openwrt.yaml

- hosts: openwrt
  connection: ssh
  user: root
  become: yes
  gather_facts: no
  serial: 1
  ignore_unreachable: true
  vars:
    aps: "{{ groups['aps'] }}"

  roles:
    - gekmihesg.openwrt

  tasks:

    - name: List all firmware
      delegate_to: localhost
      become: no
      find:
        path: firmware
        patterns: '*{{ model }}*sysupgrade.bin'
      register: firmware_candidates
      check_mode: false

    - name: Select newest firmware image
      set_fact:
        firmware: '{{ firmware_candidates.files | sort(attribute="ctime", reverse=True) | map(attribute="path") | first | default("") }}'

    - name: Get currently installed version
      when: firmware != ''
      shell: source /etc/openwrt_release && echo "$DISTRIB_RELEASE"
      register: openwrt_version_command
      check_mode: false

    - name: Get currently installed version
      when: firmware != ''
      set_fact:
        openwrt_version: '{{ openwrt_version_command.stdout_lines[0] }}'

    - name: Determine if new firmware should be installed
      when: firmware != ''
      set_fact:
        latest_version_installed: '{{ firmware | regex_findall(openwrt_version) | length | bool }}'

    - name: Confirm upgrade of firmware
      when: firmware != '' and not latest_version_installed
      pause:
        prompt: OpenWrt will be upgraded to {{ firmware }}. Continue?

    - name: Copy new OpenWrt firmware
      when: firmware != '' and not latest_version_installed
      copy:
        src: '{{ firmware }}'
        dest: /tmp/sysupgrade.bin
    
    - name: Start sysupgrade
      when: firmware != '' and not latest_version_installed
      nohup:
        command: sysupgrade -q /tmp/sysupgrade.bin
    
    - name: Wait for reboot
      when: firmware != '' and not latest_version_installed
      wait_for_connection:
        timeout: 300
        delay: 60

    - name: Ensure reboot after configuration
      when: firmware != '' and not latest_version_installed
      set_fact:
        reboot_after: yes

    - name: Get a list of all installed packages
      shell: opkg list-installed | cut -d " " -f1
      register: installed_packages_command
      check_mode: false

    - name: Get a list of all installed packages
      set_fact:
        installed_packages: '{{ installed_packages_command.stdout_lines }}'
      check_mode: false

    - name: Remove packages
      when: (common_packages.remove is defined or packages.remove is defined) and item in installed_packages
      opkg:
        name: '{{ item }}'
        state: absent
      with_flattened:
        - '{{ common_packages.remove | default([]) }}'
        - '{{ packages.remove | default([]) }}'
      loop_control:
        label: Removing {{ item }}
    
    - name: Set required packages for gekmihesg.openwrt
      when: firmware != '' and not latest_version_installed
      set_fact:
        gekmihesg_openwrt_required_packages:
          - coreutils-base64
          - coreutils-md5sum
          - coreutils-sha1sum

    - name: Install packages
      when: (common_packages.install is defined or packages.install is defined) and item not in installed_packages
      opkg:
        name: '{{ item }}'
        state: present
        update_cache: yes
      with_flattened:
        - '{{ gekmihesg_openwrt_required_packages | default([]) }}'
        - '{{ common_packages.install | default([]) }}'
        - '{{ packages.install | default([]) }}'
      loop_control:
        label: Installing {{ item }}

    - name: Copy local packages
      when: common_packages.local is defined or packages.local is defined
      copy:
        src: packages/{{ item }}
        dest: /tmp
      with_flattened:
        - '{{ common_packages.local | default([]) }}'
        - '{{ packages.local | default([]) }}'
      loop_control:
        label: Copying {{ item }}

    - name: Install local packages
      when: common_packages.local is defined or packages.local is defined
      opkg:
        name: '/tmp/{{ item }}'
        state: present
        force: reinstall
      with_flattened:
        - '{{ common_packages.local | default([]) }}'
        - '{{ packages.local | default([]) }}'
      loop_control:
        label: Installing {{ item }}
      register: opkg_install_local_command
      failed_when: '"Installing " not in opkg_install_local_command.msg'

    - name: Cleanup copied local packages in /tmp
      when: common_packages.local is defined or packages.local is defined
      file:
        name: '/tmp/{{ item }}'
        state: absent
      with_flattened:
        - '{{ common_packages.local | default([]) }}'
        - '{{ packages.local | default([]) }}'
      loop_control:
        label: Cleaning up /tmp/{{ item }}

    - name: Pin packages
      when: common_packages.pin is defined or packages.pin is defined
      shell: opkg flag hold {{ item }}
      with_flattened:
        - '{{ common_packages.pin | default([]) }}'
        - '{{ packages.pin | default([]) }}'
      loop_control:
        label: Pinning {{ item }}

    - name: Get packages that can be upgraded
      when: upgrade_packages is defined and upgrade_packages
      shell: opkg list-upgradable | cut -d " " -f1
      register: available_upgrades_command
      check_mode: false

    - name: Get packages that can be upgraded
      when: upgrade_packages is defined and upgrade_packages
      set_fact:
        available_upgrades: '{{ available_upgrades_command.stdout_lines }}'
      check_mode: false

    - name: Upgrade all other packages
      when: available_upgrades is defined
      shell: opkg upgrade {{ item }}
      with_flattened:
        - '{{ available_upgrades }}'
      loop_control:
        label: Upgrading {{ item }}

    - name: Get public IP address
      when: upnp.configure_with_external_ip is defined and upnp.configure_with_external_ip
      shell: wget -qO- http://ipecho.net/plain
      register: external_ip_command
      check_mode: false

    - name: Set variable for public IP address
      when: upnp.configure_with_external_ip is defined and upnp.configure_with_external_ip
      set_fact:
        external_ip: '{{ external_ip_command.stdout_lines[0] }}'

    - name: Hash password
      delegate_to: localhost
      become: no
      shell: openssl passwd -salt 'YRNxiMTL' -1 '{{ ssh_password }}'
      register: ssh_password_hashed_command
      check_mode: false

    - name: Set variable for hashed password
      set_fact:
        ssh_password_hashed: '{{ ssh_password_hashed_command.stdout_lines[0] }}'

    - name: Creating required directories
      file:
        path: '{{item}}'
        recurse: yes
        state: directory
      with_items:
        - /etc/crontabs
      loop_control:
        label: Creating directory {{ item }}

    - name: Copy configuration
      template:
        src: 'config/{{ item.name }}'
        dest: '{{ item.path }}/{{ item.filename | default(item.name) }}'
      with_items:
        - name: authorized_keys
          path: /etc/dropbear
        - name: dhcp
          path: /etc/config
        - name: dnsmasq.conf
          path: /etc
        - name: ethers
          path: /etc
        - name: firewall
          path: /etc/config
        - name: luci
          path: /etc/config
        - name: network
          path: /etc/config
        - name: shadow
          path: /etc
        - name: sqm
          path: /etc/config
        - name: system
          path: /etc/config
        - name: uhttpd
          path: /etc/config
        - name: upnpd
          path: /etc/config
        - name: wireless
          path: /etc/config
        - name: dawn
          path: /etc/config
        - name: cron
          path: /etc/crontabs
          filename: root
      vars:
        networks: "{{ common_networks | combine(host_networks | default({}), recursive=True) }}"
      loop_control:
        label: Copying {{ item.path }}/{{ item.filename | default(item.name) }}

    - name: Copy configuration (binary files)
      copy:
        src: 'certs/{{ item.name }}'
        dest: '{{ item.path }}/{{ item.name }}'
      with_items:
        - name: uhttpd.crt
          path: /etc
        - name: uhttpd.key
          path: /etc
      loop_control:
        label: Copying {{ item.path }}/{{ item.name }}
        
    - name: Copy additional scripts
      copy:
        src: 'bin/{{ item }}'
        dest: '/usr/sbin/{{ item }}'
        mode: 0755
      with_items:
        - upgrade-all-packages
      loop_control:
        label: Copying script to /usr/sbin/{{ item }}

    - name: Disable services
      when: disabled_services is defined
      service:
        name: '{{ item }}'
        state: stopped
        enabled: no
      loop: '{{ disabled_services }}'
      loop_control:
        label: Disabling service {{ item }}

    - name: Reboot device
      when: reboot_after is not defined or reboot_after
      shell: reboot

    - name: Wait for reboot
      when: reboot_after is not defined or reboot_after
      wait_for_connection:
        timeout: 300
        delay: 60