feat(ansible): add post-deploy aw-health-check gate

ansible/deploy_aw_server.yml

@@ -375,6 +375,14 @@
             group: root
             mode: "0755"
 
+        - name: Установить скрипт aw-health-check
+          ansible.builtin.copy:
+            src: "{{ aw_repo_root }}/aw-server/health-check.sh"
+            dest: /usr/local/bin/aw-health-check
+            owner: root
+            group: root
+            mode: "0755"
+
         - name: Установить systemd unit AW worktime UI bridge
           ansible.builtin.copy:
             src: "{{ aw_repo_root }}/aw-server/aw-worktime-ui-bridge.service"
@@ -941,6 +949,21 @@
             msg: "{{ aw_hayabusa_ioc_refresh_result.stdout }}"
           when: aw_hayabusa_ioc_refresh_result.stdout is defined
 
+    - name: Post-deploy health gate (aw-health-check)
+      when:
+        - not ansible_check_mode
+        - aw_server_post_deploy_health_check_enabled | default(true) | bool
+      block:
+        - name: Запустить /usr/local/bin/aw-health-check
+          ansible.builtin.command:
+            cmd: /usr/local/bin/aw-health-check
+          register: aw_post_deploy_health
+          changed_when: false
+
+        - name: Показать результат aw-health-check
+          ansible.builtin.debug:
+            msg: "{{ aw_post_deploy_health.stdout }}"
+
   handlers:
     - name: Перезагрузить systemd
       ansible.builtin.systemd:

ansible/group_vars/all.example.yml

@@ -40,3 +40,4 @@ aw_dlp_policy_engine_enabled: true
 aw_dlp_policy_engine_bind_host: "0.0.0.0"
 aw_dlp_policy_engine_port: 5601
 aw_dlp_policy_engine_db_path: "{{ aw_server_data_dir }}/dlp-policy-engine.sqlite"
+aw_server_post_deploy_health_check_enabled: true

ansible/group_vars/all.yml

@@ -31,6 +31,7 @@ aw_dlp_policy_engine_enabled: true
 aw_dlp_policy_engine_bind_host: "0.0.0.0"
 aw_dlp_policy_engine_port: 5601
 aw_dlp_policy_engine_db_path: "{{ aw_server_data_dir }}/dlp-policy-engine.sqlite"
+aw_server_post_deploy_health_check_enabled: true
 
 aw_worktime_from: "08:00"
 aw_worktime_to: "17:00"

aw-server/health-check.sh

@@ -10,6 +10,15 @@ WARNINGS=()
 
 check_service() {
     local service=$1
+    if [[ "$service" == "aw-worktime-ui-bridge" ]]; then
+        if systemctl is-active --quiet aw-worktime-ui-bridge.timer && systemctl is-enabled --quiet aw-worktime-ui-bridge.timer; then
+            echo "✓ aw-worktime-ui-bridge.timer is running and enabled"
+        else
+            echo "✗ aw-worktime-ui-bridge.timer is not active/enabled"
+            UNHEALTHY_SERVICES+=("aw-worktime-ui-bridge.timer")
+        fi
+        return
+    fi
     if systemctl is-active --quiet "$service"; then
         echo "✓ $service is running"
     else