homelab/ansible/roles/semaphore/tasks/main.yml

---
- name: Ensure cast group exists
  ansible.builtin.group:
    name: "{{ semaphore_group }}"
    state: present
    system: true

- name: Ensure cast user exists
  ansible.builtin.user:
    name: "{{ semaphore_user }}"
    group: "{{ semaphore_group }}"
    shell: /bin/bash
    create_home: true
    state: present

- name: Create Semaphore data directories with correct ownership
  ansible.builtin.file:
    path: "{{ item }}"
    state: directory
    owner: "{{ semaphore_user }}"
    group: "{{ semaphore_group }}"
    mode: "0777"
    recurse: true
  become: true
  loop:
    - "{{ semaphore_data_dir }}"
    - "{{ semaphore_config_dir }}"

# ============================================================
# LEGACY DEPLOYMENT (podman_container + generate systemd)
# ============================================================
- name: Legacy deployment with PostgreSQL
  when: semaphore_use_postgres | default(false)
  block:
    - name: Create dedicated Podman network for Semaphore + PostgreSQL
      ansible.builtin.command:
        cmd: "podman network create semaphore-net"
      become: true
      register: net_result
      changed_when: "'already exists' not in net_result.stderr"
      failed_when: false

    - name: Create required Podman volumes
      ansible.builtin.command:
        cmd: "podman volume create {{ item }}"
      become: true
      register: vol_result
      changed_when: vol_result.stdout | length > 0
      failed_when: false
      loop:
        - "{{ semaphore_postgres_volume }}"
        - "{{ semaphore_data_volume }}"

    - name: Deploy PostgreSQL container (legacy)
      containers.podman.podman_container:
        name: "{{ semaphore_postgres_container_name }}"
        image: "{{ semaphore_postgres_image }}"
        network: semaphore-net
        state: started
        recreate: true
        volumes:
          - "{{ semaphore_postgres_volume }}:/var/lib/postgresql/data:Z"
        env:
          POSTGRES_USER: "{{ semaphore_postgres_user }}"
          POSTGRES_PASSWORD: "{{ vault_semaphore_database_password }}"
          POSTGRES_DB: "{{ semaphore_postgres_db }}"
      become: true

    - name: Deploy Semaphore container (legacy)
      containers.podman.podman_container:
        name: "{{ semaphore_container_name }}"
        image: "{{ semaphore_image }}"
        network: semaphore-net
        state: started
        recreate: true
        ports:
          - "{{ semaphore_port }}:3000"
        volumes:
          - "{{ semaphore_data_volume }}:/var/lib/semaphore:Z"
          - "{{ semaphore_config_dir }}:/etc/semaphore:Z"
        env:
          SEMAPHORE_DB_DIALECT: "postgres"
          SEMAPHORE_DB_PATH: ""
          SEMAPHORE_DB_USER: "{{ semaphore_postgres_user }}"
          SEMAPHORE_DB_PASS: "{{ vault_semaphore_database_password }}"
          SEMAPHORE_DB_HOST: "{{ semaphore_postgres_container_name }}"
          SEMAPHORE_DB_PORT: "5432"
          SEMAPHORE_DB_NAME: "{{ semaphore_postgres_db }}"
          SEMAPHORE_ADMIN: "admin"
          SEMAPHORE_ADMIN_PASSWORD: "{{ vault_semaphore_admin_password }}"
          SEMAPHORE_ACCESS_KEY_ENCRYPTION: "{{ vault_semaphore_access_key_encryption }}"
      become: true

    - name: Generate systemd service for PostgreSQL
      ansible.builtin.command:
        cmd: "podman generate systemd --name --new --files {{ semaphore_postgres_container_name }}"
        chdir: /etc/systemd/system
      become: true
      changed_when: true

    - name: Generate systemd service for Semaphore
      ansible.builtin.command:
        cmd: "podman generate systemd --name --new --files {{ semaphore_container_name }}"
        chdir: /etc/systemd/system
      become: true
      changed_when: true

    - name: Reload systemd and enable services
      ansible.builtin.systemd:
        daemon_reload: true
        name: "{{ item }}"
        state: started
        enabled: true
      become: true
      loop:
        - "container-{{ semaphore_postgres_container_name }}.service"
        - "container-{{ semaphore_container_name }}.service"

# ============================================================
# LEGACY DEPLOYMENT - BoltDB fallback
# ============================================================
- name: Legacy deployment with BoltDB
  when: not (semaphore_use_postgres | default(false))
  block:
    - name: Create Semaphore config.json for BoltDB
      ansible.builtin.copy:
        dest: "{{ semaphore_config_dir }}/config.json"
        owner: "{{ semaphore_user }}"
        group: "{{ semaphore_group }}"
        mode: "0644"
        content: |
          {
            "db": {
              "Dialect": "bolt",
              "BoltDB": {
                "Path": "{{ semaphore_data_dir }}"
              }
            },
            "server": {
              "Addr": ":{{ semaphore_port }}"
            }
          }
      become: true

    - name: Create and start Semaphore container
      containers.podman.podman_container:
        name: "{{ semaphore_container_name }}"
        image: "{{ semaphore_image }}"
        network: semaphore-net
        state: started
        recreate: true
        ports:
          - "{{ semaphore_port }}:3000"
        volumes:
          - "{{ semaphore_data_dir }}:/var/lib/semaphore:Z"
          - "{{ semaphore_config_dir }}:/etc/semaphore:Z"
        env:
          SEMAPHORE_DB_DIALECT: "{{ semaphore_db_type }}"
          SEMAPHORE_DB_PATH: "{{ semaphore_db_path }}"
          SEMAPHORE_ADMIN: admin
          SEMAPHORE_ADMIN_PASSWORD: "{{ vault_semaphore_admin_password }}"
          SEMAPHORE_ACCESS_KEY_ENCRYPTION: "{{ vault_semaphore_access_key_encryption }}"

    - name: Generate systemd service for the container
      ansible.builtin.command:
        cmd: podman generate systemd --name --new --files {{ semaphore_container_name }}
        chdir: /etc/systemd/system
      become: true
      changed_when: true

    - name: Reload systemd and enable service
      ansible.builtin.systemd:
        daemon_reload: true
        name: "container-{{ semaphore_container_name }}.service"
        state: started
        enabled: true
  become: true