feat(semaphore): install Ansible collections via bind-mounted host directory

- New tasks/collections.yml installs collections from defaults list
  into /opt/semaphore/ansible-collections on the host
- semaphore.container.j2: bind-mounts that dir into the container at
  /home/semaphore/.ansible/collections (read-only)
- defaults/main.yml: semaphore_collections_dir + semaphore_ansible_collections
  list (containers.podman, effectivelywild.technitium_dns)
- main.yml: collections task wired in after semaphore.yml, before verify
- Collections survive container restarts/rebuilds without image changes
- Re-run with --tags collections to add new collections without full redeploy

ansible/roles/semaphore/defaults/main.yml

@@ -74,3 +74,17 @@ semaphore_health_check_delay: 2
 # Quadlet location (rootful)
 # ---------------------------------------------------------------------------
 semaphore_quadlet_dir: /etc/containers/systemd
+
+# ---------------------------------------------------------------------------
+# Ansible collections
+# ---------------------------------------------------------------------------
+# Host-side directory bind-mounted into the container at
+# /home/semaphore/.ansible/collections so collections persist across
+# container restarts and rebuilds.
+semaphore_collections_dir: /opt/semaphore/ansible-collections
+
+semaphore_ansible_collections:
+  - name: containers.podman
+    version: ">=1.10.0"
+  - name: effectivelywild.technitium_dns
+    version: ">=1.1.0"

ansible/roles/semaphore/tasks/collections.yml

@@ -0,0 +1,30 @@
+---
+# ============================================================================
+# Install Ansible collections into a host-side directory that is
+# bind-mounted into the Semaphore container at the Ansible collections
+# path (/home/semaphore/.ansible/collections).
+#
+# This persists collections across container restarts/rebuilds without
+# baking them into the image. Add new collections to
+# semaphore_ansible_collections in defaults/main.yml.
+# ============================================================================
+
+- name: Ensure Ansible collections directory exists on host
+  ansible.builtin.file:
+    path: "{{ semaphore_collections_dir }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Install Ansible collections into host collections directory
+  ansible.builtin.command:
+    cmd: >
+      ansible-galaxy collection install
+      {{ item.name }}{% if item.version is defined %}:{{ item.version }}{% endif %}
+      -p {{ semaphore_collections_dir }}
+      --force
+  loop: "{{ semaphore_ansible_collections }}"
+  loop_control:
+    label: "{{ item.name }}"
+  changed_when: true

ansible/roles/semaphore/tasks/main.yml

@@ -31,6 +31,10 @@
   ansible.builtin.import_tasks: semaphore.yml
   tags: [semaphore]
 
+- name: Install Ansible collections for Semaphore
+  ansible.builtin.import_tasks: collections.yml
+  tags: [semaphore, collections]
+
 - name: Verify Semaphore is reachable
   ansible.builtin.import_tasks: verify.yml
   tags: [semaphore, verify]

ansible/roles/semaphore/templates/semaphore.container.j2

@@ -17,6 +17,11 @@ PublishPort={{ semaphore_listen_address }}:{{ semaphore_listen_port }}:3000
 # Persistent runtime state (project repos, tmp playbooks, etc.)
 Volume={{ semaphore_data_volume }}:/var/lib/semaphore:Z
 
+# Ansible collections — host-side dir populated by the semaphore role.
+# Bind-mounted so collections persist across container restarts/rebuilds
+# without baking them into the image.
+Volume={{ semaphore_collections_dir }}:/home/semaphore/.ansible/collections:Z,ro
+
 # Database — points at the postgres container on the user-defined network
 Environment=SEMAPHORE_DB_DIALECT=postgres
 Environment=SEMAPHORE_DB_HOST={{ semaphore_postgres_container_name }}