all:
  children:
    zuul_unreachable:
      hosts: {}
  hosts:
    debian-bookworm:
      ansible_connection: ssh
      ansible_host: 2a13:1a81:8000:3124:f816:3eff:feb9:eb27
      ansible_port: 22
      ansible_python_interpreter: auto
      ansible_user: zuul
      nodepool:
        az: nova
        cloud: regiocloud-a-ci
        external_id: 304dca1b-723f-456f-8b15-678adc6a15bd
        host_id: 4ba4344415ca7057d9956ea5de826bbc0b830981e82c0e0f191fa07b
        interface_ip: 2a13:1a81:8000:3124:f816:3eff:feb9:eb27
        label: debian-bookworm
        node_properties: {}
        private_ipv4: 10.128.0.99
        private_ipv6: null
        provider: regiocloud-a
        public_ipv4: 81.163.193.11
        public_ipv6: 2a13:1a81:8000:3124:f816:3eff:feb9:eb27
        region: null
        slot: null
  vars:
    zuul:
      _inheritance_path:
      - '<Job base explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-config/zuul.d/jobs.yaml@main#2>'
      - '<Job ansible-lint explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-jobs/.zuul.yaml@main#7>'
      - '<Job ansible-lint explicit: None implied: None source: osism/ansible-collection-services/.zuul.yaml@main#498>'
      ansible_version: '9'
      attempts: 1
      branch: main
      build: 8a64f76a5da84dfa87932a67a3c06d88
      build_refs:
      - branch: main
        change: '2086'
        change_message: "wireguard: add MASQUERADE for gateway mode\n\n## Summary\n\n-
          Adds `PreUp` check that aborts with a clear error if `ip_forward` is disabled,
          before the interface is created\n- Adds scoped MASQUERADE rule on the outbound
          interface so WireGuard-forwarded packets leave with the manager's own IP
          \u2014 without it Neutron port security drops them (client range `192.168.48.x`
          is not in `allowed_address_pairs`)\n- `PostDown` removes the MASQUERADE
          rule before tearing down FORWARD rules\n- Two new variables: `wireguard_outbound_interface`
          and `wireguard_client_network`, both with sensible defaults\n\n## Test plan\n\n-
          [ ] Molecule `test_gateway_forwarding` passes (Zuul CI) \u2014 verifies
          `ip_forward=1` and exact MASQUERADE rule present after role runs\n- [ ]
          Verified end-to-end on regiocloud: WireGuard client connects, pings testbed-node-0
          (`192.168.16.10`) through the tunnel \u2014 0% packet loss\n\n\U0001F916
          Generated with [Claude Code](https://claude.com/claude-code)"
        change_url: https://github.com/osism/ansible-collection-services/pull/2086
        commit_id: 9f0935419df0bd5b8b06239f507181df3a856fe1
        patchset: 9f0935419df0bd5b8b06239f507181df3a856fe1
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/ansible-collection-services
          name: osism/ansible-collection-services
          short_name: ansible-collection-services
        src_dir: src/github.com/osism/ansible-collection-services
        topic: null
      buildset: f4a13226eaa945fab87ef9b23f8e8290
      buildset_refs:
      - branch: main
        change: '2086'
        change_message: "wireguard: add MASQUERADE for gateway mode\n\n## Summary\n\n-
          Adds `PreUp` check that aborts with a clear error if `ip_forward` is disabled,
          before the interface is created\n- Adds scoped MASQUERADE rule on the outbound
          interface so WireGuard-forwarded packets leave with the manager's own IP
          \u2014 without it Neutron port security drops them (client range `192.168.48.x`
          is not in `allowed_address_pairs`)\n- `PostDown` removes the MASQUERADE
          rule before tearing down FORWARD rules\n- Two new variables: `wireguard_outbound_interface`
          and `wireguard_client_network`, both with sensible defaults\n\n## Test plan\n\n-
          [ ] Molecule `test_gateway_forwarding` passes (Zuul CI) \u2014 verifies
          `ip_forward=1` and exact MASQUERADE rule present after role runs\n- [ ]
          Verified end-to-end on regiocloud: WireGuard client connects, pings testbed-node-0
          (`192.168.16.10`) through the tunnel \u2014 0% packet loss\n\n\U0001F916
          Generated with [Claude Code](https://claude.com/claude-code)"
        change_url: https://github.com/osism/ansible-collection-services/pull/2086
        commit_id: 9f0935419df0bd5b8b06239f507181df3a856fe1
        patchset: 9f0935419df0bd5b8b06239f507181df3a856fe1
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/ansible-collection-services
          name: osism/ansible-collection-services
          short_name: ansible-collection-services
        src_dir: src/github.com/osism/ansible-collection-services
        topic: null
      change: '2086'
      change_message: "wireguard: add MASQUERADE for gateway mode\n\n## Summary\n\n-
        Adds `PreUp` check that aborts with a clear error if `ip_forward` is disabled,
        before the interface is created\n- Adds scoped MASQUERADE rule on the outbound
        interface so WireGuard-forwarded packets leave with the manager's own IP \u2014
        without it Neutron port security drops them (client range `192.168.48.x` is
        not in `allowed_address_pairs`)\n- `PostDown` removes the MASQUERADE rule
        before tearing down FORWARD rules\n- Two new variables: `wireguard_outbound_interface`
        and `wireguard_client_network`, both with sensible defaults\n\n## Test plan\n\n-
        [ ] Molecule `test_gateway_forwarding` passes (Zuul CI) \u2014 verifies `ip_forward=1`
        and exact MASQUERADE rule present after role runs\n- [ ] Verified end-to-end
        on regiocloud: WireGuard client connects, pings testbed-node-0 (`192.168.16.10`)
        through the tunnel \u2014 0% packet loss\n\n\U0001F916 Generated with [Claude
        Code](https://claude.com/claude-code)"
      change_url: https://github.com/osism/ansible-collection-services/pull/2086
      child_jobs: []
      commit_id: 9f0935419df0bd5b8b06239f507181df3a856fe1
      event_id: 1104d6b0-55d9-11f1-8e27-23a90329010f
      executor:
        hostname: 521e9411259a
        inventory_file: /var/lib/zuul/builds/8a64f76a5da84dfa87932a67a3c06d88/ansible/inventory.yaml
        log_root: /var/lib/zuul/builds/8a64f76a5da84dfa87932a67a3c06d88/work/logs
        result_data_file: /var/lib/zuul/builds/8a64f76a5da84dfa87932a67a3c06d88/work/results.json
        src_root: /var/lib/zuul/builds/8a64f76a5da84dfa87932a67a3c06d88/work/src
        work_root: /var/lib/zuul/builds/8a64f76a5da84dfa87932a67a3c06d88/work
      include_vars: []
      items:
      - branch: main
        change: '2086'
        change_message: "wireguard: add MASQUERADE for gateway mode\n\n## Summary\n\n-
          Adds `PreUp` check that aborts with a clear error if `ip_forward` is disabled,
          before the interface is created\n- Adds scoped MASQUERADE rule on the outbound
          interface so WireGuard-forwarded packets leave with the manager's own IP
          \u2014 without it Neutron port security drops them (client range `192.168.48.x`
          is not in `allowed_address_pairs`)\n- `PostDown` removes the MASQUERADE
          rule before tearing down FORWARD rules\n- Two new variables: `wireguard_outbound_interface`
          and `wireguard_client_network`, both with sensible defaults\n\n## Test plan\n\n-
          [ ] Molecule `test_gateway_forwarding` passes (Zuul CI) \u2014 verifies
          `ip_forward=1` and exact MASQUERADE rule present after role runs\n- [ ]
          Verified end-to-end on regiocloud: WireGuard client connects, pings testbed-node-0
          (`192.168.16.10`) through the tunnel \u2014 0% packet loss\n\n\U0001F916
          Generated with [Claude Code](https://claude.com/claude-code)"
        change_url: https://github.com/osism/ansible-collection-services/pull/2086
        commit_id: 9f0935419df0bd5b8b06239f507181df3a856fe1
        patchset: 9f0935419df0bd5b8b06239f507181df3a856fe1
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/ansible-collection-services
          name: osism/ansible-collection-services
          short_name: ansible-collection-services
          src_dir: src/github.com/osism/ansible-collection-services
        topic: null
      job: ansible-lint
      jobtags: []
      max_attempts: 3
      message: d2lyZWd1YXJkOiBhZGQgTUFTUVVFUkFERSBmb3IgZ2F0ZXdheSBtb2RlCgojIyBTdW1tYXJ5CgotIEFkZHMgYFByZVVwYCBjaGVjayB0aGF0IGFib3J0cyB3aXRoIGEgY2xlYXIgZXJyb3IgaWYgYGlwX2ZvcndhcmRgIGlzIGRpc2FibGVkLCBiZWZvcmUgdGhlIGludGVyZmFjZSBpcyBjcmVhdGVkCi0gQWRkcyBzY29wZWQgTUFTUVVFUkFERSBydWxlIG9uIHRoZSBvdXRib3VuZCBpbnRlcmZhY2Ugc28gV2lyZUd1YXJkLWZvcndhcmRlZCBwYWNrZXRzIGxlYXZlIHdpdGggdGhlIG1hbmFnZXIncyBvd24gSVAg4oCUIHdpdGhvdXQgaXQgTmV1dHJvbiBwb3J0IHNlY3VyaXR5IGRyb3BzIHRoZW0gKGNsaWVudCByYW5nZSBgMTkyLjE2OC40OC54YCBpcyBub3QgaW4gYGFsbG93ZWRfYWRkcmVzc19wYWlyc2ApCi0gYFBvc3REb3duYCByZW1vdmVzIHRoZSBNQVNRVUVSQURFIHJ1bGUgYmVmb3JlIHRlYXJpbmcgZG93biBGT1JXQVJEIHJ1bGVzCi0gVHdvIG5ldyB2YXJpYWJsZXM6IGB3aXJlZ3VhcmRfb3V0Ym91bmRfaW50ZXJmYWNlYCBhbmQgYHdpcmVndWFyZF9jbGllbnRfbmV0d29ya2AsIGJvdGggd2l0aCBzZW5zaWJsZSBkZWZhdWx0cwoKIyMgVGVzdCBwbGFuCgotIFsgXSBNb2xlY3VsZSBgdGVzdF9nYXRld2F5X2ZvcndhcmRpbmdgIHBhc3NlcyAoWnV1bCBDSSkg4oCUIHZlcmlmaWVzIGBpcF9mb3J3YXJkPTFgIGFuZCBleGFjdCBNQVNRVUVSQURFIHJ1bGUgcHJlc2VudCBhZnRlciByb2xlIHJ1bnMKLSBbIF0gVmVyaWZpZWQgZW5kLXRvLWVuZCBvbiByZWdpb2Nsb3VkOiBXaXJlR3VhcmQgY2xpZW50IGNvbm5lY3RzLCBwaW5ncyB0ZXN0YmVkLW5vZGUtMCAoYDE5Mi4xNjguMTYuMTBgKSB0aHJvdWdoIHRoZSB0dW5uZWwg4oCUIDAlIHBhY2tldCBsb3NzCgrwn6SWIEdlbmVyYXRlZCB3aXRoIFtDbGF1ZGUgQ29kZV0oaHR0cHM6Ly9jbGF1ZGUuY29tL2NsYXVkZS1jb2RlKQ==
      patchset: 9f0935419df0bd5b8b06239f507181df3a856fe1
      pipeline: check
      playbook_context:
        playbook_projects:
          trusted/project_0/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 019f0261a526db7d8989ff1abefc2299a8c0ffbc
          trusted/project_1/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 038dd8b856c62af4433c8477c5cb3d0480847059
          trusted/project_2/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 0c74c57cedff2b36bb37ca68a5338d1c49991496
          untrusted/project_0/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 0c74c57cedff2b36bb37ca68a5338d1c49991496
          untrusted/project_1/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 019f0261a526db7d8989ff1abefc2299a8c0ffbc
          untrusted/project_2/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 038dd8b856c62af4433c8477c5cb3d0480847059
        playbooks:
        - path: untrusted/project_0/github.com/osism/zuul-jobs/playbooks/ansible-lint/run.yaml
          roles:
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_0/zuul-config
            link_target: untrusted/project_1/github.com/osism/zuul-config
            role_path: ansible/playbook_0/role_0/zuul-config/roles
          - checkout: master
            checkout_description: project default branch
            link_name: ansible/playbook_0/role_1/openinfra-zuul-jobs
            link_target: untrusted/project_2/github.com/osism/openinfra-zuul-jobs
            role_path: ansible/playbook_0/role_1/openinfra-zuul-jobs/roles
          - checkout: main
            checkout_description: playbook branch
            link_name: ansible/playbook_0/role_2/zuul-jobs
            link_target: untrusted/project_0/github.com/osism/zuul-jobs
            role_path: ansible/playbook_0/role_2/zuul-jobs/roles
      post_review: false
      post_timeout: null
      pre_timeout: null
      project:
        canonical_hostname: github.com
        canonical_name: github.com/osism/ansible-collection-services
        name: osism/ansible-collection-services
        short_name: ansible-collection-services
        src_dir: src/github.com/osism/ansible-collection-services
      projects:
        github.com/osism/ansible-collection-services:
          canonical_hostname: github.com
          canonical_name: github.com/osism/ansible-collection-services
          checkout: main
          checkout_description: zuul branch
          commit: b4501ae160b4f47e481df8a8b0c2e1f3a270b774
          name: osism/ansible-collection-services
          required: false
          short_name: ansible-collection-services
          src_dir: src/github.com/osism/ansible-collection-services
      ref: refs/pull/2086/head
      resources: {}
      tenant: osism
      timeout: 1800
      topic: null
      voting: true
