120 lines
3.8 KiB
Bash
Executable File
120 lines
3.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# Hardcoded NetBox access (DEV ONLY!)
|
|
NETBOX_URL="http://netbox.gt-tiso.ikeja.co.za"
|
|
NETBOX_TOKEN="7648e4f5ee370cda7834682e61b47c2ee8e95623"
|
|
|
|
usage() {
|
|
cat >&2 <<EOF
|
|
Usage: nbplay [--pwfile PATH] [--user USER] [--rebootin VALUE] <playbook.yml> <device_name> [ansible-playbook args...]
|
|
--pwfile PATH Path to password/vars file:
|
|
- YAML/JSON: must contain ansible_ssh_pass (and optionally ansible_user)
|
|
- Plain text: first line is the password (wrapped as ansible_ssh_pass)
|
|
--user USER ansible_user to use (overrides file value unless omitted)
|
|
--rebootin VAL Passes playbook var rebootin=VAL (e.g. "23:35" or "120")
|
|
Examples:
|
|
nbplay update-indoor.yml ikeja12345 --pwfile /opt/.../ssh.yml --rebootin "23:35"
|
|
nbplay update-indoor.yml ikeja12345 --pwfile /opt/.../ssh.txt --user root --rebootin "120"
|
|
EOF
|
|
exit 2
|
|
}
|
|
|
|
# ---- Parse args
|
|
PWFILE=""
|
|
USER_OVERRIDE=""
|
|
REBOOTIN_VALUE=""
|
|
ARGS=()
|
|
while (( $# )); do
|
|
case "${1:-}" in
|
|
--pwfile) shift; PWFILE="${1:-}"; [[ -n "$PWFILE" ]] || usage; shift;;
|
|
--user) shift; USER_OVERRIDE="${1:-}"; [[ -n "$USER_OVERRIDE" ]] || usage; shift;;
|
|
--rebootin) shift; REBOOTIN_VALUE="${1:-}"; [[ -n "$REBOOTIN_VALUE" ]] || usage; shift;;
|
|
-h|--help) usage;;
|
|
*) ARGS+=("$1"); shift;;
|
|
esac
|
|
done
|
|
set -- "${ARGS[@]}"
|
|
|
|
if [[ $# -lt 2 ]]; then usage; fi
|
|
PLAYBOOK="$1"; shift
|
|
NAME="$1"; shift
|
|
|
|
if [[ -z "${PWFILE}" ]]; then
|
|
DEFAULT_PWFILE="${NBPLAY_PWFILE:-/opt/containers/ansible-worker/data/ssh.yml}"
|
|
if [[ -f "$DEFAULT_PWFILE" ]]; then
|
|
PWFILE="$DEFAULT_PWFILE"
|
|
fi
|
|
fi
|
|
|
|
# ---- Deps
|
|
command -v jq >/dev/null 2>&1 || { echo "jq not found" >&2; exit 127; }
|
|
command -v curl >/dev/null 2>&1 || { echo "curl not found" >&2; exit 127; }
|
|
|
|
BASE="${NETBOX_URL%/}"
|
|
hdr=(-H "Authorization: Token ${NETBOX_TOKEN}" -H "Accept: application/json")
|
|
|
|
# ---- Resolve device -> IP
|
|
dev_json="$(curl -fsS "${hdr[@]}" "${BASE}/api/dcim/devices/?name=${NAME}&limit=1")"
|
|
count="$(printf '%s' "$dev_json" | jq -r '.count // 0')"
|
|
if [[ "$count" != "1" ]]; then
|
|
echo "Device '${NAME}' not found or not unique (count=${count})." >&2
|
|
exit 1
|
|
fi
|
|
addr_v4="$(printf '%s' "$dev_json" | jq -r '.results[0].primary_ip4.address // empty')"
|
|
addr_v6="$(printf '%s' "$dev_json" | jq -r '.results[0].primary_ip6.address // empty')"
|
|
addr_any="$(printf '%s' "$dev_json" | jq -r '.results[0].primary_ip.address // empty')"
|
|
addr="${addr_v4:-${addr_v6:-${addr_any:-}}}"
|
|
[[ -n "$addr" && "$addr" != "null" ]] || { echo "Device '${NAME}' has no primary IP." >&2; exit 1; }
|
|
ip="${addr%%/*}"
|
|
|
|
# ---- Temp inventory
|
|
tmpinv="$(mktemp)"; trap 'rm -f "$tmpinv" "$tmpvars"' EXIT
|
|
cat >"$tmpinv" <<EOF
|
|
[nb]
|
|
$NAME ansible_host=$ip
|
|
EOF
|
|
|
|
# ---- Build extra-vars without leaking secrets in ps
|
|
extravars=()
|
|
tmpvars=""
|
|
|
|
# Helper: ensure tmpvars exists and is 600
|
|
ensure_tmpvars() {
|
|
if [[ -z "$tmpvars" ]]; then
|
|
tmpvars="$(mktemp)"
|
|
chmod 600 "$tmpvars"
|
|
extravars+=(-e "@${tmpvars}")
|
|
fi
|
|
}
|
|
|
|
if [[ -n "$PWFILE" ]]; then
|
|
if [[ "$PWFILE" =~ \.(ya?ml|json)$ ]]; then
|
|
extravars+=(-e "@${PWFILE}")
|
|
else
|
|
[[ -r "$PWFILE" ]] || { echo "Password file not readable: $PWFILE" >&2; exit 1; }
|
|
pass="$(head -n1 "$PWFILE" | tr -d '\r\n')"
|
|
ensure_tmpvars
|
|
{
|
|
echo "ansible_ssh_pass: \"$pass\""
|
|
[[ -n "$USER_OVERRIDE" ]] && echo "ansible_user: \"$USER_OVERRIDE\""
|
|
} >> "$tmpvars"
|
|
fi
|
|
fi
|
|
|
|
# If user override provided and not already set via tmpvars/YAML, add it safely
|
|
if [[ -n "$USER_OVERRIDE" && -z "$tmpvars" ]]; then
|
|
ensure_tmpvars
|
|
echo "ansible_user: \"$USER_OVERRIDE\"" >> "$tmpvars"
|
|
fi
|
|
|
|
# If rebootin provided, add it to the temp vars file
|
|
if [[ -n "$REBOOTIN_VALUE" ]]; then
|
|
ensure_tmpvars
|
|
echo "rebootin: \"$REBOOTIN_VALUE\"" >> "$tmpvars"
|
|
fi
|
|
|
|
# ---- Run playbook (do NOT use --ask-pass)
|
|
ANSIBLE_ASK_PASS=False exec ansible-playbook -i "$tmpinv" "$PLAYBOOK" -l "$NAME" \
|
|
"${extravars[@]}" "$@"
|