kevinveenbirkenbachandClaude Opus 5 14148d95b1 fix(sys-svc-sshd): make the restart rescue reachable ...

The handler carried failed_when: false while the rescue include below waited on 'when: result is failed'. failed_when: false sets failed to False unconditionally, so the condition could never hold and the four diagnostic tasks behind it had never run once. A genuinely failed SSH restart was logged as ok: and the deploy continued. Measured with the project's own ansible: failed_when_false.is_failed=False, ignore_errors.is_failed=True.

The terminal fail is now tied to the cause instead of firing on every failure. It aborts only when sshd -t rejects the config, i.e. when the fault is ours; a transient restart failure with a valid config yields full diagnostics and the play continues. The gate uses 'is defined' rather than a default so an unregistered result cannot raise.

The config path becomes a role constant. The path the template writes and the path sshd -t validates are the same file, and whether a run aborts follows from that identity - if the two spellings drift, the run aborts for the wrong reason. Verified that the constant resolves two include levels deep inside the handler.

The runtimes report is unaffected: its parser downgrades a fatal line back to executed when '...ignoring' follows, which is exactly this case.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-08-07 17:05:50 +02:00

..

rescue_ssh_restart.yml

fix(sys-svc-sshd): make the restart rescue reachable

2026-08-07 17:05:50 +02:00