# semaphore — SnS deployment playbooks

Ansible playbooks run by [Semaphore](http://192.168.122.99:3000) for deploying
services across SnS hosts. Source of truth is this Gitea repo (`sam/semaphore`);
Semaphore pulls from here.

## Layout
```
ansible.cfg              # ansible defaults (inventory path, ssh opts)
inventory/hosts.yml      # target hosts (racknerd1/2/3), mesh IPs
group_vars/all.yml       # shared non-secret vars
playbooks/
  ping.yml               # connectivity check (run this first)
  deploy-homarr.yml      # Homarr dashboard on racknerd1
requirements.yml         # ansible collections (community.docker)
```

## Semaphore setup (one-time)
1. **Key Store**: add the SSH private key Semaphore uses to reach target hosts.
   Its public half must be in each target's `~/.ssh/authorized_keys`.
2. **Repository**: this repo — `git@gitea.snsnetlabs.com:sam/semaphore.git`
   (SSH deploy key) or HTTPS + Gitea token.
3. **Inventory**: point at `inventory/hosts.yml`.
4. **Environment/Variable Group**: set `homarr_secret_encryption_key`
   = `openssl rand -hex 32` (secret; do NOT commit).
5. **Task Templates**:
   - `ping`      -> playbook `playbooks/ping.yml`
   - `homarr`    -> playbook `playbooks/deploy-homarr.yml`, limit `racknerd1`

## Run order
Run `ping` first to confirm Semaphore can reach the target, then `homarr`.

## Notes
- Targets are reached over the NetBird mesh (Semaphore LXC is on the mesh).
- Secrets live in Semaphore's variable store, never in this repo.