503f4df2ae
- Updated `bf-wireguard-restart.yml` to include dynamic host targeting based on `operation_wave`. - Added pre-tasks to assert that the operation wave is approved and confirmed, ensuring proper execution context. - Modified the service restart task to use a more structured command format. - Adjusted `operations.py` and `ui_gui.py` to reflect changes in operation scope from "simple" to "wave" for relevant operations. - Improved UI handling in `ui_gui.py` and `ui_surfaces.py` for better output management and user interaction. - Updated log rotation configuration to target specific log files. - Enhanced systemd service configurations for WireGuard to improve restart behavior. - Refined firstboot scripts to ensure proper handling of dealer ID and state management. - Improved error handling and rollback mechanisms in identity and installation scripts.
55 lines
2.1 KiB
YAML
55 lines
2.1 KiB
YAML
---
|
|
# Restart a single service by name (parametric, allowlisted).
|
|
# Run: ansible-playbook -i inventory/hosts.yml playbooks/bf-service-restart.yml -e operation_wave=lab -e operation_confirmed=true --limit lab -e service_name=blueforce-agent
|
|
# Only names in service_allowlist are accepted; everything else fails closed.
|
|
# No Semaphore Pro feature is used.
|
|
- name: Restart allowlisted service
|
|
hosts: "{{ operation_wave | default('invalid-wave', true) }}"
|
|
gather_facts: false
|
|
become: true
|
|
vars:
|
|
approved_operation_waves: [lab, pilot_1, pilot_2, wave_1, wave_2, production]
|
|
production_override: false
|
|
service_name: ""
|
|
service_allowlist:
|
|
- blueforce-agent
|
|
- docker
|
|
- sshd
|
|
- ssh
|
|
- systemd-journald
|
|
- cron
|
|
pre_tasks:
|
|
- name: Require confirmed approved operation wave scope
|
|
ansible.builtin.assert:
|
|
that:
|
|
- operation_wave in approved_operation_waves
|
|
- operation_confirmed | bool
|
|
- operation_wave in groups
|
|
- ansible_play_hosts_all | length > 0
|
|
- ansible_play_hosts_all | difference(groups[operation_wave]) | length == 0
|
|
fail_msg: "Set operation_wave to one inventory wave and operation_confirmed=true; full-fleet scope is refused."
|
|
run_once: true
|
|
|
|
- name: Require separate production override
|
|
ansible.builtin.assert:
|
|
that:
|
|
- operation_wave != 'production' or production_override | bool
|
|
fail_msg: "Production operation requires production_override=true in addition to operation_confirmed=true."
|
|
run_once: true
|
|
tasks:
|
|
- name: Validate service_name is provided
|
|
ansible.builtin.assert:
|
|
that:
|
|
- service_name | length > 0
|
|
fail_msg: "service_name is required, e.g. -e service_name=blueforce-agent"
|
|
|
|
- name: Validate service_name is allowlisted
|
|
ansible.builtin.assert:
|
|
that:
|
|
- service_name in service_allowlist
|
|
fail_msg: "service_name '{{ service_name }}' is not in the allowlist. Refusing to restart arbitrary services."
|
|
|
|
- name: Restart service
|
|
ansible.builtin.systemd:
|
|
name: "{{ service_name }}"
|
|
state: restarted
|