fix(agent): verify host110 harbor backend route

apps/api/src/services/awooop_ansible_audit_service.py

@@ -448,7 +448,7 @@ _CATALOG: tuple[dict[str, Any], ...] = (
         "auto_apply_enabled": True,
         "approval_required": False,
         "risk_level": "medium",
-        "catalog_revision": "2026-07-14-host110-inputs-v2",
+        "catalog_revision": "2026-07-14-host110-harbor-route-v3",
     },
     {
         "catalog_id": "ansible:188-momo-backup-user",

apps/api/src/services/awooop_ansible_post_verifier.py

@@ -109,7 +109,9 @@ _POSTCONDITION_REGISTRY: dict[str, tuple[AssetPostcondition, ...]] = {
             "host_110_harbor_route",
             "route",
             "host_110",
-            "test -s /etc/nginx/sites-enabled/harbor.conf && systemctl is-active --quiet nginx",
+            "status=$(curl -sS -o /dev/null -w '%{http_code}' --max-time 10 "
+            "http://127.0.0.1:5000/v2/); "
+            "[ \"$status\" = 200 ] || [ \"$status\" = 401 ]",
         ),
         AssetPostcondition(
             "host_110_backup_assets",

apps/api/tests/test_awooop_ansible_post_verifier.py

@@ -16,6 +16,7 @@ from src.services.awooop_ansible_post_verifier import (
     AssetPostcondition,
     ReadOnlyProbeResult,
     build_read_only_probe_command,
+    postconditions_for_catalog,
     registered_catalog_ids,
     run_ansible_asset_post_verifier,
 )
@@ -51,6 +52,27 @@ def test_asset_postcondition_registry_covers_every_ansible_catalog() -> None:
     assert registered_catalog_ids() == catalog_ids
 
 
+def test_host110_harbor_postcondition_matches_registry_backend() -> None:
+    catalog = next(
+        item
+        for item in list_ansible_catalog()
+        if item["catalog_id"] == "ansible:110-devops"
+    )
+    condition = next(
+        item
+        for item in postconditions_for_catalog("ansible:110-devops")
+        if item.condition_id == "host_110_harbor_route"
+    )
+
+    assert "127.0.0.1:5000/v2/" in condition.probe
+    assert "200" in condition.probe
+    assert "401" in condition.probe
+    assert "sites-enabled/harbor.conf" not in condition.probe
+    assert catalog["catalog_revision"] == (
+        "2026-07-14-host110-harbor-route-v3"
+    )
+
+
 def test_read_only_probe_command_uses_structured_inventory(tmp_path: Path) -> None:
     root, key, known_hosts = _verifier_root(tmp_path)
     condition = AssetPostcondition(

infra/ansible/playbooks/110-devops.yml

@@ -11,7 +11,7 @@
 #   bitan:        running docker (port 3003)
 #   wooo-aiops:   running PM2 (port 3000)
 #   runners:      5x GitHub Actions runners (systemd)
-#   nginx:        harbor conf -> 127.0.0.1:5000
+#   harbor route: registry backend 127.0.0.1:5000 (TLS/proxy terminates on 188)
 #   keepalived:   BACKUP priority 90 VIP:200
 
 - name: "192.168.0.110 DevOps 金庫 — 預期狀態收斂"
@@ -170,28 +170,22 @@
       tags: keepalived
 
     # ========================================================================
-    # Nginx harbor conf 指向確認
+    # Harbor registry backend route
     # ========================================================================
-    - name: "Nginx | 確認 harbor nginx conf 存在"
-      ansible.builtin.stat:
-        path: /etc/nginx/sites-enabled/harbor.conf
-      register: harbor_nginx
-      tags: nginx
-
-    - name: "Nginx | 確認 harbor conf 指向 :5000 (非 :5050)"
-      ansible.builtin.command:
-        cmd: "grep -c ':5050' /etc/nginx/sites-enabled/harbor.conf"
-      register: harbor_conf_check
+    - name: "Harbor | 驗證本機 registry API"
+      ansible.builtin.uri:
+        url: http://127.0.0.1:5000/v2/
+        method: GET
+        status_code:
+          - 200
+          - 401
+        return_content: false
+        timeout: 10
+      register: harbor_registry_route
       changed_when: false
-      failed_when: false
-      when: harbor_nginx.stat.exists
-      tags: nginx
-
-    - name: "Nginx | 警告：harbor conf 仍指向 :5050"
-      ansible.builtin.debug:
-        msg: "⚠️  harbor nginx conf 仍有 :5050，請確認已修正為 :5000"
-      when: harbor_nginx.stat.exists and harbor_conf_check.stdout != "0"
-      tags: nginx
+      tags:
+        - harbor
+        - nginx
 
     # ========================================================================
     # Prometheus rule source/runtime convergence