1229 lines
48 KiB
YAML
1229 lines
48 KiB
YAML
# ptsd-migration.yml — PPPoE to super DHCP
|
|
# Phase 0: reliable DEV2 connectivity + wrapper build (no DEV2 commands)
|
|
# Phase 1: DEV2 commands via wrapper (initially uptime)
|
|
|
|
- name: "PPPoE to super DHCP | Phase 0+1 | Reliable DEV2 connectivity + wrapper + uptime"
|
|
hosts: all
|
|
gather_facts: no
|
|
|
|
vars:
|
|
pathprefix: "PATH=/sbin:/usr/sbin:/bin:/usr/bin:$PATH; "
|
|
|
|
dev1_user: "root"
|
|
dev1_pass: "wavewave"
|
|
|
|
dev2_host: "192.168.1.1"
|
|
dev2_port: 22
|
|
|
|
dev2_side_ip: "192.168.1.11/24"
|
|
dev2_side_ip_addr: "{{ dev2_side_ip.split('/')[0] }}"
|
|
dev1_iface: "br-wan"
|
|
|
|
arping_iface: "eth0"
|
|
|
|
dev2_ssh_user: "root"
|
|
dev2_passfiles:
|
|
- "basicpass"
|
|
- "basicpass2"
|
|
|
|
ssh_opts_common: >-
|
|
-o PreferredAuthentications=password
|
|
-o PubkeyAuthentication=no
|
|
-o StrictHostKeyChecking=no
|
|
-o UserKnownHostsFile=/dev/null
|
|
-o NumberOfPasswordPrompts=1
|
|
-o ConnectTimeout=30
|
|
-o ConnectionAttempts=1
|
|
-o LogLevel=ERROR
|
|
|
|
debugging: true
|
|
ssh_timeout: 30
|
|
|
|
pre_tasks:
|
|
- name: Initialize passfile facts defensively (avoid undefined vars later)
|
|
delegate_to: localhost
|
|
ansible.builtin.set_fact:
|
|
dev2_passfile_used_direct: "NONE"
|
|
dev2_passfile_used_tunnel: "NONE"
|
|
dev2_passfile_used_lldp4: "NONE"
|
|
dev2_passfile_used_lldp6: "NONE"
|
|
changed_when: false
|
|
|
|
- name: Report init migrate accumulator
|
|
delegate_to: localhost
|
|
ansible.builtin.set_fact:
|
|
ptsd_migrate_report: ""
|
|
changed_when: false
|
|
|
|
- name: Read DEV1 hostname (busybox-safe)
|
|
ansible.builtin.raw: >
|
|
{{ pathprefix }}
|
|
(cat /proc/sys/kernel/hostname 2>/dev/null || echo "")
|
|
register: dev1_host_read
|
|
changed_when: false
|
|
|
|
- name: Stop early if connected DEV1 hostname != inventory (guard)
|
|
ansible.builtin.meta: end_host
|
|
when: (dev1_host_read.stdout | trim | length > 0) and
|
|
((dev1_host_read.stdout | trim) != (inventory_hostname | string))
|
|
|
|
tasks:
|
|
# ============================ PHASE 0: LLDP DISCOVERY (IPv4 + IPv6) ============================
|
|
- name: Compute hostname digits key for LLDP lookup (DEV2)
|
|
ansible.builtin.set_fact:
|
|
dev2_lldp_digits: "{{ (inventory_hostname | string) | regex_replace('[^0-9]', '') }}"
|
|
changed_when: false
|
|
|
|
- name: Discover DEV2 candidate IPv4 via LLDP on DEV1 (best-effort)
|
|
ansible.builtin.raw: >
|
|
{{ pathprefix }}
|
|
DIGITS="{{ dev2_lldp_digits }}";
|
|
cat /var/run/lldp_server.json 2>/dev/null \
|
|
| grep -Ei "ikeja${DIGITS}\"" -A 10 \
|
|
| grep address \
|
|
| grep -vE 'subtype|ipv6' \
|
|
| awk -F'"' '{ print $4 }' \
|
|
| head -n1
|
|
register: dev2_lldp_ip_raw
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: Discover DEV2 candidate IPv6 via LLDP on DEV1 (best-effort)
|
|
ansible.builtin.raw: >
|
|
{{ pathprefix }}
|
|
DIGITS="{{ dev2_lldp_digits }}";
|
|
cat /var/run/lldp_server.json 2>/dev/null \
|
|
| grep -Ei "ikeja${DIGITS}\"" -A 15 \
|
|
| grep 'address_ipv6' \
|
|
| awk -F'"' '{ print $4 }' \
|
|
| head -n1
|
|
register: dev2_lldp_ip6_raw
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: Capture LLDP-derived DEV2 IP facts
|
|
ansible.builtin.set_fact:
|
|
lldp_dev2_ip: "{{ (dev2_lldp_ip_raw.stdout | default('')) | trim }}"
|
|
lldp_dev2_ip6: "{{ (dev2_lldp_ip6_raw.stdout | default('')) | trim }}"
|
|
changed_when: false
|
|
|
|
- name: Classify LLDP IPv4 candidate
|
|
delegate_to: localhost
|
|
ansible.builtin.set_fact:
|
|
lldp_ip_class: >-
|
|
{% set ip = (lldp_dev2_ip | default('')) %}
|
|
{% if ip == '' %}none
|
|
{% elif ip.startswith('10.') %}10
|
|
{% elif ip.startswith('192.168.') %}192_168
|
|
{% else %}other{% endif %}
|
|
changed_when: false
|
|
|
|
- name: Debug LLDP candidates
|
|
when: debugging | bool
|
|
delegate_to: localhost
|
|
ansible.builtin.debug:
|
|
msg:
|
|
- "LLDP digits={{ dev2_lldp_digits | default('') }}"
|
|
- "LLDP IPv4 candidate={{ lldp_dev2_ip | default('<none>') }}"
|
|
- "LLDP IPv4 class={{ lldp_ip_class | default('none') }}"
|
|
- "LLDP IPv6 candidate={{ lldp_dev2_ip6 | default('<none>') }}"
|
|
|
|
# ============================ PHASE 0: PRIMARY PATH DECISION ============================
|
|
- name: Override dev2_host from LLDP when candidate is 192.168.x.x
|
|
when: (lldp_ip_class | trim) == "192_168" and (lldp_dev2_ip | trim | length > 0)
|
|
delegate_to: localhost
|
|
ansible.builtin.set_fact:
|
|
dev2_host: "{{ lldp_dev2_ip | trim }}"
|
|
changed_when: false
|
|
|
|
- name: Set connection method initial (direct_lldp if 10.x else tunnel)
|
|
delegate_to: localhost
|
|
ansible.builtin.set_fact:
|
|
dev2_conn_method: "{{ 'direct_lldp' if ((lldp_ip_class | trim) == '10') else 'tunnel' }}"
|
|
changed_when: false
|
|
|
|
# ============================ PHASE 0: DIRECT LLDP IPv4 AUTH (10.x) ============================
|
|
- name: Try DEV2 login via direct LLDP IPv4 (10.x) with basicpass
|
|
when: dev2_conn_method == "direct_lldp"
|
|
delegate_to: localhost
|
|
ansible.builtin.shell: |
|
|
set -e
|
|
HOST="{{ lldp_dev2_ip }}"
|
|
sshpass -f basicpass ssh {{ ssh_opts_common }} \
|
|
-o AddressFamily=inet \
|
|
"{{ dev2_ssh_user }}@${HOST}" echo OK >/dev/null 2>&1
|
|
args: { executable: /bin/bash }
|
|
register: dev2_lldp_try_basicpass
|
|
changed_when: false
|
|
ignore_errors: true
|
|
|
|
- name: Select basicpass for direct LLDP if succeeded
|
|
when: dev2_conn_method == "direct_lldp" and dev2_lldp_try_basicpass.rc == 0
|
|
delegate_to: localhost
|
|
ansible.builtin.set_fact:
|
|
dev2_passfile_used_direct: "basicpass"
|
|
changed_when: false
|
|
|
|
- name: Try DEV2 login via direct LLDP IPv4 (10.x) with basicpass2 (only if first failed)
|
|
when: dev2_conn_method == "direct_lldp" and (dev2_passfile_used_direct == "NONE")
|
|
delegate_to: localhost
|
|
ansible.builtin.shell: |
|
|
set -e
|
|
HOST="{{ lldp_dev2_ip }}"
|
|
sshpass -f basicpass2 ssh {{ ssh_opts_common }} \
|
|
-o AddressFamily=inet \
|
|
"{{ dev2_ssh_user }}@${HOST}" echo OK >/dev/null 2>&1
|
|
args: { executable: /bin/bash }
|
|
register: dev2_lldp_try_basicpass2
|
|
changed_when: false
|
|
ignore_errors: true
|
|
|
|
- name: Select basicpass2 for direct LLDP if succeeded
|
|
when: dev2_conn_method == "direct_lldp" and dev2_passfile_used_direct == "NONE" and dev2_lldp_try_basicpass2.rc == 0
|
|
delegate_to: localhost
|
|
ansible.builtin.set_fact:
|
|
dev2_passfile_used_direct: "basicpass2"
|
|
changed_when: false
|
|
|
|
# ============================ PHASE 0: TUNNEL PREP (DEV1 temp IP + ARP + tunnel) ============================
|
|
- name: Add temporary IP on DEV1 (tolerate 'File exists')
|
|
when: dev2_conn_method == "tunnel"
|
|
ansible.builtin.raw: >
|
|
{{ pathprefix }}
|
|
ip a add {{ dev2_side_ip }} dev {{ dev1_iface }}
|
|
register: add_ip
|
|
changed_when: add_ip.rc == 0
|
|
failed_when: >
|
|
add_ip.rc != 0
|
|
and ('File exists' not in (add_ip.stdout | default('')))
|
|
and ('File exists' not in (add_ip.stderr | default('')))
|
|
|
|
- name: Discover DEV2 MAC via bridge fdb on DEV1 (best-effort)
|
|
when: dev2_conn_method == "tunnel"
|
|
ansible.builtin.raw: >
|
|
{{ pathprefix }}
|
|
bridge fdb show {{ dev1_iface }} | grep eth0 | grep -v permanent | grep master | awk '{print $1}' | head -n1
|
|
register: dev2_mac_scan
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: Capture discovered DEV2 MAC (if any)
|
|
when: dev2_conn_method == "tunnel"
|
|
ansible.builtin.set_fact:
|
|
dev2_mac: "{{ (dev2_mac_scan.stdout | default('') ) | trim }}"
|
|
changed_when: false
|
|
|
|
- name: Clear existing ARP entry for DEV2 on DEV1 (best-effort)
|
|
when: dev2_conn_method == "tunnel"
|
|
ansible.builtin.raw: >
|
|
{{ pathprefix }}
|
|
ip neigh del {{ dev2_host }} dev {{ dev1_iface }} 2>/dev/null || true
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: Add static ARP entry on DEV1 (if MAC discovered; tolerate 'File exists')
|
|
when: dev2_conn_method == "tunnel" and (dev2_mac | default('') | length > 0)
|
|
ansible.builtin.raw: >
|
|
{{ pathprefix }}
|
|
ip neigh add {{ dev2_host }} lladdr {{ dev2_mac }} dev {{ dev1_iface }} nud permanent
|
|
register: dev2_arp_add
|
|
changed_when: dev2_arp_add.rc == 0
|
|
failed_when: >
|
|
dev2_arp_add.rc != 0
|
|
and ('File exists' not in (dev2_arp_add.stdout | default('')))
|
|
and ('File exists' not in (dev2_arp_add.stderr | default('')))
|
|
|
|
- name: Refresh ARP (best-effort)
|
|
when: dev2_conn_method == "tunnel"
|
|
ansible.builtin.raw: >
|
|
{{ pathprefix }}
|
|
arping -U -I {{ arping_iface }} {{ dev2_side_ip_addr }} -c 3
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: Pick a free local TCP port for the tunnel (controller side)
|
|
when: dev2_conn_method == "tunnel"
|
|
delegate_to: localhost
|
|
ansible.builtin.shell: |
|
|
set -e
|
|
pick() {
|
|
for i in $(seq 1 25); do
|
|
p="$(shuf -i 20000-39999 -n 1)"
|
|
if command -v ss >/dev/null 2>&1; then
|
|
if ! ss -ltn | awk '{print $4}' | grep -qE "(:|\.)${p}$"; then
|
|
echo "$p"; return 0
|
|
fi
|
|
else
|
|
if ! nc -z 127.0.0.1 "$p" >/dev/null 2>&1; then
|
|
echo "$p"; return 0
|
|
fi
|
|
fi
|
|
done
|
|
return 1
|
|
}
|
|
pick
|
|
args: { executable: /bin/bash }
|
|
register: pick_port
|
|
changed_when: false
|
|
|
|
- name: Stop if no free local port was found
|
|
when: dev2_conn_method == "tunnel" and (pick_port.stdout | trim | length) == 0
|
|
ansible.builtin.meta: end_host
|
|
|
|
- name: Create control dir for SSH ControlMaster
|
|
when: dev2_conn_method == "tunnel"
|
|
delegate_to: localhost
|
|
ansible.builtin.shell: "mktemp -d"
|
|
args: { executable: /bin/bash }
|
|
register: mktemp_dir
|
|
changed_when: false
|
|
|
|
- name: Record chosen local port and build ControlMaster socket path
|
|
when: dev2_conn_method == "tunnel"
|
|
delegate_to: localhost
|
|
ansible.builtin.set_fact:
|
|
_local_port: "{{ pick_port.stdout | trim }}"
|
|
_ctrl_dir: "{{ mktemp_dir.stdout | trim }}"
|
|
_ctrl_sock: "{{ (mktemp_dir.stdout | trim) }}/ssh_tunnel_ctl"
|
|
changed_when: false
|
|
|
|
- name: Start SSH ControlMaster and forward 127.0.0.1:local_port → DEV2:22 via DEV1
|
|
when: dev2_conn_method == "tunnel"
|
|
delegate_to: localhost
|
|
ansible.builtin.shell: |
|
|
set -e
|
|
USER="{{ dev1_user }}"
|
|
HOST="{{ ansible_host | default(inventory_hostname) }}"
|
|
sshpass -p '{{ dev1_pass }}' ssh -f -N {{ ssh_opts_common }} \
|
|
-M -S "{{ _ctrl_sock }}" \
|
|
-L "127.0.0.1:{{ _local_port }}:{{ dev2_host }}:{{ dev2_port }}" \
|
|
"${USER}@${HOST}"
|
|
args: { executable: /bin/bash }
|
|
register: start_tunnel
|
|
changed_when: true
|
|
|
|
- name: Probe TCP reachability to DEV2 through the tunnel (nc)
|
|
when: dev2_conn_method == "tunnel"
|
|
delegate_to: localhost
|
|
ansible.builtin.shell: |
|
|
set -e
|
|
nc -z -w5 127.0.0.1 "{{ _local_port }}"
|
|
args: { executable: /bin/bash }
|
|
register: nc_probe
|
|
changed_when: false
|
|
ignore_errors: true
|
|
|
|
- name: Stop if tunnel TCP probe failed
|
|
when: dev2_conn_method == "tunnel" and nc_probe.rc != 0
|
|
ansible.builtin.meta: end_host
|
|
|
|
- name: Pick DEV2 password for root (tunnel) try basicpass
|
|
when: dev2_conn_method == "tunnel"
|
|
delegate_to: localhost
|
|
ansible.builtin.shell: |
|
|
set -e
|
|
PORT="{{ _local_port }}"
|
|
sshpass -f basicpass ssh {{ ssh_opts_common }} \
|
|
-o AddressFamily=inet \
|
|
-p "$PORT" root@127.0.0.1 echo OK >/dev/null 2>&1
|
|
args: { executable: /bin/bash }
|
|
register: dev2_try_basicpass
|
|
changed_when: false
|
|
ignore_errors: true
|
|
|
|
- name: Select basicpass if tunnel login succeeded
|
|
when: dev2_conn_method == "tunnel" and dev2_try_basicpass.rc == 0
|
|
delegate_to: localhost
|
|
ansible.builtin.set_fact:
|
|
dev2_passfile_used_tunnel: "basicpass"
|
|
changed_when: false
|
|
|
|
- name: Try DEV2 login through tunnel with basicpass2 (only if first failed)
|
|
when: dev2_conn_method == "tunnel" and (dev2_passfile_used_tunnel == "NONE")
|
|
delegate_to: localhost
|
|
ansible.builtin.shell: |
|
|
set -e
|
|
PORT="{{ _local_port }}"
|
|
sshpass -f basicpass2 ssh {{ ssh_opts_common }} \
|
|
-o AddressFamily=inet \
|
|
-p "$PORT" root@127.0.0.1 echo OK >/dev/null 2>&1
|
|
args: { executable: /bin/bash }
|
|
register: dev2_try_basicpass2
|
|
changed_when: false
|
|
ignore_errors: true
|
|
|
|
- name: Select basicpass2 if tunnel login succeeded
|
|
when: dev2_conn_method == "tunnel" and dev2_passfile_used_tunnel == "NONE" and dev2_try_basicpass2.rc == 0
|
|
delegate_to: localhost
|
|
ansible.builtin.set_fact:
|
|
dev2_passfile_used_tunnel: "basicpass2"
|
|
changed_when: false
|
|
|
|
# ============================ PHASE 0: SAFETY GUARD (MAC CHECK) ============================
|
|
- name: Read remote eth0 MAC via tunnel (guard, sanitized)
|
|
when:
|
|
- dev2_conn_method == "tunnel"
|
|
- (dev2_passfile_used_tunnel | default('NONE')) != "NONE"
|
|
- (dev2_mac | default('') | length) > 0
|
|
delegate_to: localhost
|
|
ansible.builtin.shell: |
|
|
PORT="{{ _local_port }}"
|
|
sshpass -f "{{ dev2_passfile_used_tunnel }}" ssh {{ ssh_opts_common }} \
|
|
-p "$PORT" "{{ dev2_ssh_user }}@127.0.0.1" \
|
|
"cat /sys/class/net/eth0/address 2>/dev/null || ip link show eth0 2>/dev/null" 2>&1
|
|
args: { executable: /bin/bash }
|
|
register: dev2_eth0_mac_raw
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: Normalize remote eth0 MAC (extract last MAC-like token)
|
|
when:
|
|
- dev2_conn_method == "tunnel"
|
|
- (dev2_passfile_used_tunnel | default('NONE')) != "NONE"
|
|
- (dev2_mac | default('') | length) > 0
|
|
delegate_to: localhost
|
|
ansible.builtin.set_fact:
|
|
remote_eth0_mac: >-
|
|
{{
|
|
(
|
|
(dev2_eth0_mac_raw.stdout | default('') | regex_replace('\r','')) ~ "\n" ~
|
|
(dev2_eth0_mac_raw.stderr | default('') | regex_replace('\r',''))
|
|
)
|
|
| regex_findall('([0-9a-fA-F]{2}(?::[0-9a-fA-F]{2}){5})')
|
|
| last
|
|
| default('')
|
|
| lower
|
|
}}
|
|
changed_when: false
|
|
|
|
- name: Abort if remote eth0 MAC != discovered DEV2 MAC
|
|
when:
|
|
- dev2_conn_method == "tunnel"
|
|
- (dev2_passfile_used_tunnel | default('NONE')) != "NONE"
|
|
- (dev2_mac | default('') | length) > 0
|
|
- (remote_eth0_mac | default('') | length) > 0
|
|
- (remote_eth0_mac | lower) != (dev2_mac | lower)
|
|
ansible.builtin.fail:
|
|
msg: >-
|
|
Safety stop: tunnel reached wrong device.
|
|
expected_dev2_mac={{ dev2_mac }}, remote_eth0_mac={{ remote_eth0_mac }}
|
|
|
|
# ============================ PHASE 0: FALLBACKS (only if tunnel auth failed) ============================
|
|
- name: Try DEV2 login via LLDP IPv4 10.x (fallback if tunnel auth failed)
|
|
when:
|
|
- dev2_conn_method == "tunnel"
|
|
- dev2_passfile_used_tunnel == "NONE"
|
|
- (lldp_dev2_ip | default('')) is match('^10\\.')
|
|
delegate_to: localhost
|
|
ansible.builtin.shell: |
|
|
set -e
|
|
HOST="{{ lldp_dev2_ip }}"
|
|
for f in {{ dev2_passfiles | join(' ') }}; do
|
|
if timeout 20s sshpass -f "$f" ssh {{ ssh_opts_common }} \
|
|
-o AddressFamily=inet \
|
|
-o ConnectTimeout=10 \
|
|
"{{ dev2_ssh_user }}@${HOST}" echo OK >/dev/null 2>&1; then
|
|
echo "$f"; exit 0
|
|
fi
|
|
done
|
|
echo "NONE"; exit 1
|
|
args: { executable: /bin/bash }
|
|
register: dev2_auth_lldp4
|
|
changed_when: false
|
|
failed_when: false
|
|
ignore_errors: true
|
|
|
|
- name: Record LLDP IPv4 fallback decision
|
|
when:
|
|
- dev2_conn_method == "tunnel"
|
|
- dev2_passfile_used_tunnel == "NONE"
|
|
- (lldp_dev2_ip | default('')) is match('^10\\.')
|
|
delegate_to: localhost
|
|
ansible.builtin.set_fact:
|
|
dev2_passfile_used_lldp4: "{{ (dev2_auth_lldp4.rc == 0) | ternary((dev2_auth_lldp4.stdout | trim), 'NONE') }}"
|
|
changed_when: false
|
|
|
|
- name: Copy DEV2 passfiles to DEV1 for IPv6 nested SSH (last resort)
|
|
when:
|
|
- dev2_conn_method == "tunnel"
|
|
- dev2_passfile_used_tunnel == "NONE"
|
|
- dev2_passfile_used_lldp4 == "NONE"
|
|
- (lldp_dev2_ip6 | default('') | length) > 0
|
|
ansible.builtin.copy:
|
|
src: "{{ item }}"
|
|
dest: "/tmp/{{ item }}"
|
|
mode: "0600"
|
|
loop: "{{ dev2_passfiles }}"
|
|
ignore_errors: true
|
|
|
|
- name: Try DEV2 login via LLDP IPv6 (nested SSH through DEV1; last resort)
|
|
when:
|
|
- dev2_conn_method == "tunnel"
|
|
- dev2_passfile_used_tunnel == "NONE"
|
|
- dev2_passfile_used_lldp4 == "NONE"
|
|
- (lldp_dev2_ip6 | default('') | length) > 0
|
|
delegate_to: localhost
|
|
ansible.builtin.shell: |
|
|
set -e
|
|
IP6="{{ lldp_dev2_ip6 }}"
|
|
for f in {{ dev2_passfiles | join(' ') }}; do
|
|
if sshpass -p '{{ dev1_pass }}' ssh {{ ssh_opts_common }} \
|
|
"{{ dev1_user }}@{{ ansible_host|default(inventory_hostname) }}" \
|
|
"timeout {{ ssh_timeout }}s sshpass -f '/tmp/${f}' ssh \
|
|
-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR \
|
|
-o PubkeyAuthentication=no \
|
|
-o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \
|
|
-o ConnectTimeout={{ ssh_timeout }} \
|
|
'{{ dev2_ssh_user }}@${IP6}%{{ dev1_iface }}' 'echo OK' " \
|
|
>/dev/null 2>&1; then
|
|
echo "$f"; exit 0
|
|
fi
|
|
done
|
|
echo "NONE"; exit 1
|
|
args: { executable: /bin/bash }
|
|
register: dev2_auth_lldp6
|
|
changed_when: false
|
|
failed_when: false
|
|
ignore_errors: true
|
|
|
|
- name: Record LLDP IPv6 fallback decision
|
|
when:
|
|
- dev2_conn_method == "tunnel"
|
|
- dev2_passfile_used_tunnel == "NONE"
|
|
- dev2_passfile_used_lldp4 == "NONE"
|
|
- (lldp_dev2_ip6 | default('') | length) > 0
|
|
delegate_to: localhost
|
|
ansible.builtin.set_fact:
|
|
dev2_passfile_used_lldp6: "{{ (dev2_auth_lldp6.rc == 0) | ternary((dev2_auth_lldp6.stdout | trim), 'NONE') }}"
|
|
changed_when: false
|
|
|
|
# ============================ PHASE 0: FINAL DECISION + WRAPPER FACTS ============================
|
|
- name: Decide final DEV2 connection mode (direct_lldp > tunnel > lldp4 > lldp6)
|
|
delegate_to: localhost
|
|
ansible.builtin.set_fact:
|
|
dev2_conn_final: >-
|
|
{%- if dev2_conn_method == 'direct_lldp' and (dev2_passfile_used_direct | default('NONE')) != 'NONE' -%}
|
|
direct_lldp
|
|
{%- elif dev2_conn_method == 'tunnel' and (dev2_passfile_used_tunnel | default('NONE')) != 'NONE' -%}
|
|
tunnel
|
|
{%- elif (dev2_passfile_used_lldp4 | default('NONE')) != 'NONE' -%}
|
|
lldp4_fallback
|
|
{%- elif (dev2_passfile_used_lldp6 | default('NONE')) != 'NONE' -%}
|
|
lldp6_via_dev1
|
|
{%- else -%}
|
|
none
|
|
{%- endif -%}
|
|
changed_when: false
|
|
|
|
- name: Report record connectivity mode
|
|
delegate_to: localhost
|
|
ansible.builtin.set_fact:
|
|
ptsd_migrate_report: "{{ (ptsd_migrate_report | default('')) ~ (', ' if (ptsd_migrate_report | default('')) != '' else '') ~ ('conn ' ~ dev2_conn_final) }}"
|
|
changed_when: false
|
|
|
|
- name: Abort if all DEV2 connection methods failed
|
|
when: dev2_conn_final == "none"
|
|
ansible.builtin.fail:
|
|
msg: >
|
|
DEV2 unreachable: tunnel auth={{ dev2_passfile_used_tunnel | default('n/a') }},
|
|
direct auth={{ dev2_passfile_used_direct | default('n/a') }},
|
|
lldp4 auth={{ dev2_passfile_used_lldp4 | default('n/a') }},
|
|
lldp6 auth={{ dev2_passfile_used_lldp6 | default('n/a') }}.
|
|
|
|
- name: Debug final connectivity decision
|
|
when: debugging | bool
|
|
delegate_to: localhost
|
|
ansible.builtin.debug:
|
|
msg:
|
|
- "dev2_conn_final={{ dev2_conn_final }}"
|
|
- "tunnel passfile={{ dev2_passfile_used_tunnel | default('n/a') }}"
|
|
- "direct passfile={{ dev2_passfile_used_direct | default('n/a') }}"
|
|
- "lldp4 passfile={{ dev2_passfile_used_lldp4 | default('n/a') }}"
|
|
- "lldp6 passfile={{ dev2_passfile_used_lldp6 | default('n/a') }}"
|
|
- "tunnel target={{ dev2_host }}:{{ dev2_port }} (forwarded to 127.0.0.1:{{ _local_port | default('na') }})"
|
|
- "lldp ipv4={{ lldp_dev2_ip | default('') }}"
|
|
- "lldp ipv6={{ lldp_dev2_ip6 | default('') }}"
|
|
|
|
- name: Build DEV2 exec wrapper (controller-side) for Phase 1 commands
|
|
delegate_to: localhost
|
|
ansible.builtin.set_fact:
|
|
dev2_exec_cmd: |
|
|
set -e
|
|
MODE="{{ dev2_conn_final }}"
|
|
if [ -z "${DEV2_CMD:-}" ]; then
|
|
echo "ERROR: DEV2_CMD is empty" >&2
|
|
exit 2
|
|
fi
|
|
|
|
case "$MODE" in
|
|
tunnel)
|
|
PORT="{{ _local_port | default('') }}"
|
|
PASS="{{ dev2_passfile_used_tunnel }}"
|
|
sshpass -f "$PASS" ssh {{ ssh_opts_common }} \
|
|
-o AddressFamily=inet \
|
|
-p "$PORT" "{{ dev2_ssh_user }}@127.0.0.1" \
|
|
"{{ pathprefix }} ${DEV2_CMD}" 2>&1
|
|
;;
|
|
direct_lldp)
|
|
HOST="{{ lldp_dev2_ip }}"
|
|
PASS="{{ dev2_passfile_used_direct }}"
|
|
sshpass -f "$PASS" ssh {{ ssh_opts_common }} \
|
|
-o AddressFamily=inet \
|
|
"{{ dev2_ssh_user }}@${HOST}" \
|
|
"{{ pathprefix }} ${DEV2_CMD}" 2>&1
|
|
;;
|
|
lldp4_fallback)
|
|
HOST="{{ lldp_dev2_ip }}"
|
|
PASS="{{ dev2_passfile_used_lldp4 }}"
|
|
sshpass -f "$PASS" ssh {{ ssh_opts_common }} \
|
|
-o AddressFamily=inet \
|
|
"{{ dev2_ssh_user }}@${HOST}" \
|
|
"{{ pathprefix }} ${DEV2_CMD}" 2>&1
|
|
;;
|
|
lldp6_via_dev1)
|
|
IP6="{{ lldp_dev2_ip6 }}"
|
|
F="{{ dev2_passfile_used_lldp6 }}"
|
|
sshpass -p "{{ dev1_pass }}" ssh {{ ssh_opts_common }} \
|
|
"{{ dev1_user }}@{{ ansible_host | default(inventory_hostname) }}" \
|
|
"sshpass -f '/tmp/${F}' ssh \
|
|
-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR \
|
|
-o PubkeyAuthentication=no \
|
|
-o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \
|
|
-o ConnectTimeout={{ ssh_timeout }} \
|
|
'{{ dev2_ssh_user }}@${IP6}%{{ dev1_iface }}' \
|
|
'{{ pathprefix }} '"${DEV2_CMD}" 2>&1"
|
|
;;
|
|
*)
|
|
echo "ERROR: unknown MODE=$MODE" >&2
|
|
exit 3
|
|
;;
|
|
esac
|
|
changed_when: false
|
|
|
|
# ============================ PHASE 0 (LAST, BEFORE PPP CHECK): IN-PROGRESS MARKER GUARD ============================
|
|
- name: "PHASE 0 (LAST) | DEV2 check /tmp/ptsd.inprogress marker exists (show-stopper) via wrapper"
|
|
delegate_to: localhost
|
|
ansible.builtin.shell: |
|
|
export DEV2_CMD="test -f /tmp/ptsd.inprogress && echo YES || echo NO"
|
|
{{ dev2_exec_cmd }}
|
|
args: { executable: /bin/bash }
|
|
register: dev2_inprogress_marker
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: "PHASE 0 (LAST) | Graceful stop if DEV2 in-progress marker is present"
|
|
when: (dev2_inprogress_marker.stdout | default('') | trim) == "YES"
|
|
delegate_to: localhost
|
|
ansible.builtin.debug:
|
|
msg:
|
|
- "Show-stopper: DEV2 has /tmp/ptsd.inprogress marker present."
|
|
- "We shall not continue: concurrent work appears to be in progress."
|
|
- "dev2_conn_final={{ dev2_conn_final }}"
|
|
changed_when: false
|
|
|
|
- name: "PHASE 0 (LAST) | End host if DEV2 in-progress marker is present"
|
|
when: (dev2_inprogress_marker.stdout | default('') | trim) == "YES"
|
|
ansible.builtin.meta: end_host
|
|
|
|
|
|
# ============================ PHASE 0 (LAST): DEV2 STATE GUARD (OLD PPP EXPECTED) ============================
|
|
- name: "PHASE 0 (LAST) | DEV2 check ppp0 has IPv4 (old expected) via wrapper"
|
|
delegate_to: localhost
|
|
ansible.builtin.shell: |
|
|
export DEV2_CMD="ip -4 addr show dev ppp0 2>/dev/null | grep -m1 'inet ' >/dev/null 2>&1 && echo YES || echo NO"
|
|
{{ dev2_exec_cmd }}
|
|
args: { executable: /bin/bash }
|
|
register: dev2_ppp0_has_ipv4
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: "PHASE 0 (LAST) | DEV2 check eth0.4000 exists (new/migrated indicator) via wrapper"
|
|
delegate_to: localhost
|
|
ansible.builtin.shell: |
|
|
export DEV2_CMD="ip link show eth0.4000 >/dev/null 2>&1 && echo YES || echo NO"
|
|
{{ dev2_exec_cmd }}
|
|
args: { executable: /bin/bash }
|
|
register: dev2_eth04000_exists
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: "PHASE 0 (LAST) | Detect mixed state ppp0 present AND eth0.4000 present (should not happen)"
|
|
delegate_to: localhost
|
|
ansible.builtin.set_fact:
|
|
dev2_ppp_present: "{{ (dev2_ppp0_has_ipv4.stdout | default('') | trim) == 'YES' }}"
|
|
dev2_eth04000_present: "{{ (dev2_eth04000_exists.stdout | default('') | trim) == 'YES' }}"
|
|
dev2_mixed_state: >-
|
|
{{
|
|
((dev2_ppp0_has_ipv4.stdout | default('') | trim) == 'YES')
|
|
and
|
|
((dev2_eth04000_exists.stdout | default('') | trim) == 'YES')
|
|
}}
|
|
changed_when: false
|
|
|
|
- name: "PHASE 0 (LAST) | Graceful stop DEV2 has BOTH ppp0 and eth0.4000 (mixed/partial migration)"
|
|
when: dev2_mixed_state | bool
|
|
delegate_to: localhost
|
|
ansible.builtin.debug:
|
|
msg:
|
|
- "We shall not continue: DEV2 is in mixed state (ppp0 present AND eth0.4000 present)."
|
|
- "This suggests partial/failed migration or unexpected config; manual inspection required."
|
|
- "ppp0_has_ipv4={{ dev2_ppp_present }}"
|
|
- "eth0.4000_exists={{ dev2_eth04000_present }}"
|
|
- "dev2_conn_final={{ dev2_conn_final }}"
|
|
changed_when: false
|
|
|
|
- name: "PHASE 0 (LAST) | End host: mixed/partial migration state"
|
|
when: dev2_mixed_state | bool
|
|
ansible.builtin.meta: end_host
|
|
|
|
- name: "PHASE 0 (LAST) | Summarize DEV2 pre-migration eligibility"
|
|
delegate_to: localhost
|
|
ansible.builtin.set_fact:
|
|
dev2_ppp_old_ok: "{{ (dev2_ppp0_has_ipv4.stdout | default('') | trim) == 'YES' }}"
|
|
dev2_eth04000_present: "{{ (dev2_eth04000_exists.stdout | default('') | trim) == 'YES' }}"
|
|
dev2_pre_migration_ok: >-
|
|
{{
|
|
((dev2_ppp0_has_ipv4.stdout | default('') | trim) == 'YES')
|
|
and
|
|
((dev2_eth04000_exists.stdout | default('') | trim) != 'YES')
|
|
}}
|
|
changed_when: false
|
|
|
|
- name: Report record eligibility
|
|
when: dev2_pre_migration_ok | bool
|
|
delegate_to: localhost
|
|
ansible.builtin.set_fact:
|
|
ptsd_migrate_report: "{{ (ptsd_migrate_report | default('')) ~ (', ' if (ptsd_migrate_report | default('')) != '' else '') ~ ('eligible PPP') }}"
|
|
changed_when: false
|
|
|
|
- name: "PHASE 0 (LAST) | Stop if DEV2 is NOT a pure old PPP device"
|
|
when: not (dev2_pre_migration_ok | bool)
|
|
delegate_to: localhost
|
|
ansible.builtin.debug:
|
|
msg:
|
|
- "We shall not continue: DEV2 is not a pure old PPP device."
|
|
- "ppp0_has_ipv4={{ dev2_ppp_old_ok }}"
|
|
- "eth0.4000_exists={{ dev2_eth04000_present }}"
|
|
- "dev2_conn_final={{ dev2_conn_final }}"
|
|
changed_when: false
|
|
|
|
- name: "PHASE 0 (LAST) | End host if DEV2 is NOT a pure old PPP device"
|
|
when: not (dev2_pre_migration_ok | bool)
|
|
ansible.builtin.meta: end_host
|
|
|
|
|
|
|
|
# ============================ PHASE 1: FIRST ON-DEVICE COMMAND (uptime) ============================
|
|
- name: "PHASE 1 | DEV2 uptime via wrapper"
|
|
delegate_to: localhost
|
|
ansible.builtin.shell: |
|
|
export DEV2_CMD="uptime"
|
|
{{ dev2_exec_cmd }}
|
|
args: { executable: /bin/bash }
|
|
register: dev2_uptime
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: "PHASE 1 | Output DEV2 uptime (stdout)"
|
|
delegate_to: localhost
|
|
ansible.builtin.debug:
|
|
msg:
|
|
- "DEV2 uptime via {{ dev2_conn_final }}:"
|
|
- "{{ (dev2_uptime.stdout | default('')) | regex_replace('\r','') }}"
|
|
|
|
- name: PHASE 1 | Set local download path for DEV2 config.json
|
|
delegate_to: localhost
|
|
ansible.builtin.set_fact:
|
|
dev2_config_local_dir: "{{ _ctrl_dir | default('/tmp') }}"
|
|
dev2_config_local_path: "{{ (_ctrl_dir | default('/tmp')) }}/dev2_config_{{ inventory_hostname }}.json"
|
|
changed_when: false
|
|
|
|
- name: PHASE 1 | DEV2 md5sum of /tmp/config.json via wrapper
|
|
delegate_to: localhost
|
|
ansible.builtin.shell: |
|
|
export DEV2_CMD="md5sum /tmp/config.json 2>/dev/null | awk '{print \$1}'"
|
|
{{ dev2_exec_cmd }}
|
|
args: { executable: /bin/bash }
|
|
register: dev2_config_md5
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: PHASE 1 | Abort if DEV2 md5 could not be read
|
|
when: (dev2_config_md5.stdout | default('') | trim | length) == 0
|
|
ansible.builtin.fail:
|
|
msg: "DEV2 md5sum for /tmp/config.json is empty; file missing or md5sum unavailable."
|
|
|
|
- name: PHASE 1 | DEV2 backup original config to /tmp/config-orig.json
|
|
delegate_to: localhost
|
|
ansible.builtin.shell: |
|
|
export DEV2_CMD="cp /tmp/config.json /tmp/config-orig.json"
|
|
{{ dev2_exec_cmd }}
|
|
args: { executable: /bin/bash }
|
|
changed_when: true
|
|
|
|
- name: Report record backup
|
|
delegate_to: localhost
|
|
ansible.builtin.set_fact:
|
|
ptsd_migrate_report: "{{ (ptsd_migrate_report | default('')) ~ (', ' if (ptsd_migrate_report | default('')) != '' else '') ~ ('backup config-orig') }}"
|
|
changed_when: false
|
|
|
|
- name: PHASE 1 | DEV2 set /tmp/ptsd.inprogress marker before controller config copy
|
|
delegate_to: localhost
|
|
ansible.builtin.shell: |
|
|
export DEV2_CMD="touch /tmp/ptsd.inprogress"
|
|
{{ dev2_exec_cmd }}
|
|
args: { executable: /bin/bash }
|
|
changed_when: true
|
|
|
|
|
|
- name: Report record inprogress marker
|
|
delegate_to: localhost
|
|
ansible.builtin.set_fact:
|
|
ptsd_migrate_report: "{{ (ptsd_migrate_report | default('')) ~ (', ' if (ptsd_migrate_report | default('')) != '' else '') ~ ('mark inprogress') }}"
|
|
changed_when: false
|
|
|
|
- name: PHASE 1 | Download /tmp/config.json from DEV2 to controller (tunnel)
|
|
when: dev2_conn_final == "tunnel"
|
|
delegate_to: localhost
|
|
ansible.builtin.shell: |
|
|
set -e
|
|
PORT="{{ _local_port }}"
|
|
PASS="{{ dev2_passfile_used_tunnel }}"
|
|
sshpass -f "$PASS" scp {{ ssh_opts_common }} \
|
|
-P "$PORT" "{{ dev2_ssh_user }}@127.0.0.1:/tmp/config.json" \
|
|
"{{ dev2_config_local_path }}"
|
|
args: { executable: /bin/bash }
|
|
register: scp_tunnel
|
|
changed_when: true
|
|
failed_when: scp_tunnel.rc != 0
|
|
|
|
- name: PHASE 1 | Download /tmp/config.json from DEV2 to controller (direct LLDP IPv4)
|
|
when: dev2_conn_final == "direct_lldp"
|
|
delegate_to: localhost
|
|
ansible.builtin.shell: |
|
|
set -e
|
|
HOST="{{ lldp_dev2_ip }}"
|
|
PASS="{{ dev2_passfile_used_direct }}"
|
|
sshpass -f "$PASS" scp {{ ssh_opts_common }} \
|
|
"{{ dev2_ssh_user }}@${HOST}:/tmp/config.json" \
|
|
"{{ dev2_config_local_path }}"
|
|
args: { executable: /bin/bash }
|
|
register: scp_direct
|
|
changed_when: true
|
|
failed_when: scp_direct.rc != 0
|
|
|
|
- name: PHASE 1 | Download /tmp/config.json from DEV2 to controller (LLDP IPv4 fallback)
|
|
when: dev2_conn_final == "lldp4_fallback"
|
|
delegate_to: localhost
|
|
ansible.builtin.shell: |
|
|
set -e
|
|
HOST="{{ lldp_dev2_ip }}"
|
|
PASS="{{ dev2_passfile_used_lldp4 }}"
|
|
sshpass -f "$PASS" scp {{ ssh_opts_common }} \
|
|
"{{ dev2_ssh_user }}@${HOST}:/tmp/config.json" \
|
|
"{{ dev2_config_local_path }}"
|
|
args: { executable: /bin/bash }
|
|
register: scp_lldp4
|
|
changed_when: true
|
|
failed_when: scp_lldp4.rc != 0
|
|
|
|
- name: PHASE 1 | Download /tmp/config.json from DEV2 to controller (LLDP IPv6 via DEV1 nested; last resort)
|
|
when: dev2_conn_final == "lldp6_via_dev1"
|
|
delegate_to: localhost
|
|
ansible.builtin.shell: |
|
|
set -e
|
|
IP6="{{ lldp_dev2_ip6 }}"
|
|
F="{{ dev2_passfile_used_lldp6 }}"
|
|
TMP_REMOTE="/tmp/config_{{ inventory_hostname }}.json"
|
|
|
|
# 1) On DEV1: scp from DEV2 (ipv6 link-local) to DEV1 /tmp
|
|
sshpass -p "{{ dev1_pass }}" ssh {{ ssh_opts_common }} \
|
|
"{{ dev1_user }}@{{ ansible_host | default(inventory_hostname) }}" \
|
|
"sshpass -f '/tmp/${F}' scp \
|
|
-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR \
|
|
-o PreferredAuthentications=password -o PubkeyAuthentication=no -o NumberOfPasswordPrompts=1 \
|
|
'{{ dev2_ssh_user }}@[${IP6}%{{ dev1_iface }}]':/tmp/config.json '${TMP_REMOTE}'"
|
|
|
|
# 2) From DEV1 to controller
|
|
sshpass -p "{{ dev1_pass }}" scp {{ ssh_opts_common }} \
|
|
"{{ dev1_user }}@{{ ansible_host | default(inventory_hostname) }}:${TMP_REMOTE}" \
|
|
"{{ dev2_config_local_path }}"
|
|
|
|
# 3) Cleanup on DEV1 (best-effort)
|
|
sshpass -p "{{ dev1_pass }}" ssh {{ ssh_opts_common }} \
|
|
"{{ dev1_user }}@{{ ansible_host | default(inventory_hostname) }}" \
|
|
"rm -f '${TMP_REMOTE}' 2>/dev/null || true"
|
|
args: { executable: /bin/bash }
|
|
register: scp_lldp6
|
|
changed_when: true
|
|
failed_when: scp_lldp6.rc != 0
|
|
|
|
- name: PHASE 1 | Controller md5sum of downloaded config.json
|
|
delegate_to: localhost
|
|
ansible.builtin.shell: |
|
|
set -e
|
|
md5sum "{{ dev2_config_local_path }}" | awk '{print $1}'
|
|
args: { executable: /bin/bash }
|
|
register: local_config_md5
|
|
changed_when: false
|
|
|
|
- name: PHASE 1 | Compare DEV2 vs controller md5sum (fail on mismatch)
|
|
delegate_to: localhost
|
|
ansible.builtin.fail:
|
|
msg: >-
|
|
MD5 mismatch for /tmp/config.json:
|
|
dev2={{ dev2_config_md5.stdout | trim }},
|
|
local={{ local_config_md5.stdout | trim }},
|
|
file={{ dev2_config_local_path }}
|
|
when: (dev2_config_md5.stdout | trim) != (local_config_md5.stdout | trim)
|
|
|
|
- name: PHASE 1 | Debug config.json download + md5
|
|
when: debugging | bool
|
|
delegate_to: localhost
|
|
ansible.builtin.debug:
|
|
msg:
|
|
- "Downloaded DEV2 /tmp/config.json to {{ dev2_config_local_path }}"
|
|
- "DEV2 md5={{ dev2_config_md5.stdout | trim }}"
|
|
- "Local md5={{ local_config_md5.stdout | trim }}"
|
|
|
|
- name: PHASE 1 | Set controller paths for DHCP conversion
|
|
delegate_to: localhost
|
|
ansible.builtin.set_fact:
|
|
pppoe_to_dhcp_script: "/opt/containers/ansible-worker/app/pppoe_to_dhcp.py"
|
|
dev2_config_dhcp_local_path: "{{ dev2_config_local_dir }}/dev2_config_dhcp_{{ inventory_hostname }}.json"
|
|
dev2_config_dhcp_remote_path: "/tmp/config-dhcp.json"
|
|
changed_when: false
|
|
|
|
- name: PHASE 1 | Abort if pppoe_to_dhcp.py is missing on controller
|
|
delegate_to: localhost
|
|
ansible.builtin.shell: |
|
|
test -f "{{ pppoe_to_dhcp_script }}"
|
|
args: { executable: /bin/bash }
|
|
register: dhcp_script_present
|
|
changed_when: false
|
|
failed_when: dhcp_script_present.rc != 0
|
|
|
|
- name: PHASE 1 | Convert config.json -> config-dhcp.json (controller)
|
|
delegate_to: localhost
|
|
ansible.builtin.shell: |
|
|
set -e
|
|
python3 "{{ pppoe_to_dhcp_script }}" "{{ dev2_config_local_path }}" -o "{{ dev2_config_dhcp_local_path }}"
|
|
args: { executable: /bin/bash }
|
|
register: convert_run
|
|
changed_when: true
|
|
failed_when: convert_run.rc != 0
|
|
|
|
- name: PHASE 1 | Controller md5sum of generated config-dhcp.json
|
|
delegate_to: localhost
|
|
ansible.builtin.shell: |
|
|
set -e
|
|
md5sum "{{ dev2_config_dhcp_local_path }}" | awk '{print $1}'
|
|
args: { executable: /bin/bash }
|
|
register: local_dhcp_md5
|
|
changed_when: false
|
|
failed_when: (local_dhcp_md5.stdout | trim | length) == 0
|
|
|
|
- name: PHASE 1 | Upload config-dhcp.json to DEV2 (tunnel)
|
|
when: dev2_conn_final == "tunnel"
|
|
delegate_to: localhost
|
|
ansible.builtin.shell: |
|
|
set -e
|
|
PORT="{{ _local_port }}"
|
|
PASS="{{ dev2_passfile_used_tunnel }}"
|
|
sshpass -f "$PASS" scp {{ ssh_opts_common }} \
|
|
-P "$PORT" "{{ dev2_config_dhcp_local_path }}" \
|
|
"{{ dev2_ssh_user }}@127.0.0.1:{{ dev2_config_dhcp_remote_path }}"
|
|
args: { executable: /bin/bash }
|
|
register: scp_up_tunnel
|
|
changed_when: true
|
|
failed_when: scp_up_tunnel.rc != 0
|
|
|
|
- name: Report record DHCP upload
|
|
when: dev2_conn_final == "tunnel"
|
|
delegate_to: localhost
|
|
ansible.builtin.set_fact:
|
|
ptsd_migrate_report: "{{ (ptsd_migrate_report | default('')) ~ (', ' if (ptsd_migrate_report | default('')) != '' else '') ~ ('upload DHCP config') }}"
|
|
changed_when: false
|
|
|
|
- name: PHASE 1 | Upload config-dhcp.json to DEV2 (direct LLDP IPv4)
|
|
when: dev2_conn_final == "direct_lldp"
|
|
delegate_to: localhost
|
|
ansible.builtin.shell: |
|
|
set -e
|
|
HOST="{{ lldp_dev2_ip }}"
|
|
PASS="{{ dev2_passfile_used_direct }}"
|
|
sshpass -f "$PASS" scp {{ ssh_opts_common }} \
|
|
"{{ dev2_config_dhcp_local_path }}" \
|
|
"{{ dev2_ssh_user }}@${HOST}:{{ dev2_config_dhcp_remote_path }}"
|
|
args: { executable: /bin/bash }
|
|
register: scp_up_direct
|
|
changed_when: true
|
|
failed_when: scp_up_direct.rc != 0
|
|
|
|
- name: Report record DHCP upload
|
|
when: dev2_conn_final == "direct_lldp"
|
|
delegate_to: localhost
|
|
ansible.builtin.set_fact:
|
|
ptsd_migrate_report: "{{ (ptsd_migrate_report | default('')) ~ (', ' if (ptsd_migrate_report | default('')) != '' else '') ~ ('upload DHCP config') }}"
|
|
changed_when: false
|
|
|
|
- name: PHASE 1 | Upload config-dhcp.json to DEV2 (LLDP IPv4 fallback)
|
|
when: dev2_conn_final == "lldp4_fallback"
|
|
delegate_to: localhost
|
|
ansible.builtin.shell: |
|
|
set -e
|
|
HOST="{{ lldp_dev2_ip }}"
|
|
PASS="{{ dev2_passfile_used_lldp4 }}"
|
|
sshpass -f "$PASS" scp {{ ssh_opts_common }} \
|
|
"{{ dev2_config_dhcp_local_path }}" \
|
|
"{{ dev2_ssh_user }}@${HOST}:{{ dev2_config_dhcp_remote_path }}"
|
|
args: { executable: /bin/bash }
|
|
register: scp_up_lldp4
|
|
changed_when: true
|
|
failed_when: scp_up_lldp4.rc != 0
|
|
|
|
- name: Report record DHCP upload
|
|
when: dev2_conn_final == "lldp4"
|
|
delegate_to: localhost
|
|
ansible.builtin.set_fact:
|
|
ptsd_migrate_report: "{{ (ptsd_migrate_report | default('')) ~ (', ' if (ptsd_migrate_report | default('')) != '' else '') ~ ('upload DHCP config') }}"
|
|
changed_when: false
|
|
|
|
- name: PHASE 1 | Upload config-dhcp.json to DEV2 (LLDP IPv6 via DEV1 nested; last resort)
|
|
when: dev2_conn_final == "lldp6_via_dev1"
|
|
delegate_to: localhost
|
|
ansible.builtin.shell: |
|
|
set -e
|
|
IP6="{{ lldp_dev2_ip6 }}"
|
|
F="{{ dev2_passfile_used_lldp6 }}"
|
|
STAGE_ON_DEV1="/tmp/config-dhcp_{{ inventory_hostname }}.json"
|
|
|
|
sshpass -p "{{ dev1_pass }}" scp {{ ssh_opts_common }} \
|
|
"{{ dev2_config_dhcp_local_path }}" \
|
|
"{{ dev1_user }}@{{ ansible_host | default(inventory_hostname) }}:${STAGE_ON_DEV1}"
|
|
|
|
sshpass -p "{{ dev1_pass }}" ssh {{ ssh_opts_common }} \
|
|
"{{ dev1_user }}@{{ ansible_host | default(inventory_hostname) }}" \
|
|
"sshpass -f '/tmp/${F}' scp \
|
|
-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR \
|
|
-o PreferredAuthentications=password -o PubkeyAuthentication=no -o NumberOfPasswordPrompts=1 \
|
|
'${STAGE_ON_DEV1}' '{{ dev2_ssh_user }}@[${IP6}%{{ dev1_iface }}]':{{ dev2_config_dhcp_remote_path }}"
|
|
|
|
sshpass -p "{{ dev1_pass }}" ssh {{ ssh_opts_common }} \
|
|
"{{ dev1_user }}@{{ ansible_host | default(inventory_hostname) }}" \
|
|
"rm -f '${STAGE_ON_DEV1}' 2>/dev/null || true"
|
|
args: { executable: /bin/bash }
|
|
register: scp_up_lldp6
|
|
changed_when: true
|
|
failed_when: scp_up_lldp6.rc != 0
|
|
|
|
- name: Report record DHCP upload
|
|
when: dev2_conn_final == "lldp6_via_dev1"
|
|
delegate_to: localhost
|
|
ansible.builtin.set_fact:
|
|
ptsd_migrate_report: "{{ (ptsd_migrate_report | default('')) ~ (', ' if (ptsd_migrate_report | default('')) != '' else '') ~ ('upload DHCP config') }}"
|
|
changed_when: false
|
|
|
|
- name: PHASE 1 | DEV2 md5sum of uploaded config-dhcp.json via wrapper
|
|
delegate_to: localhost
|
|
ansible.builtin.shell: |
|
|
export DEV2_CMD="md5sum {{ dev2_config_dhcp_remote_path }} 2>/dev/null | awk '{print \$1}'"
|
|
{{ dev2_exec_cmd }}
|
|
args: { executable: /bin/bash }
|
|
register: dev2_dhcp_md5
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: PHASE 1 | Abort if DEV2 md5 for uploaded file is empty
|
|
when: (dev2_dhcp_md5.stdout | default('') | trim | length) == 0
|
|
ansible.builtin.fail:
|
|
msg: "DEV2 md5sum for {{ dev2_config_dhcp_remote_path }} is empty; upload failed or md5sum unavailable."
|
|
|
|
- name: PHASE 1 | Compare controller vs DEV2 md5sum for config-dhcp.json (Ok, to be skipped. fail on mismatch)
|
|
delegate_to: localhost
|
|
ansible.builtin.fail:
|
|
msg: >-
|
|
MD5 mismatch for config-dhcp.json:
|
|
local={{ local_dhcp_md5.stdout | trim }},
|
|
dev2={{ dev2_dhcp_md5.stdout | trim }},
|
|
local_file={{ dev2_config_dhcp_local_path }},
|
|
remote_file={{ dev2_config_dhcp_remote_path }}
|
|
when: (local_dhcp_md5.stdout | trim) != (dev2_dhcp_md5.stdout | trim)
|
|
|
|
- name: PHASE 1 | Cleanup controller local config artifacts (only after md5 match)
|
|
delegate_to: localhost
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
state: absent
|
|
loop:
|
|
- "{{ dev2_config_local_path }}"
|
|
- "{{ dev2_config_dhcp_local_path }}"
|
|
ignore_errors: true
|
|
|
|
- name: PHASE 1 | Debug DHCP conversion + upload + md5 verification
|
|
when: debugging | bool
|
|
delegate_to: localhost
|
|
ansible.builtin.debug:
|
|
msg:
|
|
- "Converted DHCP config: {{ dev2_config_dhcp_local_path }}"
|
|
- "Uploaded to DEV2: {{ dev2_config_dhcp_remote_path }}"
|
|
- "Local md5={{ local_dhcp_md5.stdout | trim }}"
|
|
- "DEV2 md5={{ dev2_dhcp_md5.stdout | trim }}"
|
|
|
|
|
|
- name: PHASE 1 | DEV2 copy uploaded config to /tmp/config-test.json
|
|
delegate_to: localhost
|
|
ansible.builtin.shell: |
|
|
export DEV2_CMD="cp /tmp/config-dhcp.json /tmp/config-test.json"
|
|
{{ dev2_exec_cmd }}
|
|
args: { executable: /bin/bash }
|
|
changed_when: true
|
|
|
|
- name: PHASE 1 | DEV2 arm parachute reboot delayed 600 seconds
|
|
delegate_to: localhost
|
|
ansible.builtin.shell: |
|
|
export DEV2_CMD="reboot -d 600 &"
|
|
{{ dev2_exec_cmd }}
|
|
args: { executable: /bin/bash }
|
|
changed_when: true
|
|
|
|
- name: Report record parachute arm
|
|
delegate_to: localhost
|
|
ansible.builtin.set_fact:
|
|
ptsd_migrate_report: "{{ (ptsd_migrate_report | default('')) ~ (', ' if (ptsd_migrate_report | default('')) != '' else '') ~ ('arm parachute') }}"
|
|
changed_when: false
|
|
|
|
- name: PHASE 1 | DEV2 simulate upgrade marker /tmp/AA_startedupgrade
|
|
delegate_to: localhost
|
|
ansible.builtin.shell: |
|
|
export DEV2_CMD="touch /tmp/AA_startedupgrade"
|
|
{{ dev2_exec_cmd }}
|
|
args: { executable: /bin/bash }
|
|
changed_when: true
|
|
|
|
|
|
- name: PHASE 1 | schedule lld-server restart
|
|
delegate_to: localhost
|
|
ansible.builtin.shell: |
|
|
export DEV2_CMD="(sleep 20; killall lldp-server ) &"
|
|
{{ dev2_exec_cmd }}
|
|
args: { executable: /bin/bash }
|
|
changed_when: true
|
|
|
|
- name: PHASE 1 | initiating actual upgrade
|
|
delegate_to: localhost
|
|
ansible.builtin.shell: |
|
|
export DEV2_CMD="/usr/sbin/config-test.lua 400 &"
|
|
{{ dev2_exec_cmd }}
|
|
args: { executable: /bin/bash }
|
|
changed_when: true
|
|
|
|
- name: Report record activation
|
|
delegate_to: localhost
|
|
ansible.builtin.set_fact:
|
|
ptsd_migrate_report: "{{ (ptsd_migrate_report | default('')) ~ (', ' if (ptsd_migrate_report | default('')) != '' else '') ~ ('activate config-test') }}"
|
|
changed_when: false
|
|
|
|
post_tasks:
|
|
- name: Cleanup note
|
|
delegate_to: localhost
|
|
ansible.builtin.debug:
|
|
msg: "Cleanup: closing tunnel, removing temp IP, removing staged passfiles (best-effort)"
|
|
changed_when: false
|
|
|
|
- name: Close SSH ControlMaster (best-effort)
|
|
when: dev2_conn_method | default('') == "tunnel"
|
|
delegate_to: localhost
|
|
ansible.builtin.shell: |
|
|
ssh -S "{{ _ctrl_sock | default('/dev/null') }}" -O exit 2>/dev/null || true
|
|
args: { executable: /bin/bash }
|
|
changed_when: false
|
|
ignore_errors: true
|
|
|
|
- name: Remove tunnel control dir (best-effort)
|
|
when: dev2_conn_method | default('') == "tunnel"
|
|
delegate_to: localhost
|
|
ansible.builtin.file:
|
|
path: "{{ _ctrl_dir | default('/tmp/none') }}"
|
|
state: absent
|
|
ignore_errors: true
|
|
|
|
- name: Remove staged passfiles from DEV1 (best-effort)
|
|
when: dev2_conn_method | default('') == "tunnel"
|
|
ansible.builtin.raw: >
|
|
{{ pathprefix }}
|
|
rm -f /tmp/basicpass /tmp/basicpass2 2>/dev/null || true
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: Remove temporary IP on DEV1 (tolerate 'Cannot assign requested address')
|
|
when: dev2_conn_method | default('') == "tunnel"
|
|
ansible.builtin.raw: >
|
|
{{ pathprefix }}
|
|
ip a del {{ dev2_side_ip }} dev {{ dev1_iface }}
|
|
register: del_ip
|
|
changed_when: del_ip.rc == 0
|
|
failed_when: >
|
|
del_ip.rc != 0
|
|
and ('Cannot assign requested address' not in (del_ip.stdout | default('')))
|
|
and ('Cannot assign requested address' not in (del_ip.stderr | default('')))
|
|
|
|
- name: Report record cleanup completion
|
|
when: dev2_conn_final == "tunnel"
|
|
delegate_to: localhost
|
|
ansible.builtin.set_fact:
|
|
ptsd_migrate_report: "{{ (ptsd_migrate_report | default('')) ~ (', ' if (ptsd_migrate_report | default('')) != '' else '') ~ ('cleanup done') }}"
|
|
changed_when: false
|
|
|
|
- name: PHASE X | Wait 30 seconds after config activation
|
|
hosts: all
|
|
gather_facts: false
|
|
vars:
|
|
rmq_host: "{{ lookup('env','RMQ_HOST') | default('10.210.12.2', true) }}"
|
|
rmq_port: "{{ lookup('env','RMQ_PORT') | default('15672', true) }}"
|
|
rmq_user: "{{ lookup('env','RMQ_USER') | default('admin', true) }}"
|
|
rmq_pass: "{{ lookup('env','RMQ_PASS') | default('change_me', true) }}"
|
|
rmq_vhost: "{{ lookup('env','RMQ_VHOST') | default('app', true) }}"
|
|
rmq_exchange: "{{ lookup('env','RMQ_EXCHANGE') | default('controls', true) }}"
|
|
control_queue: "{{ lookup('env','CONTROL_QUEUE') | default('queue_controls', true) }}"
|
|
tasks:
|
|
- ansible.builtin.pause:
|
|
seconds: 30
|
|
|
|
- name: Report record post activation wait
|
|
delegate_to: localhost
|
|
ansible.builtin.set_fact:
|
|
ptsd_migrate_report: "{{ (ptsd_migrate_report | default('')) ~ (', ' if (ptsd_migrate_report | default('')) != '' else '') ~ ('wait 30s') }}"
|
|
changed_when: false
|
|
|
|
- name: Final migrate cumulative report
|
|
delegate_to: localhost
|
|
ansible.builtin.debug:
|
|
msg: "{{ ptsd_migrate_report | default('') }}"
|
|
changed_when: false
|
|
|
|
- name: Publish redirect and block removal journal
|
|
delegate_to: localhost
|
|
uri:
|
|
url: "http://{{ rmq_host }}:{{ rmq_port }}/api/exchanges/{{ rmq_vhost | urlencode }}/{{ rmq_exchange | urlencode }}/publish"
|
|
method: POST
|
|
user: "{{ rmq_user }}"
|
|
password: "{{ rmq_pass }}"
|
|
force_basic_auth: true
|
|
status_code: 200
|
|
headers: { content-type: "application/json" }
|
|
body_format: json
|
|
body:
|
|
properties: { content_type: "application/json" }
|
|
routing_key: "{{ control_queue }}"
|
|
payload: "{{ {
|
|
'inscope_device': (ansible_hostname | default(inventory_hostname)),
|
|
'task_name': 'journal_add',
|
|
'task_result': (ptsd_migrate_report | default(''))
|
|
} | to_json }}"
|
|
payload_encoding: "string"
|
|
changed_when: false
|
|
|
|
|
|
|
|
- import_playbook: ptsd_reacquire_attempt.yml |