refactor: consolidate all roles into ansible/roles/ and update ansible.cfg

- Move all roles from playbooks/roles/ to roles/
- Update roles_path in ansible.cfg
- Add cast user to common role
- Create standalone podman role
- Add semaphore role with Podman + Quadlet support

ansible/roles/gitea/defaults/main.yml

@@ -0,0 +1,39 @@
+---
+# ------------------------------------------------------------------------------
+# FILE: ansible/playbooks/roles/gitea/defaults/main.yml
+# ------------------------------------------------------------------------------
+
+# Directory layout on mad-tea-party
+gitea_compose_dir: /opt/gitea
+
+# Gitea application settings
+gitea_domain: gitea.mk-labs.cloud
+gitea_root_url: "https://{{ gitea_domain }}"
+gitea_http_port: 3000
+gitea_ssh_port: 2221
+
+# Trusted proxy (lightning-lane)
+gitea_trusted_proxies: 10.1.71.35
+
+# Timezone
+gitea_timezone: America/Chicago
+
+# Database
+gitea_db_name: gitea
+gitea_db_user: gitea
+
+# Traefik dynamic config destination on lightning-lane
+traefik_dynamic_config_dir: /opt/traefik/dynamic
+
+# DNS
+gitea_cname_name: gitea
+gitea_cname_domain: mk-labs.cloud
+gitea_cname_target: mad-tea-party.local.mk-labs.cloud
+
+# OIDC / Authentik SSO
+gitea_oidc_enabled: true
+gitea_oidc_client_id: "{{ vault_gitea_oidc_client_id }}"
+gitea_oidc_client_secret: "{{ vault_gitea_oidc_client_secret }}"
+gitea_oidc_discovery_url: "https://authentik.local.mk-labs.cloud/application/o/gitea/.well-known/openid-configuration"
+gitea_oidc_admin_group: "mk-labs-admins"
+gitea_admin_api_token: "{{ vault_gitea_admin_api_token }}"