refactor: consolidate all roles into ansible/roles/ and update ansible.cfg

- Move all roles from playbooks/roles/ to roles/
- Update roles_path in ansible.cfg
- Add cast user to common role
- Create standalone podman role
- Add semaphore role with Podman + Quadlet support

ansible/roles/step-ca/templates/compose.yaml.j2

@@ -0,0 +1,24 @@
+---
+# Managed by Ansible — do not edit manually
+# Smallstep step-ca — SSH & X.509 Certificate Authority
+
+services:
+  step-ca:
+    image: {{ stepca_image }}:{{ stepca_image_tag }}
+    container_name: {{ stepca_container_name }}
+    restart: unless-stopped
+    ports:
+      - "{{ stepca_listen_port }}:{{ stepca_listen_port }}"
+    volumes:
+      - {{ stepca_data_dir }}:/home/step
+    environment:
+      - DOCKER_STEPCA_INIT_NAME={{ stepca_ca_name }}
+      - DOCKER_STEPCA_INIT_DNS_NAMES={{ stepca_dns_names }}
+      - DOCKER_STEPCA_INIT_REMOTE_MANAGEMENT={{ stepca_remote_management | lower }}
+      - DOCKER_STEPCA_INIT_SSH={{ stepca_ssh_enabled | lower }}
+    networks:
+      - {{ stepca_docker_network }}
+
+networks:
+  {{ stepca_docker_network }}:
+    external: true

ansible/roles/step-ca/templates/env.j2

@@ -0,0 +1,4 @@
+# Managed by Ansible — do not edit manually
+STEPCA_DNS_NAMES={{ stepca_dns_names }}
+STEPCA_SSH_ENABLED={{ stepca_ssh_enabled | lower }}
+STEPCA_REMOTE_MANAGEMENT={{ stepca_remote_management | lower }}

ansible/roles/step-ca/templates/patch_oidc_provisioner.py.j2

@@ -0,0 +1,57 @@
+#!/usr/bin/env python3
+# Managed by Ansible — do not edit manually
+# Patches the OIDC provisioner in step-ca's ca.json with values from Ansible vars
+import json
+import sys
+
+ca_json_path = "{{ stepca_data_dir }}/config/ca.json"
+provisioner_name = "{{ stepca_oidc_provisioner_name }}"
+desired_domains = {{ stepca_oidc_domains | to_json }}
+desired_client_id = "{{ stepca_oidc_client_id }}"
+desired_client_secret = "{{ stepca_oidc_client_secret }}"
+desired_config_endpoint = "{{ stepca_oidc_configuration_endpoint }}"
+desired_listen_address = "{{ stepca_oidc_listen_address }}"
+
+with open(ca_json_path) as f:
+    cfg = json.load(f)
+
+changed = False
+found = False
+
+for p in cfg["authority"]["provisioners"]:
+    if p.get("name") == provisioner_name and p.get("type") == "OIDC":
+        found = True
+        updates = {
+            "domains": desired_domains,
+            "clientID": desired_client_id,
+            "clientSecret": desired_client_secret,
+            "configurationEndpoint": desired_config_endpoint,
+            "listenAddress": desired_listen_address,
+        }
+        for key, value in updates.items():
+            if p.get(key) != value:
+                p[key] = value
+                changed = True
+        break
+
+if not found:
+    # Add the OIDC provisioner if it doesn't exist
+    cfg["authority"]["provisioners"].append({
+        "type": "OIDC",
+        "name": provisioner_name,
+        "clientID": desired_client_id,
+        "clientSecret": desired_client_secret,
+        "configurationEndpoint": desired_config_endpoint,
+        "domains": desired_domains,
+        "listenAddress": desired_listen_address,
+        "claims": {"enableSSHCA": True},
+        "options": {"x509": {}, "ssh": {}},
+    })
+    changed = True
+
+if changed:
+    with open(ca_json_path, "w") as f:
+        json.dump(cfg, f, indent=8)
+    print("CHANGED")
+else:
+    print("OK")