david_igou.routeros_configuration.export_vars role – Capture a running device’s config into a routeros_config vars file.

Note

This role is part of the david_igou.routeros_configuration collection (version 0.0.8-alpha).

It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it use: ansible-galaxy collection install david_igou.routeros_configuration.

To use it in a playbook, specify: david_igou.routeros_configuration.export_vars.

Entry point main – Capture a running device’s config into a routeros_config vars file.

Synopsis

  • The reverse of the configure role. Reads the device over the API (community.routeros.api_info) and writes a per-host vars file containing a routeros_config dict that the configure role can re-apply.

  • Captured fields are a best-effort equivalent; review before re-applying.

Parameters

Parameter

Comments

routeros_api_hostname

string

API hostname/IP of the device.

Default: "{{ inventory_hostname }}"

routeros_api_password

string

API password. Secret — supply via vault. The module marks it no_log.

routeros_api_port

any

TCP port; empty lets the module choose from tls.

Default: ""

routeros_api_tls

boolean

Use TLS (api-ssl).

Choices:

  • false

  • true ← (default)

routeros_api_username

string

API username.

Default: "admin"

routeros_api_validate_certs

boolean

Validate the device TLS certificate.

Choices:

  • false

  • true ← (default)

routeros_export_vars_dir

string

Controller directory for the captured <inventory_hostname>.yml files.

Default: "./routeros-vars"

routeros_export_vars_exclude_paths

list / elements=string

Slash paths to exclude from the export even when they are configure-modifiable — paths that capture runtime state, hardware enumeration, or auto-generated defaults rather than intent (e.g. /file, /ip/cloud, /queue/interface). Defaults to a curated set; set to [] to capture everything.

routeros_export_vars_exclude_paths_extra

list / elements=string

Additional slash paths to exclude, merged onto routeros_export_vars_exclude_paths rather than replacing it. Use this to drop a few more paths without re-listing the defaults.

Default: []

routeros_export_vars_handle_disabled

string

How community.routeros.api_info represents fields that are unset on the device. omit (default) leaves them out, capturing only what is configured. exclamation keeps them as !field markers (the configure role reads these as reset-to-default). null-value emits field=null.

Choices:

  • "omit" ← (default)

  • "exclamation"

  • "null-value"

routeros_export_vars_ordered_content

string

The content (handle_entries_content) emitted for ordered paths. With purge, api_modify rejects the default ignore on these paths, so it must be pinned. remove_as_much_as_possible (default) resets removable fields and leaves unrecognized fields alone; remove is strict.

Choices:

  • "remove_as_much_as_possible" ← (default)

  • "remove"

routeros_export_vars_ordered_paths

list / elements=string

Slash paths whose entry order is significant (firewall chains, routing filters, simple queues). Captured with order=true, purge=true and content so the configure role enforces the exact ordered state. Defaults to the known order-sensitive RouterOS paths.

routeros_export_vars_paths

list / elements=string

Slash paths to capture. When unset, defaults to the configure role’s full rcfg_path_order (every configurable path). Paths with no entries are omitted from the output.

routeros_export_vars_redact

boolean

Replace sensitive field values (keys, PSKs, passwords) with REDACTED. Off by default so the output round-trips; encrypt the file with vault.

Choices:

  • false ← (default)

  • true

routeros_export_vars_volatile_fields

dictionary

Per-path fields stripped from the capture. Keys are slash paths, values are lists of field names. Drop a field here when it is either volatile device state (not config) or a value that breaks api_modify‘s round-trip matching. Defaults to dropping date/time from /system/clock (volatile) and group from /ip/ipsec/policy (its group remove_value is default, so a captured group of default is misread as a disable, causing a duplicate add).

Examples

# Capture the full configuration. Writes <inventory_hostname>.yml with a
# routeros_config dict that the configure role can re-apply.
- hosts: routers
  gather_facts: false
  roles:
    - role: david_igou.routeros_configuration.export_vars
      vars:
        routeros_export_vars_dir: ./routeros-vars

# Capture a focused set of paths for a fast, targeted snapshot. Paths with
# no entries are omitted from the output.
- hosts: routers
  gather_facts: false
  roles:
    - role: david_igou.routeros_configuration.export_vars
      vars:
        routeros_export_vars_paths:
          - /ip/address
          - /system/identity

# Redact secrets (keys, PSKs, passwords) as REDACTED. The output no longer
# round-trips; prefer encrypting the unredacted file with Ansible Vault.
- hosts: routers
  gather_facts: false
  roles:
    - role: david_igou.routeros_configuration.export_vars
      vars:
        routeros_export_vars_redact: true