d1ae5ba7a0
Host dir was owned by root (0755), blocking writes from uid=1001 inside the container. Set owner to semaphore_container_uid=1001 so podman exec can write collections into the bind-mount.
96 lines
4.6 KiB
YAML
96 lines
4.6 KiB
YAML
---
|
|
# ============================================================================
|
|
# semaphore role defaults
|
|
# ============================================================================
|
|
# Deploys SemaphoreUI (https://semaphoreui.com) as a rootful Podman service
|
|
# managed via Quadlet. Uses a separate PostgreSQL 16 container on the same
|
|
# user-defined network. Both services persist to named volumes.
|
|
#
|
|
# Admin user creation is intentionally NOT automated — the Semaphore CLI's
|
|
# `user add` command has been unreliable across versions. Operator creates
|
|
# the first admin manually after the first successful deployment; see README.
|
|
# ============================================================================
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Image pinning
|
|
# ---------------------------------------------------------------------------
|
|
# The -ansible2.16.5 tag bundles Ansible 2.16.5 inside the Semaphore image,
|
|
# which matches the controller. Useful when Semaphore itself runs playbooks.
|
|
semaphore_image: "docker.io/semaphoreui/semaphore:v2.18.5-ansible2.16.5"
|
|
semaphore_postgres_image: "docker.io/library/postgres:16-alpine"
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Container & network identifiers
|
|
# ---------------------------------------------------------------------------
|
|
semaphore_container_name: semaphore
|
|
semaphore_postgres_container_name: semaphore-postgres
|
|
semaphore_network_name: semaphore-net
|
|
|
|
# Named podman volumes
|
|
semaphore_data_volume: semaphore_data
|
|
semaphore_postgres_volume: semaphore_postgres_data
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Networking
|
|
# ---------------------------------------------------------------------------
|
|
# Port exposed on the VM. Traefik on lightning-lane terminates TLS and
|
|
# forwards to this port. Localhost-bind keeps the raw service off the LAN.
|
|
semaphore_listen_address: "0.0.0.0"
|
|
semaphore_listen_port: 3000
|
|
|
|
# Public URL used for Semaphore-generated absolute URLs (webhooks, OIDC
|
|
# callbacks, etc). Leave EMPTY to make Semaphore host-agnostic — the SPA
|
|
# then uses relative URLs and serves cleanly under any hostname Traefik
|
|
# points at it. Set to a fully-qualified URL only if a specific feature
|
|
# requires an absolute base.
|
|
semaphore_web_url: ""
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# PostgreSQL configuration
|
|
# ---------------------------------------------------------------------------
|
|
semaphore_db_user: semaphore
|
|
semaphore_db_name: semaphore
|
|
# semaphore_db_password sourced from vault below
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Vault inputs (defined in group_vars/all/vault, encrypted with ansible-vault)
|
|
# ---------------------------------------------------------------------------
|
|
# vault_semaphore_database_password - postgres role password
|
|
# vault_semaphore_admin_password - initial admin password (used only
|
|
# during manual user-add step)
|
|
# vault_semaphore_access_key_encryption - 32-byte key for encrypting
|
|
# Semaphore-stored access keys
|
|
semaphore_db_password: "{{ vault_semaphore_database_password }}"
|
|
semaphore_admin_password: "{{ vault_semaphore_admin_password }}"
|
|
semaphore_access_key_encryption: "{{ vault_semaphore_access_key_encryption }}"
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Health check
|
|
# ---------------------------------------------------------------------------
|
|
semaphore_health_check_retries: 30
|
|
semaphore_health_check_delay: 2
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Quadlet location (rootful)
|
|
# ---------------------------------------------------------------------------
|
|
semaphore_quadlet_dir: /etc/containers/systemd
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Ansible collections
|
|
# ---------------------------------------------------------------------------
|
|
# Host-side directory bind-mounted into the container at
|
|
# /home/semaphore/.ansible/collections so collections persist across
|
|
# container restarts and rebuilds.
|
|
semaphore_collections_dir: /opt/semaphore/ansible-collections
|
|
|
|
# UID of the semaphore user inside the container (uid=1001).
|
|
# The host-side collections directory must be owned by this UID so the
|
|
# container process can write collections into the bind-mount.
|
|
semaphore_container_uid: 1001
|
|
|
|
semaphore_ansible_collections:
|
|
- name: containers.podman
|
|
version: ">=1.10.0"
|
|
- name: effectivelywild.technitium_dns
|
|
version: ">=1.1.0"
|