JARVISandClaude Opus 5.5
94c77daf13
Found provisioning spaceship-earth: - Login was not idempotent: `multica auth status` prints to stderr (0.6.5), and the guard read stdout only, so every run re-logged in and restarted the daemon. The guard now reads both streams; the status read is no_log because it echoes a token prefix. - `multica daemon start` / `daemon restart` fork the daemon inside the caller's session (Ansible's SSH session scope), outside the systemd user unit, which stays inactive: the same orphan seen on haunted-mansion on 2026-10-21. Start/restart now go through `systemctl --user`, after a daemon-reload when autostart was (re)registered. A daemon found running outside its unit is stopped first. The unit name is read from `autostart status`, so --profile hosts resolve their own unit. spaceship-earth: second run changed=0, daemon in multica-daemon.service. Not yet run against haunted-mansion. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
51 lines
1.8 KiB
YAML
51 lines
1.8 KiB
YAML
---
|
|
# `multica auth status` prints the server and user when authenticated and exits
|
|
# non-zero otherwise, so it is the idempotency guard for login.
|
|
#
|
|
# It prints to STDERR, not stdout (0.6.5). A stdout-only guard never matches,
|
|
# so every run re-logs in and restarts the daemon. It also echoes a token
|
|
# prefix, hence no_log.
|
|
- name: Auth | Read the current authentication state
|
|
ansible.builtin.command:
|
|
argv: "{{ _multica_cmd + ['auth', 'status'] }}"
|
|
become: true
|
|
become_user: "{{ multica_user }}"
|
|
environment: "{{ _multica_user_env }}"
|
|
register: _multica_auth_status
|
|
changed_when: false
|
|
failed_when: false
|
|
check_mode: false
|
|
no_log: true
|
|
|
|
- name: Auth | Decide whether a login is needed
|
|
ansible.builtin.set_fact:
|
|
_multica_needs_login: >-
|
|
{{ multica_force_relogin | bool
|
|
or _multica_auth_status.rc != 0
|
|
or multica_server_url.rstrip('/') not in
|
|
((_multica_auth_status.stdout | default('')) ~ (_multica_auth_status.stderr | default(''))) }}
|
|
|
|
# no_log is mandatory: without it Ansible records the full argv — including the
|
|
# PAT — in play output, CI logs, and every callback plugin.
|
|
- name: Auth | Log in with the personal access token
|
|
ansible.builtin.command:
|
|
argv: "{{ _multica_cmd + ['login', '--token', multica_pat] }}"
|
|
become: true
|
|
become_user: "{{ multica_user }}"
|
|
environment: "{{ _multica_user_env }}"
|
|
when: _multica_needs_login | bool
|
|
changed_when: true
|
|
no_log: true
|
|
notify: restart multica daemon
|
|
|
|
- name: Auth | Pin the default workspace
|
|
ansible.builtin.command:
|
|
argv: "{{ _multica_cmd + ['workspace', 'switch', multica_workspace_id] }}"
|
|
become: true
|
|
become_user: "{{ multica_user }}"
|
|
environment: "{{ _multica_user_env }}"
|
|
when: multica_workspace_id | length > 0
|
|
register: _multica_ws_switch
|
|
changed_when: _multica_needs_login | bool
|
|
notify: restart multica daemon
|