Vezpi/Homelab
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

add: firmware check

Browse Source
This commit is contained in:
Vezpi
2026-06-17 19:27:15 +00:00
parent ca01e8f17e
commit 7d51740a1a
1 changed files with 54 additions and 58 deletions
Download Patch File Download Diff File Expand all files Collapse all files

112
ansible/opnsense/update_opnsense_ha_cluster.yml
View File

@@ -4,70 +4,66 @@
############################################################### ###############################################################
- name: "Phase 1 | Firmware check on all nodes" - name: "Phase 1 | Firmware check on all nodes"
hosts: opnsense hosts: opnsense
any_errors_fatal: true
gather_facts: false gather_facts: false
# vars:
# opnsense_api_key: "{{ lookup('env', 'OPNSENSE_API_KEY') }}"
# opnsense_api_secret: "{{ lookup('env', 'OPNSENSE_API_SECRET') }}"
tasks: tasks:
- name: Check node availability
ansible.builtin.uri:
url: "https://{{ opnsense_host }}/api/core/system/status"
method: GET
user: "{{ opnsense_api_key }}"
password: "{{ opnsense_api_secret }}"
force_basic_auth: true
validate_certs: false
# body_format: json
# body: {}
- block:
# - name: Trigger firmware check - name: Check node availability
# ansible.builtin.uri: ansible.builtin.uri:
# url: "https://{{ ansible_host }}/api/core/firmware/check" url: "https://{{ opnsense_host }}/api/core/system/status"
# method: POST method: GET
# user: "{{ opnsense_api_key }}" user: "{{ opnsense_api_key }}"
# password: "{{ opnsense_api_secret }}" password: "{{ opnsense_api_secret }}"
# force_basic_auth: true force_basic_auth: true
# validate_certs: false validate_certs: false
# body_format: json
# body: {}
# - name: Wait for check to complete - name: Trigger firmware check
# ansible.builtin.uri: ansible.builtin.uri:
# url: "https://{{ ansible_host }}/api/core/firmware/status" url: "https://{{ ansible_host }}/api/core/firmware/check"
# method: GET method: POST
# user: "{{ opnsense_api_key }}" user: "{{ opnsense_api_key }}"
# password: "{{ opnsense_api_secret }}" password: "{{ opnsense_api_secret }}"
# force_basic_auth: true force_basic_auth: true
# validate_certs: false validate_certs: false
# register: _fw_status
# until: _fw_status.json.status != 'running'
# retries: 12
# delay: 10
# - name: Store firmware facts - name: Wait for check to complete
# ansible.builtin.set_fact: ansible.builtin.uri:
# fw_status: "{{ _fw_status.json.status }}" url: "https://{{ ansible_host }}/api/core/firmware/status"
# fw_current_version: "{{ _fw_status.json.product_version | default('unknown') }}" method: GET
# fw_new_version: "{{ _fw_status.json.new_version | default('') }}" user: "{{ opnsense_api_key }}"
# # 'pending' means updates exist; will be overwritten to success/rolled_back password: "{{ opnsense_api_secret }}"
# # If it stays 'pending' after the run, a pre-update check failed force_basic_auth: true
# update_result: "{{ 'pending' if _fw_status.json.status == 'update' else 'skipped' }}" validate_certs: false
register: firmware_status
until: firmware_status.json.status != 'none'
retries: 12
delay: 5
# - name: Display firmware status - name: Store firmware facts
# ansible.builtin.debug: ansible.builtin.set_fact:
# msg: >- firmware_status: "{{ _firmware_status.json.status }}"
# {{ inventory_hostname }}: {{ fw_status }} fw_current_version: "{{ _firmware_status.json.product_version | default('unknown') }}"
# ({{ fw_current_version }} fw_new_version: "{{ _firmware_status.json.new_version | default('') }}"
# {% if fw_new_version %} → {{ fw_new_version }}{% endif %}) # 'pending' means updates exist; will be overwritten to success/rolled_back
# If it stays 'pending' after the run, a pre-update check failed
update_result: "{{ 'pending' if _firmware_status.json.status == 'update' else 'skipped' }}"
# - name: Warn — major upgrade skipped, handle manually - name: Display firmware status
# ansible.builtin.debug: ansible.builtin.debug:
# msg: >- msg: >-
# NOTICE: {{ inventory_hostname }} has a MAJOR upgrade available {{ inventory_hostname }}: {{ firmware_status }}
# ({{ fw_new_version }}). This playbook handles minor updates only. ({{ fw_current_version }}
# when: fw_status == 'upgrade' {% if fw_new_version %} → {{ fw_new_version }}{% endif %})
- name: Warn — major upgrade skipped, handle manually
ansible.builtin.debug:
msg: >-
NOTICE: {{ inventory_hostname }} has a MAJOR upgrade available
({{ fw_new_version }}). This playbook handles minor updates only.
when: firmware_status == 'upgrade'
# ############################################################### # ###############################################################
@@ -78,7 +74,7 @@
# tasks: # tasks:
# - name: Skip — no minor updates available on backup # - name: Skip — no minor updates available on backup
# ansible.builtin.meta: end_host # ansible.builtin.meta: end_host
# when: fw_status != 'update' # when: firmware_status != 'update'
# # Safety: confirm backup is actually in BACKUP role before touching it # # Safety: confirm backup is actually in BACKUP role before touching it
# - name: Verify backup node CARP role # - name: Verify backup node CARP role
@@ -223,7 +219,7 @@
# tasks: # tasks:
# - name: Skip — no minor updates available on master # - name: Skip — no minor updates available on master
# ansible.builtin.meta: end_host # ansible.builtin.meta: end_host
# when: fw_status != 'update' # when: firmware_status != 'update'
# - name: Verify master node CARP role # - name: Verify master node CARP role
# ansible.builtin.uri: # ansible.builtin.uri:
@@ -464,7 +460,7 @@
# {% for host in groups['opnsense'] %} # {% for host in groups['opnsense'] %}
# {% set h = hostvars[host] %} # {% set h = hostvars[host] %}
# {{ host }} # {{ host }}
# fw check : {{ h.fw_status | default('unknown') }} # fw check : {{ h.firmware_status | default('unknown') }}
# result : {{ h.update_result | default('unknown') }} # result : {{ h.update_result | default('unknown') }}
# version : {{ h.fw_post_version | default(h.fw_current_version | default('?')) }} # version : {{ h.fw_post_version | default(h.fw_current_version | default('?')) }}
# {% endfor %} # {% endfor %}