life-church: scaffold playbooks/test-connection.yml (Semaphore project 2)

life-church/playbooks/test-connection.yml

@@ -0,0 +1,72 @@
+---
+# ============================================================================
+# life-church/playbooks/test-connection.yml — diagnostic (no host changes).
+# Verifies: repo pull over the deploy key + Infisical auth/read.
+# Reads Infisical creds from env vars first (Semaphore environment), then
+# falls back to extra-vars. Mirrors the SnS project's test-connection.
+# ============================================================================
+
+- name: "Life Church diagnostics — repo + Infisical"
+  hosts: localhost
+  gather_facts: false
+
+  tasks:
+    - name: "[repo] List repo files"
+      ansible.builtin.find:
+        paths: "{{ playbook_dir | dirname }}"
+        excludes: ".git"
+        recurse: true
+      register: repo_files
+
+    - name: "[repo] Repo pulled OK"
+      ansible.builtin.debug:
+        msg: "life-church files: {{ repo_files.files | map(attribute='path') | map('regex_replace','^.*/life-church/','') | list }}"
+
+    - name: "[resolve] Resolve Infisical creds (env var, else extra-var, else empty)"
+      ansible.builtin.set_fact:
+        infisical_client_id: "{{ lookup('env','INFISICAL_CLIENT_ID') | default(lookup('vars','INFISICAL_CLIENT_ID', default=''), true) }}"
+        infisical_client_secret: "{{ lookup('env','INFISICAL_CLIENT_SECRET') | default(lookup('vars','INFISICAL_CLIENT_SECRET', default=''), true) }}"
+        infisical_project_id: "{{ lookup('env','INFISICAL_PROJECT_ID') | default(lookup('vars','INFISICAL_PROJECT_ID', default=''), true) }}"
+        infisical_url: "{{ lookup('env','INFISICAL_API_URL') | default(lookup('env','INFISICAL_URL') | default(lookup('vars','INFISICAL_URL', default='http://192.168.122.41:8080'), true), true) }}"
+        infisical_env_slug: "{{ lookup('env','INFISICAL_ENV_SLUG') | default(lookup('vars','INFISICAL_ENV_SLUG', default='prod'), true) }}"
+
+    - name: "[diag] Cred source (lengths only, no secrets)"
+      ansible.builtin.debug:
+        msg:
+          - "env INFISICAL_CLIENT_ID length: {{ lookup('env','INFISICAL_CLIENT_ID') | length }}"
+          - "resolved client_id length: {{ infisical_client_id | length }}"
+          - "resolved project_id length: {{ infisical_project_id | length }}"
+          - "url: {{ infisical_url }}  env_slug: {{ infisical_env_slug }}"
+
+    - name: "[infisical] Assert creds resolved"
+      ansible.builtin.assert:
+        that:
+          - infisical_client_id | length > 0
+          - infisical_client_secret | length > 0
+          - infisical_project_id | length > 0
+        fail_msg: "Infisical creds still empty — see [diag]. If env length is 0, Semaphore isn't exporting the environment as env vars."
+
+    - name: "[infisical] Log in"
+      infisical.vault.login:
+        url: "{{ infisical_url }}"
+        auth_method: universal_auth
+        universal_auth_client_id: "{{ infisical_client_id }}"
+        universal_auth_client_secret: "{{ infisical_client_secret }}"
+      register: infisical_login
+
+    - name: "[infisical] Read secrets under /semaphore"
+      infisical.vault.read_secrets:
+        login_data: "{{ infisical_login.login_data }}"
+        project_id: "{{ infisical_project_id }}"
+        env_slug: "{{ infisical_env_slug }}"
+        path: "/semaphore"
+        as_dict: true
+      register: infisical_secrets
+
+    - name: "[infisical] Secret keys visible (values hidden)"
+      ansible.builtin.debug:
+        msg: "Infisical OK (env={{ infisical_env_slug }}, path=/semaphore) — keys: {{ infisical_secrets.secrets.keys() | list }}"
+
+    - name: "[result] ALL CHECKS PASSED"
+      ansible.builtin.debug:
+        msg: "SSH repo pull OK | Infisical auth + read OK — Life Church pipeline ready."