Currently Majic Ansible Roles does not have a concept of putting the services into a maintenance mode. The idea behind maintenance mode would be to disallow the access to services from outside, and to be able to reconfigure and redeploy the server configuration. This would be particularly useful in case of distribution upgrades, where you really don't want any users or external servers connecting.

While there are many ways to go about with this, probably the simplest (and somewhat most flexible) way would be to provide a listing of allowed addresses (or hosts) from which the connections should be accepted while in the maintenance mode, and to be able to enable/disable the maintenance mode via single parameter.

While it could be useful to have some granularity in the long term, short term the best way to introduce this kind of limitation would be through the common role.

The following should be done:

• Update the common role as follows:
  • Introduce the maintenance parameter (defaulting to False) to common role for indicating whether the maintenance should be enabled or not.
  • Introduce the maintenance_allowed_hosts parameter to common role for specifying list of hosts.
  • When in maintenance mode, allow incoming connections only on default SSH port (22), and from hosts listed via the maintenance_allowed_hosts parameter.
• Update role reference documentation.
• Document the feature in the usage instructions.
• Update release notes.