mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-07 19:32:17 +00:00
kevinveenbirkenbachandClaude Opus 5
14148d95b1
The handler carried failed_when: false while the rescue include below waited on 'when: result is failed'. failed_when: false sets failed to False unconditionally, so the condition could never hold and the four diagnostic tasks behind it had never run once. A genuinely failed SSH restart was logged as ok: and the deploy continued. Measured with the project's own ansible: failed_when_false.is_failed=False, ignore_errors.is_failed=True. The terminal fail is now tied to the cause instead of firing on every failure. It aborts only when sshd -t rejects the config, i.e. when the fault is ours; a transient restart failure with a valid config yields full diagnostics and the play continues. The gate uses 'is defined' rather than a default so an unregistered result cannot raise. The config path becomes a role constant. The path the template writes and the path sshd -t validates are the same file, and whether a run aborts follows from that identity - if the two spellings drift, the run aborts for the wrong reason. Verified that the constant resolves two include levels deep inside the handler. The runtimes report is unaffected: its parser downgrades a fatal line back to executed when '...ignoring' follows, which is exactly this case. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
43 lines
1.6 KiB
YAML
43 lines
1.6 KiB
YAML
---
|
|
- name: 👁️ Show shared diagnostics for failed SSH restart
|
|
ansible.builtin.include_role:
|
|
name: sys-service
|
|
tasks_from: utils/debug.yml
|
|
vars:
|
|
system_service_debug_unit: "{{ sys_svc_sshd_service_unit }}"
|
|
system_service_debug_context: |
|
|
ansible_virtualization_type={{ ansible_facts['virtualization_type'] | default('unknown') }}
|
|
ansible_virtualization_role={{ ansible_facts['virtualization_role'] | default('unknown') }}
|
|
failed_msg={{ sys_svc_sshd_restart_result.msg | default('') }}
|
|
failed_stderr={{ sys_svc_sshd_restart_result.stderr | default('') }}
|
|
failed_result={{ sys_svc_sshd_restart_result | to_nice_json }}
|
|
|
|
- name: ✅ Validate sshd_config after failed restart
|
|
ansible.builtin.command:
|
|
argv:
|
|
- sshd
|
|
- -t
|
|
- -f
|
|
- "{{ SYS_SVC_SSHD_CONFIG_FILE }}"
|
|
register: sys_svc_sshd_config_check
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: 👁️ Show sshd_config validation after failed restart
|
|
ansible.builtin.debug:
|
|
msg: |
|
|
=== sshd -t -f {{ SYS_SVC_SSHD_CONFIG_FILE }} ===
|
|
rc={{ sys_svc_sshd_config_check.rc | default('n/a') }}
|
|
{{ sys_svc_sshd_config_check.stdout | default('') }}
|
|
{{ sys_svc_sshd_config_check.stderr | default('') }}
|
|
|
|
- name: 🛑 Fail SSH restart on an invalid sshd_config
|
|
ansible.builtin.fail:
|
|
msg: >-
|
|
Restart of {{ sys_svc_sshd_service_unit }} failed and
|
|
sshd -t rejects {{ SYS_SVC_SSHD_CONFIG_FILE }} (rc={{ sys_svc_sshd_config_check.rc }}).
|
|
See shared service diagnostics above and the validation output.
|
|
when:
|
|
- sys_svc_sshd_config_check.rc is defined
|
|
- sys_svc_sshd_config_check.rc != 0
|