feat(semaphore): add idempotent initial admin user creation

- New variables for admin user (password from vault)
- Task checks if user exists before creating
- Uses podman exec + semaphore CLI

ansible/roles/semaphore/defaults/main.yml

@@ -24,3 +24,8 @@ semaphore_db_path: "{{ semaphore_data_dir }}/database.boltdb"
 # Vault variables (defined in group_vars/all/vault)
 # vault_semaphore_admin_password
 # vault_semaphore_access_key_encryption
+# Initial admin user (password should come from vault)
+semaphore_admin_user: admin
+semaphore_admin_name: Administrator
+semaphore_admin_email: admin@local.mk-labs.cloud
+# semaphore_admin_password: defined in vault

ansible/roles/semaphore/tasks/main.yml

@@ -77,3 +77,26 @@
     name: "container-{{ semaphore_container_name }}.service"
     state: started
     enabled: true
+- name: Check if admin user already exists
+  ansible.builtin.command:
+    cmd: "podman exec {{ semaphore_container_name }} semaphore user list"
+  register: semaphore_user_list
+  changed_when: false
+  failed_when: false
+  no_log: true
+
+- name: Create initial admin user
+  ansible.builtin.command:
+    cmd: >
+      podman exec {{ semaphore_container_name }} semaphore user add --admin
+      --login {{ semaphore_admin_user }}
+      --name "{{ semaphore_admin_name }}"
+      --email {{ semaphore_admin_email }}
+      --password {{ semaphore_admin_password }}
+  register: create_admin_result
+  changed_when: create_admin_result.rc == 0
+  failed_when: create_admin_result.rc != 0 and 'already exists' not in create_admin_result.stderr
+  when:
+    - semaphore_admin_password is defined
+    - semaphore_admin_user not in semaphore_user_list.stdout
+  no_log: true