ready.yml

---
- name: "🔍 Postgres | Resolve hosting node + container id"
  ansible.builtin.include_tasks: "{{ lookup('path_absolute', 'roles/sys-svc-compose/tasks/utils/swarm/resolve_host_cid.yml') }}"
  vars:
    resolve_service_key: "{{ entity_name }}"
    resolve_service_name: "{{ lookup('database', database_consumer_id, 'service_name') }}"
    resolve_output_prefix: POSTGRES
    resolve_compose_cid: "{{ lookup('database', database_consumer_id, 'container') }}"

- name: ⏳ Wait until postgres TCP auth works
  block:
    - name: ⏳ Wait for Postgres TCP auth
      no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
      ansible.builtin.shell: > # nocheck: container-exec-resolver  POSTGRES_LOCAL_CID resolved at delegate_to runtime
        IFS= read -r PGPASSWORD && export PGPASSWORD && container exec -e PGPASSWORD {{ POSTGRES_LOCAL_CID | quote }} sh -lc
        'psql -h "{{ POSTGRES_LOCAL_HOST }}" -p "{{ POSTGRES_PORT }}"
        -U postgres -d postgres -c "SELECT 1"'
      args:
        stdin: "{{ POSTGRES_PASSWORD }}"
      delegate_to: "{{ POSTGRES_HOST_NODE }}"
      register: pg_ready
      until: pg_ready.rc == 0
      retries: 30
      delay: 5
      changed_when: false

  rescue:
    - name: "💾 Postgres | Dump pg_hba.conf into the diagnostics folder" # nocheck: rescue-extra-diagnostics pg_hba.conf is postgres-specific auth config the generic rescue script cannot capture, and it is what a failed TCP-auth wait needs
      ansible.builtin.command:
        argv:
          - bash
          - -c
          - "{{ lookup('file', lookup('path_absolute', 'roles/svc-db-postgres/files/shell/dump_pg_hba.sh')) }}"
          - dump_pg_hba.sh
        stdin: "{{ POSTGRES_PASSWORD }}"
        expand_argument_vars: false
      environment:
        POSTGRES_CONTAINER_ADDRESS: "{{ POSTGRES_LOCAL_CID }}"
      delegate_to: "{{ POSTGRES_HOST_NODE }}"
      changed_when: false
      failed_when: false
      no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
    - name: "🛑 Postgres | fail after pg_hba dump"
      ansible.builtin.fail:
        msg: "Postgres TCP auth never became ready; pg_hba.conf was dumped into the diagnostics folder (the workflow-level rescue capture collects the full snapshot)"

- name: "🧊 Postgres | Remember the container whose TCP auth works"
  ansible.builtin.set_fact:
    postgres_verified_target: "{{ postgres_target }}"
  changed_when: false