009f244739
Adds an idempotent configuration pass that drives a freshly-deployed
Semaphore instance into its desired state via the REST API. Declared
in group_vars/all/semaphore.yml, applied by tasks/configure.yml,
toggled by semaphore_configure feature flag (default off).
Object types managed:
- Project (mk-labs)
- Keys (ansible-vault-pass, gitea-deploy, jarvis-ssh)
- Repositories (homelab on gitea)
- Inventories (production -> ansible/inventory.yml in homelab repo)
- Environments (default with ANSIBLE_HOST_KEY_CHECKING=False)
- Templates (day0_linux_baseline + variants, day1_deploy_semaphore)
with survey vars for runtime parameters
Each object found-or-created by name; existing ones never modified.
no_log on token-bearing calls to keep secrets out of stdout.
Inputs (already in vault):
vault_semaphore_api_token
vault_jarvis_ssh_private_key
vault_gitea_deploy_key
vault_ansible_vault_password
42 lines
1.4 KiB
YAML
42 lines
1.4 KiB
YAML
---
|
|
# ============================================================================
|
|
# semaphore / main entrypoint
|
|
# ----------------------------------------------------------------------------
|
|
# Order matters:
|
|
# 1. Podman + Quadlet support installed and ready
|
|
# 2. Network created (containers reference it by name)
|
|
# 3. Volumes created (postgres + semaphore data)
|
|
# 4. Postgres started (Semaphore depends on it being ready)
|
|
# 5. Semaphore started (web service)
|
|
# 6. Verify reachable on listen port
|
|
# ============================================================================
|
|
|
|
- name: Install Podman and dependencies
|
|
ansible.builtin.import_tasks: podman.yml
|
|
tags: [semaphore, podman]
|
|
|
|
- name: Ensure podman network exists
|
|
ansible.builtin.import_tasks: network.yml
|
|
tags: [semaphore, network]
|
|
|
|
- name: Ensure podman volumes exist
|
|
ansible.builtin.import_tasks: volumes.yml
|
|
tags: [semaphore, volumes]
|
|
|
|
- name: Deploy PostgreSQL container
|
|
ansible.builtin.import_tasks: postgres.yml
|
|
tags: [semaphore, postgres]
|
|
|
|
- name: Deploy Semaphore container
|
|
ansible.builtin.import_tasks: semaphore.yml
|
|
tags: [semaphore]
|
|
|
|
- name: Verify Semaphore is reachable
|
|
ansible.builtin.import_tasks: verify.yml
|
|
tags: [semaphore, verify]
|
|
|
|
- name: Apply Semaphore configuration (projects, keys, repos, templates)
|
|
ansible.builtin.import_tasks: configure.yml
|
|
when: semaphore_configure | default(false) | bool
|
|
tags: [semaphore, configure]
|