8627b00ed8
- New tasks/collections.yml installs collections from defaults list into /opt/semaphore/ansible-collections on the host - semaphore.container.j2: bind-mounts that dir into the container at /home/semaphore/.ansible/collections (read-only) - defaults/main.yml: semaphore_collections_dir + semaphore_ansible_collections list (containers.podman, effectivelywild.technitium_dns) - main.yml: collections task wired in after semaphore.yml, before verify - Collections survive container restarts/rebuilds without image changes - Re-run with --tags collections to add new collections without full redeploy
61 lines
2.2 KiB
Django/Jinja
61 lines
2.2 KiB
Django/Jinja
# {{ ansible_managed }}
|
|
# mk-labs SemaphoreUI web service
|
|
# Managed by Ansible - semaphore role
|
|
|
|
[Unit]
|
|
Description=SemaphoreUI
|
|
After=network-online.target {{ semaphore_postgres_container_name }}.service
|
|
Wants=network-online.target
|
|
Requires={{ semaphore_postgres_container_name }}.service
|
|
|
|
[Container]
|
|
Image={{ semaphore_image }}
|
|
ContainerName={{ semaphore_container_name }}
|
|
Network={{ semaphore_network_name }}
|
|
PublishPort={{ semaphore_listen_address }}:{{ semaphore_listen_port }}:3000
|
|
|
|
# Persistent runtime state (project repos, tmp playbooks, etc.)
|
|
Volume={{ semaphore_data_volume }}:/var/lib/semaphore:Z
|
|
|
|
# Ansible collections — host-side dir populated by the semaphore role.
|
|
# Bind-mounted so collections persist across container restarts/rebuilds
|
|
# without baking them into the image.
|
|
Volume={{ semaphore_collections_dir }}:/home/semaphore/.ansible/collections:Z,ro
|
|
|
|
# Database — points at the postgres container on the user-defined network
|
|
Environment=SEMAPHORE_DB_DIALECT=postgres
|
|
Environment=SEMAPHORE_DB_HOST={{ semaphore_postgres_container_name }}
|
|
Environment=SEMAPHORE_DB_PORT=5432
|
|
Environment=SEMAPHORE_DB={{ semaphore_db_name }}
|
|
Environment=SEMAPHORE_DB_USER={{ semaphore_db_user }}
|
|
Environment=SEMAPHORE_DB_PASS={{ semaphore_db_password }}
|
|
|
|
# First-boot admin user (used only during initial setup; subsequent
|
|
# password changes go through the web UI).
|
|
Environment=SEMAPHORE_ADMIN=admin
|
|
Environment=SEMAPHORE_ADMIN_PASSWORD={{ semaphore_admin_password }}
|
|
Environment=SEMAPHORE_ADMIN_NAME=Administrator
|
|
Environment=SEMAPHORE_ADMIN_EMAIL=admin@local.mk-labs.cloud
|
|
|
|
# Playbook scratch directory inside the container
|
|
Environment=SEMAPHORE_PLAYBOOK_PATH=/var/lib/semaphore/playbooks
|
|
|
|
# Encryption for stored access keys (must be a 32-byte base64 string).
|
|
Environment=SEMAPHORE_ACCESS_KEY_ENCRYPTION={{ semaphore_access_key_encryption }}
|
|
|
|
# Public-facing URL used for OIDC redirects, webhooks, etc.
|
|
# Empty string keeps Semaphore host-agnostic (relative URLs).
|
|
{% if semaphore_web_url | length > 0 %}
|
|
Environment=SEMAPHORE_WEB_ROOT={{ semaphore_web_url }}
|
|
{% endif %}
|
|
|
|
# Timezone matches host baseline
|
|
Environment=TZ=America/Chicago
|
|
|
|
[Service]
|
|
Restart=always
|
|
TimeoutStartSec=180
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target default.target
|