all:
  children:
    zuul_unreachable:
      hosts: {}
  hosts:
    debian-bookworm:
      ansible_connection: ssh
      ansible_host: 2a13:1a81:8000:3124:f816:3eff:fedc:9274
      ansible_port: 22
      ansible_python_interpreter: auto
      ansible_user: zuul
      nodepool:
        az: nova
        cloud: regiocloud-a-ci
        external_id: 5ac9c72e-4e8b-438b-bc58-6b1d079fbba0
        host_id: df70f2a3f3d0c26428f22685cfc722ebc48099d99e7332c39e017195
        interface_ip: 2a13:1a81:8000:3124:f816:3eff:fedc:9274
        label: debian-bookworm
        node_properties: {}
        private_ipv4: 10.128.7.124
        private_ipv6: null
        provider: regiocloud-a
        public_ipv4: 81.163.192.113
        public_ipv6: 2a13:1a81:8000:3124:f816:3eff:fedc:9274
        region: null
        slot: null
  vars:
    zuul:
      _inheritance_path:
      - '<Job base explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-config/zuul.d/jobs.yaml@main#2>'
      - '<Job ansible-collection-ensure-readme explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-jobs/.zuul.yaml@main#2>'
      - '<Job ansible-collection-ensure-readme explicit: None implied: None source:
        osism/ansible-collection-services/.zuul.yaml@main#498>'
      ansible_version: '9'
      attempts: 1
      branch: main
      build: 31ee0409f830484ebab0b6c6cfa3aedb
      build_refs:
      - branch: main
        change: '2085'
        change_message: "wireguard: enable IP forwarding and MASQUERADE for gateway
          mode\n\n## Summary\n\n- Add `sysctl -w net.ipv4.ip_forward=1` and `iptables
          -t nat -A POSTROUTING -o ... -j MASQUERADE` to the WireGuard role's `PostUp`,
          and the corresponding `PostDown` cleanup\n- Add `wireguard_outbound_interface`
          variable (default: `ansible_default_ipv4.interface`) to identify the interface
          for MASQUERADE\n- Add `test_gateway_forwarding` molecule test verifying
          ip_forward and MASQUERADE are in effect after the role runs\n\n## Background\n\nThe
          WireGuard role is deployed on the testbed manager as a gateway: clients
          connect via WireGuard and traffic to `192.168.16.0/20` (the testbed management
          network, including `api.testbed.osism.xyz` at `192.168.16.254`) is forwarded
          through the manager's primary interface.\n\nTwo settings were missing:\n\n1.
          **ip_forward** \u2014 without it the kernel silently drops forwarded packets\n2.
          **MASQUERADE** \u2014 without it forwarded packets leave the manager with
          the client's WireGuard IP (`192.168.48.x`) as source, which is not in the
          manager's Neutron port `allowed_address_pairs` and is dropped by port security\n\n##
          Scope\n\nThe change applies to every node in the `wireguard` host group.
          Nodes using the role for peer-to-peer VPN without gateway routing will also
          get ip_forward enabled and a MASQUERADE rule on their default interface.
          Both are harmless in that context but are broader than strictly necessary.\n\nip_forward
          is not restored to 0 in PostDown \u2014 this is intentional and standard
          practice for WireGuard gateways.\n\n## Test plan\n\n- [ ] Molecule test
          `test_gateway_forwarding` passes (checks ip_forward=1 and MASQUERADE present)\n-
          [ ] Verified end-to-end on regiocloud testbed: WireGuard client on testbed-node-0
          connects to manager, pings testbed-node-1 through tunnel \u2014 0% packet
          loss\n\n**Known limitation:** the molecule MASQUERADE assertion can pass
          vacuously on CI runners where Docker is running (Docker installs its own
          MASQUERADE rules). The ip_forward assertion is not affected.\n\n\U0001F916
          Generated with [Claude Code](https://claude.com/claude-code)"
        change_url: https://github.com/osism/ansible-collection-services/pull/2085
        commit_id: 9e51509e440ea023f8f7d73921ed596493d4d71c
        patchset: 9e51509e440ea023f8f7d73921ed596493d4d71c
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/ansible-collection-services
          name: osism/ansible-collection-services
          short_name: ansible-collection-services
        src_dir: src/github.com/osism/ansible-collection-services
        topic: null
      buildset: e262f5897a0542ee9467b357fba696c3
      buildset_refs:
      - branch: main
        change: '2085'
        change_message: "wireguard: enable IP forwarding and MASQUERADE for gateway
          mode\n\n## Summary\n\n- Add `sysctl -w net.ipv4.ip_forward=1` and `iptables
          -t nat -A POSTROUTING -o ... -j MASQUERADE` to the WireGuard role's `PostUp`,
          and the corresponding `PostDown` cleanup\n- Add `wireguard_outbound_interface`
          variable (default: `ansible_default_ipv4.interface`) to identify the interface
          for MASQUERADE\n- Add `test_gateway_forwarding` molecule test verifying
          ip_forward and MASQUERADE are in effect after the role runs\n\n## Background\n\nThe
          WireGuard role is deployed on the testbed manager as a gateway: clients
          connect via WireGuard and traffic to `192.168.16.0/20` (the testbed management
          network, including `api.testbed.osism.xyz` at `192.168.16.254`) is forwarded
          through the manager's primary interface.\n\nTwo settings were missing:\n\n1.
          **ip_forward** \u2014 without it the kernel silently drops forwarded packets\n2.
          **MASQUERADE** \u2014 without it forwarded packets leave the manager with
          the client's WireGuard IP (`192.168.48.x`) as source, which is not in the
          manager's Neutron port `allowed_address_pairs` and is dropped by port security\n\n##
          Scope\n\nThe change applies to every node in the `wireguard` host group.
          Nodes using the role for peer-to-peer VPN without gateway routing will also
          get ip_forward enabled and a MASQUERADE rule on their default interface.
          Both are harmless in that context but are broader than strictly necessary.\n\nip_forward
          is not restored to 0 in PostDown \u2014 this is intentional and standard
          practice for WireGuard gateways.\n\n## Test plan\n\n- [ ] Molecule test
          `test_gateway_forwarding` passes (checks ip_forward=1 and MASQUERADE present)\n-
          [ ] Verified end-to-end on regiocloud testbed: WireGuard client on testbed-node-0
          connects to manager, pings testbed-node-1 through tunnel \u2014 0% packet
          loss\n\n**Known limitation:** the molecule MASQUERADE assertion can pass
          vacuously on CI runners where Docker is running (Docker installs its own
          MASQUERADE rules). The ip_forward assertion is not affected.\n\n\U0001F916
          Generated with [Claude Code](https://claude.com/claude-code)"
        change_url: https://github.com/osism/ansible-collection-services/pull/2085
        commit_id: 9e51509e440ea023f8f7d73921ed596493d4d71c
        patchset: 9e51509e440ea023f8f7d73921ed596493d4d71c
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/ansible-collection-services
          name: osism/ansible-collection-services
          short_name: ansible-collection-services
        src_dir: src/github.com/osism/ansible-collection-services
        topic: null
      change: '2085'
      change_message: "wireguard: enable IP forwarding and MASQUERADE for gateway
        mode\n\n## Summary\n\n- Add `sysctl -w net.ipv4.ip_forward=1` and `iptables
        -t nat -A POSTROUTING -o ... -j MASQUERADE` to the WireGuard role's `PostUp`,
        and the corresponding `PostDown` cleanup\n- Add `wireguard_outbound_interface`
        variable (default: `ansible_default_ipv4.interface`) to identify the interface
        for MASQUERADE\n- Add `test_gateway_forwarding` molecule test verifying ip_forward
        and MASQUERADE are in effect after the role runs\n\n## Background\n\nThe WireGuard
        role is deployed on the testbed manager as a gateway: clients connect via
        WireGuard and traffic to `192.168.16.0/20` (the testbed management network,
        including `api.testbed.osism.xyz` at `192.168.16.254`) is forwarded through
        the manager's primary interface.\n\nTwo settings were missing:\n\n1. **ip_forward**
        \u2014 without it the kernel silently drops forwarded packets\n2. **MASQUERADE**
        \u2014 without it forwarded packets leave the manager with the client's WireGuard
        IP (`192.168.48.x`) as source, which is not in the manager's Neutron port
        `allowed_address_pairs` and is dropped by port security\n\n## Scope\n\nThe
        change applies to every node in the `wireguard` host group. Nodes using the
        role for peer-to-peer VPN without gateway routing will also get ip_forward
        enabled and a MASQUERADE rule on their default interface. Both are harmless
        in that context but are broader than strictly necessary.\n\nip_forward is
        not restored to 0 in PostDown \u2014 this is intentional and standard practice
        for WireGuard gateways.\n\n## Test plan\n\n- [ ] Molecule test `test_gateway_forwarding`
        passes (checks ip_forward=1 and MASQUERADE present)\n- [ ] Verified end-to-end
        on regiocloud testbed: WireGuard client on testbed-node-0 connects to manager,
        pings testbed-node-1 through tunnel \u2014 0% packet loss\n\n**Known limitation:**
        the molecule MASQUERADE assertion can pass vacuously on CI runners where Docker
        is running (Docker installs its own MASQUERADE rules). The ip_forward assertion
        is not affected.\n\n\U0001F916 Generated with [Claude Code](https://claude.com/claude-code)"
      change_url: https://github.com/osism/ansible-collection-services/pull/2085
      child_jobs: []
      commit_id: 9e51509e440ea023f8f7d73921ed596493d4d71c
      event_id: 3ef86cd0-5449-11f1-898b-bcb110dc4ae8
      executor:
        hostname: 521e9411259a
        inventory_file: /var/lib/zuul/builds/31ee0409f830484ebab0b6c6cfa3aedb/ansible/inventory.yaml
        log_root: /var/lib/zuul/builds/31ee0409f830484ebab0b6c6cfa3aedb/work/logs
        result_data_file: /var/lib/zuul/builds/31ee0409f830484ebab0b6c6cfa3aedb/work/results.json
        src_root: /var/lib/zuul/builds/31ee0409f830484ebab0b6c6cfa3aedb/work/src
        work_root: /var/lib/zuul/builds/31ee0409f830484ebab0b6c6cfa3aedb/work
      include_vars: []
      items:
      - branch: main
        change: '2085'
        change_message: "wireguard: enable IP forwarding and MASQUERADE for gateway
          mode\n\n## Summary\n\n- Add `sysctl -w net.ipv4.ip_forward=1` and `iptables
          -t nat -A POSTROUTING -o ... -j MASQUERADE` to the WireGuard role's `PostUp`,
          and the corresponding `PostDown` cleanup\n- Add `wireguard_outbound_interface`
          variable (default: `ansible_default_ipv4.interface`) to identify the interface
          for MASQUERADE\n- Add `test_gateway_forwarding` molecule test verifying
          ip_forward and MASQUERADE are in effect after the role runs\n\n## Background\n\nThe
          WireGuard role is deployed on the testbed manager as a gateway: clients
          connect via WireGuard and traffic to `192.168.16.0/20` (the testbed management
          network, including `api.testbed.osism.xyz` at `192.168.16.254`) is forwarded
          through the manager's primary interface.\n\nTwo settings were missing:\n\n1.
          **ip_forward** \u2014 without it the kernel silently drops forwarded packets\n2.
          **MASQUERADE** \u2014 without it forwarded packets leave the manager with
          the client's WireGuard IP (`192.168.48.x`) as source, which is not in the
          manager's Neutron port `allowed_address_pairs` and is dropped by port security\n\n##
          Scope\n\nThe change applies to every node in the `wireguard` host group.
          Nodes using the role for peer-to-peer VPN without gateway routing will also
          get ip_forward enabled and a MASQUERADE rule on their default interface.
          Both are harmless in that context but are broader than strictly necessary.\n\nip_forward
          is not restored to 0 in PostDown \u2014 this is intentional and standard
          practice for WireGuard gateways.\n\n## Test plan\n\n- [ ] Molecule test
          `test_gateway_forwarding` passes (checks ip_forward=1 and MASQUERADE present)\n-
          [ ] Verified end-to-end on regiocloud testbed: WireGuard client on testbed-node-0
          connects to manager, pings testbed-node-1 through tunnel \u2014 0% packet
          loss\n\n**Known limitation:** the molecule MASQUERADE assertion can pass
          vacuously on CI runners where Docker is running (Docker installs its own
          MASQUERADE rules). The ip_forward assertion is not affected.\n\n\U0001F916
          Generated with [Claude Code](https://claude.com/claude-code)"
        change_url: https://github.com/osism/ansible-collection-services/pull/2085
        commit_id: 9e51509e440ea023f8f7d73921ed596493d4d71c
        patchset: 9e51509e440ea023f8f7d73921ed596493d4d71c
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/ansible-collection-services
          name: osism/ansible-collection-services
          short_name: ansible-collection-services
          src_dir: src/github.com/osism/ansible-collection-services
        topic: null
      job: ansible-collection-ensure-readme
      jobtags: []
      max_attempts: 3
      message: d2lyZWd1YXJkOiBlbmFibGUgSVAgZm9yd2FyZGluZyBhbmQgTUFTUVVFUkFERSBmb3IgZ2F0ZXdheSBtb2RlCgojIyBTdW1tYXJ5CgotIEFkZCBgc3lzY3RsIC13IG5ldC5pcHY0LmlwX2ZvcndhcmQ9MWAgYW5kIGBpcHRhYmxlcyAtdCBuYXQgLUEgUE9TVFJPVVRJTkcgLW8gLi4uIC1qIE1BU1FVRVJBREVgIHRvIHRoZSBXaXJlR3VhcmQgcm9sZSdzIGBQb3N0VXBgLCBhbmQgdGhlIGNvcnJlc3BvbmRpbmcgYFBvc3REb3duYCBjbGVhbnVwCi0gQWRkIGB3aXJlZ3VhcmRfb3V0Ym91bmRfaW50ZXJmYWNlYCB2YXJpYWJsZSAoZGVmYXVsdDogYGFuc2libGVfZGVmYXVsdF9pcHY0LmludGVyZmFjZWApIHRvIGlkZW50aWZ5IHRoZSBpbnRlcmZhY2UgZm9yIE1BU1FVRVJBREUKLSBBZGQgYHRlc3RfZ2F0ZXdheV9mb3J3YXJkaW5nYCBtb2xlY3VsZSB0ZXN0IHZlcmlmeWluZyBpcF9mb3J3YXJkIGFuZCBNQVNRVUVSQURFIGFyZSBpbiBlZmZlY3QgYWZ0ZXIgdGhlIHJvbGUgcnVucwoKIyMgQmFja2dyb3VuZAoKVGhlIFdpcmVHdWFyZCByb2xlIGlzIGRlcGxveWVkIG9uIHRoZSB0ZXN0YmVkIG1hbmFnZXIgYXMgYSBnYXRld2F5OiBjbGllbnRzIGNvbm5lY3QgdmlhIFdpcmVHdWFyZCBhbmQgdHJhZmZpYyB0byBgMTkyLjE2OC4xNi4wLzIwYCAodGhlIHRlc3RiZWQgbWFuYWdlbWVudCBuZXR3b3JrLCBpbmNsdWRpbmcgYGFwaS50ZXN0YmVkLm9zaXNtLnh5emAgYXQgYDE5Mi4xNjguMTYuMjU0YCkgaXMgZm9yd2FyZGVkIHRocm91Z2ggdGhlIG1hbmFnZXIncyBwcmltYXJ5IGludGVyZmFjZS4KClR3byBzZXR0aW5ncyB3ZXJlIG1pc3Npbmc6CgoxLiAqKmlwX2ZvcndhcmQqKiDigJQgd2l0aG91dCBpdCB0aGUga2VybmVsIHNpbGVudGx5IGRyb3BzIGZvcndhcmRlZCBwYWNrZXRzCjIuICoqTUFTUVVFUkFERSoqIOKAlCB3aXRob3V0IGl0IGZvcndhcmRlZCBwYWNrZXRzIGxlYXZlIHRoZSBtYW5hZ2VyIHdpdGggdGhlIGNsaWVudCdzIFdpcmVHdWFyZCBJUCAoYDE5Mi4xNjguNDgueGApIGFzIHNvdXJjZSwgd2hpY2ggaXMgbm90IGluIHRoZSBtYW5hZ2VyJ3MgTmV1dHJvbiBwb3J0IGBhbGxvd2VkX2FkZHJlc3NfcGFpcnNgIGFuZCBpcyBkcm9wcGVkIGJ5IHBvcnQgc2VjdXJpdHkKCiMjIFNjb3BlCgpUaGUgY2hhbmdlIGFwcGxpZXMgdG8gZXZlcnkgbm9kZSBpbiB0aGUgYHdpcmVndWFyZGAgaG9zdCBncm91cC4gTm9kZXMgdXNpbmcgdGhlIHJvbGUgZm9yIHBlZXItdG8tcGVlciBWUE4gd2l0aG91dCBnYXRld2F5IHJvdXRpbmcgd2lsbCBhbHNvIGdldCBpcF9mb3J3YXJkIGVuYWJsZWQgYW5kIGEgTUFTUVVFUkFERSBydWxlIG9uIHRoZWlyIGRlZmF1bHQgaW50ZXJmYWNlLiBCb3RoIGFyZSBoYXJtbGVzcyBpbiB0aGF0IGNvbnRleHQgYnV0IGFyZSBicm9hZGVyIHRoYW4gc3RyaWN0bHkgbmVjZXNzYXJ5LgoKaXBfZm9yd2FyZCBpcyBub3QgcmVzdG9yZWQgdG8gMCBpbiBQb3N0RG93biDigJQgdGhpcyBpcyBpbnRlbnRpb25hbCBhbmQgc3RhbmRhcmQgcHJhY3RpY2UgZm9yIFdpcmVHdWFyZCBnYXRld2F5cy4KCiMjIFRlc3QgcGxhbgoKLSBbIF0gTW9sZWN1bGUgdGVzdCBgdGVzdF9nYXRld2F5X2ZvcndhcmRpbmdgIHBhc3NlcyAoY2hlY2tzIGlwX2ZvcndhcmQ9MSBhbmQgTUFTUVVFUkFERSBwcmVzZW50KQotIFsgXSBWZXJpZmllZCBlbmQtdG8tZW5kIG9uIHJlZ2lvY2xvdWQgdGVzdGJlZDogV2lyZUd1YXJkIGNsaWVudCBvbiB0ZXN0YmVkLW5vZGUtMCBjb25uZWN0cyB0byBtYW5hZ2VyLCBwaW5ncyB0ZXN0YmVkLW5vZGUtMSB0aHJvdWdoIHR1bm5lbCDigJQgMCUgcGFja2V0IGxvc3MKCioqS25vd24gbGltaXRhdGlvbjoqKiB0aGUgbW9sZWN1bGUgTUFTUVVFUkFERSBhc3NlcnRpb24gY2FuIHBhc3MgdmFjdW91c2x5IG9uIENJIHJ1bm5lcnMgd2hlcmUgRG9ja2VyIGlzIHJ1bm5pbmcgKERvY2tlciBpbnN0YWxscyBpdHMgb3duIE1BU1FVRVJBREUgcnVsZXMpLiBUaGUgaXBfZm9yd2FyZCBhc3NlcnRpb24gaXMgbm90IGFmZmVjdGVkLgoK8J+kliBHZW5lcmF0ZWQgd2l0aCBbQ2xhdWRlIENvZGVdKGh0dHBzOi8vY2xhdWRlLmNvbS9jbGF1ZGUtY29kZSk=
      patchset: 9e51509e440ea023f8f7d73921ed596493d4d71c
      pipeline: check
      playbook_context:
        playbook_projects:
          trusted/project_0/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 58f24f5b479e15eb2d520850d27e3b1b6fc66aa6
          trusted/project_1/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 038dd8b856c62af4433c8477c5cb3d0480847059
          trusted/project_2/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 0c74c57cedff2b36bb37ca68a5338d1c49991496
          untrusted/project_0/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 0c74c57cedff2b36bb37ca68a5338d1c49991496
          untrusted/project_1/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 58f24f5b479e15eb2d520850d27e3b1b6fc66aa6
          untrusted/project_2/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 038dd8b856c62af4433c8477c5cb3d0480847059
        playbooks:
        - path: untrusted/project_0/github.com/osism/zuul-jobs/playbooks/ansible-collection-ensure-readme/run.yaml
          roles:
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_0/zuul-config
            link_target: untrusted/project_1/github.com/osism/zuul-config
            role_path: ansible/playbook_0/role_0/zuul-config/roles
          - checkout: master
            checkout_description: project default branch
            link_name: ansible/playbook_0/role_1/openinfra-zuul-jobs
            link_target: untrusted/project_2/github.com/osism/openinfra-zuul-jobs
            role_path: ansible/playbook_0/role_1/openinfra-zuul-jobs/roles
          - checkout: main
            checkout_description: playbook branch
            link_name: ansible/playbook_0/role_2/zuul-jobs
            link_target: untrusted/project_0/github.com/osism/zuul-jobs
            role_path: ansible/playbook_0/role_2/zuul-jobs/roles
      post_review: false
      post_timeout: null
      pre_timeout: null
      project:
        canonical_hostname: github.com
        canonical_name: github.com/osism/ansible-collection-services
        name: osism/ansible-collection-services
        short_name: ansible-collection-services
        src_dir: src/github.com/osism/ansible-collection-services
      projects:
        github.com/osism/ansible-collection-services:
          canonical_hostname: github.com
          canonical_name: github.com/osism/ansible-collection-services
          checkout: main
          checkout_description: zuul branch
          commit: 2ed607b5152b20270546c86b4b5d19d8e59003a4
          name: osism/ansible-collection-services
          required: false
          short_name: ansible-collection-services
          src_dir: src/github.com/osism/ansible-collection-services
      ref: refs/pull/2085/head
      resources: {}
      tenant: osism
      timeout: 1800
      topic: null
      voting: true
