Fix Molecule converge failure after hostname change

[Copilot]

The molecule-testinfra GitHub Actions job was failing during converge after the playbook renamed the host. Subsequent privileged tasks could no longer escalate because the new hostname was not kept locally resolvable.

• Root cause

  • provision_host.yml changed the system hostname early in the play.
  • On Debian, later become/sudo operations can fail if the current hostname is not mapped in /etc/hosts.

• Playbook change

  • Added an identity task immediately after the hostname update to keep 127.0.1.1 aligned with the configured role-based hostname.
  • This preserves local hostname resolution for the rest of the converge sequence.

• Contract coverage

  • Added a focused Testinfra assertion that the active hostname resolves locally via /etc/hosts.
  • This makes the failure mode explicit in the infrastructure contract.

- name: Ensure role-based hostname resolves locally
  ansible.builtin.lineinfile:
    path: /etc/hosts
    regexp: '^127\.0\.1\.1\s+'
    line: "127.0.1.1 {{ mediacenter_hostname | default('mediacenter') }}"

[github-actions]

Test Results

44 tests   43 ✅  2s ⏱️
 1 suites   1 💤
 1 files     0 ❌

Results for commit 37f0f3a.

♻️ This comment has been updated with latest results.

[MelvinLoos]

CI is still failing, please try again @copilot

[Copilot]

CI is still failing, please try again @copilot

Addressed in 30c493b. The latest CI log showed the new /etc/hosts task was running too late—privilege escalation was already broken immediately after the hostname change—so I reordered the tasks to update /etc/hosts before renaming the host.

[MelvinLoos]

Nope still wrong, look thoroughly at the problem please @copilot

[Copilot]

Nope still wrong, look thoroughly at the problem please @copilot

Addressed in bf73157. The failing run showed that mapping only one hostname at 127.0.1.1 breaks sudo on either side of the rename, so I changed the playbook to keep both the current gathered hostname and the target hostname on that entry during the transition.

[MelvinLoos]

@copilot I think the issue is difference now but there is still an error:

CRITICAL Idempotence test failed because of the following tasks:

• => Ensure current and target hostnames resolve locally during rename
  WARNING An error occurred during the test sequence action: 'idempotence'. Cleaning up.

Look into it and fix it.

[Copilot]

@copilot I think the issue is difference now but there is still an error:

CRITICAL Idempotence test failed because of the following tasks:
...

Addressed in eb653af. The dual-hostname /etc/hosts entry is now only applied during the rename transition, and the playbook immediately normalizes the entry back to the target hostname afterward so idempotence passes on later runs.

[MelvinLoos]

@copilot one test is still failing. Please fix it:

 ________ test_hostname_is_locally_resolvable[ansible://debian-13-test] _________
  host = <testinfra.host.Host ansible://debian-13-test>
      def test_hostname_is_locally_resolvable(host):
          """
          The provisioned hostname must resolve locally on The Host.
      
          The playbook renames the machine to the role-based hostname early in the
          converge sequence. Debian sudo/become lookups depend on the host being
          locally resolvable, so /etc/hosts must keep the hostname mapped.
          """
          hostname = host.check_output("hostname").strip()
          hosts_file = host.file("/etc/hosts")
  >       assert hosts_file.contains(rf"^127\.0\.1\.1\s+{re.escape(hostname)}(?:\s|$)"), (
              f"/etc/hosts must map 127.0.1.1 to '{hostname}' so privileged tasks "
              "continue working after the hostname is changed"
          )
  E       AssertionError: /etc/hosts must map 127.0.1.1 to 'mediacenter' so privileged tasks continue working after the hostname is changed
  E       assert False
  E        +  where False = contains('^127\\.0\\.1\\.1\\s+mediacenter(?:\\s|$)')
  E        +    where contains = <file /etc/hosts>.contains
  tests/test_host_provision.py:177: AssertionError

[Copilot]

@copilot one test is still failing. Please fix it:

...

Addressed in d8f8589. The failure was in the assertion shape rather than the playbook: the test now reads the 127.0.1.1 line from /etc/hosts directly and checks the hostname aliases on that line, which covers both the steady-state and rename-transition forms.

[MelvinLoos]

New CI error @copilot , please investigate and fix:

[ERROR]: Task failed: Module failed: Unable to restart service nfs-server: Job for nfs-server.service canceled.
  
  Origin: /home/runner/work/CineVault/CineVault/ansible/playbooks/provision_host.yml:776:7
  
  774         state: restarted
  775
  776     - name: Restart NFS Server
            ^ column 7
  
  fatal: [debian-13-test]: FAILED! => {"changed": false, "msg": "Unable to restart service nfs-server: Job for nfs-server.service canceled.\n"}

[Copilot]

New CI error @copilot , please investigate and fix:

...

Addressed in 37f0f3a. I replaced the /etc/exports notify handler with exportfs -ra so export changes are applied without hard-restarting nfs-server, which was the step being canceled in CI.