From 8be0de1c85000341397ea23c3322f145f1767a25 Mon Sep 17 00:00:00 2001
From: igor04091968 <igor04091968@gmail.com>
Date: Mon, 11 May 2026 22:57:57 +0300
Subject: [PATCH] feat(ansible): add post-deploy aw-health-check gate

---
 ansible/deploy_aw_server.yml       | 23 +++++++++++++++++++++++
 ansible/group_vars/all.example.yml |  1 +
 ansible/group_vars/all.yml         |  1 +
 aw-server/health-check.sh          |  9 +++++++++
 4 files changed, 34 insertions(+)

diff --git a/ansible/deploy_aw_server.yml b/ansible/deploy_aw_server.yml
index c7e7700..8d9daef 100644
--- a/ansible/deploy_aw_server.yml
+++ b/ansible/deploy_aw_server.yml
@@ -375,6 +375,14 @@
             group: root
             mode: "0755"
 
+        - name: Установить скрипт aw-health-check
+          ansible.builtin.copy:
+            src: "{{ aw_repo_root }}/aw-server/health-check.sh"
+            dest: /usr/local/bin/aw-health-check
+            owner: root
+            group: root
+            mode: "0755"
+
         - name: Установить systemd unit AW worktime UI bridge
           ansible.builtin.copy:
             src: "{{ aw_repo_root }}/aw-server/aw-worktime-ui-bridge.service"
@@ -941,6 +949,21 @@
             msg: "{{ aw_hayabusa_ioc_refresh_result.stdout }}"
           when: aw_hayabusa_ioc_refresh_result.stdout is defined
 
+    - name: Post-deploy health gate (aw-health-check)
+      when:
+        - not ansible_check_mode
+        - aw_server_post_deploy_health_check_enabled | default(true) | bool
+      block:
+        - name: Запустить /usr/local/bin/aw-health-check
+          ansible.builtin.command:
+            cmd: /usr/local/bin/aw-health-check
+          register: aw_post_deploy_health
+          changed_when: false
+
+        - name: Показать результат aw-health-check
+          ansible.builtin.debug:
+            msg: "{{ aw_post_deploy_health.stdout }}"
+
   handlers:
     - name: Перезагрузить systemd
       ansible.builtin.systemd:
diff --git a/ansible/group_vars/all.example.yml b/ansible/group_vars/all.example.yml
index ffb0c05..bb87c41 100644
--- a/ansible/group_vars/all.example.yml
+++ b/ansible/group_vars/all.example.yml
@@ -40,3 +40,4 @@ aw_dlp_policy_engine_enabled: true
 aw_dlp_policy_engine_bind_host: "0.0.0.0"
 aw_dlp_policy_engine_port: 5601
 aw_dlp_policy_engine_db_path: "{{ aw_server_data_dir }}/dlp-policy-engine.sqlite"
+aw_server_post_deploy_health_check_enabled: true
diff --git a/ansible/group_vars/all.yml b/ansible/group_vars/all.yml
index d1310e5..5b35b12 100644
--- a/ansible/group_vars/all.yml
+++ b/ansible/group_vars/all.yml
@@ -31,6 +31,7 @@ aw_dlp_policy_engine_enabled: true
 aw_dlp_policy_engine_bind_host: "0.0.0.0"
 aw_dlp_policy_engine_port: 5601
 aw_dlp_policy_engine_db_path: "{{ aw_server_data_dir }}/dlp-policy-engine.sqlite"
+aw_server_post_deploy_health_check_enabled: true
 
 aw_worktime_from: "08:00"
 aw_worktime_to: "17:00"
diff --git a/aw-server/health-check.sh b/aw-server/health-check.sh
index 7fb9e6f..e839b79 100644
--- a/aw-server/health-check.sh
+++ b/aw-server/health-check.sh
@@ -10,6 +10,15 @@ WARNINGS=()
 
 check_service() {
     local service=$1
+    if [[ "$service" == "aw-worktime-ui-bridge" ]]; then
+        if systemctl is-active --quiet aw-worktime-ui-bridge.timer && systemctl is-enabled --quiet aw-worktime-ui-bridge.timer; then
+            echo "✓ aw-worktime-ui-bridge.timer is running and enabled"
+        else
+            echo "✗ aw-worktime-ui-bridge.timer is not active/enabled"
+            UNHEALTHY_SERVICES+=("aw-worktime-ui-bridge.timer")
+        fi
+        return
+    fi
     if systemctl is-active --quiet "$service"; then
         echo "✓ $service is running"
     else