ansible-msp-automations/roles/pfsense_upgrade/tasks/upgrade.yml

---
# roles/pfsense_upgrade/tasks/upgrade.yml
# Execute the actual upgrade process with dynamic repository switching

- name: Display upgrade details
  ansible.builtin.debug:
    msg:
      - "============================================================"
      - "Starting upgrade process on {{ inventory_hostname }}"
      - "============================================================"
      - "  Current version    : {{ pfsense_current_version }}"
      - "  Current repo       : {{ current_repo }}"
      - "  Target repo        : {{ upgrade_target_repo }}"
      - "  Target description : {{ upgrade_target_description }}"
      - "============================================================"
  when: perform_upgrade | bool

# ---------------------------------------------------------------------------
# 1. Backup current configuration before any changes
# ---------------------------------------------------------------------------
- name: Create timestamp for backup
  ansible.builtin.set_fact:
    backup_timestamp: "{{ ansible_date_time.epoch | default(lookup('pipe', 'date +%s')) }}"
  when: perform_upgrade | bool

- name: Create backup of current config.xml
  ansible.builtin.raw: |
    cp /conf/config.xml /conf/config.xml.pre_upgrade_{{ backup_timestamp | default(lookup('pipe', 'date +%s')) }}
  become: yes
  register: _config_backup
  when: perform_upgrade | bool

- name: Verify config backup was created
  ansible.builtin.raw: |
    test -f /conf/config.xml.pre_upgrade_*
  become: yes
  register: _backup_verified
  failed_when: false
  when: perform_upgrade | bool

# ---------------------------------------------------------------------------
# 2. Switch repository in configuration
# ---------------------------------------------------------------------------
- name: Switch repository in config.xml
  ansible.builtin.raw: |
    php -r 'require_once("/etc/inc/config.inc"); require_once("/etc/inc/pkg-utils.inc"); config_set_path("system/pkg_repo_conf_path", "{{ upgrade_target_repo }}"); write_config("Switched to {{ upgrade_target_repo }} for upgrade");'
  become: yes
  register: _repo_switch
  changed_when: true
  when: perform_upgrade | bool

- name: Apply repository configuration via pfSense-repo-setup
  ansible.builtin.raw: |
    /usr/local/sbin/pfSense-repo-setup -U
  become: yes
  register: _repo_apply
  when: perform_upgrade | bool

- name: Verify repository switch took effect
  ansible.builtin.raw: |
    php -r 'require_once("/etc/inc/pkg-utils.inc"); foreach(pkg_list_repos() as $r) { if (isset($r["default"])) { echo $r["name"]; } }'
  become: yes
  register: _verify_repo_switch
  when: perform_upgrade | bool

- name: Display new default repository
  ansible.builtin.debug:
    msg: "Repository switched to: {{ _verify_repo_switch.stdout | trim }}"
  when: 
    - perform_upgrade | bool
    - _verify_repo_switch.stdout | trim == upgrade_target_repo

# ---------------------------------------------------------------------------
# 3. Execute the upgrade (with retry for lock error RC=99)
# ---------------------------------------------------------------------------
- name: Execute pfSense upgrade command
  ansible.builtin.raw: |
    /usr/local/sbin/pfSense-upgrade -y -l /conf/upgrade_log.txt -p /tmp/pfSense-upgrade.sock
  become: yes
  register: _upgrade_exec
  until: _upgrade_exec.rc != 99
  retries: 3
  delay: 10
  ignore_errors: yes
  when: perform_upgrade | bool
  timeout: "{{ upgrade_check_timeout | default(120) }}"

- name: Display upgrade command exit code
  ansible.builtin.debug:
    msg: "Upgrade command exit code: {{ _upgrade_exec.rc }}"
  when: perform_upgrade | bool

- name: Check upgrade success from log file
  ansible.builtin.raw: |
    grep -q "__RC=0" /conf/upgrade_log.txt && echo "SUCCESS" || echo "FAILED"
  become: yes
  register: _upgrade_verify
  when: perform_upgrade | bool

- name: Parse upgrade verification result
  ansible.builtin.set_fact:
    upgrade_successful: "{{ _upgrade_verify.stdout | trim == 'SUCCESS' }}"
    upgrade_exit_code: "{{ _upgrade_exec.rc }}"
  when: perform_upgrade | bool

- name: Display upgrade verification result
  ansible.builtin.debug:
    msg: 
      - "Upgrade verification: {{ _upgrade_verify.stdout | trim }}"
      - "Exit code from log: {{ upgrade_exit_code }}"
  when: perform_upgrade | bool

# ---------------------------------------------------------------------------
# 4. Extract upgrade log summary for debugging
# ---------------------------------------------------------------------------
- name: Get last 20 lines of upgrade log
  ansible.builtin.raw: |
    tail -20 /conf/upgrade_log.txt
  become: yes
  register: _upgrade_log_tail
  when: perform_upgrade | bool

- name: Display upgrade log tail (for debugging)
  ansible.builtin.debug:
    msg: "Upgrade log tail:\n{{ _upgrade_log_tail.stdout }}"
  when: 
    - perform_upgrade | bool
    - not upgrade_successful

# ---------------------------------------------------------------------------
# 5. Handle reboot if needed
# ---------------------------------------------------------------------------
- name: Check if reboot is required from upgrade log
  ansible.builtin.raw: |
    grep -q "__REBOOT_AFTER" /conf/upgrade_log.txt && echo "REBOOT_NEEDED" || echo "NO_REBOOT"
  become: yes
  register: _reboot_check
  when: 
    - perform_upgrade | bool
    - upgrade_successful

- name: Display reboot status
  ansible.builtin.debug:
    msg: "Reboot required: {{ _reboot_check.stdout | trim }}"
  when: 
    - perform_upgrade | bool
    - upgrade_successful

- name: Initiate system reboot
  ansible.builtin.raw: |
    /sbin/reboot
  become: yes
  when: 
    - perform_upgrade | bool
    - upgrade_successful
    - _reboot_check.stdout | trim == "REBOOT_NEEDED"

- name: Wait for system to come back online after reboot
  ansible.builtin.wait_for_connection:
    timeout: "{{ reboot_timeout | default(300) }}"
    delay: 15
  when: 
    - perform_upgrade | bool
    - upgrade_successful
    - _reboot_check.stdout | trim == "REBOOT_NEEDED"

# ---------------------------------------------------------------------------
# 6. Final status and failure handling
# ---------------------------------------------------------------------------
- name: Display upgrade completion message
  ansible.builtin.debug:
    msg: 
      - "============================================================"
      - "✅ Upgrade completed successfully on {{ inventory_hostname }}"
      - "============================================================"
  when: 
    - perform_upgrade | bool
    - upgrade_successful

- name: Display upgrade failure message
  ansible.builtin.debug:
    msg: 
      - "============================================================"
      - "❌ Upgrade FAILED on {{ inventory_hostname }}"
      - "  Exit code: {{ upgrade_exit_code }}"
      - "  Check /conf/upgrade_log.txt on the target system"
      - "============================================================"
  when: 
    - perform_upgrade | bool
    - not upgrade_successful

- name: Fail playbook if upgrade unsuccessful
  ansible.builtin.fail:
    msg: "Upgrade failed on {{ inventory_hostname }}. Manual intervention required."
  when: 
    - perform_upgrade | bool
    - not upgrade_successful