personal_infra/ansible/roles/healthcheck/tasks/main.yml

---
- name: "Assert healthcheck '{{ healthcheck_name }}' is fully specified"
  ansible.builtin.assert:
    that:
      - healthcheck_name | length > 0
      - healthcheck_description | length > 0
      - (healthcheck_check | length > 0) != (healthcheck_command | length > 0)
      - not (healthcheck_push_url | length > 0) or (healthcheck_push_token | length > 0)
    fail_msg: >-
      healthcheck needs a name, a description, exactly one of healthcheck_check
      or healthcheck_command, and a token whenever a push URL is set. A push URL
      with no token would report to Gatus and be rejected 401 on every run.

# Deduplicated across the whole play run. This role is included once PER CHECK,
# and a host with several checks was otherwise running apt several times to
# install a curl that was already there - 29 apt transactions estate-wide, and
# the slowest thing in the deploy by a wide margin. The fact below remembers
# what has already been ensured on this host.
- name: Install healthcheck dependencies
  ansible.builtin.package:
    name: "{{ healthcheck_wanted_packages }}"
    state: present
  vars:
    healthcheck_wanted_packages: >-
      {{ (healthcheck_packages | default(['curl']))
         | difference(healthcheck_installed_packages | default([])) }}
  when: healthcheck_wanted_packages | length > 0

- name: Remember which dependencies this host already has
  ansible.builtin.set_fact:
    healthcheck_installed_packages: >-
      {{ (healthcheck_installed_packages | default([]))
         | union(healthcheck_packages | default(['curl'])) }}

- name: Create the healthcheck log directory
  ansible.builtin.file:
    path: "{{ healthcheck_log_dir }}"
    state: directory
    owner: root
    group: root
    mode: "0750"

- name: "Install the {{ healthcheck_name }} check script"
  ansible.builtin.template:
    src: healthcheck.sh.j2
    dest: "{{ healthcheck_script_dir }}/{{ healthcheck_name }}-healthcheck.sh"
    owner: root
    group: root
    mode: "0755"

# The token is in this unit file, so it must not be world-readable.
- name: "Install the {{ healthcheck_name }} systemd service"
  ansible.builtin.template:
    src: healthcheck.service.j2
    dest: "/etc/systemd/system/{{ healthcheck_name }}-healthcheck.service"
    owner: root
    group: root
    mode: "0600"

- name: "Install the {{ healthcheck_name }} systemd timer"
  ansible.builtin.template:
    src: healthcheck.timer.j2
    dest: "/etc/systemd/system/{{ healthcheck_name }}-healthcheck.timer"
    owner: root
    group: root
    mode: "0644"

# `restarted`, not `started`: started is a no-op on an already-active timer, so
# a changed interval or a stuck timer would never be picked up.
- name: "Enable and start the {{ healthcheck_name }} timer"
  ansible.builtin.systemd:
    name: "{{ healthcheck_name }}-healthcheck.timer"
    enabled: yes
    state: restarted
    daemon_reload: yes

- name: "Run the {{ healthcheck_name }} check once now"
  ansible.builtin.command: "{{ healthcheck_script_dir }}/{{ healthcheck_name }}-healthcheck.sh"
  environment:
    HEALTHCHECK_PUSH_URL: "{{ healthcheck_push_url }}"
    HEALTHCHECK_PUSH_TOKEN: "{{ healthcheck_push_token }}"
  register: healthcheck_first_run
  changed_when: false
  failed_when: false

- name: "Report the first {{ healthcheck_name }} result"
  ansible.builtin.debug:
    msg: >-
      {{ healthcheck_name }}: {{ 'HEALTHY' if healthcheck_first_run.rc == 0
         else 'UNHEALTHY (rc=' ~ healthcheck_first_run.rc ~ ')' }}