pavel/ansible-worker
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

1001

Browse Source
This commit is contained in:
pavel
2026-01-20 10:01:14 +02:00
parent 8700d8125a
commit fc68a3d6f5
1 changed files with 240 additions and 238 deletions
Download Patch File Download Diff File Expand all files Collapse all files

478
files/ansible-playbooks/ptsd-migrate.yml
View File

@@ -1,37 +1,36 @@
# ptsd-migration.yml — PPPoE to super DHCP (phase 0: connectivity prove-out) # ptsd-migration.yml — PPPoE to super DHCP | Phase 0 connectivity + Phase 1 commands (initially uptime)
# Focus: reliable connectivity to DEV2
# Paths:
# A) direct LLDP IPv4 (10.x) if available and auth works
# B) tunnel via DEV1 (default)
# C) LLDP IPv4 (10.x) fallback if tunnel auth fails
# D) LLDP IPv6 fallback via DEV1 (nested ssh to [ip6%iface]) if all else fails
# After connection: run "uptime" on DEV2 and print it.
- name: PPPoE to super DHCP | Phase 0 | Prove reliable DEV2 connectivity + uptime - name: "PPPoE to super DHCP | Phase 0 | Prove reliable DEV2 connectivity (no device commands)"
hosts: all hosts: all
gather_facts: no gather_facts: no
vars: vars:
# Busybox-safe PATH prefix for all remote raw calls on DEV1 / DEV2
pathprefix: "PATH=/sbin:/usr/sbin:/bin:/usr/bin:$PATH; " pathprefix: "PATH=/sbin:/usr/sbin:/bin:/usr/bin:$PATH; "
# DEV1 credentials # DEV1 credentials
dev1_user: "root" dev1_user: "root"
dev1_pass: "wavewave" dev1_pass: "wavewave"
# DEV2 default behind DEV1 # DEV2 behind DEV1 (default tunnel target; may be overridden by LLDP 192.168.*)
dev2_host: "192.168.1.1" dev2_host: "192.168.1.1"
dev2_port: 22 dev2_port: 22
# Temp IP we add to DEV1 so it can reach DEV2 # Temp IP we add to DEV1 so it can reach DEV2
dev2_side_ip: "192.168.1.11/24" dev2_side_ip: "192.168.1.11/24"
dev2_side_ip_addr: "{{ dev2_side_ip.split('/')[0] }}" dev2_side_ip_addr: "{{ dev2_side_ip.split('/')[0] }}"
dev1_iface: "br-wan" # also used as IPv6 scope-id dev1_iface: "br-wan"
# ARP refresh interface (as in sot-updater)
arping_iface: "eth0" arping_iface: "eth0"
# DEV2 credentials # DEV2 login candidates
dev2_ssh_user: "root" dev2_ssh_user: "root"
dev2_passfiles: [ "basicpass", "basicpass2" ] dev2_passfiles:
- "basicpass"
- "basicpass2"
# SSH options used from controller
ssh_opts_common: >- ssh_opts_common: >-
-o PreferredAuthentications=password -o PreferredAuthentications=password
-o PubkeyAuthentication=no -o PubkeyAuthentication=no
@@ -40,13 +39,11 @@
-o NumberOfPasswordPrompts=1 -o NumberOfPasswordPrompts=1
-o ConnectTimeout=30 -o ConnectTimeout=30
# Debugging toggle
debugging: true debugging: true
# Connection state # ssh timeout for nested / probes
dev2_conn_method: "" ssh_timeout: 30
dev2_passfile_used: "NONE" # tunnel or direct_lldp primary
dev2_passfile_used_lldp: "NONE" # LLDP IPv4 fallback
dev2_passfile_used_lldp6: "NONE" # LLDP IPv6 via DEV1 fallback
pre_tasks: pre_tasks:
- name: Read DEV1 hostname (busybox-safe) - name: Read DEV1 hostname (busybox-safe)
@@ -62,7 +59,7 @@
((dev1_host_read.stdout | trim) != (inventory_hostname | string)) ((dev1_host_read.stdout | trim) != (inventory_hostname | string))
tasks: tasks:
# ============================ LLDP DISCOVERY (DEV1) ============================ # ============================ LLDP DISCOVERY (IPv4 + IPv6) ============================
- name: Compute hostname digits key for LLDP lookup (DEV2) - name: Compute hostname digits key for LLDP lookup (DEV2)
ansible.builtin.set_fact: ansible.builtin.set_fact:
dev2_lldp_digits: "{{ (inventory_hostname | string) | regex_replace('[^0-9]', '') }}" dev2_lldp_digits: "{{ (inventory_hostname | string) | regex_replace('[^0-9]', '') }}"
@@ -72,12 +69,12 @@
ansible.builtin.raw: > ansible.builtin.raw: >
{{ pathprefix }} {{ pathprefix }}
DIGITS="{{ dev2_lldp_digits }}"; DIGITS="{{ dev2_lldp_digits }}";
cat /var/run/lldp_server.json 2>/dev/null cat /var/run/lldp_server.json 2>/dev/null \
| grep "${DIGITS}" -A 15 | grep "${DIGITS}" -A 10 \
| grep address | grep address \
| grep -vE 'subtype|ipv6' | grep -vE 'subtype|ipv6' \
| awk -F'"' '{ print $4 }' | awk -F'"' '{ print $4 }' \
| head -n1 | head -n1
register: dev2_lldp_ip_raw register: dev2_lldp_ip_raw
changed_when: false changed_when: false
failed_when: false failed_when: false
@@ -86,11 +83,11 @@
ansible.builtin.raw: > ansible.builtin.raw: >
{{ pathprefix }} {{ pathprefix }}
DIGITS="{{ dev2_lldp_digits }}"; DIGITS="{{ dev2_lldp_digits }}";
cat /var/run/lldp_server.json 2>/dev/null cat /var/run/lldp_server.json 2>/dev/null \
| grep "${DIGITS}" -A 15 | grep "${DIGITS}" -A 15 \
| grep 'address_ipv6' | grep 'address_ipv6' \
| awk -F'"' '{ print $4 }' | awk -F'"' '{ print $4 }' \
| head -n1 | head -n1
register: dev2_lldp_ip6_raw register: dev2_lldp_ip6_raw
changed_when: false changed_when: false
failed_when: false failed_when: false
@@ -117,11 +114,13 @@
delegate_to: localhost delegate_to: localhost
ansible.builtin.debug: ansible.builtin.debug:
msg: msg:
- "LLDP digits={{ dev2_lldp_digits }}" - "LLDP digits={{ dev2_lldp_digits | default('') }}"
- "LLDP IPv4 candidate={{ lldp_dev2_ip | default('<none>') }}" - "LLDP IPv4 candidate={{ lldp_dev2_ip | default('<none>') }}"
- "LLDP IPv4 class={{ lldp_ip_class | default('none') }}" - "LLDP IPv4 class={{ lldp_ip_class | default('none') }}"
- "LLDP IPv6 candidate={{ lldp_dev2_ip6 | default('<none>') }}" - "LLDP IPv6 candidate={{ lldp_dev2_ip6 | default('<none>') }}"
# ============================ PRIMARY PATH DECISION (same as indoor-restart-cloudagent) ============================
# If LLDP gives 192.168.* we use it as dev2_host for the tunnel target
- name: Override dev2_host from LLDP when candidate is 192.168.x.x - name: Override dev2_host from LLDP when candidate is 192.168.x.x
when: (lldp_ip_class | trim) == "192_168" and (lldp_dev2_ip | trim | length > 0) when: (lldp_ip_class | trim) == "192_168" and (lldp_dev2_ip | trim | length > 0)
delegate_to: localhost delegate_to: localhost
@@ -129,69 +128,66 @@
dev2_host: "{{ lldp_dev2_ip | trim }}" dev2_host: "{{ lldp_dev2_ip | trim }}"
changed_when: false changed_when: false
# ============================ PATH A: DIRECT LLDP IPv4 (10.x) PRIMARY ============================ # Direct LLDP only if 10.x
- name: Set connection method initial (direct_lldp if 10.x else tunnel)
delegate_to: localhost
ansible.builtin.set_fact:
dev2_conn_method: "{{ 'direct_lldp' if ((lldp_ip_class | trim) == '10') else 'tunnel' }}"
changed_when: false
# ============================ DIRECT LLDP IPv4 AUTH (10.x) ============================
- name: Try DEV2 login via direct LLDP IPv4 (10.x) with basicpass - name: Try DEV2 login via direct LLDP IPv4 (10.x) with basicpass
when: (lldp_ip_class | trim) == "10" when: dev2_conn_method == "direct_lldp"
delegate_to: localhost delegate_to: localhost
ansible.builtin.shell: | ansible.builtin.shell: |
set -e set -e
HOST="{{ lldp_dev2_ip }}" HOST="{{ lldp_dev2_ip }}"
sshpass -f basicpass ssh \ sshpass -f basicpass ssh {{ ssh_opts_common }} \
-o AddressFamily=inet \ -o AddressFamily=inet \
-o StrictHostKeyChecking=no -o PubkeyAuthentication=no \ -o ConnectionAttempts=1 \
-o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \
-o ConnectTimeout=30 \
"{{ dev2_ssh_user }}@${HOST}" echo OK >/dev/null 2>&1 "{{ dev2_ssh_user }}@${HOST}" echo OK >/dev/null 2>&1
args: { executable: /bin/bash } args: { executable: /bin/bash }
register: direct_lldp_try_basicpass register: dev2_lldp_try_basicpass
changed_when: false changed_when: false
ignore_errors: true ignore_errors: true
- name: Select basicpass for direct LLDP if succeeded - name: Select basicpass for direct LLDP if succeeded
when: (lldp_ip_class | trim) == "10" and direct_lldp_try_basicpass.rc == 0 when: dev2_conn_method == "direct_lldp" and dev2_lldp_try_basicpass.rc == 0
delegate_to: localhost delegate_to: localhost
ansible.builtin.set_fact: ansible.builtin.set_fact:
dev2_conn_method: "direct_lldp" dev2_passfile_used_direct: "basicpass"
dev2_passfile_used: "basicpass"
dev2_ssh_host: "{{ lldp_dev2_ip }}"
dev2_ssh_port: 22
changed_when: false changed_when: false
- name: Try DEV2 login via direct LLDP IPv4 (10.x) with basicpass2 (only if first failed) - name: Try DEV2 login via direct LLDP IPv4 (10.x) with basicpass2 (only if first failed)
when: (lldp_ip_class | trim) == "10" and dev2_conn_method != "direct_lldp" when: dev2_conn_method == "direct_lldp" and (dev2_passfile_used_direct is not defined)
delegate_to: localhost delegate_to: localhost
ansible.builtin.shell: | ansible.builtin.shell: |
set -e set -e
HOST="{{ lldp_dev2_ip }}" HOST="{{ lldp_dev2_ip }}"
sshpass -f basicpass2 ssh \ sshpass -f basicpass2 ssh {{ ssh_opts_common }} \
-o AddressFamily=inet \ -o AddressFamily=inet \
-o StrictHostKeyChecking=no -o PubkeyAuthentication=no \ -o ConnectionAttempts=1 \
-o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \
-o ConnectTimeout=30 \
"{{ dev2_ssh_user }}@${HOST}" echo OK >/dev/null 2>&1 "{{ dev2_ssh_user }}@${HOST}" echo OK >/dev/null 2>&1
args: { executable: /bin/bash } args: { executable: /bin/bash }
register: direct_lldp_try_basicpass2 register: dev2_lldp_try_basicpass2
changed_when: false changed_when: false
ignore_errors: true ignore_errors: true
- name: Select basicpass2 for direct LLDP if succeeded - name: Select basicpass2 for direct LLDP if succeeded
when: (lldp_ip_class | trim) == "10" and dev2_conn_method != "direct_lldp" and direct_lldp_try_basicpass2.rc == 0 when: dev2_conn_method == "direct_lldp" and dev2_passfile_used_direct is not defined and dev2_lldp_try_basicpass2.rc == 0
delegate_to: localhost delegate_to: localhost
ansible.builtin.set_fact: ansible.builtin.set_fact:
dev2_conn_method: "direct_lldp" dev2_passfile_used_direct: "basicpass2"
dev2_passfile_used: "basicpass2"
dev2_ssh_host: "{{ lldp_dev2_ip }}"
dev2_ssh_port: 22
changed_when: false changed_when: false
# ============================ PATH B: TUNNEL VIA DEV1 (DEFAULT) ============================ - name: Mark direct LLDP auth as NONE if both failed
- name: Set connection method to tunnel if not already direct LLDP when: dev2_conn_method == "direct_lldp" and dev2_passfile_used_direct is not defined
when: dev2_conn_method != "direct_lldp"
delegate_to: localhost delegate_to: localhost
ansible.builtin.set_fact: ansible.builtin.set_fact:
dev2_conn_method: "tunnel" dev2_passfile_used_direct: "NONE"
changed_when: false changed_when: false
# ============================ TUNNEL PREP (DEV1 temp IP + ARP + tunnel) ============================
- name: Add temporary IP on DEV1 (tolerate 'File exists') - name: Add temporary IP on DEV1 (tolerate 'File exists')
when: dev2_conn_method == "tunnel" when: dev2_conn_method == "tunnel"
ansible.builtin.raw: > ansible.builtin.raw: >
@@ -216,7 +212,7 @@
- name: Capture discovered DEV2 MAC (if any) - name: Capture discovered DEV2 MAC (if any)
when: dev2_conn_method == "tunnel" when: dev2_conn_method == "tunnel"
ansible.builtin.set_fact: ansible.builtin.set_fact:
dev2_mac: "{{ (dev2_mac_scan.stdout | default('')) | trim }}" dev2_mac: "{{ (dev2_mac_scan.stdout | default('') ) | trim }}"
changed_when: false changed_when: false
- name: Clear existing ARP entry for DEV2 on DEV1 (best-effort) - name: Clear existing ARP entry for DEV2 on DEV1 (best-effort)
@@ -243,7 +239,7 @@
when: dev2_conn_method == "tunnel" when: dev2_conn_method == "tunnel"
ansible.builtin.raw: > ansible.builtin.raw: >
{{ pathprefix }} {{ pathprefix }}
arping -U -I {{ arping_iface }} {{ dev2_side_ip_addr }} -c 2 2>/dev/null || true arping -U -I {{ arping_iface }} {{ dev2_side_ip_addr }} -c 3
changed_when: false changed_when: false
failed_when: false failed_when: false
@@ -276,12 +272,12 @@
when: dev2_conn_method == "tunnel" and (pick_port.stdout | trim | length) == 0 when: dev2_conn_method == "tunnel" and (pick_port.stdout | trim | length) == 0
ansible.builtin.meta: end_host ansible.builtin.meta: end_host
# ---- FIX: create ctrl dir first, then derive sock ----
- name: Create control dir for SSH ControlMaster - name: Create control dir for SSH ControlMaster
when: dev2_conn_method == "tunnel" when: dev2_conn_method == "tunnel"
delegate_to: localhost delegate_to: localhost
ansible.builtin.set_fact: ansible.builtin.shell: "mktemp -d"
_ctrl_dir: "{{ lookup('ansible.builtin.pipe', 'mktemp -d') }}" args: { executable: /bin/bash }
register: mktemp_dir
changed_when: false changed_when: false
- name: Record chosen local port and build ControlMaster socket path - name: Record chosen local port and build ControlMaster socket path
@@ -289,7 +285,8 @@
delegate_to: localhost delegate_to: localhost
ansible.builtin.set_fact: ansible.builtin.set_fact:
_local_port: "{{ pick_port.stdout | trim }}" _local_port: "{{ pick_port.stdout | trim }}"
_ctrl_sock: "{{ _ctrl_dir }}/ssh_tunnel_ctl" _ctrl_dir: "{{ mktemp_dir.stdout | trim }}"
_ctrl_sock: "{{ (mktemp_dir.stdout | trim) }}/ssh_tunnel_ctl"
changed_when: false changed_when: false
- name: Start SSH ControlMaster and forward 127.0.0.1:local_port → DEV2:22 via DEV1 - name: Start SSH ControlMaster and forward 127.0.0.1:local_port → DEV2:22 via DEV1
@@ -322,18 +319,16 @@
when: dev2_conn_method == "tunnel" and nc_probe.rc != 0 when: dev2_conn_method == "tunnel" and nc_probe.rc != 0
ansible.builtin.meta: end_host ansible.builtin.meta: end_host
- name: Try DEV2 login through tunnel with basicpass - name: Pick DEV2 password for root (tunnel) try basicpass
when: dev2_conn_method == "tunnel" when: dev2_conn_method == "tunnel"
delegate_to: localhost delegate_to: localhost
ansible.builtin.shell: | ansible.builtin.shell: |
set -e set -e
PORT="{{ _local_port }}" PORT="{{ _local_port }}"
sshpass -f basicpass ssh \ sshpass -f basicpass ssh {{ ssh_opts_common }} \
-o AddressFamily=inet \ -o AddressFamily=inet \
-o StrictHostKeyChecking=no -o PubkeyAuthentication=no \ -o ConnectionAttempts=1 \
-o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \ -p "$PORT" root@127.0.0.1 echo OK >/dev/null 2>&1
-o ConnectTimeout=30 \
-p "$PORT" "{{ dev2_ssh_user }}@127.0.0.1" echo OK >/dev/null 2>&1
args: { executable: /bin/bash } args: { executable: /bin/bash }
register: dev2_try_basicpass register: dev2_try_basicpass
changed_when: false changed_when: false
@@ -343,106 +338,105 @@
when: dev2_conn_method == "tunnel" and dev2_try_basicpass.rc == 0 when: dev2_conn_method == "tunnel" and dev2_try_basicpass.rc == 0
delegate_to: localhost delegate_to: localhost
ansible.builtin.set_fact: ansible.builtin.set_fact:
dev2_passfile_used: "basicpass" dev2_passfile_used_tunnel: "basicpass"
dev2_ssh_host: "127.0.0.1"
dev2_ssh_port: "{{ _local_port }}"
changed_when: false changed_when: false
- name: Try DEV2 login through tunnel with basicpass2 (only if first failed) - name: Try DEV2 login through tunnel with basicpass2 (only if first failed)
when: dev2_conn_method == "tunnel" and dev2_passfile_used == "NONE" when: dev2_conn_method == "tunnel" and (dev2_passfile_used_tunnel is not defined)
delegate_to: localhost delegate_to: localhost
ansible.builtin.shell: | ansible.builtin.shell: |
set -e set -e
PORT="{{ _local_port }}" PORT="{{ _local_port }}"
sshpass -f basicpass2 ssh \ sshpass -f basicpass2 ssh {{ ssh_opts_common }} \
-o AddressFamily=inet \ -o AddressFamily=inet \
-o StrictHostKeyChecking=no -o PubkeyAuthentication=no \ -o ConnectionAttempts=1 \
-o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \ -p "$PORT" root@127.0.0.1 echo OK >/dev/null 2>&1
-o ConnectTimeout=30 \
-p "$PORT" "{{ dev2_ssh_user }}@127.0.0.1" echo OK >/dev/null 2>&1
args: { executable: /bin/bash } args: { executable: /bin/bash }
register: dev2_try_basicpass2 register: dev2_try_basicpass2
changed_when: false changed_when: false
ignore_errors: true ignore_errors: true
- name: Select basicpass2 if tunnel login succeeded - name: Select basicpass2 if tunnel login succeeded
when: dev2_conn_method == "tunnel" and dev2_passfile_used == "NONE" and dev2_try_basicpass2.rc == 0 when: dev2_conn_method == "tunnel" and dev2_passfile_used_tunnel is not defined and dev2_try_basicpass2.rc == 0
delegate_to: localhost delegate_to: localhost
ansible.builtin.set_fact: ansible.builtin.set_fact:
dev2_passfile_used: "basicpass2" dev2_passfile_used_tunnel: "basicpass2"
dev2_ssh_host: "127.0.0.1"
dev2_ssh_port: "{{ _local_port }}"
changed_when: false changed_when: false
- name: Mark tunnel auth as NONE if both attempts failed
when: dev2_conn_method == "tunnel" and dev2_passfile_used_tunnel is not defined
delegate_to: localhost
ansible.builtin.set_fact:
dev2_passfile_used_tunnel: "NONE"
changed_when: false
# Safety guard (only if we discovered MAC)
- name: Read remote eth0 MAC via tunnel (guard) - name: Read remote eth0 MAC via tunnel (guard)
when: dev2_conn_method == "tunnel" and dev2_passfile_used != "NONE" and (dev2_mac | default('') | trim | length > 0) when: dev2_conn_method == "tunnel" and dev2_passfile_used_tunnel != "NONE" and (dev2_mac | default('') | trim | length > 0)
delegate_to: localhost delegate_to: localhost
ansible.builtin.shell: | ansible.builtin.shell: |
set -e set -e
PORT="{{ _local_port }}" PORT="{{ _local_port }}"
sshpass -f "{{ dev2_passfile_used }}" ssh \ sshpass -f "{{ dev2_passfile_used_tunnel }}" ssh {{ ssh_opts_common }} \
-o AddressFamily=inet \ -o AddressFamily=inet \
-o StrictHostKeyChecking=no -o PubkeyAuthentication=no \ -o ConnectionAttempts=1 \
-o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \
-o ConnectTimeout=30 \
-p "$PORT" "{{ dev2_ssh_user }}@127.0.0.1" \ -p "$PORT" "{{ dev2_ssh_user }}@127.0.0.1" \
"cat /sys/class/net/eth0/address 2>/dev/null || echo" "cat /sys/class/net/eth0/address 2>/dev/null || echo" 2>&1
args: { executable: /bin/bash } args: { executable: /bin/bash }
register: dev2_eth0_mac_read register: dev2_eth0_mac_read
changed_when: false changed_when: false
failed_when: false failed_when: false
- name: Abort if remote eth0 MAC != discovered DEV2 MAC - name: Abort if remote eth0 MAC != discovered DEV2 MAC
when: dev2_conn_method == "tunnel" and dev2_passfile_used != "NONE" and (dev2_mac | default('') | trim | length > 0) and when: dev2_conn_method == "tunnel" and dev2_passfile_used_tunnel != "NONE" and (dev2_mac | default('') | trim | length > 0) and ((dev2_eth0_mac_read.stdout | default('') | trim | lower) != (dev2_mac | trim | lower))
((dev2_eth0_mac_read.stdout | default('') | trim | lower) != (dev2_mac | trim | lower))
ansible.builtin.fail: ansible.builtin.fail:
msg: > msg: >
Safety stop: tunnel reached wrong device. Safety stop: tunnel reached wrong device.
expected_dev2_mac={{ dev2_mac | trim }}, expected_dev2_mac={{ dev2_mac | trim }},
remote_eth0_mac={{ dev2_eth0_mac_read.stdout | default('') | trim }}. remote_eth0_mac={{ dev2_eth0_mac_read.stdout | default('') | trim }}.
# ============================ FALLBACK C: DIRECT LLDP IPv4 (10.x) ============================ # ============================ FALLBACKS (only if tunnel/direct failed) ============================
# LLDP IPv4 fallback is only for 10.x in sot-updater; keep that behavior:
- name: Try DEV2 login via LLDP IPv4 10.x (fallback if tunnel auth failed) - name: Try DEV2 login via LLDP IPv4 10.x (fallback if tunnel auth failed)
when: when:
- dev2_conn_method == "tunnel" - dev2_conn_method == "tunnel"
- dev2_passfile_used == "NONE" - dev2_passfile_used_tunnel == "NONE"
- (lldp_dev2_ip | default('')) is match('^10\.') - (lldp_dev2_ip | default('')) is match('^10\\.')
delegate_to: localhost delegate_to: localhost
ansible.builtin.shell: | ansible.builtin.shell: |
set -e set -e
HOST="{{ lldp_dev2_ip }}" HOST="{{ lldp_dev2_ip }}"
for f in basicpass basicpass2; do for f in {{ dev2_passfiles | join(' ') }}; do
if sshpass -f "$f" ssh \ if timeout 20s sshpass -f "$f" ssh {{ ssh_opts_common }} \
-o AddressFamily=inet \ -o AddressFamily=inet \
-o StrictHostKeyChecking=no -o PubkeyAuthentication=no \ -o ConnectionAttempts=1 -o ConnectTimeout=10 \
-o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \
-o ConnectTimeout=20 \
"{{ dev2_ssh_user }}@${HOST}" echo OK >/dev/null 2>&1; then "{{ dev2_ssh_user }}@${HOST}" echo OK >/dev/null 2>&1; then
echo "$f"; exit 0 echo "$f"; exit 0
fi fi
done done
exit 1 echo "NONE"; exit 1
args: { executable: /bin/bash } args: { executable: /bin/bash }
register: dev2_auth_lldp register: dev2_auth_lldp4
changed_when: false changed_when: false
failed_when: false
ignore_errors: true ignore_errors: true
- name: Record LLDP IPv4 fallback decision - name: Record LLDP IPv4 fallback decision
when: when:
- dev2_conn_method == "tunnel" - dev2_conn_method == "tunnel"
- dev2_passfile_used == "NONE" - dev2_passfile_used_tunnel == "NONE"
- (lldp_dev2_ip | default('')) is match('^10\.') - (lldp_dev2_ip | default('')) is match('^10\\.')
delegate_to: localhost delegate_to: localhost
ansible.builtin.set_fact: ansible.builtin.set_fact:
dev2_passfile_used_lldp: "{{ (dev2_auth_lldp.rc == 0) | ternary((dev2_auth_lldp.stdout | trim), 'NONE') }}" dev2_passfile_used_lldp4: "{{ (dev2_auth_lldp4.rc == 0) | ternary((dev2_auth_lldp4.stdout | trim), 'NONE') }}"
changed_when: false changed_when: false
# ============================ FALLBACK D: IPv6 LLDP VIA DEV1 (LAST RESORT) ============================ # LLDP IPv6 nested fallback (last resort): only if tunnel and lldp4 failed
- name: Copy DEV2 passfiles to DEV1 for IPv6 nested SSH (last resort) - name: Copy DEV2 passfiles to DEV1 for IPv6 nested SSH (last resort)
when: when:
- dev2_conn_method == "tunnel" - dev2_conn_method == "tunnel"
- dev2_passfile_used == "NONE" - dev2_passfile_used_tunnel == "NONE"
- (dev2_passfile_used_lldp | default('NONE')) == "NONE" - (dev2_passfile_used_lldp4 is not defined or dev2_passfile_used_lldp4 == "NONE")
- (lldp_dev2_ip6 | default('') | length) > 0 - (lldp_dev2_ip6 | default('') | length) > 0
ansible.builtin.copy: ansible.builtin.copy:
src: "{{ item }}" src: "{{ item }}"
@@ -454,8 +448,8 @@
- name: Try DEV2 login via LLDP IPv6 (nested SSH through DEV1; last resort) - name: Try DEV2 login via LLDP IPv6 (nested SSH through DEV1; last resort)
when: when:
- dev2_conn_method == "tunnel" - dev2_conn_method == "tunnel"
- dev2_passfile_used == "NONE" - dev2_passfile_used_tunnel == "NONE"
- (dev2_passfile_used_lldp | default('NONE')) == "NONE" - (dev2_passfile_used_lldp4 is not defined or dev2_passfile_used_lldp4 == "NONE")
- (lldp_dev2_ip6 | default('') | length) > 0 - (lldp_dev2_ip6 | default('') | length) > 0
delegate_to: localhost delegate_to: localhost
ansible.builtin.shell: | ansible.builtin.shell: |
@@ -463,44 +457,45 @@
IP6="{{ lldp_dev2_ip6 }}" IP6="{{ lldp_dev2_ip6 }}"
for f in {{ dev2_passfiles | join(' ') }}; do for f in {{ dev2_passfiles | join(' ') }}; do
if sshpass -p '{{ dev1_pass }}' ssh {{ ssh_opts_common }} \ if sshpass -p '{{ dev1_pass }}' ssh {{ ssh_opts_common }} \
-o ConnectionAttempts=1 \
"{{ dev1_user }}@{{ ansible_host|default(inventory_hostname) }}" \ "{{ dev1_user }}@{{ ansible_host|default(inventory_hostname) }}" \
"timeout 30s sshpass -f '/tmp/${f}' ssh \ "timeout {{ ssh_timeout }}s sshpass -f '/tmp/${f}' ssh \
-o StrictHostKeyChecking=no -o PubkeyAuthentication=no \ -o StrictHostKeyChecking=no -o PubkeyAuthentication=no \
-o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \ -o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \
-o ConnectTimeout=30 \ -o ConnectTimeout={{ ssh_timeout }} \
'{{ dev2_ssh_user }}@\[${IP6}%{{ dev1_iface }}\]' \ '{{ dev2_ssh_user }}@\[${IP6}%{{ dev1_iface }}\]' 'echo OK' " \
'echo OK'" \
>/dev/null 2>&1; then >/dev/null 2>&1; then
echo "$f"; exit 0 echo "$f"; exit 0
fi fi
done done
exit 1 echo "NONE"; exit 1
args: { executable: /bin/bash } args: { executable: /bin/bash }
register: dev2_auth_lldp6 register: dev2_auth_lldp6
changed_when: false changed_when: false
failed_when: false
ignore_errors: true ignore_errors: true
- name: Record LLDP IPv6 fallback decision - name: Record LLDP IPv6 fallback decision
when: when:
- dev2_conn_method == "tunnel" - dev2_conn_method == "tunnel"
- dev2_passfile_used == "NONE" - dev2_passfile_used_tunnel == "NONE"
- (dev2_passfile_used_lldp | default('NONE')) == "NONE" - (dev2_passfile_used_lldp4 is not defined or dev2_passfile_used_lldp4 == "NONE")
- (lldp_dev2_ip6 | default('') | length) > 0 - (lldp_dev2_ip6 | default('') | length) > 0
delegate_to: localhost delegate_to: localhost
ansible.builtin.set_fact: ansible.builtin.set_fact:
dev2_passfile_used_lldp6: "{{ (dev2_auth_lldp6.rc == 0) | ternary((dev2_auth_lldp6.stdout | trim), 'NONE') }}" dev2_passfile_used_lldp6: "{{ (dev2_auth_lldp6.rc == 0) | ternary((dev2_auth_lldp6.stdout | trim), 'NONE') }}"
changed_when: false changed_when: false
# ============================ FINAL CONNECTION RESOLUTION ============================ # ============================ FINAL DECISION + WRAPPER FACTS ============================
- name: Decide final DEV2 connection mode (direct_lldp > tunnel > lldp4 > lldp6) - name: Decide final DEV2 connection mode (direct_lldp > tunnel > lldp4 > lldp6)
delegate_to: localhost delegate_to: localhost
ansible.builtin.set_fact: ansible.builtin.set_fact:
dev2_conn_final: >- dev2_conn_final: >-
{%- if (dev2_conn_method == 'direct_lldp') and (dev2_passfile_used != 'NONE') -%} {%- if dev2_conn_method == 'direct_lldp' and (dev2_passfile_used_direct | default('NONE')) != 'NONE' -%}
direct_lldp direct_lldp
{%- elif (dev2_conn_method == 'tunnel') and (dev2_passfile_used != 'NONE') -%} {%- elif dev2_conn_method == 'tunnel' and (dev2_passfile_used_tunnel | default('NONE')) != 'NONE' -%}
tunnel tunnel
{%- elif (dev2_passfile_used_lldp | default('NONE')) != 'NONE' -%} {%- elif (dev2_passfile_used_lldp4 | default('NONE')) != 'NONE' -%}
lldp4_fallback lldp4_fallback
{%- elif (dev2_passfile_used_lldp6 | default('NONE')) != 'NONE' -%} {%- elif (dev2_passfile_used_lldp6 | default('NONE')) != 'NONE' -%}
lldp6_via_dev1 lldp6_via_dev1
@@ -513,8 +508,10 @@
when: dev2_conn_final == "none" when: dev2_conn_final == "none"
ansible.builtin.fail: ansible.builtin.fail:
msg: > msg: >
DEV2 unreachable: tunnel auth failed, LLDP IPv4 fallback failed, and LLDP IPv6 fallback failed. DEV2 unreachable: tunnel auth={{ dev2_passfile_used_tunnel | default('n/a') }},
lldp_ipv4='{{ lldp_dev2_ip | default('') }}', lldp_ipv6='{{ lldp_dev2_ip6 | default('') }}'. direct auth={{ dev2_passfile_used_direct | default('n/a') }},
lldp4 auth={{ dev2_passfile_used_lldp4 | default('n/a') }},
lldp6 auth={{ dev2_passfile_used_lldp6 | default('n/a') }}.
- name: Debug final connectivity decision - name: Debug final connectivity decision
when: debugging | bool when: debugging | bool
@@ -522,135 +519,140 @@
ansible.builtin.debug: ansible.builtin.debug:
msg: msg:
- "dev2_conn_final={{ dev2_conn_final }}" - "dev2_conn_final={{ dev2_conn_final }}"
- "tunnel passfile={{ dev2_passfile_used }}" - "tunnel passfile={{ dev2_passfile_used_tunnel | default('n/a') }}"
- "lldp4 passfile={{ dev2_passfile_used_lldp }}" - "direct passfile={{ dev2_passfile_used_direct | default('n/a') }}"
- "lldp6 passfile={{ dev2_passfile_used_lldp6 }}" - "lldp4 passfile={{ dev2_passfile_used_lldp4 | default('n/a') }}"
- "tunnel target={{ dev2_host }}:{{ dev2_port }} (forwarded to 127.0.0.1:{{ _local_port | default('n/a') }})" - "lldp6 passfile={{ dev2_passfile_used_lldp6 | default('n/a') }}"
- "lldp ipv4={{ lldp_dev2_ip | default('<none>') }}" - "tunnel target={{ dev2_host }}:{{ dev2_port }} (forwarded to 127.0.0.1:{{ _local_port | default('na') }})"
- "lldp ipv6={{ lldp_dev2_ip6 | default('<none>') }}" - "lldp ipv4={{ lldp_dev2_ip | default('') }}"
- "lldp ipv6={{ lldp_dev2_ip6 | default('') }}"
# ============================ PHASE 0 ACTION: DEV2 UPTIME ============================ # ---- Wrapper: produce a single executable snippet in dev2_exec_cmd ----
- name: DEV2 | uptime (tunnel) - name: Build DEV2 exec wrapper (controller-side) for Phase 1 commands
when: dev2_conn_final == "tunnel" delegate_to: localhost
ansible.builtin.set_fact:
dev2_exec_cmd: |
set -e
MODE="{{ dev2_conn_final }}"
# DEV2_CMD is injected by Phase 1 tasks
if [ -z "${DEV2_CMD:-}" ]; then
echo "ERROR: DEV2_CMD is empty" >&2
exit 2
fi
case "$MODE" in
tunnel)
PORT="{{ _local_port }}"
PASS="{{ dev2_passfile_used_tunnel }}"
sshpass -f "$PASS" ssh {{ ssh_opts_common }} \
-o AddressFamily=inet \
-o ConnectionAttempts=1 \
-p "$PORT" "{{ dev2_ssh_user }}@127.0.0.1" \
"{{ pathprefix }} ${DEV2_CMD}" 2>&1
;;
direct_lldp)
HOST="{{ lldp_dev2_ip }}"
PASS="{{ dev2_passfile_used_direct }}"
sshpass -f "$PASS" ssh {{ ssh_opts_common }} \
-o AddressFamily=inet \
-o ConnectionAttempts=1 \
"{{ dev2_ssh_user }}@${HOST}" \
"{{ pathprefix }} ${DEV2_CMD}" 2>&1
;;
lldp4_fallback)
HOST="{{ lldp_dev2_ip }}"
PASS="{{ dev2_passfile_used_lldp4 }}"
sshpass -f "$PASS" ssh {{ ssh_opts_common }} \
-o AddressFamily=inet \
-o ConnectionAttempts=1 \
"{{ dev2_ssh_user }}@${HOST}" \
"{{ pathprefix }} ${DEV2_CMD}" 2>&1
;;
lldp6_via_dev1)
IP6="{{ lldp_dev2_ip6 }}"
F="{{ dev2_passfile_used_lldp6 }}"
sshpass -p "{{ dev1_pass }}" ssh {{ ssh_opts_common }} \
-o ConnectionAttempts=1 \
"{{ dev1_user }}@{{ ansible_host | default(inventory_hostname) }}" \
"sshpass -f '/tmp/${F}' ssh \
-o StrictHostKeyChecking=no -o PubkeyAuthentication=no \
-o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \
-o ConnectTimeout={{ ssh_timeout }} \
'{{ dev2_ssh_user }}@\[${IP6}%{{ dev1_iface }}\]' \
'{{ pathprefix }} '"${DEV2_CMD}" 2>&1"
;;
*)
echo "ERROR: unknown MODE=$MODE" >&2
exit 3
;;
esac
changed_when: false
- name: "PPPoE to super DHCP | Phase 1 | On-device actions (initially uptime)"
hosts: all
gather_facts: no
tasks:
# NOTE: Phase 1 assumes Phase 0 facts are still available in-play execution.
# If your runner executes plays independently, merge into one play.
- name: DEV2 | exec wrapper run (Phase 1)
delegate_to: localhost delegate_to: localhost
ansible.builtin.shell: | ansible.builtin.shell: |
PORT="{{ _local_port }}" export DEV2_CMD="uptime"
sshpass -f "{{ dev2_passfile_used }}" ssh {{ ssh_opts_common }} \ {{ dev2_exec_cmd }}
-o AddressFamily=inet \
-o ConnectionAttempts=1 \
-p "$PORT" "{{ dev2_ssh_user }}@127.0.0.1" \
"{{ pathprefix }} uptime 2>&1 || true"
args: { executable: /bin/bash } args: { executable: /bin/bash }
register: dev2_uptime register: dev2_exec
changed_when: false changed_when: false
failed_when: false failed_when: false
- name: DEV2 | uptime debug (tunnel) - name: DEV2 | uptime (stdout)
when: dev2_conn_final == "tunnel"
delegate_to: localhost
ansible.builtin.debug:
msg:
- "uptime.rc={{ dev2_uptime.rc | default('n/a') }}"
- "uptime.stdout='{{ dev2_uptime.stdout | default('') | regex_replace('\r','') }}'"
- "uptime.stderr='{{ dev2_uptime.stderr | default('') | regex_replace('\r','') }}'"
- name: DEV2 | uptime (direct LLDP IPv4 primary)
when: dev2_conn_final == "direct_lldp"
delegate_to: localhost
ansible.builtin.shell: |
HOST="{{ lldp_dev2_ip }}"
sshpass -f "{{ dev2_passfile_used }}" ssh {{ ssh_opts_common }} \
-o AddressFamily=inet \
-o ConnectionAttempts=1 \
"{{ dev2_ssh_user }}@${HOST}" \
"{{ pathprefix }} uptime 2>&1 || true"
args: { executable: /bin/bash }
register: dev2_uptime
changed_when: false
failed_when: false
- name: DEV2 | uptime (LLDP IPv4 fallback)
when: dev2_conn_final == "lldp4_fallback"
delegate_to: localhost
ansible.builtin.shell: |
HOST="{{ lldp_dev2_ip }}"
sshpass -f "{{ dev2_passfile_used_lldp }}" ssh {{ ssh_opts_common }} \
-o AddressFamily=inet \
-o ConnectionAttempts=1 \
"{{ dev2_ssh_user }}@${HOST}" \
"{{ pathprefix }} uptime 2>&1 || true"
args: { executable: /bin/bash }
register: dev2_uptime
changed_when: false
failed_when: false
- name: DEV2 | uptime (LLDP IPv6 via DEV1 nested)
when: dev2_conn_final == "lldp6_via_dev1"
delegate_to: localhost
ansible.builtin.shell: |
IP6="{{ lldp_dev2_ip6 }}"
F="{{ dev2_passfile_used_lldp6 }}"
sshpass -p '{{ dev1_pass }}' ssh {{ ssh_opts_common }} \
-o ConnectionAttempts=1 \
"{{ dev1_user }}@{{ ansible_host|default(inventory_hostname) }}" \
"sshpass -f '/tmp/${F}' ssh \
-o StrictHostKeyChecking=no -o PubkeyAuthentication=no \
-o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \
-o ConnectTimeout=30 \
'{{ dev2_ssh_user }}@\[${IP6}%{{ dev1_iface }}\]' \
'{{ pathprefix }} uptime 2>&1 || true'"
args: { executable: /bin/bash }
register: dev2_uptime
changed_when: false
failed_when: false
- name: Output DEV2 uptime (stdout)
delegate_to: localhost delegate_to: localhost
ansible.builtin.debug: ansible.builtin.debug:
msg: msg:
- "DEV2 uptime via {{ dev2_conn_final }}:" - "DEV2 uptime via {{ dev2_conn_final }}:"
- "{{ (dev2_uptime.stdout | default('') | regex_replace('\r','')) }}" - "{{ dev2_exec.stdout | default('') | regex_replace('\r','') }}"
post_tasks: post_tasks:
- name: Cleanup (always) - name: Cleanup note
block: delegate_to: localhost
- ansible.builtin.debug: ansible.builtin.debug:
msg: "Cleanup: closing tunnel, removing temp IP, removing staged passfiles (best-effort)" msg: "Cleanup: closing tunnel, removing temp IP, removing staged passfiles (best-effort)"
delegate_to: localhost changed_when: false
changed_when: false
always:
- name: Close SSH ControlMaster (best-effort)
when: dev2_conn_method == "tunnel"
delegate_to: localhost
ansible.builtin.shell: |
ssh -S "{{ _ctrl_sock | default('/dev/null') }}" -O exit 2>/dev/null || true
changed_when: false
ignore_errors: true
- name: Remove tunnel control dir (best-effort) - name: Close SSH ControlMaster (best-effort)
when: dev2_conn_method == "tunnel" when: dev2_conn_method | default('') == "tunnel"
delegate_to: localhost delegate_to: localhost
ansible.builtin.file: ansible.builtin.shell: |
path: "{{ _ctrl_dir | default('/tmp/none') }}" ssh -S "{{ _ctrl_sock | default('/dev/null') }}" -O exit 2>/dev/null || true
state: absent args: { executable: /bin/bash }
ignore_errors: true changed_when: false
ignore_errors: true
- name: Remove staged passfiles from DEV1 (best-effort) - name: Remove tunnel control dir (best-effort)
ansible.builtin.raw: > when: dev2_conn_method | default('') == "tunnel"
{{ pathprefix }} delegate_to: localhost
rm -f /tmp/basicpass /tmp/basicpass2 2>/dev/null || true ansible.builtin.file:
changed_when: false path: "{{ _ctrl_dir | default('/tmp/none') }}"
failed_when: false state: absent
ignore_errors: true
- name: Remove temporary IP on DEV1 (tolerate 'Cannot assign requested address') - name: Remove staged passfiles from DEV1 (best-effort)
when: dev2_conn_method == "tunnel" when: dev2_conn_method | default('') == "tunnel"
ansible.builtin.raw: > ansible.builtin.raw: >
{{ pathprefix }} {{ pathprefix }}
ip a del {{ dev2_side_ip }} dev {{ dev1_iface }} rm -f /tmp/basicpass /tmp/basicpass2 2>/dev/null || true
register: del_ip changed_when: false
changed_when: del_ip.rc == 0 failed_when: false
failed_when: >
del_ip.rc != 0 - name: Remove temporary IP on DEV1 (tolerate 'Cannot assign requested address')
and ('Cannot assign requested address' not in (del_ip.stdout | default(''))) when: dev2_conn_method | default('') == "tunnel"
and ('Cannot assign requested address' not in (del_ip.stderr | default(''))) ansible.builtin.raw: >
{{ pathprefix }}
ip a del {{ dev2_side_ip }} dev {{ dev1_iface }}
register: del_ip
changed_when: del_ip.rc == 0
failed_when: >
del_ip.rc != 0
and ('Cannot assign requested address' not in (del_ip.stdout | default('')))
and ('Cannot assign requested address' not in (del_ip.stderr | default('')))