158 lines
4.5 KiB
YAML
158 lines
4.5 KiB
YAML
---
|
|
# Create the services directory on the host
|
|
- name: Create services directory
|
|
ansible.builtin.file:
|
|
path: /opt/services
|
|
state: directory
|
|
mode: "0755"
|
|
|
|
# Create a placeholder index page for the static site
|
|
- name: Create www directory
|
|
ansible.builtin.file:
|
|
path: /opt/www
|
|
state: directory
|
|
mode: "0755"
|
|
|
|
- name: Create placeholder index.html
|
|
ansible.builtin.copy:
|
|
dest: /opt/www/index.html
|
|
content: |
|
|
<!DOCTYPE html>
|
|
<html>
|
|
<head><title>Cloud Elves</title></head>
|
|
<body><h1>cloud-elves.eu</h1><p>Coming soon.</p></body>
|
|
</html>
|
|
mode: "0644"
|
|
force: false
|
|
|
|
# Template config files
|
|
- name: Deploy Caddyfile
|
|
ansible.builtin.template:
|
|
src: Caddyfile.j2
|
|
dest: /opt/services/Caddyfile
|
|
mode: "0644"
|
|
register: caddyfile_changed
|
|
|
|
- name: Deploy Dex config
|
|
ansible.builtin.template:
|
|
src: dex-config.yml.j2
|
|
dest: /opt/services/dex-config.yml
|
|
mode: "0644"
|
|
|
|
# Check if we already have a runner token saved
|
|
- name: Check for existing runner token
|
|
ansible.builtin.stat:
|
|
path: /opt/services/.runner-token
|
|
register: runner_token_file
|
|
|
|
# Use a placeholder token for first deploy (runner won't start yet)
|
|
- name: Set runner token from file if exists
|
|
ansible.builtin.slurp:
|
|
src: /opt/services/.runner-token
|
|
register: runner_token_content
|
|
when: runner_token_file.stat.exists
|
|
|
|
- name: Set runner token variable
|
|
ansible.builtin.set_fact:
|
|
gitea_runner_token: "{{ runner_token_content.content | b64decode | trim }}"
|
|
when: runner_token_file.stat.exists
|
|
|
|
- name: Set placeholder runner token for first deploy
|
|
ansible.builtin.set_fact:
|
|
gitea_runner_token: "placeholder"
|
|
when: not runner_token_file.stat.exists
|
|
|
|
# Deploy compose file
|
|
- name: Deploy docker-compose.yml
|
|
ansible.builtin.template:
|
|
src: docker-compose.yml.j2
|
|
dest: /opt/services/docker-compose.yml
|
|
mode: "0644"
|
|
|
|
# Start everything (runner will fail to register with placeholder token — that's OK)
|
|
- name: Start all services
|
|
ansible.builtin.command:
|
|
cmd: docker compose up -d --remove-orphans
|
|
chdir: /opt/services
|
|
changed_when: true
|
|
|
|
# Reload Caddy if Caddyfile changed (zero-downtime)
|
|
- name: Reload Caddy config
|
|
ansible.builtin.command:
|
|
cmd: docker compose exec -T caddy caddy reload --config /etc/caddy/Caddyfile
|
|
chdir: /opt/services
|
|
when: caddyfile_changed.changed
|
|
changed_when: true
|
|
|
|
# Wait for Gitea to be ready
|
|
- name: Wait for Gitea to be ready
|
|
ansible.builtin.command:
|
|
cmd: docker compose exec -T -u git gitea gitea admin user list
|
|
chdir: /opt/services
|
|
register: gitea_ready
|
|
retries: 10
|
|
delay: 5
|
|
until: gitea_ready.rc == 0
|
|
changed_when: false
|
|
|
|
# --- Gitea OIDC setup ---
|
|
|
|
- name: Check if Dex auth source exists in Gitea
|
|
ansible.builtin.shell:
|
|
cmd: docker compose exec -T -u git gitea gitea admin auth list 2>&1 | grep -q dex
|
|
chdir: /opt/services
|
|
register: gitea_auth_check
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: Add Dex OIDC auth source to Gitea
|
|
ansible.builtin.command:
|
|
cmd: >
|
|
docker compose exec -T -u git gitea gitea admin auth add-oauth
|
|
--name dex
|
|
--provider openidConnect
|
|
--key gitea
|
|
--secret {{ dex_gitea_client_secret }}
|
|
--auto-discover-url https://auth.{{ domain }}/.well-known/openid-configuration
|
|
--scopes "openid profile email"
|
|
chdir: /opt/services
|
|
when: gitea_auth_check.rc != 0
|
|
changed_when: true
|
|
|
|
# --- Gitea Actions runner setup ---
|
|
|
|
- name: Generate runner registration token
|
|
ansible.builtin.shell:
|
|
cmd: docker compose exec -T -u git gitea gitea actions generate-runner-token 2>/dev/null
|
|
chdir: /opt/services
|
|
register: runner_token_result
|
|
changed_when: false
|
|
when: not runner_token_file.stat.exists
|
|
|
|
- name: Save runner token
|
|
ansible.builtin.copy:
|
|
content: "{{ runner_token_result.stdout | trim }}"
|
|
dest: /opt/services/.runner-token
|
|
mode: "0600"
|
|
when: not runner_token_file.stat.exists
|
|
|
|
# Re-template compose with real token and restart runner
|
|
- name: Set real runner token
|
|
ansible.builtin.set_fact:
|
|
gitea_runner_token: "{{ runner_token_result.stdout | trim }}"
|
|
when: not runner_token_file.stat.exists
|
|
|
|
- name: Re-deploy docker-compose with real runner token
|
|
ansible.builtin.template:
|
|
src: docker-compose.yml.j2
|
|
dest: /opt/services/docker-compose.yml
|
|
mode: "0644"
|
|
when: not runner_token_file.stat.exists
|
|
|
|
- name: Restart runner with real token
|
|
ansible.builtin.command:
|
|
cmd: docker compose up -d --remove-orphans
|
|
chdir: /opt/services
|
|
when: not runner_token_file.stat.exists
|
|
changed_when: true
|