homelab/ansible/roles/semaphore/tasks/main.yml

---
- name: Ensure cast group exists
  ansible.builtin.group:
    name: "{{ semaphore_group }}"
    state: present
    system: true

- name: Ensure cast user exists
  ansible.builtin.user:
    name: "{{ semaphore_user }}"
    group: "{{ semaphore_group }}"
    shell: /bin/bash
    create_home: true
    state: present

- name: Create Semaphore data directories with correct ownership
  ansible.builtin.file:
    path: "{{ item }}"
    state: directory
    owner: "{{ semaphore_user }}"
    group: "{{ semaphore_group }}"
    mode: "0755"
  become: true
  changed_when: true
  loop:
    - "{{ semaphore_data_dir }}"
    - "{{ semaphore_config_dir }}"

- name: Create Semaphore config.json for BoltDB
  ansible.builtin.copy:
    dest: "{{ semaphore_config_dir }}/config.json"
    owner: "{{ semaphore_user }}"
    group: "{{ semaphore_group }}"
    mode: "0644"
    content: |
      {
        "db": {
          "Dialect": "bolt",
          "BoltDB": {
            "Path": "{{ semaphore_data_dir }}"
          }
        },
        "server": {
          "Addr": ":{{ semaphore_port }}"
        }
      }
  become: true

- name: Create and start Semaphore container
  containers.podman.podman_container:
    name: "{{ semaphore_container_name }}"
    image: "{{ semaphore_image }}"
    state: started
    recreate: true
    ports:
      - "{{ semaphore_port }}:3000"
    volumes:
      - "{{ semaphore_data_dir }}:/var/lib/semaphore:Z"
      - "{{ semaphore_config_dir }}:/etc/semaphore:Z"
    env:
      SEMAPHORE_DB_DIALECT: "{{ semaphore_db_type }}"
      SEMAPHORE_DB_PATH: "{{ semaphore_db_path }}"
      SEMAPHORE_ADMIN: admin
      SEMAPHORE_ADMIN_PASSWORD: "{{ vault_semaphore_admin_password }}"
      SEMAPHORE_ACCESS_KEY_ENCRYPTION: "{{ vault_semaphore_access_key_encryption }}"

- name: Generate systemd service for the container
  ansible.builtin.command:
    cmd: podman generate systemd --name --new --files {{ semaphore_container_name }}
    chdir: /etc/systemd/system
  become: true
  changed_when: true

- name: Reload systemd and enable service
  ansible.builtin.systemd:
    daemon_reload: true
    name: "container-{{ semaphore_container_name }}.service"
    state: started
    enabled: true
- name: Check if admin user already exists
  ansible.builtin.command:
    cmd: "podman exec {{ semaphore_container_name }} semaphore user list"
  register: semaphore_user_list
  changed_when: false
  failed_when: false
  no_log: true

- name: Create initial admin user
  ansible.builtin.command:
    cmd: >
      podman exec {{ semaphore_container_name }} semaphore user add --admin
      --login {{ semaphore_admin_user }}
      --name "{{ semaphore_admin_name }}"
      --email {{ semaphore_admin_email }}
      --password {{ semaphore_admin_password }}
  register: create_admin_result
  changed_when: create_admin_result.rc == 0
  failed_when: create_admin_result.rc != 0 and 'already exists' not in create_admin_result.stderr
  when:
    - semaphore_admin_password is defined
    - semaphore_admin_user not in semaphore_user_list.stdout
  no_log: true

- name: Force delete admin user if requested
  ansible.builtin.command:
    cmd: "podman exec {{ semaphore_container_name }} semaphore user delete --login {{ semaphore_admin_user }}"
  register: delete_admin_result
  failed_when: false
  changed_when: delete_admin_result.rc == 0
  when:
    - semaphore_force_admin_user | bool
    - semaphore_admin_user in semaphore_user_list.stdout
  no_log: true

- name: Create initial admin user (forced)
  ansible.builtin.command:
    cmd: >
      podman exec {{ semaphore_container_name }} semaphore user add --admin
      --login {{ semaphore_admin_user }}
      --name "{{ semaphore_admin_name }}"
      --email {{ semaphore_admin_email }}
      --password {{ semaphore_admin_password }}
  register: create_admin_result
  changed_when: create_admin_result.rc == 0
  failed_when: create_admin_result.rc != 0
  when:
    - semaphore_force_admin_user | bool
    - semaphore_admin_password is defined
  no_log: true