503f4df2ae
- Updated `bf-wireguard-restart.yml` to include dynamic host targeting based on `operation_wave`. - Added pre-tasks to assert that the operation wave is approved and confirmed, ensuring proper execution context. - Modified the service restart task to use a more structured command format. - Adjusted `operations.py` and `ui_gui.py` to reflect changes in operation scope from "simple" to "wave" for relevant operations. - Improved UI handling in `ui_gui.py` and `ui_surfaces.py` for better output management and user interaction. - Updated log rotation configuration to target specific log files. - Enhanced systemd service configurations for WireGuard to improve restart behavior. - Refined firstboot scripts to ensure proper handling of dealer ID and state management. - Improved error handling and rollback mechanisms in identity and installation scripts.
46 lines
1.9 KiB
YAML
46 lines
1.9 KiB
YAML
---
|
|
# Restart the WireGuard tunnel interface.
|
|
# Run: ansible-playbook -i inventory/hosts.yml playbooks/bf-wireguard-restart.yml -e operation_wave=lab -e operation_confirmed=true --limit lab
|
|
# Uses wg_interface from group_vars and defaults to wg0.
|
|
# No Semaphore Pro feature is used.
|
|
- name: Restart WireGuard tunnel
|
|
hosts: "{{ operation_wave | default('invalid-wave', true) }}"
|
|
gather_facts: false
|
|
become: true
|
|
vars:
|
|
approved_operation_waves: [lab, pilot_1, pilot_2, wave_1, wave_2, production]
|
|
production_override: false
|
|
wireguard_restart_interface: "{{ wg_interface | default('wg0') }}"
|
|
pre_tasks:
|
|
- name: Require confirmed approved operation wave scope
|
|
ansible.builtin.assert:
|
|
that:
|
|
- operation_wave in approved_operation_waves
|
|
- operation_confirmed | bool
|
|
- operation_wave in groups
|
|
- ansible_play_hosts_all | length > 0
|
|
- ansible_play_hosts_all | difference(groups[operation_wave]) | length == 0
|
|
fail_msg: "Set operation_wave to one inventory wave and operation_confirmed=true; full-fleet scope is refused."
|
|
run_once: true
|
|
|
|
- name: Require separate production override
|
|
ansible.builtin.assert:
|
|
that:
|
|
- operation_wave != 'production' or production_override | bool
|
|
fail_msg: "Production operation requires production_override=true in addition to operation_confirmed=true."
|
|
run_once: true
|
|
tasks:
|
|
- name: Restart WireGuard service
|
|
ansible.builtin.systemd:
|
|
name: "wg-quick@{{ wireguard_restart_interface }}"
|
|
state: restarted
|
|
|
|
- name: Verify tunnel state
|
|
ansible.builtin.command:
|
|
argv: [wg, show, "{{ wireguard_restart_interface }}"]
|
|
register: wg_out
|
|
changed_when: false
|
|
|
|
- name: Show WireGuard state
|
|
ansible.builtin.debug:
|
|
msg: "{{ inventory_hostname }}: {{ wg_out.stdout_lines | default([]) }}"
|