added multica agent hosts

ansible/playbooks/provision-agent-host.yml

@@ -0,0 +1,46 @@
+---
+# Example playbook. The role takes multica_pat as a VALUE — pick ONE of the
+# lookups below (or any other) and delete the rest. Changing secret provider
+# later is a change to this file only; the role is untouched.
+- name: Provision Multica agent hosts
+  hosts: multica_agent_hosts
+  become: true
+
+  vars:
+    multica_server_url: "https://multica.wdw-labs.cloud"
+    multica_app_url: "https://multica.wdw-labs.cloud"
+    multica_version: "0.6.5"
+    multica_node_version: "24.22.1"
+    multica_workspaces_root: "/opt/multica/workspaces"
+    # No NAS mount under the workspaces root yet, so the mount guard is off.
+    # When utilidor is mounted, switch both lines together — never set the
+    # root onto a mount without also setting the guard, or a play that runs
+    # while the mount is down fills the root filesystem instead of failing.
+    # multica_workspaces_root: "/mnt/utilidor/multica/workspaces"
+    # multica_workspaces_root_mount: "/mnt/utilidor"
+    multica_agent_clis:
+      - claude
+
+    # --- Secret source ----------------------------------------------------
+    # This homelab keeps Ansible secrets in ansible-vault encrypted files, so
+    # that is the live form. vault_multica_pat is defined in
+    # group_vars/multica_agent_hosts/vault.yml (encrypted); the indirection
+    # keeps the name greppable and the file swappable.
+    multica_pat: "{{ vault_multica_pat }}"
+    #
+    # Alternatives, if the backend ever consolidates. Each is a one-line
+    # change here; the role is untouched by any of them.
+    #
+    # HashiCorp Vault (community.hashi_vault):
+    # multica_pat: "{{ lookup('community.hashi_vault.vault_kv2_get',
+    #                         'multica/agent-host').secret.pat }}"
+    #
+    # 1Password (community.general):
+    # multica_pat: "{{ lookup('community.general.onepassword',
+    #                         'Multica Agent Host PAT', field='credential') }}"
+    #
+    # Environment variable on the control node:
+    # multica_pat: "{{ lookup('env', 'MULTICA_PAT') }}"
+
+  roles:
+    - role: multica_agent_host