菜单
Dynamic group reconstruction for rollback play patterns. Use when setting up rollback plays that target dynamic groups, managing ephemeral groups, or reconstructing host connections.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Project architecture and design principles for vm_builds Ansible project. Includes bake vs configure patterns, two-role service model, and deployment lifecycle.
Python code conventions. Functions return errors, .env parsing strips quotes, type hints required.
Proactive validation patterns to catch issues early, prevent debugging blind, and establish testing habits before problems escalate.
Update skills and rules when encountering new issues to prevent recurrence. Includes hard-fail patterns, code custodianship, and mandatory testing requirements.
LXC container provisioning and configuration patterns. Use when creating LXC services, managing container networking, or handling LXC template operations.
Molecule test performance optimization patterns. Template caching, NTP sync, pct_remote overhead, apt cache, selective rebuilds.
| name | rollback-group-reconstruction |
| description | Dynamic group reconstruction for rollback play patterns. Use when setting up rollback plays that target dynamic groups, managing ephemeral groups, or reconstructing host connections. |
Rollback plays targeting dynamic groups (e.g., openwrt) MUST be preceded by a group reconstruction play in cleanup.yml. The dynamic group is ephemeral — add_host state does not persist across ansible-playbook invocations.
Without reconstruction, rollback plays have no hosts to target.
ALWAYS add a reconstruction play at the top of cleanup.yml, tagged with ALL rollback tags so it runs whenever any rollback is invoked:
# In playbooks/cleanup.yml — BEFORE any rollback plays
- name: Reconstruct openwrt dynamic group
hosts: router_nodes
tags: [openwrt-security-rollback, openwrt-vlans-rollback, openwrt-dns-rollback, openwrt-mesh-rollback]
gather_facts: true
tasks:
- name: Include group reconstruction
ansible.builtin.include_tasks: tasks/reconstruct_openwrt_group.yml
Extract reconstruction logic into a reusable task file (tasks/reconstruct_openwrt_group.yml) consumed by converge, verify, and cleanup entry points.
The reconstruction task file:
qm statusOPENWRT_SSH_PRIVATE_KEY and ansible_local.vm_builds.playsadd_host with the correct SSH argumentsThe group reconstruction play MUST detect the current auth method (key vs. password) by checking for OPENWRT_SSH_PRIVATE_KEY env var and deploy_stamp state.
After a security hardening rollback, the auth method reverts to password — reconstruction must handle both.
When project_version in group_vars/all.yml advances:
deploy_stamp compares the new version against ansible_local.vm_builds.project_versionThis is the migration path: bump project_version, update the feature play, run converge. The play detects the version mismatch and re-applies. No separate migration playbook needed.