refactor: consolidate all roles into ansible/roles/ and update ansible.cfg

- Move all roles from playbooks/roles/ to roles/
- Update roles_path in ansible.cfg
- Add cast user to common role
- Create standalone podman role
- Add semaphore role with Podman + Quadlet support

ansible/roles/step-ca/tasks/main.yml

@@ -0,0 +1,123 @@
+---
+# file: roles/step-ca/tasks/main.yml
+
+- name: Create step-ca base directory
+  ansible.builtin.file:
+    path: "{{ stepca_base_dir }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Create step-ca data directory
+  ansible.builtin.file:
+    path: "{{ stepca_data_dir }}"
+    state: directory
+    owner: "1000"
+    group: "1000"
+    mode: "0755"
+
+- name: Create Docker network for step-ca
+  community.docker.docker_network:
+    name: "{{ stepca_docker_network }}"
+    state: present
+
+- name: Deploy step-ca compose file
+  ansible.builtin.template:
+    src: compose.yaml.j2
+    dest: "{{ stepca_base_dir }}/compose.yaml"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: restart step-ca
+
+- name: Deploy step-ca environment file
+  ansible.builtin.template:
+    src: env.j2
+    dest: "{{ stepca_base_dir }}/.env"
+    owner: root
+    group: root
+    mode: "0600"
+  no_log: true
+  notify: restart step-ca
+
+- name: Create step-ca secrets directory
+  ansible.builtin.file:
+    path: "{{ stepca_data_dir }}/secrets"
+    state: directory
+    owner: "1000"
+    group: "1000"
+    mode: "0700"
+
+- name: Write CA password file
+  ansible.builtin.copy:
+    content: "{{ stepca_ca_password }}"
+    dest: "{{ stepca_data_dir }}/secrets/password"
+    owner: "1000"
+    group: "1000"
+    mode: "0600"
+  no_log: true
+
+- name: Check if step-ca is already initialized
+  ansible.builtin.stat:
+    path: "{{ stepca_data_dir }}/config/ca.json"
+  register: stepca_config
+
+- name: Initialize step-ca (first run only)
+  when: not stepca_config.stat.exists
+  block:
+    - name: Run step-ca initialization
+      community.docker.docker_container:
+        name: "{{ stepca_container_name }}-init"
+        image: "{{ stepca_image }}:{{ stepca_image_tag }}"
+        command: >-
+          step ca init
+          --name "{{ stepca_ca_name }}"
+          --dns "{{ stepca_dns_names }}"
+          --address ":{{ stepca_listen_port }}"
+          --provisioner "admin"
+          --password-file /home/step/secrets/password
+          --ssh
+          --remote-management
+        volumes:
+          - "{{ stepca_data_dir }}:/home/step"
+        state: started
+        detach: false
+        cleanup: true
+      register: stepca_init
+
+    - name: Display CA fingerprint
+      ansible.builtin.debug:
+        msg: "{{ stepca_init.container.Output }}"
+      when: stepca_init is changed
+
+- name: Start step-ca
+  community.docker.docker_compose_v2:
+    project_src: "{{ stepca_base_dir }}"
+    state: present
+
+- name: Template OIDC provisioner patch script
+  ansible.builtin.template:
+    src: patch_oidc_provisioner.py.j2
+    dest: "{{ stepca_base_dir }}/patch_oidc_provisioner.py"
+    owner: root
+    group: root
+    mode: "0700"
+  no_log: true
+
+- name: Patch OIDC provisioner in ca.json
+  ansible.builtin.command:
+    cmd: python3 {{ stepca_base_dir }}/patch_oidc_provisioner.py
+  register: oidc_patch_result
+  changed_when: "'CHANGED' in oidc_patch_result.stdout"
+
+- name: Restart step-ca if OIDC provisioner changed
+  community.docker.docker_compose_v2:
+    project_src: "{{ stepca_base_dir }}"
+    state: restarted
+  when: oidc_patch_result is changed
+
+- name: Clean up patch script
+  ansible.builtin.file:
+    path: "{{ stepca_base_dir }}/patch_oidc_provisioner.py"
+    state: absent