veza/infra/ansible/roles/veza_app/tasks/probe.yml

# Hammer the component's health endpoint until 200 or we exhaust the
# retry budget. This runs INSIDE the container (curl-to-localhost),
# which means we're proving the systemd unit is up and the process
# is bound — not the Incus DNS / network path. Phase D in
# playbooks/deploy_app.yml does the cross-container probe via curl
# from the runner.
---
- name: Wait for {{ veza_app_service_name }} to answer on :{{ veza_app_listen_port }}{{ veza_app_health_path }}
  ansible.builtin.uri:
    url: "http://127.0.0.1:{{ veza_app_listen_port }}{{ veza_app_health_path }}"
    method: GET
    status_code: [200]
    return_content: false
    timeout: 5
  register: veza_app_probe
  retries: "{{ veza_healthcheck_retries }}"
  delay: "{{ veza_healthcheck_delay_seconds }}"
  until: veza_app_probe.status == 200
  changed_when: false
  tags: [veza_app, probe]

- name: Record probe success
  ansible.builtin.copy:
    dest: "{{ veza_state_root }}/last-probe.txt"
    content: |
      probed_at={{ ansible_date_time.iso8601 }}
      url=http://127.0.0.1:{{ veza_app_listen_port }}{{ veza_app_health_path }}
      sha={{ veza_release_sha }}
      result=ok
    owner: root
    group: root
    mode: "0644"
  tags: [veza_app, probe]