100 lines
3.8 KiB
YAML
100 lines
3.8 KiB
YAML
---
|
|
# roles/pfsense_upgrade/tasks/upgrade.yml
|
|
# Applies the upgrade after safety checks pass.
|
|
# Only runs when perform_upgrade=true.
|
|
|
|
- name: Abort if no upgrade is available (nothing to do)
|
|
ansible.builtin.debug:
|
|
msg: >
|
|
No in-branch upgrade is available for {{ inventory_hostname }}.
|
|
Current version {{ pfsense_current_version }} is already the latest on branch {{ pfsense_major_minor }}.
|
|
Skipping upgrade.
|
|
when:
|
|
- not (upgrade_available | bool)
|
|
- not (new_major_release_available | bool and allow_major_upgrade | bool)
|
|
|
|
- name: End play for this host if nothing to upgrade
|
|
ansible.builtin.meta: end_host
|
|
when:
|
|
- not (upgrade_available | bool)
|
|
- not (new_major_release_available | bool and allow_major_upgrade | bool)
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Branch-crossing guard
|
|
# ---------------------------------------------------------------------------
|
|
- name: Abort if major upgrade is available but not explicitly allowed
|
|
ansible.builtin.fail:
|
|
msg: >
|
|
A new pfSense branch is available ({{ upstream_version }}) but allow_major_upgrade=false.
|
|
Review the release notes for {{ upstream_version }} before upgrading across branches.
|
|
Re-run with -e "allow_major_upgrade=true" when ready.
|
|
when:
|
|
- new_major_release_available | bool
|
|
- not (allow_major_upgrade | bool)
|
|
- not (upgrade_available | bool)
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Pre-upgrade config backup
|
|
# ---------------------------------------------------------------------------
|
|
- name: Trigger config backup via PHP (writes to /cf/conf/backup/)
|
|
ansible.builtin.raw: >
|
|
sudo php -r "require_once('/etc/inc/config.inc');
|
|
require_once('/etc/inc/util.inc');
|
|
backup_config();"
|
|
register: _backup_result
|
|
changed_when: false
|
|
when: not (skip_backup_check | bool)
|
|
|
|
- name: Confirm backup file was created
|
|
ansible.builtin.raw: >
|
|
ls -t {{ pfsense_config_backup_path }}/config-*.xml 2>/dev/null | head -1
|
|
register: _backup_file
|
|
changed_when: false
|
|
when: not (skip_backup_check | bool)
|
|
|
|
- name: Display backup file path
|
|
ansible.builtin.debug:
|
|
msg: "Config backup written to: {{ _backup_file.stdout | trim }}"
|
|
when:
|
|
- not (skip_backup_check | bool)
|
|
- _backup_file.stdout | trim | length > 0
|
|
|
|
- name: Warn if no backup file found
|
|
ansible.builtin.debug:
|
|
msg: >
|
|
WARNING: Could not confirm config backup was written.
|
|
Check {{ pfsense_config_backup_path }} manually before proceeding.
|
|
when:
|
|
- not (skip_backup_check | bool)
|
|
- _backup_file.stdout | trim | length == 0
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Execute the upgrade
|
|
# ---------------------------------------------------------------------------
|
|
- name: "UPGRADE — Running pfSense-upgrade on {{ inventory_hostname }}"
|
|
ansible.builtin.raw: >
|
|
sudo {{ pfsense_upgrade_bin }} -d -y 2>&1
|
|
register: _upgrade_result
|
|
async: 600 # pfSense upgrades can take several minutes
|
|
poll: 10
|
|
timeout: 620
|
|
# The upgrade reboots the host — the connection will drop. That is expected.
|
|
failed_when: >
|
|
_upgrade_result.rc is defined and
|
|
_upgrade_result.rc != 0 and
|
|
'reboot' not in _upgrade_result.stdout | lower and
|
|
'Restarting' not in _upgrade_result.stdout
|
|
|
|
- name: Display upgrade output
|
|
ansible.builtin.debug:
|
|
msg: "{{ _upgrade_result.stdout_lines | default(['(no output captured — likely rebooted mid-stream)']) }}"
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Wait for host to come back after reboot
|
|
# ---------------------------------------------------------------------------
|
|
- name: Wait for pfSense to reboot and become reachable
|
|
ansible.builtin.wait_for_connection:
|
|
delay: 30
|
|
timeout: "{{ reboot_timeout }}"
|
|
sleep: 10
|
|
when: auto_reboot | bool |