菜单
Per-feature rollback implementation patterns and tag conventions. Use when implementing rollback for specific features, managing UCI changes, or designing rollback procedures.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Project architecture and design principles for vm_builds Ansible project. Includes bake vs configure patterns, two-role service model, and deployment lifecycle.
Python code conventions. Functions return errors, .env parsing strips quotes, type hints required.
Proactive validation patterns to catch issues early, prevent debugging blind, and establish testing habits before problems escalate.
Update skills and rules when encountering new issues to prevent recurrence. Includes hard-fail patterns, code custodianship, and mandatory testing requirements.
LXC container provisioning and configuration patterns. Use when creating LXC services, managing container networking, or handling LXC template operations.
Molecule test performance optimization patterns. Template caching, NTP sync, pct_remote overhead, apt cache, selective rebuilds.
| name | rollback-per-feature |
| description | Per-feature rollback implementation patterns and tag conventions. Use when implementing rollback for specific features, managing UCI changes, or designing rollback procedures. |
Per-feature rollback uses Ansible tags in cleanup.yml. Convention: --tags <feature>-rollback runs the inverse of --tags <feature>.
Feature Tags follow this pattern:
Feature Tags (current)
├── Apply: openwrt-security, openwrt-vlans, openwrt-dns, openwrt-mesh
└── Rollback: openwrt-security-rollback, openwrt-vlans-rollback, openwrt-dns-rollback, openwrt-mesh-rollback
Apply tags go in site.yml plays. Rollback tags go in cleanup.yml plays. Rollback plays are gated by their rollback-specific tags (e.g., openwrt-security-rollback) — you must pass --tags explicitly to invoke them. NEVER use Ansible's never special tag.
UCI changes on OpenWrt are atomic per uci commit. ALWAYS group related UCI changes into a single commit. Rollback reverses them with uci delete or uci set to defaults, then uci commit.
Per-feature rollback pattern (OpenWrt UCI):
# In playbooks/cleanup.yml
- name: Rollback security hardening
hosts: openwrt
tags: [openwrt-security-rollback]
gather_facts: false
tasks:
- name: Remove banIP and revert SSH config
ansible.builtin.raw: |
opkg remove banip 2>/dev/null
uci delete dropbear.@dropbear[0].PasswordAuth 2>/dev/null
uci delete dropbear.@dropbear[0].RootPasswordAuth 2>/dev/null
uci commit dropbear
/etc/init.d/dropbear restart
Rollback plays are gated by when: rollback | default(false) | bool. Invoke via: ansible-playbook cleanup.yml --tags openwrt-security-rollback -e rollback=true.
opkg remove. ALWAYS list installed packages in the feature's rollback procedure.deploy_stamp records what ran. Rollback tasks MUST check ansible_local.vm_builds.plays to determine what needs undoing. NEVER attempt to roll back a feature that was never applied.
Use deploy_stamp for idempotent feature application — skip expensive operations when the feature is already at the current version.
Rollback MUST fully restore the baseline auth/connection state. If a feature deploys SSH keys and disables password auth, rollback MUST re-enable password auth AND clear the root password (restoring empty-password baseline).
Partial auth rollback leaves the system in an undefined state — neither key nor password works.
cleanup.sh supports a rollback subcommand that delegates to build.py:
./cleanup.sh rollback security test.env
# → build.py --playbook cleanup --tags openwrt-security-rollback
The subcommand maps the feature name to the rollback tag using the convention openwrt-<feature>-rollback.
site.yml and cleanup.yml free of dead code.