---
- name: System firmware version check (banner probe + journal)
  hosts: all
  gather_facts: no

  # RabbitMQ (match your existing defaults)
  vars:
    rmq_host: "10.210.12.2"
    rmq_port: 15672
    rmq_user: "admin"
    rmq_pass: "change_me"
    rmq_vhost: "app"
    rmq_exchange: "controls"
    control_queue: "queue_controls"

    # Probing/SSH defaults (kept identical to your afterupgrade_check.yml)
    tcp_port: 22
    nc_timeout: 5
    ssh_user: "{{ ansible_user | default('root') }}"
    ssh_pass: "{{ ansible_ssh_pass | default('wavewave') }}"
    ssh_timeout: 10

  tasks:
    # -------- Fast TCP reachability probe (controller-side), unchanged style --------
    - name: Check if TCP/{{ tcp_port }} is reachable with nc
      delegate_to: localhost
      ansible.builtin.shell: |
        nc -z -w{{ nc_timeout }} {{ ansible_host | default(inventory_hostname) }} {{ tcp_port }}
      register: nc_probe
      changed_when: false
      ignore_errors: true

    # If TCP failed → emit a single journal line and stop
    - name: Build TCP-fail journal payload
      when: nc_probe.rc != 0
      delegate_to: localhost
      ansible.builtin.set_fact:
        tcp_fail_payload:
          inscope_device: "{{ ansible_hostname | default(inventory_hostname) }}"
          task_name: "journal_add"
          task_result: >-
            system check: TCP {{ tcp_port }} unreachable (nc failed)

    - name: Publish TCP-fail journal
      when: tcp_fail_payload is defined
      delegate_to: localhost
      ansible.builtin.uri:
        url: "http://{{ rmq_host }}:{{ rmq_port }}/api/exchanges/{{ rmq_vhost | urlencode }}/{{ rmq_exchange | urlencode }}/publish"
        method: POST
        user: "{{ rmq_user }}"
        password: "{{ rmq_pass }}"
        force_basic_auth: true
        status_code: 200
        headers:
          content-type: "application/json"
        body_format: json
        body:
          properties:
            content_type: "application/json"
          routing_key: "{{ control_queue }}"
          payload: "{{ tcp_fail_payload | to_json }}"
          payload_encoding: "string"
      register: rmq_tcp_fail_resp
      changed_when: (rmq_tcp_fail_resp.json is defined) and (rmq_tcp_fail_resp.json.routed | default(false) | bool)

    - name: Stop host after TCP failure
      when: nc_probe.rc != 0
      ansible.builtin.meta: end_host

    # -------- SSH banner probe (controller-side), EXACT command reused --------
    - name: Probe banner via SSH from controller (classic extraction)
      delegate_to: localhost
      ansible.builtin.shell: |
        set -e
        USER="{{ ssh_user }}"
        HOST="{{ ansible_host | default(inventory_hostname) }}"
        sshpass -p '{{ ssh_pass }}' \
        ssh -o StrictHostKeyChecking=no -o PubkeyAuthentication=no -o ConnectTimeout={{ ssh_timeout }} \
          "${USER}@${HOST}" \
          "PATH=/sbin:/usr/sbin:/bin:/usr/bin:$PATH; cat /etc/banner | grep -i rev | head -n1"
      register: banner_probe
      changed_when: false
      ignore_errors: true

    # SSH error → journal and stop
    - name: Build SSH-fail journal payload
      when: banner_probe.rc != 0
      delegate_to: localhost
      ansible.builtin.set_fact:
        ssh_fail_payload:
          inscope_device: "{{ ansible_hostname | default(inventory_hostname) }}"
          task_name: "journal_add"
          task_result: >-
            system check: SSH error - {{ (banner_probe.stderr | default('') | trim) }}

    - name: Publish SSH-fail journal
      when: ssh_fail_payload is defined
      delegate_to: localhost
      ansible.builtin.uri:
        url: "http://{{ rmq_host }}:{{ rmq_port }}/api/exchanges/{{ rmq_vhost | urlencode }}/{{ rmq_exchange | urlencode }}/publish"
        method: POST
        user: "{{ rmq_user }}"
        password: "{{ rmq_pass }}"
        force_basic_auth: true
        status_code: 200
        headers:
          content-type: "application/json"
        body_format: json
        body:
          properties:
            content_type: "application/json"
          routing_key: "{{ control_queue }}"
          payload: "{{ ssh_fail_payload | to_json }}"
          payload_encoding: "string"
      register: rmq_ssh_fail_resp
      changed_when: (rmq_ssh_fail_resp.json is defined) and (rmq_ssh_fail_resp.json.routed | default(false) | bool)

    - name: Stop host after SSH failure
      when: banner_probe.rc != 0
      ansible.builtin.meta: end_host

    # -------- Success: banner line captured → journal with "system check:" prefix --------
    - name: Build success journal payload (banner captured)
      delegate_to: localhost
      ansible.builtin.set_fact:
        sc_success_payload:
          inscope_device: "{{ ansible_hostname | default(inventory_hostname) }}"
          task_name: "journal_add"
          task_result: >-
            system check: Banner='{{ (banner_probe.stdout | default('') | trim) }}'

    - name: Publish success journal
      delegate_to: localhost
      ansible.builtin.uri:
        url: "http://{{ rmq_host }}:{{ rmq_port }}/api/exchanges/{{ rmq_vhost | urlencode }}/{{ rmq_exchange | urlencode }}/publish"
        method: POST
        user: "{{ rmq_user }}"
        password: "{{ rmq_pass }}"
        force_basic_auth: true
        status_code: 200
        headers:
          content-type: "application/json"
        body_format: json
        body:
          properties:
            content_type: "application/json"
          routing_key: "{{ control_queue }}"
          payload: "{{ sc_success_payload | to_json }}"
          payload_encoding: "string"
      register: rmq_sc_success_resp
      changed_when: (rmq_sc_success_resp.json is defined) and (rmq_sc_success_resp.json.routed | default(false) | bool)