forked from jakub/ansible
feat: enhance MikroTik backup playbook with improved validation and structure
This commit is contained in:
martin.fencl
+267
-85
@@ -1,149 +1,331 @@
|
||||
# mikrotikbackup_clean.yml
|
||||
|
||||
|
||||
- name: Backup and/or Upgrade MikroTik
|
||||
hosts: mikrotik_routers
|
||||
gather_facts: no
|
||||
---
|
||||
- name: Backup and/or upgrade MikroTik
|
||||
hosts: mikrotiks
|
||||
gather_facts: false
|
||||
|
||||
vars:
|
||||
backup_dir: /opt/mikrotik_backups/
|
||||
# This directory is located on the Semaphore runner
|
||||
backup_dir: /opt/mikrotik_backups
|
||||
|
||||
# Maximum time for a router to return after an upgrade
|
||||
upgrade_wait_timeout: 900
|
||||
|
||||
tasks:
|
||||
# -------------------------------------------------------------------------
|
||||
# Common information
|
||||
# -------------------------------------------------------------------------
|
||||
|
||||
# ----------------------------
|
||||
# Always: identity + timestamp
|
||||
# ----------------------------
|
||||
- name: Get router identity
|
||||
community.routeros.command:
|
||||
commands: /system identity print
|
||||
commands:
|
||||
- /system identity get name
|
||||
register: identity_raw
|
||||
tags: always
|
||||
changed_when: false
|
||||
tags:
|
||||
- always
|
||||
|
||||
- name: Parse router name
|
||||
set_fact:
|
||||
router_name: "{{ identity_raw.stdout[0].split(': ')[1] | trim }}"
|
||||
tags: always
|
||||
- name: Build safe router name
|
||||
ansible.builtin.set_fact:
|
||||
router_name: >-
|
||||
{{
|
||||
(
|
||||
identity_raw.stdout[0]
|
||||
| default(inventory_hostname, true)
|
||||
| trim
|
||||
)
|
||||
| regex_replace('[^A-Za-z0-9._-]+', '_')
|
||||
| regex_replace('^_+|_+$', '')
|
||||
}}
|
||||
tags:
|
||||
- always
|
||||
|
||||
- name: Get timestamp
|
||||
ansible.builtin.command: date +%Y-%m-%d_%H-%M-%S
|
||||
- name: Validate router name
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- router_name | length > 0
|
||||
fail_msg: >-
|
||||
Could not determine RouterOS identity for
|
||||
{{ inventory_hostname }}.
|
||||
quiet: true
|
||||
tags:
|
||||
- always
|
||||
|
||||
- name: Generate backup timestamp
|
||||
ansible.builtin.command:
|
||||
argv:
|
||||
- date
|
||||
- --utc
|
||||
- "+%Y-%m-%d_%H-%M-%S"
|
||||
register: date_out
|
||||
changed_when: false
|
||||
delegate_to: localhost
|
||||
tags: always
|
||||
tags:
|
||||
- always
|
||||
|
||||
- name: Set timestamp fact
|
||||
set_fact:
|
||||
ts: "{{ date_out.stdout }}"
|
||||
tags: always
|
||||
ansible.builtin.set_fact:
|
||||
backup_timestamp: "{{ date_out.stdout | trim }}"
|
||||
tags:
|
||||
- always
|
||||
|
||||
# -------------------------------------------------------------------------
|
||||
# Backup
|
||||
# Run with: --tags backup
|
||||
# -------------------------------------------------------------------------
|
||||
|
||||
# ----------------------------
|
||||
# Backup (tag: backup)
|
||||
# ----------------------------
|
||||
- name: Ensure local backup directory exists
|
||||
ansible.builtin.file:
|
||||
path: "{{ backup_dir }}"
|
||||
state: directory
|
||||
mode: "0755"
|
||||
mode: "0700"
|
||||
delegate_to: localhost
|
||||
tags: [backup, never]
|
||||
run_once: true
|
||||
tags:
|
||||
- backup
|
||||
- never
|
||||
|
||||
- name: Export router config
|
||||
- name: Export RouterOS configuration
|
||||
community.routeros.command:
|
||||
commands: /export terse show-sensitive
|
||||
commands:
|
||||
- /export terse show-sensitive
|
||||
register: export_cfg
|
||||
tags: [backup, never]
|
||||
changed_when: false
|
||||
no_log: true
|
||||
tags:
|
||||
- backup
|
||||
- never
|
||||
|
||||
- name: Save export locally
|
||||
- name: Validate exported configuration
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- export_cfg.stdout is defined
|
||||
- export_cfg.stdout | length > 0
|
||||
- export_cfg.stdout[0] | default('') | trim | length > 0
|
||||
fail_msg: >-
|
||||
RouterOS returned an empty configuration export
|
||||
for {{ inventory_hostname }}.
|
||||
quiet: true
|
||||
no_log: true
|
||||
tags:
|
||||
- backup
|
||||
- never
|
||||
|
||||
- name: Set backup filename
|
||||
ansible.builtin.set_fact:
|
||||
backup_file: >-
|
||||
{{
|
||||
backup_dir
|
||||
~ '/'
|
||||
~ router_name
|
||||
~ '-'
|
||||
~ backup_timestamp
|
||||
~ '.rsc'
|
||||
}}
|
||||
tags:
|
||||
- backup
|
||||
- never
|
||||
|
||||
- name: Save RouterOS configuration locally
|
||||
ansible.builtin.copy:
|
||||
content: "{{ export_cfg.stdout[0] }}"
|
||||
dest: "{{ backup_dir }}/{{ router_name }}-{{ ts }}.rsc"
|
||||
content: "{{ export_cfg.stdout[0] | trim }}\n"
|
||||
dest: "{{ backup_file }}"
|
||||
mode: "0600"
|
||||
delegate_to: localhost
|
||||
tags: [backup, never]
|
||||
no_log: true
|
||||
diff: false
|
||||
tags:
|
||||
- backup
|
||||
- never
|
||||
|
||||
# ----------------------------
|
||||
# Upgrade (tag: upgrade)
|
||||
# ----------------------------
|
||||
- name: Check current and latest available package versions
|
||||
- name: Show backup result
|
||||
ansible.builtin.debug:
|
||||
msg: >-
|
||||
MikroTik backup completed:
|
||||
host={{ inventory_hostname }}
|
||||
identity={{ router_name }}
|
||||
file={{ backup_file }}
|
||||
tags:
|
||||
- backup
|
||||
- never
|
||||
|
||||
# -------------------------------------------------------------------------
|
||||
# Upgrade
|
||||
# Run with: --tags upgrade
|
||||
# Run with backup before upgrade: --tags backup,upgrade
|
||||
# -------------------------------------------------------------------------
|
||||
|
||||
- name: Check current and latest RouterOS versions
|
||||
community.routeros.command:
|
||||
commands: /system package update check-for-updates
|
||||
commands:
|
||||
- /system package update check-for-updates
|
||||
register: update_check
|
||||
tags: [upgrade, never]
|
||||
changed_when: false
|
||||
tags:
|
||||
- upgrade
|
||||
- never
|
||||
|
||||
- name: Normalize update output
|
||||
set_fact:
|
||||
_update_text: "{{ update_check.stdout[0] | replace('\r', '') }}"
|
||||
tags: [upgrade, never]
|
||||
ansible.builtin.set_fact:
|
||||
update_text: >-
|
||||
{{
|
||||
update_check.stdout[0]
|
||||
| default('')
|
||||
| replace('\r', '')
|
||||
}}
|
||||
tags:
|
||||
- upgrade
|
||||
- never
|
||||
|
||||
# ⬇️ Add this to see exactly what RouterOS returns before parsing
|
||||
- name: Debug raw update output
|
||||
ansible.builtin.debug:
|
||||
msg: "{{ _update_text }}"
|
||||
tags: [upgrade, never]
|
||||
- name: Extract version matches
|
||||
ansible.builtin.set_fact:
|
||||
installed_version_matches: >-
|
||||
{{
|
||||
update_text
|
||||
| regex_findall(
|
||||
'(?im)^\\s*(?:installed|current)-version:\\s*(\\S+)\\s*$'
|
||||
)
|
||||
}}
|
||||
latest_version_matches: >-
|
||||
{{
|
||||
update_text
|
||||
| regex_findall(
|
||||
'(?im)^\\s*(?:latest|newest)-version:\\s*(\\S+)\\s*$'
|
||||
)
|
||||
}}
|
||||
tags:
|
||||
- upgrade
|
||||
- never
|
||||
|
||||
- name: Parse installed and latest versions
|
||||
set_fact:
|
||||
- name: Set installed and latest versions
|
||||
ansible.builtin.set_fact:
|
||||
installed_version: >-
|
||||
{{
|
||||
(_update_text | regex_findall('(?:installed|current)-version:[ ]*([0-9A-Za-z.]+)'))[0]
|
||||
if (_update_text | regex_findall('(?:installed|current)-version:[ ]*([0-9A-Za-z.]+)'))
|
||||
installed_version_matches[0]
|
||||
if installed_version_matches | length > 0
|
||||
else 'unknown'
|
||||
}}
|
||||
latest_version: >-
|
||||
{{
|
||||
(_update_text | regex_findall('(?:latest|newest)-version:[ ]*([0-9A-Za-z.]+)'))[0]
|
||||
if (_update_text | regex_findall('(?:latest|newest)-version:[ ]*([0-9A-Za-z.]+)'))
|
||||
latest_version_matches[0]
|
||||
if latest_version_matches | length > 0
|
||||
else 'unknown'
|
||||
}}
|
||||
tags: [upgrade, never]
|
||||
tags:
|
||||
- upgrade
|
||||
- never
|
||||
|
||||
- name: Fail if versions could not be parsed
|
||||
ansible.builtin.fail:
|
||||
msg: >
|
||||
Could not parse versions from update output.
|
||||
Raw text was: {{ _update_text }}
|
||||
when: installed_version == 'unknown' or latest_version == 'unknown'
|
||||
tags: [upgrade, never]
|
||||
- name: Show raw update output
|
||||
ansible.builtin.debug:
|
||||
msg: "{{ update_text }}"
|
||||
tags:
|
||||
- upgrade
|
||||
- never
|
||||
|
||||
- name: Debug parsed versions
|
||||
- name: Validate parsed RouterOS versions
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- installed_version != 'unknown'
|
||||
- latest_version != 'unknown'
|
||||
fail_msg: >-
|
||||
Could not parse RouterOS versions on
|
||||
{{ inventory_hostname }}.
|
||||
Raw output: {{ update_text }}
|
||||
quiet: true
|
||||
tags:
|
||||
- upgrade
|
||||
- never
|
||||
|
||||
- name: Show RouterOS versions
|
||||
ansible.builtin.debug:
|
||||
msg:
|
||||
- "Router: {{ router_name }}"
|
||||
- "Installed: {{ installed_version }}"
|
||||
- "Latest: {{ latest_version }}"
|
||||
tags: [upgrade, never]
|
||||
tags:
|
||||
- upgrade
|
||||
- never
|
||||
|
||||
- name: Skip upgrade if already on latest
|
||||
- name: Show already up-to-date result
|
||||
ansible.builtin.debug:
|
||||
msg: "Router {{ router_name }} is already on latest version {{ installed_version }}. Skipping upgrade."
|
||||
msg: >-
|
||||
Router {{ router_name }} is already running
|
||||
RouterOS {{ installed_version }}.
|
||||
when: installed_version == latest_version
|
||||
tags: [upgrade, never]
|
||||
tags:
|
||||
- upgrade
|
||||
- never
|
||||
|
||||
- name: Trigger package download and install
|
||||
- name: Trigger RouterOS package installation
|
||||
community.routeros.command:
|
||||
commands: /system package update install
|
||||
commands:
|
||||
- /system package update install
|
||||
register: upgrade_result
|
||||
changed_when: true
|
||||
failed_when: false
|
||||
when: installed_version != latest_version
|
||||
tags: [upgrade, never]
|
||||
tags:
|
||||
- upgrade
|
||||
- never
|
||||
|
||||
- name: Wait for router to come back online after reboot
|
||||
- name: Wait for router SSH service to stop
|
||||
ansible.builtin.wait_for:
|
||||
host: "{{ ansible_host | default(inventory_hostname) }}"
|
||||
port: "{{ ansible_port | default(22) | int }}"
|
||||
state: stopped
|
||||
connect_timeout: 5
|
||||
timeout: 180
|
||||
delegate_to: localhost
|
||||
failed_when: false
|
||||
when: installed_version != latest_version
|
||||
tags:
|
||||
- upgrade
|
||||
- never
|
||||
|
||||
- name: Wait for router SSH service to start
|
||||
ansible.builtin.wait_for:
|
||||
host: "{{ ansible_host | default(inventory_hostname) }}"
|
||||
port: "{{ ansible_port | default(22) | int }}"
|
||||
state: started
|
||||
delay: 10
|
||||
connect_timeout: 5
|
||||
timeout: "{{ upgrade_wait_timeout }}"
|
||||
delegate_to: localhost
|
||||
when: installed_version != latest_version
|
||||
tags:
|
||||
- upgrade
|
||||
- never
|
||||
|
||||
- name: Reset RouterOS connection
|
||||
ansible.builtin.meta: reset_connection
|
||||
when: installed_version != latest_version
|
||||
tags:
|
||||
- upgrade
|
||||
- never
|
||||
|
||||
- name: Read RouterOS version after upgrade
|
||||
community.routeros.command:
|
||||
commands: /system resource print
|
||||
register: reboot_wait
|
||||
until: reboot_wait is not failed
|
||||
retries: 30
|
||||
commands:
|
||||
- /system resource get version
|
||||
register: post_upgrade_version
|
||||
retries: 20
|
||||
delay: 15
|
||||
when:
|
||||
- installed_version != latest_version
|
||||
- upgrade_result is not failed
|
||||
tags: [upgrade, never]
|
||||
|
||||
- name: Confirm upgraded version
|
||||
community.routeros.command:
|
||||
commands: /system resource print
|
||||
register: post_upgrade_info
|
||||
until: post_upgrade_version is succeeded
|
||||
changed_when: false
|
||||
when: installed_version != latest_version
|
||||
tags: [upgrade, never]
|
||||
tags:
|
||||
- upgrade
|
||||
- never
|
||||
|
||||
- name: Show post-upgrade RouterOS version
|
||||
- name: Show RouterOS version after upgrade
|
||||
ansible.builtin.debug:
|
||||
msg: "{{ post_upgrade_info.stdout[0] | regex_search('version: .+') }}"
|
||||
msg: >-
|
||||
Router {{ router_name }} is online.
|
||||
RouterOS version:
|
||||
{{ post_upgrade_version.stdout[0] | default('unknown') | trim }}
|
||||
when: installed_version != latest_version
|
||||
tags: [upgrade, never]
|
||||
tags:
|
||||
- upgrade
|
||||
- never
|
||||
|
||||
Reference in New Issue
Block a user