added multica agent hosts

ansible/roles/multica_agent_host/tasks/verify.yml

@@ -0,0 +1,120 @@
+---
+# Assertions, not hope. Each of these has failed in practice for a different
+# reason, so each gets its own check and its own error message.
+
+- name: Verify | Daemon reports running
+  ansible.builtin.command:
+    argv: "{{ _multica_cmd + ['daemon', 'status', '--output', 'json'] }}"
+  become: true
+  become_user: "{{ multica_user }}"
+  environment: "{{ _multica_user_env }}"
+  register: _multica_verify_daemon
+  until:
+    - _multica_verify_daemon.rc == 0
+    - (_multica_verify_daemon.stdout | from_json).status | default('') == 'running'
+  retries: "{{ multica_verify_retries }}"
+  delay: "{{ multica_verify_delay }}"
+  changed_when: false
+  check_mode: false
+
+- name: Verify | Daemon is the pinned version and sees the configured workspaces root
+  ansible.builtin.assert:
+    that:
+      - (_multica_verify_daemon.stdout | from_json).cli_version == multica_version
+      - (_multica_verify_daemon.stdout | from_json).server_url | regex_replace('/$', '')
+        == multica_server_url | regex_replace('/$', '')
+    fail_msg: >-
+      Daemon is running but does not match declared state:
+      {{ _multica_verify_daemon.stdout }}
+    quiet: true
+
+- name: Verify | Every selected agent CLI is registered as an online runtime
+  ansible.builtin.command:
+    argv: "{{ _multica_cmd + ['runtime', 'list', '--output', 'json'] }}"
+  become: true
+  become_user: "{{ multica_user }}"
+  environment: "{{ _multica_user_env }}"
+  register: _multica_verify_runtimes
+  until:
+    - _multica_verify_runtimes.rc == 0
+    - _multica_expected_providers
+      | difference(_multica_verify_runtimes.stdout | from_json
+          | selectattr('daemon_id', 'equalto', (_multica_verify_daemon.stdout | from_json).daemon_id)
+          | selectattr('status', 'equalto', 'online')
+          | map(attribute='provider') | list)
+      | length == 0
+  retries: "{{ multica_verify_retries }}"
+  delay: "{{ multica_verify_delay }}"
+  changed_when: false
+  check_mode: false
+  vars:
+    _multica_expected_providers: >-
+      {{ multica_agent_clis | map('extract', multica_agent_cli_catalog, 'provider') | list }}
+
+- name: Verify | Runtimes name this host
+  ansible.builtin.assert:
+    that:
+      - _multica_verify_runtimes.stdout | from_json
+        | selectattr('daemon_id', 'equalto', (_multica_verify_daemon.stdout | from_json).daemon_id)
+        | rejectattr('device_info', 'search', '^' ~ (multica_device_name | regex_escape))
+        | list | length == 0
+    fail_msg: >-
+      Runtimes registered under this daemon do not report device_name
+      "{{ multica_device_name }}".
+    quiet: true
+
+- name: Verify | Stat the workspaces root
+  ansible.builtin.stat:
+    path: "{{ multica_workspaces_root }}"
+  register: _multica_verify_ws
+  become: true
+
+- name: Verify | Re-prove the daemon user can write to the workspaces root
+  ansible.builtin.command:
+    argv:
+      - /bin/sh
+      - -c
+      - 'd="$1"; f="$d/.multica-write-test.$$"; : > "$f" && rm -f "$f"'
+      - sh
+      - "{{ multica_workspaces_root }}"
+  become: true
+  become_user: "{{ multica_user }}"
+  register: _multica_verify_ws_write
+  changed_when: false
+  failed_when: false
+  check_mode: false
+
+- name: Verify | Workspaces root assertions
+  ansible.builtin.assert:
+    that:
+      - _multica_verify_ws.stat.exists
+      - _multica_verify_ws.stat.isdir
+      - _multica_verify_ws.stat.pw_name == multica_user
+      - _multica_verify_ws_write.rc == 0
+    fail_msg: >-
+      {{ multica_workspaces_root }} is missing, not a directory, or not
+      owned/writable by {{ multica_user }}.
+    quiet: true
+
+- name: Verify | Workspaces root is on the expected mount
+  ansible.builtin.assert:
+    that:
+      - multica_workspaces_root_mount in (ansible_facts['mounts'] | map(attribute='mount') | list)
+    fail_msg: "{{ multica_workspaces_root_mount }} is not mounted."
+    quiet: true
+  when: multica_workspaces_root_mount | length > 0
+
+- name: Verify | Report what still needs a human
+  ansible.builtin.debug:
+    msg: >-
+      {{ multica_device_name }} is provisioned: multica {{ multica_version }},
+      daemon running, runtimes online for
+      {{ multica_agent_clis | join(', ') }}.
+      Remaining manual step(s):
+      {{ multica_agent_clis
+         | select('in', multica_agent_cli_catalog)
+         | map('extract', multica_agent_cli_catalog)
+         | selectattr('manual_login', 'defined')
+         | selectattr('manual_login')
+         | map(attribute='manual_login_hint')
+         | list | join('; ') | default('none', true) }}