# {{ ansible_managed }}
# mk-labs SemaphoreUI web service
# Managed by Ansible - semaphore role

[Unit]
Description=SemaphoreUI
After=network-online.target {{ semaphore_postgres_container_name }}.service
Wants=network-online.target
Requires={{ semaphore_postgres_container_name }}.service

[Container]
Image={{ semaphore_image }}
ContainerName={{ semaphore_container_name }}
Network={{ semaphore_network_name }}
PublishPort={{ semaphore_listen_address }}:{{ semaphore_listen_port }}:3000

# Persistent runtime state (project repos, tmp playbooks, etc.)
Volume={{ semaphore_data_volume }}:/var/lib/semaphore:Z

# Ansible collections — host-side dir populated by the semaphore role.
# Bind-mounted to a neutral path; ANSIBLE_COLLECTIONS_PATHS tells
# ansible-galaxy where to find them without touching ~/.ansible/.
Volume={{ semaphore_collections_dir }}:/opt/ansible-collections:Z,ro

# Database — points at the postgres container on the user-defined network
Environment=SEMAPHORE_DB_DIALECT=postgres
Environment=SEMAPHORE_DB_HOST={{ semaphore_postgres_container_name }}
Environment=SEMAPHORE_DB_PORT=5432
Environment=SEMAPHORE_DB={{ semaphore_db_name }}
Environment=SEMAPHORE_DB_USER={{ semaphore_db_user }}
Environment=SEMAPHORE_DB_PASS={{ semaphore_db_password }}

# First-boot admin user (used only during initial setup; subsequent
# password changes go through the web UI).
Environment=SEMAPHORE_ADMIN=admin
Environment=SEMAPHORE_ADMIN_PASSWORD={{ semaphore_admin_password }}
Environment=SEMAPHORE_ADMIN_NAME=Administrator
Environment=SEMAPHORE_ADMIN_EMAIL=admin@local.mk-labs.cloud

# Playbook scratch directory inside the container
Environment=SEMAPHORE_PLAYBOOK_PATH=/var/lib/semaphore/playbooks

# Encryption for stored access keys (must be a 32-byte base64 string).
Environment=SEMAPHORE_ACCESS_KEY_ENCRYPTION={{ semaphore_access_key_encryption }}

# Public-facing URL used for OIDC redirects, webhooks, etc.
# Empty string keeps Semaphore host-agnostic (relative URLs).
{% if semaphore_web_url | length > 0 %}
Environment=SEMAPHORE_WEB_ROOT={{ semaphore_web_url }}
{% endif %}

# Timezone matches host baseline
Environment=TZ=America/Chicago

# Tell Ansible where to find collections installed by the role
Environment=ANSIBLE_COLLECTIONS_PATHS=/opt/ansible-collections

[Service]
Restart=always
TimeoutStartSec=180

[Install]
WantedBy=multi-user.target default.target