Coming soon.
mode: "0644" force: false # Template config files - name: Deploy Caddyfile ansible.builtin.template: src: Caddyfile.j2 dest: /opt/services/Caddyfile mode: "0644" register: caddyfile_changed - name: Deploy Dex config ansible.builtin.template: src: dex-config.yml.j2 dest: /opt/services/dex-config.yml mode: "0644" # Check if we already have a runner token saved - name: Check for existing runner token ansible.builtin.stat: path: /opt/services/.runner-token register: runner_token_file # Use a placeholder token for first deploy (runner won't start yet) - name: Set runner token from file if exists ansible.builtin.slurp: src: /opt/services/.runner-token register: runner_token_content when: runner_token_file.stat.exists - name: Set runner token variable ansible.builtin.set_fact: gitea_runner_token: "{{ runner_token_content.content | b64decode | trim }}" when: runner_token_file.stat.exists - name: Set placeholder runner token for first deploy ansible.builtin.set_fact: gitea_runner_token: "placeholder" when: not runner_token_file.stat.exists # Deploy compose file - name: Deploy docker-compose.yml ansible.builtin.template: src: docker-compose.yml.j2 dest: /opt/services/docker-compose.yml mode: "0644" # Start everything (runner will fail to register with placeholder token — that's OK) - name: Start all services ansible.builtin.command: cmd: docker compose up -d --remove-orphans chdir: /opt/services changed_when: true # Reload Caddy if Caddyfile changed (zero-downtime) - name: Reload Caddy config ansible.builtin.command: cmd: docker compose exec -T caddy caddy reload --config /etc/caddy/Caddyfile chdir: /opt/services when: caddyfile_changed.changed changed_when: true # Wait for Gitea to be ready - name: Wait for Gitea to be ready ansible.builtin.command: cmd: docker compose exec -T -u git gitea gitea admin user list chdir: /opt/services register: gitea_ready retries: 10 delay: 5 until: gitea_ready.rc == 0 changed_when: false # --- Gitea OIDC setup --- - name: Check if Dex auth source exists in Gitea ansible.builtin.shell: cmd: docker compose exec -T -u git gitea gitea admin auth list 2>&1 | grep -q dex chdir: /opt/services register: gitea_auth_check changed_when: false failed_when: false - name: Add Dex OIDC auth source to Gitea ansible.builtin.command: cmd: > docker compose exec -T -u git gitea gitea admin auth add-oauth --name dex --provider openidConnect --key gitea --secret {{ dex_gitea_client_secret }} --auto-discover-url https://auth.{{ domain }}/.well-known/openid-configuration --scopes "openid profile email" chdir: /opt/services when: gitea_auth_check.rc != 0 changed_when: true # --- Gitea Actions runner setup --- - name: Generate runner registration token ansible.builtin.shell: cmd: docker compose exec -T -u git gitea gitea actions generate-runner-token 2>/dev/null chdir: /opt/services register: runner_token_result changed_when: false when: not runner_token_file.stat.exists - name: Save runner token ansible.builtin.copy: content: "{{ runner_token_result.stdout | trim }}" dest: /opt/services/.runner-token mode: "0600" when: not runner_token_file.stat.exists # Re-template compose with real token and restart runner - name: Set real runner token ansible.builtin.set_fact: gitea_runner_token: "{{ runner_token_result.stdout | trim }}" when: not runner_token_file.stat.exists - name: Re-deploy docker-compose with real runner token ansible.builtin.template: src: docker-compose.yml.j2 dest: /opt/services/docker-compose.yml mode: "0644" when: not runner_token_file.stat.exists - name: Restart runner with real token ansible.builtin.command: cmd: docker compose up -d --remove-orphans chdir: /opt/services when: not runner_token_file.stat.exists changed_when: true