refactor: consolidate all roles into ansible/roles/ and update ansible.cfg

- Move all roles from playbooks/roles/ to roles/
- Update roles_path in ansible.cfg
- Add cast user to common role
- Create standalone podman role
- Add semaphore role with Podman + Quadlet support

ansible/roles/step-ca/defaults/main.yml

@@ -0,0 +1,20 @@
+---
+# file: roles/step-ca/defaults/main.yml
+
+# Docker image
+stepca_image: "smallstep/step-ca"
+stepca_image_tag: "latest"
+stepca_container_name: "step-ca"
+
+# Paths
+stepca_base_dir: "/opt/docker/step-ca"
+stepca_data_dir: "{{ stepca_base_dir }}/data"
+
+# CA configuration
+stepca_ca_name: "mk-labs CA"
+stepca_listen_port: 9000
+stepca_ssh_enabled: true
+stepca_remote_management: true
+
+# Network
+stepca_docker_network: "proxy"

ansible/roles/step-ca/handlers/main.yml

@@ -0,0 +1,7 @@
+---
+# file: roles/step-ca/handlers/main.yml
+
+- name: restart step-ca
+  community.docker.docker_compose_v2:
+    project_src: "{{ stepca_base_dir }}"
+    state: restarted

ansible/roles/step-ca/tasks/main.yml

@@ -0,0 +1,123 @@
+---
+# file: roles/step-ca/tasks/main.yml
+
+- name: Create step-ca base directory
+  ansible.builtin.file:
+    path: "{{ stepca_base_dir }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Create step-ca data directory
+  ansible.builtin.file:
+    path: "{{ stepca_data_dir }}"
+    state: directory
+    owner: "1000"
+    group: "1000"
+    mode: "0755"
+
+- name: Create Docker network for step-ca
+  community.docker.docker_network:
+    name: "{{ stepca_docker_network }}"
+    state: present
+
+- name: Deploy step-ca compose file
+  ansible.builtin.template:
+    src: compose.yaml.j2
+    dest: "{{ stepca_base_dir }}/compose.yaml"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: restart step-ca
+
+- name: Deploy step-ca environment file
+  ansible.builtin.template:
+    src: env.j2
+    dest: "{{ stepca_base_dir }}/.env"
+    owner: root
+    group: root
+    mode: "0600"
+  no_log: true
+  notify: restart step-ca
+
+- name: Create step-ca secrets directory
+  ansible.builtin.file:
+    path: "{{ stepca_data_dir }}/secrets"
+    state: directory
+    owner: "1000"
+    group: "1000"
+    mode: "0700"
+
+- name: Write CA password file
+  ansible.builtin.copy:
+    content: "{{ stepca_ca_password }}"
+    dest: "{{ stepca_data_dir }}/secrets/password"
+    owner: "1000"
+    group: "1000"
+    mode: "0600"
+  no_log: true
+
+- name: Check if step-ca is already initialized
+  ansible.builtin.stat:
+    path: "{{ stepca_data_dir }}/config/ca.json"
+  register: stepca_config
+
+- name: Initialize step-ca (first run only)
+  when: not stepca_config.stat.exists
+  block:
+    - name: Run step-ca initialization
+      community.docker.docker_container:
+        name: "{{ stepca_container_name }}-init"
+        image: "{{ stepca_image }}:{{ stepca_image_tag }}"
+        command: >-
+          step ca init
+          --name "{{ stepca_ca_name }}"
+          --dns "{{ stepca_dns_names }}"
+          --address ":{{ stepca_listen_port }}"
+          --provisioner "admin"
+          --password-file /home/step/secrets/password
+          --ssh
+          --remote-management
+        volumes:
+          - "{{ stepca_data_dir }}:/home/step"
+        state: started
+        detach: false
+        cleanup: true
+      register: stepca_init
+
+    - name: Display CA fingerprint
+      ansible.builtin.debug:
+        msg: "{{ stepca_init.container.Output }}"
+      when: stepca_init is changed
+
+- name: Start step-ca
+  community.docker.docker_compose_v2:
+    project_src: "{{ stepca_base_dir }}"
+    state: present
+
+- name: Template OIDC provisioner patch script
+  ansible.builtin.template:
+    src: patch_oidc_provisioner.py.j2
+    dest: "{{ stepca_base_dir }}/patch_oidc_provisioner.py"
+    owner: root
+    group: root
+    mode: "0700"
+  no_log: true
+
+- name: Patch OIDC provisioner in ca.json
+  ansible.builtin.command:
+    cmd: python3 {{ stepca_base_dir }}/patch_oidc_provisioner.py
+  register: oidc_patch_result
+  changed_when: "'CHANGED' in oidc_patch_result.stdout"
+
+- name: Restart step-ca if OIDC provisioner changed
+  community.docker.docker_compose_v2:
+    project_src: "{{ stepca_base_dir }}"
+    state: restarted
+  when: oidc_patch_result is changed
+
+- name: Clean up patch script
+  ansible.builtin.file:
+    path: "{{ stepca_base_dir }}/patch_oidc_provisioner.py"
+    state: absent

ansible/roles/step-ca/templates/compose.yaml.j2

@@ -0,0 +1,24 @@
+---
+# Managed by Ansible — do not edit manually
+# Smallstep step-ca — SSH & X.509 Certificate Authority
+
+services:
+  step-ca:
+    image: {{ stepca_image }}:{{ stepca_image_tag }}
+    container_name: {{ stepca_container_name }}
+    restart: unless-stopped
+    ports:
+      - "{{ stepca_listen_port }}:{{ stepca_listen_port }}"
+    volumes:
+      - {{ stepca_data_dir }}:/home/step
+    environment:
+      - DOCKER_STEPCA_INIT_NAME={{ stepca_ca_name }}
+      - DOCKER_STEPCA_INIT_DNS_NAMES={{ stepca_dns_names }}
+      - DOCKER_STEPCA_INIT_REMOTE_MANAGEMENT={{ stepca_remote_management | lower }}
+      - DOCKER_STEPCA_INIT_SSH={{ stepca_ssh_enabled | lower }}
+    networks:
+      - {{ stepca_docker_network }}
+
+networks:
+  {{ stepca_docker_network }}:
+    external: true

ansible/roles/step-ca/templates/env.j2

@@ -0,0 +1,4 @@
+# Managed by Ansible — do not edit manually
+STEPCA_DNS_NAMES={{ stepca_dns_names }}
+STEPCA_SSH_ENABLED={{ stepca_ssh_enabled | lower }}
+STEPCA_REMOTE_MANAGEMENT={{ stepca_remote_management | lower }}

ansible/roles/step-ca/templates/patch_oidc_provisioner.py.j2

@@ -0,0 +1,57 @@
+#!/usr/bin/env python3
+# Managed by Ansible — do not edit manually
+# Patches the OIDC provisioner in step-ca's ca.json with values from Ansible vars
+import json
+import sys
+
+ca_json_path = "{{ stepca_data_dir }}/config/ca.json"
+provisioner_name = "{{ stepca_oidc_provisioner_name }}"
+desired_domains = {{ stepca_oidc_domains | to_json }}
+desired_client_id = "{{ stepca_oidc_client_id }}"
+desired_client_secret = "{{ stepca_oidc_client_secret }}"
+desired_config_endpoint = "{{ stepca_oidc_configuration_endpoint }}"
+desired_listen_address = "{{ stepca_oidc_listen_address }}"
+
+with open(ca_json_path) as f:
+    cfg = json.load(f)
+
+changed = False
+found = False
+
+for p in cfg["authority"]["provisioners"]:
+    if p.get("name") == provisioner_name and p.get("type") == "OIDC":
+        found = True
+        updates = {
+            "domains": desired_domains,
+            "clientID": desired_client_id,
+            "clientSecret": desired_client_secret,
+            "configurationEndpoint": desired_config_endpoint,
+            "listenAddress": desired_listen_address,
+        }
+        for key, value in updates.items():
+            if p.get(key) != value:
+                p[key] = value
+                changed = True
+        break
+
+if not found:
+    # Add the OIDC provisioner if it doesn't exist
+    cfg["authority"]["provisioners"].append({
+        "type": "OIDC",
+        "name": provisioner_name,
+        "clientID": desired_client_id,
+        "clientSecret": desired_client_secret,
+        "configurationEndpoint": desired_config_endpoint,
+        "domains": desired_domains,
+        "listenAddress": desired_listen_address,
+        "claims": {"enableSSHCA": True},
+        "options": {"x509": {}, "ssh": {}},
+    })
+    changed = True
+
+if changed:
+    with open(ca_json_path, "w") as f:
+        json.dump(cfg, f, indent=8)
+    print("CHANGED")
+else:
+    print("OK")