refactor: consolidate all roles into ansible/roles/ and update ansible.cfg

- Move all roles from playbooks/roles/ to roles/
- Update roles_path in ansible.cfg
- Add cast user to common role
- Create standalone podman role
- Add semaphore role with Podman + Quadlet support

ansible/roles/gitea/defaults/main.yml

@@ -0,0 +1,39 @@
+---
+# ------------------------------------------------------------------------------
+# FILE: ansible/playbooks/roles/gitea/defaults/main.yml
+# ------------------------------------------------------------------------------
+
+# Directory layout on mad-tea-party
+gitea_compose_dir: /opt/gitea
+
+# Gitea application settings
+gitea_domain: gitea.mk-labs.cloud
+gitea_root_url: "https://{{ gitea_domain }}"
+gitea_http_port: 3000
+gitea_ssh_port: 2221
+
+# Trusted proxy (lightning-lane)
+gitea_trusted_proxies: 10.1.71.35
+
+# Timezone
+gitea_timezone: America/Chicago
+
+# Database
+gitea_db_name: gitea
+gitea_db_user: gitea
+
+# Traefik dynamic config destination on lightning-lane
+traefik_dynamic_config_dir: /opt/traefik/dynamic
+
+# DNS
+gitea_cname_name: gitea
+gitea_cname_domain: mk-labs.cloud
+gitea_cname_target: mad-tea-party.local.mk-labs.cloud
+
+# OIDC / Authentik SSO
+gitea_oidc_enabled: true
+gitea_oidc_client_id: "{{ vault_gitea_oidc_client_id }}"
+gitea_oidc_client_secret: "{{ vault_gitea_oidc_client_secret }}"
+gitea_oidc_discovery_url: "https://authentik.local.mk-labs.cloud/application/o/gitea/.well-known/openid-configuration"
+gitea_oidc_admin_group: "mk-labs-admins"
+gitea_admin_api_token: "{{ vault_gitea_admin_api_token }}"

ansible/roles/gitea/handlers/main.yml

@@ -0,0 +1,10 @@
+---
+# ------------------------------------------------------------------------------
+# FILE: ansible/playbooks/roles/gitea/handlers/main.yml
+# ------------------------------------------------------------------------------
+
+- name: restart gitea
+  community.docker.docker_compose_v2:
+    project_src: "{{ gitea_compose_dir }}"
+    state: present
+    recreate: always

ansible/roles/gitea/tasks/configure_oidc.yml

@@ -0,0 +1,27 @@
+---
+# ------------------------------------------------------------------------------
+# FILE: ansible/playbooks/roles/gitea/tasks/configure_oidc.yml
+# DESCRIPTION: Registers Authentik as an OAuth2 source in Gitea via the admin
+#              API. Idempotent — skips creation if source already exists.
+# ------------------------------------------------------------------------------
+
+- name: Check if authentik auth source already exists
+  ansible.builtin.command:
+    cmd: docker exec -u git gitea-gitea-1 gitea admin auth list
+  register: _auth_list
+  changed_when: false
+
+- name: Create Authentik OAuth2 auth source
+  ansible.builtin.command:
+    cmd: >
+      docker exec -u git gitea-gitea-1 gitea admin auth add-oauth
+      --name authentik
+      --provider openidConnect
+      --key {{ gitea_oidc_client_id }}
+      --secret {{ gitea_oidc_client_secret }}
+      --auto-discover-url {{ gitea_oidc_discovery_url }}
+      --scopes "email profile"
+      --group-claim-name groups
+      --admin-group {{ gitea_oidc_admin_group }}
+      --skip-local-2fa false
+  when: "'authentik' not in _auth_list.stdout"

ansible/roles/gitea/tasks/main.yml

@@ -0,0 +1,67 @@
+---
+# ------------------------------------------------------------------------------
+# FILE: ansible/playbooks/roles/gitea/tasks/main.yml
+# ------------------------------------------------------------------------------
+
+# ── Directories ────────────────────────────────────────────────────────────────
+
+- name: Create Gitea compose directory
+  ansible.builtin.file:
+    path: "{{ gitea_compose_dir }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+
+# ── Compose & env ──────────────────────────────────────────────────────────────
+
+- name: Deploy Gitea compose file from boilerplate
+  ansible.builtin.copy:
+    src: "{{ playbook_dir }}/../../boilerplates/gitea/compose.yaml"
+    dest: "{{ gitea_compose_dir }}/compose.yaml"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: restart gitea
+
+- name: Deploy .env file with secrets from vault
+  ansible.builtin.template:
+    src: env.j2
+    dest: "{{ gitea_compose_dir }}/.env"
+    owner: root
+    group: root
+    mode: "0600"
+  notify: restart gitea
+
+# ── Compose stack ──────────────────────────────────────────────────────────────
+
+- name: Start Gitea stack
+  community.docker.docker_compose_v2:
+    project_src: "{{ gitea_compose_dir }}"
+    state: present
+    recreate: always
+
+# ── Traefik route ──────────────────────────────────────────────────────────────
+
+# - name: Deploy Traefik dynamic config for Gitea
+#   ansible.builtin.copy:
+#     src: "{{ playbook_dir }}/../../boilerplates/traefik/dynamic/gitea.yml"
+#     dest: "{{ traefik_dynamic_config_dir }}/gitea.yml"
+#     owner: root
+#     group: root
+#     mode: "0644"
+#   delegate_to: localhost
+
+# ── DNS ────────────────────────────────────────────────────────────────────────
+
+# - name: Create DNS CNAME for Gitea
+#   ansible.builtin.include_role:
+#     name: add_service_route
+#   vars:
+#     service_name: "{{ gitea_cname_name }}"
+#     service_domain: "{{ gitea_cname_domain }}"
+#     target_host: "{{ gitea_cname_target }}"
+- name: Configure Authentik OIDC source
+  ansible.builtin.import_tasks: configure_oidc.yml
+  when: gitea_oidc_enabled | bool
+  tags: oidc

ansible/roles/gitea/templates/env.j2

@@ -0,0 +1,12 @@
+# ------------------------------------------------------------------------------
+# FILE: ansible/playbooks/roles/gitea/templates/env.j2
+# DESCRIPTION: Environment file for Gitea Docker Compose stack.
+#              Populated from Ansible Vault at deploy time.
+# ------------------------------------------------------------------------------
+
+DATABASE_PASSWORD={{ gitea_db_password }}
+
+# OIDC auto-registration (Gitea reads these at runtime)
+GITEA__oauth2__ENABLE_AUTO_REGISTRATION=true
+GITEA__oauth2__UPDATE_AVATAR=true
+GITEA__oauth2__ACCOUNT_LINKING=login