semaphore — SnS deployment playbooks

Ansible playbooks run by Semaphore for deploying services across SnS hosts. Source of truth is this Gitea repo (sam/semaphore); Semaphore pulls from here.

Layout

ansible.cfg              # ansible defaults (inventory path, ssh opts)
inventory/hosts.yml      # target hosts (racknerd1/2/3), mesh IPs
group_vars/all.yml       # shared non-secret vars
playbooks/
  ping.yml               # connectivity check (run this first)
  deploy-homarr.yml      # Homarr dashboard on racknerd1
requirements.yml         # ansible collections (community.docker)

Semaphore setup (one-time)

1. Key Store: add the SSH private key Semaphore uses to reach target hosts. Its public half must be in each target's ~/.ssh/authorized_keys.
2. Repository: this repo — git@gitea.snsnetlabs.com:sam/semaphore.git (SSH deploy key) or HTTPS + Gitea token.
3. Inventory: point at inventory/hosts.yml.
4. Environment/Variable Group: set homarr_secret_encryption_key = openssl rand -hex 32 (secret; do NOT commit).
5. Task Templates:
   • ping -> playbook playbooks/ping.yml
   • homarr -> playbook playbooks/deploy-homarr.yml, limit racknerd1

Run order

Run ping first to confirm Semaphore can reach the target, then homarr.

Notes

• Targets are reached over the NetBird mesh (Semaphore LXC is on the mesh).
• Secrets live in Semaphore's variable store, never in this repo.