add: master update with Proxmox snapshoty
This commit is contained in:
@@ -17,3 +17,4 @@ all:
|
|||||||
ansible_host: 192.168.88.2
|
ansible_host: 192.168.88.2
|
||||||
main_role: MASTER
|
main_role: MASTER
|
||||||
hypervisor: Proxmox
|
hypervisor: Proxmox
|
||||||
|
proxmox_vmid: 122
|
||||||
@@ -74,7 +74,7 @@
|
|||||||
- name: "Assert"
|
- name: "Assert"
|
||||||
ansible.builtin.assert:
|
ansible.builtin.assert:
|
||||||
that:
|
that:
|
||||||
- firmware_status == 'update'
|
- firmware_status == 'update' or skip_update
|
||||||
- not in_maintenance
|
- not in_maintenance
|
||||||
- mismatched_vips == 0
|
- mismatched_vips == 0
|
||||||
- total_vips > 0
|
- total_vips > 0
|
||||||
@@ -127,7 +127,8 @@
|
|||||||
gather_facts: false
|
gather_facts: false
|
||||||
tasks:
|
tasks:
|
||||||
|
|
||||||
- block:
|
- when: not skip_update | default(false)
|
||||||
|
block:
|
||||||
|
|
||||||
- name: Enable CARP maintenance mode
|
- name: Enable CARP maintenance mode
|
||||||
ansible.builtin.uri:
|
ansible.builtin.uri:
|
||||||
@@ -162,353 +163,228 @@
|
|||||||
retries: 300
|
retries: 300
|
||||||
delay: 15
|
delay: 15
|
||||||
|
|
||||||
# - name: Wait for node to go offline
|
- name: Wait for node to go offline
|
||||||
# ansible.builtin.wait_for:
|
ansible.builtin.wait_for:
|
||||||
# host: "{{ ansible_host }}"
|
host: "{{ ansible_host }}"
|
||||||
# port: 443
|
port: "{{ opnsense_https_port }}"
|
||||||
# state: stopped
|
state: stopped
|
||||||
# timeout: 60
|
timeout: 60
|
||||||
# delegate_to: localhost
|
when: needs_reboot
|
||||||
|
|
||||||
# - name: Wait for node to come back online
|
- name: Wait for node to come back online
|
||||||
# ansible.builtin.wait_for:
|
ansible.builtin.wait_for:
|
||||||
# host: "{{ ansible_host }}"
|
host: "{{ ansible_host }}"
|
||||||
# port: 443
|
port: "{{ opnsense_https_port }}"
|
||||||
# state: started
|
state: started
|
||||||
# timeout: 300
|
timeout: 300
|
||||||
# delay: 30
|
delay: 30
|
||||||
# delegate_to: localhost
|
when: needs_reboot
|
||||||
|
|
||||||
# - name: Wait for API to be fully responsive
|
- name: Wait for API to be fully responsive
|
||||||
# ansible.builtin.uri:
|
ansible.builtin.uri:
|
||||||
# url: "https://{{ opnsense_host }}/api/core/firmware/status"
|
url: "https://{{ opnsense_host }}/api/core/firmware/status"
|
||||||
# method: GET
|
method: GET
|
||||||
# user: "{{ opnsense_api_key }}"
|
user: "{{ opnsense_api_key }}"
|
||||||
# password: "{{ opnsense_api_secret }}"
|
password: "{{ opnsense_api_secret }}"
|
||||||
# force_basic_auth: true
|
force_basic_auth: true
|
||||||
# validate_certs: false
|
validate_certs: false
|
||||||
# register: _post_status
|
register: _post_status
|
||||||
# until: _post_status.status == 200
|
until: _post_status.status == 200
|
||||||
# retries: 20
|
retries: 20
|
||||||
# delay: 10
|
delay: 10
|
||||||
|
|
||||||
# - name: Health check — no remaining updates
|
- name: Check VIP status
|
||||||
# ansible.builtin.assert:
|
ansible.builtin.uri:
|
||||||
# that:
|
url: "https://{{ opnsense_host }}/api/diagnostics/interface/get_vip_status"
|
||||||
# - _post_status.json.status == 'none'
|
method: GET
|
||||||
# fail_msg: >-
|
user: "{{ opnsense_api_key }}"
|
||||||
# Post-update firmware status is '{{ _post_status.json.status }}'
|
password: "{{ opnsense_api_secret }}"
|
||||||
# on {{ inventory_hostname }}. Expected 'none'.
|
force_basic_auth: true
|
||||||
|
validate_certs: false
|
||||||
|
register: _carp_post_udapte
|
||||||
|
|
||||||
# - name: Health check — CARP role is BACKUP
|
- name: Disable CARP maintenance mode
|
||||||
# ansible.builtin.uri:
|
ansible.builtin.uri:
|
||||||
# url: "https://{{ opnsense_host }}/api/carp/status/get"
|
url: "https://{{ opnsense_host }}/api/carp/status/maintenancemode"
|
||||||
# method: GET
|
method: POST
|
||||||
# user: "{{ opnsense_api_key }}"
|
user: "{{ opnsense_api_key }}"
|
||||||
# password: "{{ opnsense_api_secret }}"
|
password: "{{ opnsense_api_secret }}"
|
||||||
# force_basic_auth: true
|
force_basic_auth: true
|
||||||
# validate_certs: false
|
validate_certs: false
|
||||||
# register: _carp_post
|
when: _carp_post_udapte.json.carp.maintenancemode
|
||||||
# failed_when: _carp_post.json.status | upper not in ['BACKUP', 'MAINTENANCE']
|
|
||||||
|
|
||||||
# - name: Disable CARP maintenance mode
|
rescue:
|
||||||
# ansible.builtin.uri:
|
|
||||||
# url: "https://{{ opnsense_host }}/api/carp/status/maintenancemode"
|
|
||||||
# method: POST
|
|
||||||
# user: "{{ opnsense_api_key }}"
|
|
||||||
# password: "{{ opnsense_api_secret }}"
|
|
||||||
# force_basic_auth: true
|
|
||||||
# validate_certs: false
|
|
||||||
# body_format: json
|
|
||||||
# body: {}
|
|
||||||
|
|
||||||
# - name: Record backup update result
|
- name: Send Ntfy notification
|
||||||
# ansible.builtin.set_fact:
|
ansible.builtin.uri:
|
||||||
# update_result: "success"
|
url: "{{ ntfy_url }}/{{ ntfy_topic }}"
|
||||||
# fw_post_version: "{{ _post_status.json.product_version | default('unknown') }}"
|
method: POST
|
||||||
|
user: "{{ ntfy_user }}"
|
||||||
|
password: "{{ lookup('env', 'NTFY_PASSWORD') }}"
|
||||||
|
force_basic_auth: true
|
||||||
|
body: |
|
||||||
|
TODO
|
||||||
|
# Current version: {{ firmware_current_version }}
|
||||||
|
# {% if firmware_status != "update" %}
|
||||||
|
# {% if firmware_status == "upgrade" %}
|
||||||
|
# Upgrade to {{ firmware_upgrade_version }} available, relaunch the playbook manually to proceed.
|
||||||
|
# {% else %}
|
||||||
|
# No updates available on the cluster.
|
||||||
|
# {% endif %}
|
||||||
|
# {% elif in_maintenance %}
|
||||||
|
# The node {{ inventory_hostname }} is in CARP maintenance mode.
|
||||||
|
# {% elif mismatched_vips > 0 %}
|
||||||
|
# Some VIP are not {{ main_role }} on {{ ansible_host }}.
|
||||||
|
# {% else %}
|
||||||
|
# No VIPs are managed.
|
||||||
|
# {% endif %}
|
||||||
|
headers:
|
||||||
|
Title: "OPNsense update failed on {{ inventory_hostname }}"
|
||||||
|
Priority: "default"
|
||||||
|
Tags: "x"
|
||||||
|
run_once: true
|
||||||
|
when: ntfy_url is defined
|
||||||
|
|
||||||
|
- ansible.builtin.fail:
|
||||||
|
msg: "Update aborted"
|
||||||
|
|
||||||
# ###############################################################
|
- name: "Phase 3 | Update master node (Proxmox, with snapshot)"
|
||||||
# - name: "Phase 3 | Update master node (Proxmox, with snapshot)"
|
hosts: opnsense_master
|
||||||
# hosts: opnsense_master
|
gather_facts: false
|
||||||
# gather_facts: false
|
vars:
|
||||||
|
proxmox_snap_name: "preupdate-{{ now().strftime('%Y%m%d-%H%M') }}"
|
||||||
|
|
||||||
# vars:
|
tasks:
|
||||||
# snap_name: "preupdate-{{ now().strftime('%Y%m%d-%H%M') }}"
|
|
||||||
# _pve_base: "https://{{ proxmox_api_host }}/api2/json/nodes/{{ proxmox_node }}/qemu/{{ proxmox_vmid }}"
|
|
||||||
# _pve_auth:
|
|
||||||
# Authorization: "PVEAPIToken={{ proxmox_api_token_id }}={{ proxmox_api_token_secret }}"
|
|
||||||
|
|
||||||
# tasks:
|
- block:
|
||||||
# - name: Skip — no minor updates available on master
|
|
||||||
# ansible.builtin.meta: end_host
|
|
||||||
# when: firmware_status != 'update'
|
|
||||||
|
|
||||||
# - name: Verify master node CARP role
|
- name: Take Proxmox VM snapshot
|
||||||
# ansible.builtin.uri:
|
community.general.proxmox_snap:
|
||||||
# url: "https://{{ opnsense_host }}/api/carp/status/get"
|
vmid: "{{ proxmox_vmid }}"
|
||||||
# method: GET
|
state: present
|
||||||
# user: "{{ opnsense_api_key }}"
|
snapname: "{{ proxmox_snap_name }}"
|
||||||
# password: "{{ opnsense_api_secret }}"
|
description: "Pre-firmware-update: {{ firmware_current_version }} → {{ firmware_new_version }}"
|
||||||
# force_basic_auth: true
|
|
||||||
# validate_certs: false
|
|
||||||
# register: _carp
|
|
||||||
# failed_when: _carp.json.status | upper != 'MASTER'
|
|
||||||
|
|
||||||
# # Snapshot BEFORE maintenance mode — the restore point should be
|
- name: Enable CARP maintenance mode
|
||||||
# # a fully functioning MASTER node, not one mid-failover
|
ansible.builtin.uri:
|
||||||
# - name: Take Proxmox VM snapshot
|
url: "https://{{ opnsense_host }}/api/diagnostics/interface/carp_status/maintenance"
|
||||||
# community.general.proxmox_snap:
|
method: POST
|
||||||
# api_host: "{{ proxmox_api_host }}"
|
user: "{{ opnsense_api_key }}"
|
||||||
# api_token_id: "{{ proxmox_api_token_id }}"
|
password: "{{ opnsense_api_secret }}"
|
||||||
# api_token_secret: "{{ proxmox_api_token_secret }}"
|
force_basic_auth: true
|
||||||
# vmid: "{{ proxmox_vmid }}"
|
validate_certs: false
|
||||||
# state: present
|
register: _enable_maintenance
|
||||||
# snapname: "{{ snap_name }}"
|
changed_when: _enable_maintenance.status == "ok"
|
||||||
# description: "Pre-firmware-update: {{ firmware_current_version }} → {{ firmware_new_version }}"
|
|
||||||
# timeout: 60
|
|
||||||
# delegate_to: localhost
|
|
||||||
|
|
||||||
# - name: Enable CARP maintenance mode (triggers controlled failover to backup)
|
- name: Trigger firmware update
|
||||||
# ansible.builtin.uri:
|
ansible.builtin.uri:
|
||||||
# url: "https://{{ opnsense_host }}/api/carp/status/maintenancemode"
|
url: "https://{{ opnsense_host }}/api/core/firmware/update"
|
||||||
# method: POST
|
method: POST
|
||||||
# user: "{{ opnsense_api_key }}"
|
user: "{{ opnsense_api_key }}"
|
||||||
# password: "{{ opnsense_api_secret }}"
|
password: "{{ opnsense_api_secret }}"
|
||||||
# force_basic_auth: true
|
force_basic_auth: true
|
||||||
# validate_certs: false
|
validate_certs: false
|
||||||
# body_format: json
|
|
||||||
# body: {}
|
|
||||||
|
|
||||||
# - name: Wait for CARP failover to settle
|
- name: Wait for packages to update
|
||||||
# ansible.builtin.pause:
|
ansible.builtin.uri:
|
||||||
# seconds: 10
|
url: "https://{{ opnsense_host }}/api/core/firmware/running"
|
||||||
|
method: GET
|
||||||
|
user: "{{ opnsense_api_key }}"
|
||||||
|
password: "{{ opnsense_api_secret }}"
|
||||||
|
force_basic_auth: true
|
||||||
|
validate_certs: false
|
||||||
|
register: _update_running
|
||||||
|
until: _update_running.json.status != 'busy'
|
||||||
|
retries: 300
|
||||||
|
delay: 15
|
||||||
|
|
||||||
# # Do not proceed if the backup has not actually taken over.
|
- name: Wait for node to go offline
|
||||||
# # A failed failover means no traffic coverage during master update.
|
ansible.builtin.wait_for:
|
||||||
# - name: Confirm backup node is now MASTER
|
host: "{{ ansible_host }}"
|
||||||
# ansible.builtin.uri:
|
port: "{{ opnsense_https_port }}"
|
||||||
# url: "https://{{ hostvars[groups['opnsense_backup'][0]].ansible_host }}/api/carp/status/get"
|
state: stopped
|
||||||
# method: GET
|
timeout: 60
|
||||||
# user: "{{ opnsense_api_key }}"
|
when: needs_reboot
|
||||||
# password: "{{ opnsense_api_secret }}"
|
|
||||||
# force_basic_auth: true
|
|
||||||
# validate_certs: false
|
|
||||||
# register: _backup_carp
|
|
||||||
# delegate_to: localhost
|
|
||||||
# failed_when: _backup_carp.json.status | upper != 'MASTER'
|
|
||||||
|
|
||||||
# - name: Update and verify
|
- name: Wait for node to come back online
|
||||||
# block:
|
ansible.builtin.wait_for:
|
||||||
|
host: "{{ ansible_host }}"
|
||||||
|
port: "{{ opnsense_https_port }}"
|
||||||
|
state: started
|
||||||
|
timeout: 300
|
||||||
|
delay: 30
|
||||||
|
when: needs_reboot
|
||||||
|
|
||||||
# - name: Trigger firmware update
|
- name: Wait for API to be fully responsive
|
||||||
# ansible.builtin.uri:
|
ansible.builtin.uri:
|
||||||
# url: "https://{{ opnsense_host }}/api/core/firmware/update"
|
url: "https://{{ opnsense_host }}/api/core/firmware/status"
|
||||||
# method: POST
|
method: GET
|
||||||
# user: "{{ opnsense_api_key }}"
|
user: "{{ opnsense_api_key }}"
|
||||||
# password: "{{ opnsense_api_secret }}"
|
password: "{{ opnsense_api_secret }}"
|
||||||
# force_basic_auth: true
|
force_basic_auth: true
|
||||||
# validate_certs: false
|
validate_certs: false
|
||||||
# body_format: json
|
register: _post_status
|
||||||
# body: {}
|
until: _post_status.status == 200
|
||||||
|
retries: 20
|
||||||
|
delay: 10
|
||||||
|
|
||||||
# - name: Wait for packages to install
|
- name: Check VIP status
|
||||||
# ansible.builtin.uri:
|
ansible.builtin.uri:
|
||||||
# url: "https://{{ opnsense_host }}/api/core/firmware/running"
|
url: "https://{{ opnsense_host }}/api/diagnostics/interface/get_vip_status"
|
||||||
# method: GET
|
method: GET
|
||||||
# user: "{{ opnsense_api_key }}"
|
user: "{{ opnsense_api_key }}"
|
||||||
# password: "{{ opnsense_api_secret }}"
|
password: "{{ opnsense_api_secret }}"
|
||||||
# force_basic_auth: true
|
force_basic_auth: true
|
||||||
# validate_certs: false
|
validate_certs: false
|
||||||
# register: _update_running
|
register: _carp_post_udapte
|
||||||
# until: _update_running.json.status != 'running'
|
|
||||||
# retries: 30
|
|
||||||
# delay: 15
|
|
||||||
|
|
||||||
# - name: Reboot node
|
- name: Disable CARP maintenance mode
|
||||||
# ansible.builtin.uri:
|
ansible.builtin.uri:
|
||||||
# url: "https://{{ opnsense_host }}/api/core/firmware/reboot"
|
url: "https://{{ opnsense_host }}/api/carp/status/maintenancemode"
|
||||||
# method: POST
|
method: POST
|
||||||
# user: "{{ opnsense_api_key }}"
|
user: "{{ opnsense_api_key }}"
|
||||||
# password: "{{ opnsense_api_secret }}"
|
password: "{{ opnsense_api_secret }}"
|
||||||
# force_basic_auth: true
|
force_basic_auth: true
|
||||||
# validate_certs: false
|
validate_certs: false
|
||||||
# body_format: json
|
when: _carp_post_udapte.json.carp.maintenancemode
|
||||||
# body: {}
|
|
||||||
# ignore_errors: true
|
|
||||||
|
|
||||||
# - name: Wait for node to go offline
|
rescue:
|
||||||
# ansible.builtin.wait_for:
|
|
||||||
# host: "{{ ansible_host }}"
|
|
||||||
# port: 443
|
|
||||||
# state: stopped
|
|
||||||
# timeout: 60
|
|
||||||
# delegate_to: localhost
|
|
||||||
|
|
||||||
# - name: Wait for node to come back online
|
- name: Rollback VM to the pre-update snapshot
|
||||||
# ansible.builtin.wait_for:
|
community.proxmox.proxmox_snap:
|
||||||
# host: "{{ ansible_host }}"
|
vmid: "{{ proxmox_vmid }}"
|
||||||
# port: 443
|
state: rollback
|
||||||
# state: started
|
snapname: "{{ proxmox_snap_name }}"
|
||||||
# timeout: 300
|
|
||||||
# delay: 30
|
|
||||||
# delegate_to: localhost
|
|
||||||
|
|
||||||
# - name: Wait for API to be fully responsive
|
- name: Send Ntfy notification
|
||||||
# ansible.builtin.uri:
|
ansible.builtin.uri:
|
||||||
# url: "https://{{ opnsense_host }}/api/core/firmware/status"
|
url: "{{ ntfy_url }}/{{ ntfy_topic }}"
|
||||||
# method: GET
|
method: POST
|
||||||
# user: "{{ opnsense_api_key }}"
|
user: "{{ ntfy_user }}"
|
||||||
# password: "{{ opnsense_api_secret }}"
|
password: "{{ lookup('env', 'NTFY_PASSWORD') }}"
|
||||||
# force_basic_auth: true
|
force_basic_auth: true
|
||||||
# validate_certs: false
|
body: |
|
||||||
# register: _post_status
|
TODO
|
||||||
# until: _post_status.status == 200
|
# Current version: {{ firmware_current_version }}
|
||||||
# retries: 20
|
# {% if firmware_status != "update" %}
|
||||||
# delay: 10
|
# {% if firmware_status == "upgrade" %}
|
||||||
|
# Upgrade to {{ firmware_upgrade_version }} available, relaunch the playbook manually to proceed.
|
||||||
|
# {% else %}
|
||||||
|
# No updates available on the cluster.
|
||||||
|
# {% endif %}
|
||||||
|
# {% elif in_maintenance %}
|
||||||
|
# The node {{ inventory_hostname }} is in CARP maintenance mode.
|
||||||
|
# {% elif mismatched_vips > 0 %}
|
||||||
|
# Some VIP are not {{ main_role }} on {{ ansible_host }}.
|
||||||
|
# {% else %}
|
||||||
|
# No VIPs are managed.
|
||||||
|
# {% endif %}
|
||||||
|
headers:
|
||||||
|
Title: "OPNsense update failed on {{ inventory_hostname }}"
|
||||||
|
Priority: "default"
|
||||||
|
Tags: "x"
|
||||||
|
run_once: true
|
||||||
|
when: ntfy_url is defined
|
||||||
|
|
||||||
# - name: Health check — no remaining updates
|
- ansible.builtin.fail:
|
||||||
# ansible.builtin.assert:
|
msg: "Update aborted"
|
||||||
# that:
|
|
||||||
# - _post_status.json.status == 'none'
|
|
||||||
# fail_msg: >-
|
|
||||||
# Post-update firmware status is '{{ _post_status.json.status }}'.
|
|
||||||
# Expected 'none'. Triggering rollback.
|
|
||||||
|
|
||||||
# # After maintenance mode failover, master should rejoin as BACKUP
|
|
||||||
# - name: Health check — CARP role is BACKUP
|
|
||||||
# ansible.builtin.uri:
|
|
||||||
# url: "https://{{ opnsense_host }}/api/carp/status/get"
|
|
||||||
# method: GET
|
|
||||||
# user: "{{ opnsense_api_key }}"
|
|
||||||
# password: "{{ opnsense_api_secret }}"
|
|
||||||
# force_basic_auth: true
|
|
||||||
# validate_certs: false
|
|
||||||
# register: _carp_post
|
|
||||||
# failed_when: _carp_post.json.status | upper not in ['BACKUP', 'MAINTENANCE']
|
|
||||||
|
|
||||||
# - name: Record master update result
|
|
||||||
# ansible.builtin.set_fact:
|
|
||||||
# update_result: "success"
|
|
||||||
# fw_post_version: "{{ _post_status.json.product_version | default('unknown') }}"
|
|
||||||
|
|
||||||
# rescue:
|
|
||||||
# # Snapshot was taken before maintenance mode, so the restored VM
|
|
||||||
# # will come back as a healthy MASTER on the previous version.
|
|
||||||
# # Backup (already updated) continues serving traffic during rollback.
|
|
||||||
|
|
||||||
# - name: "ROLLBACK | Stop VM"
|
|
||||||
# ansible.builtin.uri:
|
|
||||||
# url: "{{ _pve_base }}/status/stop"
|
|
||||||
# method: POST
|
|
||||||
# headers: "{{ _pve_auth }}"
|
|
||||||
# validate_certs: false
|
|
||||||
# delegate_to: localhost
|
|
||||||
|
|
||||||
# - name: "ROLLBACK | Wait for VM to stop"
|
|
||||||
# ansible.builtin.uri:
|
|
||||||
# url: "{{ _pve_base }}/status/current"
|
|
||||||
# method: GET
|
|
||||||
# headers: "{{ _pve_auth }}"
|
|
||||||
# validate_certs: false
|
|
||||||
# register: _vm_state
|
|
||||||
# until: _vm_state.json.data.status == 'stopped'
|
|
||||||
# retries: 12
|
|
||||||
# delay: 5
|
|
||||||
# delegate_to: localhost
|
|
||||||
|
|
||||||
# - name: "ROLLBACK | Restore snapshot {{ snap_name }}"
|
|
||||||
# ansible.builtin.uri:
|
|
||||||
# url: "{{ _pve_base }}/snapshot/{{ snap_name }}/rollback"
|
|
||||||
# method: POST
|
|
||||||
# headers: "{{ _pve_auth }}"
|
|
||||||
# validate_certs: false
|
|
||||||
# delegate_to: localhost
|
|
||||||
|
|
||||||
# # Proxmox rollback tasks run async; wait for completion
|
|
||||||
# - name: "ROLLBACK | Wait for snapshot restore to complete"
|
|
||||||
# ansible.builtin.pause:
|
|
||||||
# seconds: 30
|
|
||||||
|
|
||||||
# - name: "ROLLBACK | Start VM"
|
|
||||||
# ansible.builtin.uri:
|
|
||||||
# url: "{{ _pve_base }}/status/start"
|
|
||||||
# method: POST
|
|
||||||
# headers: "{{ _pve_auth }}"
|
|
||||||
# validate_certs: false
|
|
||||||
# delegate_to: localhost
|
|
||||||
|
|
||||||
# - name: "ROLLBACK | Wait for VM to come back online"
|
|
||||||
# ansible.builtin.wait_for:
|
|
||||||
# host: "{{ ansible_host }}"
|
|
||||||
# port: 443
|
|
||||||
# state: started
|
|
||||||
# timeout: 300
|
|
||||||
# delay: 30
|
|
||||||
# delegate_to: localhost
|
|
||||||
|
|
||||||
# - name: "ROLLBACK | Record result"
|
|
||||||
# ansible.builtin.set_fact:
|
|
||||||
# update_result: "rolled_back"
|
|
||||||
# fw_post_version: "{{ firmware_current_version }}"
|
|
||||||
|
|
||||||
# always:
|
|
||||||
# # Best-effort: disable maintenance mode whether update succeeded or rolled back.
|
|
||||||
# # On rollback, the restored snapshot predates maintenance mode so this
|
|
||||||
# # is effectively a no-op, but run it anyway as a safety net.
|
|
||||||
# - name: Disable CARP maintenance mode
|
|
||||||
# ansible.builtin.uri:
|
|
||||||
# url: "https://{{ opnsense_host }}/api/carp/status/maintenancemode"
|
|
||||||
# method: POST
|
|
||||||
# user: "{{ opnsense_api_key }}"
|
|
||||||
# password: "{{ opnsense_api_secret }}"
|
|
||||||
# force_basic_auth: true
|
|
||||||
# validate_certs: false
|
|
||||||
# body_format: json
|
|
||||||
# body: {}
|
|
||||||
# ignore_errors: true
|
|
||||||
|
|
||||||
|
|
||||||
# ###############################################################
|
|
||||||
# # Phase 4 targets localhost — it runs even if Phase 3 failed,
|
|
||||||
# # because localhost was never marked as a failed host.
|
|
||||||
# - name: "Phase 4 | Send ntfy notification"
|
|
||||||
# hosts: localhost
|
|
||||||
# gather_facts: false
|
|
||||||
|
|
||||||
# tasks:
|
|
||||||
# - name: Build report
|
|
||||||
# ansible.builtin.set_fact:
|
|
||||||
# _report: |
|
|
||||||
# {% for host in groups['opnsense'] %}
|
|
||||||
# {% set h = hostvars[host] %}
|
|
||||||
# {{ host }}
|
|
||||||
# fw check : {{ h.firmware_status | default('unknown') }}
|
|
||||||
# result : {{ h.update_result | default('unknown') }}
|
|
||||||
# version : {{ h.fw_post_version | default(h.firmware_current_version | default('?')) }}
|
|
||||||
# {% endfor %}
|
|
||||||
# _any_issue: >-
|
|
||||||
# {{ groups['opnsense']
|
|
||||||
# | map('extract', hostvars, 'update_result')
|
|
||||||
# | select('in', ['rolled_back', 'pending'])
|
|
||||||
# | list
|
|
||||||
# | length > 0 }}
|
|
||||||
|
|
||||||
# - name: Send ntfy notification
|
|
||||||
# ansible.builtin.uri:
|
|
||||||
# url: "{{ ntfy_url }}/{{ ntfy_topic }}"
|
|
||||||
# method: POST
|
|
||||||
# headers:
|
|
||||||
# Authorization: "Bearer {{ ntfy_token }}"
|
|
||||||
# Title: "OPNsense HA Update Report"
|
|
||||||
# Priority: "{{ 'high' if _any_issue else 'default' }}"
|
|
||||||
# Tags: "{{ 'warning' if _any_issue else 'white_check_mark' }},shield"
|
|
||||||
# Content-Type: "text/plain"
|
|
||||||
# body: "{{ _report }}"
|
|
||||||
|
|
||||||
# - name: Fail playbook if any node was rolled back or did not complete
|
|
||||||
# ansible.builtin.fail:
|
|
||||||
# msg: >-
|
|
||||||
# One or more nodes did not update successfully.
|
|
||||||
# Check ntfy report and Ansible output for details.
|
|
||||||
# when: _any_issue | bool
|
|
||||||
|
|||||||
Reference in New Issue
Block a user