45 lines
1.6 KiB
YAML
45 lines
1.6 KiB
YAML
---
|
|
# `multica auth status` prints the server and user when authenticated and exits
|
|
# non-zero otherwise, so it is the idempotency guard for login.
|
|
- name: Auth | Read the current authentication state
|
|
ansible.builtin.command:
|
|
argv: "{{ _multica_cmd + ['auth', 'status'] }}"
|
|
become: true
|
|
become_user: "{{ multica_user }}"
|
|
environment: "{{ _multica_user_env }}"
|
|
register: _multica_auth_status
|
|
changed_when: false
|
|
failed_when: false
|
|
check_mode: false
|
|
|
|
- name: Auth | Decide whether a login is needed
|
|
ansible.builtin.set_fact:
|
|
_multica_needs_login: >-
|
|
{{ multica_force_relogin | bool
|
|
or _multica_auth_status.rc != 0
|
|
or multica_server_url.rstrip('/') not in (_multica_auth_status.stdout | default('')) }}
|
|
|
|
# no_log is mandatory: without it Ansible records the full argv — including the
|
|
# PAT — in play output, CI logs, and every callback plugin.
|
|
- name: Auth | Log in with the personal access token
|
|
ansible.builtin.command:
|
|
argv: "{{ _multica_cmd + ['login', '--token', multica_pat] }}"
|
|
become: true
|
|
become_user: "{{ multica_user }}"
|
|
environment: "{{ _multica_user_env }}"
|
|
when: _multica_needs_login | bool
|
|
changed_when: true
|
|
no_log: true
|
|
notify: restart multica daemon
|
|
|
|
- name: Auth | Pin the default workspace
|
|
ansible.builtin.command:
|
|
argv: "{{ _multica_cmd + ['workspace', 'switch', multica_workspace_id] }}"
|
|
become: true
|
|
become_user: "{{ multica_user }}"
|
|
environment: "{{ _multica_user_env }}"
|
|
when: multica_workspace_id | length > 0
|
|
register: _multica_ws_switch
|
|
changed_when: _multica_needs_login | bool
|
|
notify: restart multica daemon
|