added multica agent hosts

ansible/roles/multica_agent_host/tasks/workspaces_root.yml

@@ -0,0 +1,41 @@
+---
+# Guard against the mount not being present: without it the daemon happily
+# writes run workspaces onto the root filesystem and nobody notices until it
+# fills up.
+- name: Workspaces root | Assert it lands on the expected mount
+  ansible.builtin.assert:
+    that:
+      - multica_workspaces_root_mount in (ansible_facts['mounts'] | map(attribute='mount') | list)
+      - multica_workspaces_root == multica_workspaces_root_mount
+        or multica_workspaces_root.startswith(multica_workspaces_root_mount.rstrip('/') ~ '/')
+    fail_msg: >-
+      multica_workspaces_root ({{ multica_workspaces_root }}) is not on
+      {{ multica_workspaces_root_mount }}, which is not currently mounted or
+      does not contain it. Mount it before provisioning.
+    quiet: true
+  when: multica_workspaces_root_mount | length > 0
+
+- name: Workspaces root | Create the directory
+  ansible.builtin.file:
+    path: "{{ multica_workspaces_root }}"
+    state: directory
+    owner: "{{ multica_user }}"
+    group: "{{ multica_group }}"
+    mode: "{{ multica_workspaces_root_mode }}"
+  become: true
+
+# Ownership is not writability: a read-only or root-squashed network mount
+# passes the file module and fails the first run.
+- name: Workspaces root | Prove the daemon user can write to it
+  ansible.builtin.command:
+    argv:
+      - /bin/sh
+      - -c
+      - 'd="$1"; f="$d/.multica-write-test.$$"; : > "$f" && rm -f "$f"'
+      - sh
+      - "{{ multica_workspaces_root }}"
+  become: true
+  become_user: "{{ multica_user }}"
+  changed_when: false
+  register: _multica_ws_write
+  failed_when: _multica_ws_write.rc != 0