# semaphore

Semaphore UI (https://semaphoreui.com) packaged for InfoMaOS. Web UI and
API for running Ansible, Terraform, OpenTofu, Terragrunt, Bash and
PowerShell tasks.

Binaries are the upstream **community** (fully open source, MIT) release
builds. Download the source tarballs with:

    spectool -g semaphore.spec

## Subpackages

- `semaphore` — common base: `semaphore` user/group (uid/gid 127),
  `/etc/semaphore/config.json`, `/etc/semaphore/env` (secrets generated
  on first install), `/var/lib/semaphore` data directory.
- `semaphore-service` — native binary + `semaphore.service` unit.
  Requires `git` and `ansible`. Conflicts with `semaphore-container`.
- `semaphore-container` — Podman quadlet running
  `docker.io/semaphoreui/semaphore:v<version>` in a pod
  (`semaphore-pod`, web UI published on port 3000). The image bundles
  Ansible, Terraform, OpenTofu and Terragrunt. Conflicts with
  `semaphore-service`.
- `semaphore-postgresql` — optional PostgreSQL backend as a
  `semaphore-db` quadlet container. With `-service` it runs standalone,
  published on `127.0.0.1:5432`; with `-container` it joins the
  semaphore pod. Without it, Semaphore uses SQLite at
  `/var/lib/semaphore/database.sqlite` (zero configuration).

## Database

Default dialect is SQLite (`config.json`). Installing
`semaphore-postgresql` switches the dialect to PostgreSQL via
`SEMAPHORE_DB_*` environment drop-ins:

- service mode: `/etc/systemd/system/semaphore.service.d/database.conf`
- container mode: `/usr/share/containers/systemd/semaphore.container.d/database.conf`

Change the default `semaphore`/`semaphore` credentials in **both** the
relevant `database.conf` and
`/etc/containers/systemd/semaphore-db.container.d/credentials.conf`
before first start.

## First start

```bash
systemctl enable --now semaphore.service   # service mode
systemctl start semaphore.service          # container mode (enabled via pod drop-in)

# Create the initial admin user
semaphore user add --admin --login admin --name Admin \
    --email admin@example.org --password '<password>' \
    --config /etc/semaphore/config.json
```

In container mode `/usr/bin/semaphore` is a shim that runs the CLI
inside the running container.

Session/encryption secrets (`SEMAPHORE_COOKIE_HASH`,
`SEMAPHORE_COOKIE_ENCRYPTION`, `SEMAPHORE_ACCESS_KEY_ENCRYPTION`) are
generated into `/etc/semaphore/env` by the base package `%post` on first
install. Back up this file — `SEMAPHORE_ACCESS_KEY_ENCRYPTION` encrypts
the stored SSH keys and secrets, which are lost if it changes.

## Updating

1. Bump `Version` in the spec and the image tag in
   `semaphore.container`.
2. `spectool -g semaphore.spec`
3. `./build.sh`