---
- name: "🔍 Resolve {{ application_id }} hosting node + container id"
ansible.builtin.include_tasks: "{{ lookup('path_absolute', 'roles/sys-svc-compose/tasks/utils/swarm/resolve_host_cid.yml') }}"
vars:
resolve_service_key: semaphore
resolve_output_prefix: SEMAPHORE
resolve_compose_cid: "{{ SEMAPHORE_NAME }}"
- name: "⏳ Wait until the Semaphore API/DB is ready"
ansible.builtin.shell: > # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
container exec {{ SEMAPHORE_LOCAL_CID | quote }}
semaphore user list
register: semaphore_user_list
changed_when: false
retries: 30
delay: 5
until: semaphore_user_list.rc == 0
delegate_to: "{{ SEMAPHORE_HOST_NODE }}"
- name: "👤 Ensure the OIDC administrator is an external Semaphore admin"
ansible.builtin.shell: > # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
container exec {{ SEMAPHORE_LOCAL_CID | quote }}
semaphore user add
--admin --external
--login {{ SEMAPHORE_OIDC_ADMIN_LOGIN | quote }}
--name {{ SEMAPHORE_OIDC_ADMIN_NAME | quote }}
--email {{ SEMAPHORE_OIDC_ADMIN_EMAIL | quote }}
delegate_to: "{{ SEMAPHORE_HOST_NODE }}"
register: semaphore_oidc_admin
changed_when: semaphore_oidc_admin.rc == 0
failed_when: >-
semaphore_oidc_admin.rc != 0
and 'duplicate key' not in (semaphore_oidc_admin.stderr | default('') | lower)
and 'exist' not in (semaphore_oidc_admin.stderr | default('') | lower)
and 'exist' not in (semaphore_oidc_admin.stdout | default('') | lower)
when: SEMAPHORE_OIDC_ADMIN_LOGIN not in (semaphore_user_list.stdout_lines | default([]))
