72 lines
3.2 KiB
YAML
72 lines
3.2 KiB
YAML
---
|
|
# ============================================================================
|
|
# test-connection.yml — diagnostic (no host changes).
|
|
# Confirms repo pull + Infisical auth. Resolves Infisical creds safely from
|
|
# env vars OR ansible vars (via the `vars` dict) without erroring on undefined.
|
|
# ============================================================================
|
|
|
|
- name: "Semaphore diagnostics — repo + Infisical"
|
|
hosts: localhost
|
|
gather_facts: false
|
|
|
|
tasks:
|
|
- name: "[repo] List repo files"
|
|
ansible.builtin.find:
|
|
paths: "{{ playbook_dir | dirname }}"
|
|
excludes: ".git"
|
|
recurse: false
|
|
register: repo_files
|
|
|
|
- name: "[repo] Repo pulled OK"
|
|
ansible.builtin.debug:
|
|
msg: "Repo files: {{ repo_files.files | map(attribute='path') | map('basename') | list }}"
|
|
|
|
# Resolve creds: prefer env var, else look in the vars dict (extra-vars), else ''
|
|
- name: "[resolve] Gather Infisical creds from env or vars (no undefined errors)"
|
|
ansible.builtin.set_fact:
|
|
infisical_client_id: "{{ lookup('env','INFISICAL_CLIENT_ID') or (vars['INFISICAL_CLIENT_ID'] | default('')) }}"
|
|
infisical_client_secret: "{{ lookup('env','INFISICAL_CLIENT_SECRET') or (vars['INFISICAL_CLIENT_SECRET'] | default('')) }}"
|
|
infisical_project_id: "{{ lookup('env','INFISICAL_PROJECT_ID') or (vars['INFISICAL_PROJECT_ID'] | default('')) }}"
|
|
infisical_url: "{{ lookup('env','INFISICAL_URL') or (vars['INFISICAL_URL'] | default('http://192.168.122.41:8080')) }}"
|
|
infisical_env_slug: "{{ lookup('env','INFISICAL_ENV_SLUG') or (vars['INFISICAL_ENV_SLUG'] | default('dev')) }}"
|
|
|
|
- name: "[diag] Which channel carried the client id? (lengths only)"
|
|
ansible.builtin.debug:
|
|
msg:
|
|
- "env var length: {{ lookup('env','INFISICAL_CLIENT_ID') | length }}"
|
|
- "vars-dict has key: {{ 'INFISICAL_CLIENT_ID' in vars }}"
|
|
- "resolved id length: {{ infisical_client_id | length }}"
|
|
|
|
- name: "[infisical] Assert creds resolved"
|
|
ansible.builtin.assert:
|
|
that:
|
|
- infisical_client_id | length > 0
|
|
- infisical_client_secret | length > 0
|
|
- infisical_project_id | length > 0
|
|
fail_msg: "Infisical creds not reaching playbook via env OR vars. See [diag] above."
|
|
|
|
- name: "[infisical] Log in"
|
|
infisical.vault.login:
|
|
url: "{{ infisical_url }}"
|
|
auth_method: universal_auth
|
|
universal_auth_client_id: "{{ infisical_client_id }}"
|
|
universal_auth_client_secret: "{{ infisical_client_secret }}"
|
|
register: infisical_login
|
|
|
|
- name: "[infisical] Read secrets"
|
|
infisical.vault.read_secrets:
|
|
login_data: "{{ infisical_login.login_data }}"
|
|
project_id: "{{ infisical_project_id }}"
|
|
env_slug: "{{ infisical_env_slug }}"
|
|
path: "/"
|
|
as_dict: true
|
|
register: infisical_secrets
|
|
|
|
- name: "[infisical] Secret keys visible (values hidden)"
|
|
ansible.builtin.debug:
|
|
msg: "Infisical OK (env={{ infisical_env_slug }}) — keys: {{ infisical_secrets.secrets.keys() | list }}"
|
|
|
|
- name: "[result] ALL CHECKS PASSED"
|
|
ansible.builtin.debug:
|
|
msg: "SSH repo pull OK | Infisical auth + read OK — pipeline ready."
|