json"
+      changed_when: false
+
+    - name: PHASE 1 | md5sum local config-dhcp.json
       delegate_to: localhost
       ansible.builtin.shell: |
         set -e
@@ -890,7 +905,6 @@
       args: { executable: /bin/bash }
       register: local_dhcp_md5
       changed_when: false
-      failed_when: (local_dhcp_md5.stdout | trim | length) == 0
 
     - name: PHASE 1 | Upload config-dhcp.json to DEV2 (tunnel)
       when: dev2_conn_final == "tunnel"
@@ -1097,6 +1111,185 @@
         and ('Cannot assign requested address' not in (del_ip.stdout | default('')))
         and ('Cannot assign requested address' not in (del_ip.stderr | default('')))
 
+    - name: REPORT Initialize cumulative migrate report
+      delegate_to: localhost
+      ansible.builtin.set_fact:
+        migrate_report: "migrate observed"
+      changed_when: false
+
+    - name: REPORT Append connectivity summary
+      delegate_to: localhost
+      ansible.builtin.set_fact:
+        migrate_report: >-
+          {{
+            migrate_report
+            ~ ', '
+            ~ ('conn_initial ' ~ (dev2_conn_method | default('unknown')))
+            ~ ', '
+            ~ ('conn_final ' ~ (dev2_conn_final | default('unknown')))
+          }}
+      changed_when: false
+
+    - name: REPORT Append LLDP candidates
+      delegate_to: localhost
+      ansible.builtin.set_fact:
+        migrate_report: >-
+          {{
+            migrate_report
+            ~ ', '
+            ~ ('lldp4 ' ~ (lldp_dev2_ip | default('<none>')))
+            ~ ', '
+            ~ ('lldp4_class ' ~ (lldp_ip_class | default('none')))
+            ~ ', '
+            ~ ('lldp6 ' ~ (lldp_dev2_ip6 | default('<none>')))
+          }}
+      changed_when: false
+
+    - name: REPORT Append passfiles used
+      delegate_to: localhost
+      ansible.builtin.set_fact:
+        migrate_report: >-
+          {{
+            migrate_report
+            ~ ', '
+            ~ ('pass_direct ' ~ (dev2_passfile_used_direct | default('NONE')))
+            ~ ', '
+            ~ ('pass_tunnel ' ~ (dev2_passfile_used_tunnel | default('NONE')))
+            ~ ', '
+            ~ ('pass_lldp4 ' ~ (dev2_passfile_used_lldp4 | default('NONE')))
+            ~ ', '
+            ~ ('pass_lldp6 ' ~ (dev2_passfile_used_lldp6 | default('NONE')))
+          }}
+      changed_when: false
+
+    - name: REPORT Append inprogress marker status
+      delegate_to: localhost
+      ansible.builtin.set_fact:
+        migrate_report: >-
+          {{
+            migrate_report
+            ~ ', '
+            ~ (
+              'marker present'
+              if (dev2_inprogress_marker.stdout | default('') | trim) == 'YES'
+              else 'marker absent'
+            )
+          }}
+      changed_when: false
+
+    - name: REPORT Append pre migration interface state
+      delegate_to: localhost
+      ansible.builtin.set_fact:
+        migrate_report: >-
+          {{
+            migrate_report
+            ~ ', '
+            ~ ('ppp0_has_ipv4 ' ~ ((dev2_ppp0_has_ipv4.stdout | default('') | trim) | default('UNKNOWN')))
+            ~ ', '
+            ~ ('eth0_4000_exists ' ~ ((dev2_eth04000_exists.stdout | default('') | trim) | default('UNKNOWN')))
+            ~ ', '
+            ~ (
+              'precheck ok old ppp'
+              if (dev2_pre_migration_ok | default(false) | bool)
+              else
+              (
+                'precheck mixed'
+                if (dev2_mixed_state | default(false) | bool)
+                else 'precheck not old ppp'
+              )
+            )
+          }}
+      changed_when: false
+
+    - name: REPORT Append config json md5 status
+      delegate_to: localhost
+      ansible.builtin.set_fact:
+        migrate_report: >-
+          {{
+            migrate_report
+            ~ ', '
+            ~ (
+              'config.json md5 match'
+              if (dev2_config_md5.stdout | default('') | trim) == (local_config_md5.stdout | default('') | trim)
+              else 'config.json md5 mismatch'
+            )
+          }}
+      changed_when: false
+
+    - name: REPORT Append dhcp conversion status
+      delegate_to: localhost
+      ansible.builtin.set_fact:
+        migrate_report: >-
+          {{
+            migrate_report
+            ~ ', '
+            ~ (
+              'convert ok'
+              if (convert_run.rc | default(1)) == 0
+              else 'convert failed'
+            )
+          }}
+      changed_when: false
+
+    - name: REPORT Append upload method
+      delegate_to: localhost
+      ansible.builtin.set_fact:
+        migrate_report: >-
+          {{
+            migrate_report
+            ~ ', '
+            ~ (
+              'upload tunnel'
+              if (scp_up_tunnel is defined)
+              else
+              (
+                'upload direct_lldp'
+                if (scp_up_direct is defined)
+                else
+                (
+                  'upload lldp4_fallback'
+                  if (scp_up_lldp4 is defined)
+                  else
+                  (
+                    'upload lldp6_via_dev1'
+                    if (scp_up_lldp6 is defined)
+                    else 'upload unknown'
+                  )
+                )
+              )
+            )
+          }}
+      changed_when: false
+
+    - name: REPORT Append config dhcp md5 status
+      delegate_to: localhost
+      ansible.builtin.set_fact:
+        migrate_report: >-
+          {{
+            migrate_report
+            ~ ', '
+            ~ (
+              'config-dhcp md5 match'
+              if (dev2_dhcp_md5.stdout | default('') | trim) == (local_dhcp_md5.stdout | default('') | trim)
+              else 'config-dhcp md5 mismatch'
+            )
+          }}
+      changed_when: false
+
+    - name: REPORT Append upgrade actions started
+      delegate_to: localhost
+      ansible.builtin.set_fact:
+        migrate_report: "{{ migrate_report ~ ', staged config-test and armed parachute reboot and initiated config-test.lua 400' }}"
+      changed_when: false
+
+    - name: REPORT Final cumulative migrate report
+      delegate_to: localhost
+      ansible.builtin.debug:
+        msg:
+          - "{{ migrate_report }}"
+          - "DEV2 uptime via {{ dev2_conn_final | default('unknown') }}={{ (dev2_uptime.stdout | default('') ) | regex_replace('\r','') }}"
+      changed_when: false
+
 - name: PHASE X | Wait 45 seconds after config activation
   hosts: all
   gather_facts: false
@@ -1104,4 +1297,4 @@
     - ansible.builtin.pause:
         seconds: 45
 
-- import_playbook: ptsd_reacquire_attempt.yml
+- import_playbook: ptsd_reacquire_attempt.yml