From fd2b97673a4c961d43056a64c1228126e9ea5438 Mon Sep 17 00:00:00 2001
From: pavel <pavel.larkin@ikeja.co.za>
Date: Tue, 20 Jan 2026 07:23:06 +0200
Subject: [PATCH] 0723

---
 .../indoor-restart-cloudagent.yml             | 37 +++++++++++++++++++
 .../ansible-playbooks/sot-updater-wrapper.yml |  9 +++++
 2 files changed, 46 insertions(+)

diff --git a/files/ansible-playbooks/indoor-restart-cloudagent.yml b/files/ansible-playbooks/indoor-restart-cloudagent.yml
index ad09fdc..9f5e467 100644
--- a/files/ansible-playbooks/indoor-restart-cloudagent.yml
+++ b/files/ansible-playbooks/indoor-restart-cloudagent.yml
@@ -116,6 +116,14 @@
           - "LLDP candidate IP={{ lldp_dev2_ip | default('<none>') }}"
           - "LLDP class={{ lldp_ip_class | default('none') }}"
 
+    # >>> STEP 2 (single, correct task): override dev2_host before any tunnel tasks use it <<<
+    - name: Override dev2_host from LLDP when candidate is 192.168.x.x (for tunnel target)
+      when: (lldp_ip_class | trim) == "192_168" and (lldp_dev2_ip | trim | length > 0)
+      delegate_to: localhost
+      ansible.builtin.set_fact:
+        dev2_host: "{{ lldp_dev2_ip | trim }}"
+      changed_when: false
+
     - name: Set connection method to tunnel by default
       delegate_to: localhost
       ansible.builtin.set_fact:
@@ -392,6 +400,35 @@
         dev2_ssh_port: "{{ _local_port }}"
       changed_when: false
 
+    # ============================ SAFETY GUARD (TUNNEL ONLY): VERIFY WE REACHED DEV2 ============================
+    - name: Read remote eth0 MAC via selected connection (guard: ensure this is DEV2)
+      when: dev2_conn_method == "tunnel" and dev2_passfile_used != "NONE" and (dev2_mac | default('') | trim | length > 0)
+      delegate_to: localhost
+      ansible.builtin.shell: |
+        set -e
+        HOST="{{ dev2_ssh_host }}"
+        PORT="{{ dev2_ssh_port }}"
+        sshpass -f "{{ dev2_passfile_used }}" ssh \
+          -o AddressFamily=inet \
+          -o StrictHostKeyChecking=no -o PubkeyAuthentication=no \
+          -o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \
+          -o ConnectTimeout=30 \
+          -p "$PORT" "{{ dev2_ssh_user }}@${HOST}" \
+          "cat /sys/class/net/eth0/address 2>/dev/null || echo"
+      args:
+        executable: /bin/bash
+      register: dev2_eth0_mac_read
+      changed_when: false
+
+    - name: Abort if remote eth0 MAC != discovered DEV2 MAC
+      when: dev2_conn_method == "tunnel" and dev2_passfile_used != "NONE" and (dev2_mac | default('') | trim | length > 0)
+      ansible.builtin.fail:
+        msg: >
+          Safety stop: tunnel reached wrong device.
+          expected_dev2_mac={{ dev2_mac | trim }},
+          remote_eth0_mac={{ dev2_eth0_mac_read.stdout | trim }}.
+      failed_when: (dev2_eth0_mac_read.stdout | trim | lower) != (dev2_mac | trim | lower)
+
     # ============================ DEV2 HOSTNAME GUARD ============================
     - name: Stop and journal if DEV2 auth failed (no passfile worked)
       when: dev2_passfile_used == "NONE"
diff --git a/files/ansible-playbooks/sot-updater-wrapper.yml b/files/ansible-playbooks/sot-updater-wrapper.yml
index d7a501e..d8be764 100644
--- a/files/ansible-playbooks/sot-updater-wrapper.yml
+++ b/files/ansible-playbooks/sot-updater-wrapper.yml
@@ -24,6 +24,15 @@
 - name: Phase 2 | Refresh in-memory target IP after iponly
   hosts: all
   gather_facts: no
+  vars:
+    rmq_host: "{{ lookup('env','RMQ_HOST') | default('10.210.12.2', true) }}"
+    rmq_port: "{{ lookup('env','RMQ_PORT') | default('15672', true) }}"
+    rmq_user: "{{ lookup('env','RMQ_USER') | default('admin', true) }}"
+    rmq_pass: "{{ lookup('env','RMQ_PASS') | default('change_me', true) }}"
+    rmq_vhost: "{{ lookup('env','RMQ_VHOST') | default('app', true) }}"
+    rmq_exchange: "{{ lookup('env','RMQ_EXCHANGE') | default('controls', true) }}"
+    control_queue: "{{ lookup('env','CONTROLQUEUE') | default('queue_controls', true) }}"
+
 
   tasks:
     - name: "Wrapper | Extract nb_ip from nb_onedevice_update.py stdout"