---
# Guard against the mount not being present: without it the daemon happily
# writes run workspaces onto the root filesystem and nobody notices until it
# fills up.
- name: Workspaces root | Assert it lands on the expected mount
  ansible.builtin.assert:
    that:
      - multica_workspaces_root_mount in (ansible_facts['mounts'] | map(attribute='mount') | list)
      - multica_workspaces_root == multica_workspaces_root_mount
        or multica_workspaces_root.startswith(multica_workspaces_root_mount.rstrip('/') ~ '/')
    fail_msg: >-
      multica_workspaces_root ({{ multica_workspaces_root }}) is not on
      {{ multica_workspaces_root_mount }}, which is not currently mounted or
      does not contain it. Mount it before provisioning.
    quiet: true
  when: multica_workspaces_root_mount | length > 0

- name: Workspaces root | Create the directory
  ansible.builtin.file:
    path: "{{ multica_workspaces_root }}"
    state: directory
    owner: "{{ multica_user }}"
    group: "{{ multica_group }}"
    mode: "{{ multica_workspaces_root_mode }}"
  become: true

# Ownership is not writability: a read-only or root-squashed network mount
# passes the file module and fails the first run.
- name: Workspaces root | Prove the daemon user can write to it
  ansible.builtin.command:
    argv:
      - /bin/sh
      - -c
      - 'd="$1"; f="$d/.multica-write-test.$$"; : > "$f" && rm -f "$f"'
      - sh
      - "{{ multica_workspaces_root }}"
  become: true
  become_user: "{{ multica_user }}"
  changed_when: false
  register: _multica_ws_write
  failed_when: _multica_ws_write.rc != 0