[ENH] Allow to retry 2nd build_lab phase in case VPN connection was not configured or ansible failed. #1368

Activity

1. P4T12ICK commented on Feb 13, 2026

   

   P4T12ICK

   on Feb 13, 2026

   Collaborator

   More actions

   Great point. I will work on it.
2. janderik commented on Jul 22, 2026

   

   janderik

   on Jul 22, 2026

   More actions

   Rather than destroying everything and rebuilding from scratch, a more resilient approach would be to track build phase state and allow targeted re-runs:

   1. Track phase state with a simple state machine:

   class BuildPhase(Enum):
       NOT_STARTED = "not_started"
       IN_PROGRESS = "in_progress"
       COMPLETED = "completed"
       FAILED = "failed"
   
   class BuildState:
       def __init__(self, state_file='build_state.json'):
           self.phases = {phase: BuildPhase.NOT_STARTED for phase in BuildPhase}
           self.state_file = state_file
   
       def mark_complete(self, phase):
           self.phases[phase] = BuildPhase.COMPLETED
           self.save()
   
       def mark_failed(self, phase):
           self.phases[phase] = BuildPhase.FAILED
           self.save()
   
       def failed_phase(self):
           for phase, status in self.phases.items():
               if status == BuildPhase.FAILED:
                   return phase
           return None

   2. Use Terraform's -target flag for partial re-runs:
   When resuming, only target the failed phase's resources instead of running terraform apply on everything:

   def resume_build(self):
       failed = self.build_state.failed_phase()
       if failed:
           targets = self.get_terraform_targets_for_phase(failed)
           target_args = ' '.join(f'-target={t}' for t in targets)
           run_command(f'terraform apply {target_args} -auto-approve')

   3. Separate phase tracking from resource destruction — keep the state file alongside terraform.tfstate so that attack_range destroy only removes resources for a specific phase if --phase is passed, rather than nuking the entire environment.

   This way, a user who hits a failure in phase 2 can resume from phase 2 without re-running (and potentially re-paying for) phase 1 resources.