fix(semaphore): make host-agnostic by omitting SEMAPHORE_WEB_ROOT

The SPA was rendering <base href="https://semaphore.local.mk-labs.cloud/">
regardless of which hostname served the page, causing the imagineering
alias to load the same UI but rewrite all in-page navigation back to the
semaphore hostname. Confusing for users hitting either Traefik alias.

Leave SEMAPHORE_WEB_ROOT empty so Semaphore emits relative URLs and is
fully host-agnostic. Both DNS names (semaphore + imagineering) now serve
cleanly without preference between them.

The template only emits SEMAPHORE_WEB_ROOT when the variable is set, so
the env-var is absent from the container when not needed.

ansible/roles/semaphore/defaults/main.yml

@@ -38,8 +38,12 @@ semaphore_postgres_volume: semaphore_postgres_data
 semaphore_listen_address: "0.0.0.0"
 semaphore_listen_port: 3000
 
-# Public URL (used by Semaphore for OIDC redirects, webhook URLs, etc.)
-semaphore_web_url: "https://semaphore.local.mk-labs.cloud"
+# Public URL used for Semaphore-generated absolute URLs (webhooks, OIDC
+# callbacks, etc). Leave EMPTY to make Semaphore host-agnostic — the SPA
+# then uses relative URLs and serves cleanly under any hostname Traefik
+# points at it. Set to a fully-qualified URL only if a specific feature
+# requires an absolute base.
+semaphore_web_url: ""
 
 # ---------------------------------------------------------------------------
 # PostgreSQL configuration

ansible/roles/semaphore/templates/semaphore.container.j2

@@ -39,7 +39,10 @@ Environment=SEMAPHORE_PLAYBOOK_PATH=/var/lib/semaphore/playbooks
 Environment=SEMAPHORE_ACCESS_KEY_ENCRYPTION={{ semaphore_access_key_encryption }}
 
 # Public-facing URL used for OIDC redirects, webhooks, etc.
+# Empty string keeps Semaphore host-agnostic (relative URLs).
+{% if semaphore_web_url | length > 0 %}
 Environment=SEMAPHORE_WEB_ROOT={{ semaphore_web_url }}
+{% endif %}
 
 # Timezone matches host baseline
 Environment=TZ=America/Chicago