Name:           semaphore
Version:        2.19.8
Release:        1%{?dist}
Summary:        Semaphore UI - modern UI for Ansible, Terraform, OpenTofu and other DevOps tools
License:        MIT
Group:          System Environment/Base
URL:            https://semaphoreui.com

# Upstream community (fully open source) release binaries, download with
# spectool -g semaphore.spec
Source0:        https://github.com/semaphoreui/semaphore/releases/download/v%{version}/semaphore_community_%{version}_linux_amd64.tar.gz
Source1:        https://github.com/semaphoreui/semaphore/releases/download/v%{version}/semaphore_community_%{version}_linux_arm64.tar.gz
Source10:       semaphore.service
Source11:       semaphore.sysusers
Source12:       config.json
Source13:       semaphore.env
Source14:       semaphore-shim
Source15:       semaphore.container
Source16:       semaphore.pod
Source17:       semaphore-pod-enable.conf
Source18:       semaphore-database.conf
Source19:       semaphore-container-database.conf
Source20:       semaphore-db.container
Source21:       semaphore-db-pod.conf
Source22:       semaphore-db-publish.conf
Source23:       semaphore-db-credentials.conf

ExclusiveArch:  x86_64 aarch64

BuildRequires:  systemd-rpm-macros

%description
Semaphore UI is a modern web interface and API for running Ansible
playbooks, Terraform, OpenTofu, Terragrunt, Bash and PowerShell tasks
with notifications, access control and audit trail.

%package service
Summary:        Semaphore UI systemd service (native binary)
Requires:       %{name} = %{version}-%{release}
Requires:       git
Requires:       ansible
Conflicts:      %{name}-container
%{?systemd_requires}

%description service
Runs Semaphore UI as a native binary under systemd. Includes the
semaphore binary and systemd unit. Uses the SQLite database by default.

%package container
Summary:        Semaphore UI container (Podman quadlet)
Requires:       %{name} = %{version}-%{release}
Requires:       podman
Requires:       containers-common
Conflicts:      %{name}-service

%description container
Runs Semaphore UI as a Podman container via quadlet. The upstream image
bundles Ansible, Terraform, OpenTofu and Terragrunt.

%package postgresql
Summary:        PostgreSQL database support for Semaphore UI
Requires:       podman
Requires:       containers-common
Requires:       %{name} = %{version}-%{release}

%description postgresql
Provides PostgreSQL database integration for Semaphore UI. When used
with semaphore-service, runs a standalone PostgreSQL container
(semaphore-db) published on the loopback. When used with
semaphore-container, runs the PostgreSQL container in the semaphore pod.

%install
%{__rm} -rf %{buildroot}

# Binary (for -service subpackage) → libexec
install -d -m 755 %{buildroot}%{_libexecdir}
%ifarch x86_64
tar -xzf %{SOURCE0} -C . semaphore
%endif

%ifarch aarch64
tar -xzf %{SOURCE1} -C . semaphore
%endif
install -m 755 semaphore %{buildroot}%{_libexecdir}/semaphore

# Shim (for -container subpackage)
install -m 755 %{SOURCE14} %{buildroot}%{_libexecdir}/semaphore-container

# Base: sysusers, config, env
install -p -D -m 644 %{SOURCE11} %{buildroot}%{_sysusersdir}/semaphore.conf

install -d -m 750 %{buildroot}%{_sysconfdir}/semaphore
install -m 640 %{SOURCE12} %{buildroot}%{_sysconfdir}/semaphore/config.json
install -m 600 %{SOURCE13} %{buildroot}%{_sysconfdir}/semaphore/env

# Base: data dirs
install -d -m 750 %{buildroot}%{_sharedstatedir}/semaphore
install -d -m 750 %{buildroot}%{_sharedstatedir}/semaphore/tmp

# Service subpackage
install -p -D -m 644 %{SOURCE10} %{buildroot}%{_unitdir}/semaphore.service
install -p -D -m 644 %{SOURCE22} %{buildroot}%{_datadir}/containers/systemd/semaphore-db.container.d/publish.conf

# Container subpackage
install -p -D -m 644 %{SOURCE15} %{buildroot}%{_datadir}/containers/systemd/semaphore.container
install -p -D -m 644 %{SOURCE16} %{buildroot}%{_datadir}/containers/systemd/semaphore.pod
install -p -D -m 644 %{SOURCE17} %{buildroot}%{_sysconfdir}/containers/systemd/semaphore.pod.d/enable.conf

# PostgreSQL subpackage
install -d -m 750 %{buildroot}%{_sharedstatedir}/semaphore/postgresql
install -p -D -m 644 %{SOURCE18} %{buildroot}%{_sysconfdir}/systemd/system/semaphore.service.d/database.conf
install -p -D -m 644 %{SOURCE19} %{buildroot}%{_datadir}/containers/systemd/semaphore.container.d/database.conf
install -p -D -m 644 %{SOURCE20} %{buildroot}%{_datadir}/containers/systemd/semaphore-db.container
install -p -D -m 644 %{SOURCE21} %{buildroot}%{_datadir}/containers/systemd/semaphore-db.container.d/pod.conf
install -p -D -m 644 %{SOURCE23} %{buildroot}%{_sysconfdir}/containers/systemd/semaphore-db.container.d/credentials.conf

%pre
%sysusers_create_compat %{SOURCE11}

%post
# Generate session/encryption secrets on first install (empty values only)
for key in SEMAPHORE_COOKIE_HASH SEMAPHORE_COOKIE_ENCRYPTION SEMAPHORE_ACCESS_KEY_ENCRYPTION; do
    if grep -q "^${key}=$" %{_sysconfdir}/semaphore/env 2>/dev/null; then
        secret=$(head -c 32 /dev/urandom | base64 -w0)
        sed -i "s|^${key}=$|${key}=${secret}|" %{_sysconfdir}/semaphore/env
    fi
done

%post service
%systemd_post semaphore.service

%posttrans service
ln -sf %{_libexecdir}/semaphore %{_bindir}/semaphore

%preun service
%systemd_preun semaphore.service

%postun service
%systemd_postun semaphore.service
if [ $1 -eq 0 ]; then
    rm -f %{_bindir}/semaphore
fi

%post container
%systemd_post semaphore.service

%posttrans container
ln -sf %{_libexecdir}/semaphore-container %{_bindir}/semaphore

%preun container
%systemd_preun semaphore.service
if [ $1 -eq 0 ]; then
    rm -f %{_bindir}/semaphore
fi

%postun container
%systemd_postun semaphore.service

%clean
%{__rm} -rf %{buildroot}

%files
%defattr(-,root,root,-)
%{_sysusersdir}/semaphore.conf

%dir %attr(0750,semaphore,semaphore) %{_sysconfdir}/semaphore
%config(noreplace) %attr(0640,semaphore,semaphore) %{_sysconfdir}/semaphore/config.json
%config(noreplace) %attr(0600,root,root) %{_sysconfdir}/semaphore/env

%dir %attr(0750,semaphore,semaphore) %{_sharedstatedir}/semaphore
%dir %attr(0750,semaphore,semaphore) %{_sharedstatedir}/semaphore/tmp

%files service
%defattr(-,root,root,-)
%{_libexecdir}/semaphore
%ghost %{_bindir}/semaphore
%attr(0644,root,root) %{_unitdir}/semaphore.service
%dir %{_datadir}/containers/systemd/semaphore-db.container.d
%{_datadir}/containers/systemd/semaphore-db.container.d/publish.conf

%files container
%defattr(-,root,root,-)
%attr(0755,root,root) %{_libexecdir}/semaphore-container
%ghost %{_bindir}/semaphore
%{_datadir}/containers/systemd/semaphore.container
%{_datadir}/containers/systemd/semaphore.pod
%dir %{_sysconfdir}/containers/systemd/semaphore.pod.d
%config(noreplace) %{_sysconfdir}/containers/systemd/semaphore.pod.d/enable.conf

%files postgresql
%defattr(-,root,root,-)
%dir %attr(0750,semaphore,semaphore) %{_sharedstatedir}/semaphore/postgresql
# For -service: systemd drop-in switching the native service to PostgreSQL
%dir %{_sysconfdir}/systemd/system/semaphore.service.d
%config(noreplace) %{_sysconfdir}/systemd/system/semaphore.service.d/database.conf
# For -container: semaphore-db container + drop-in wiring it to semaphore
%{_datadir}/containers/systemd/semaphore-db.container
%dir %{_datadir}/containers/systemd/semaphore.container.d
%config(noreplace) %{_datadir}/containers/systemd/semaphore.container.d/database.conf
%dir %{_datadir}/containers/systemd/semaphore-db.container.d
%{_datadir}/containers/systemd/semaphore-db.container.d/pod.conf
%dir %{_sysconfdir}/containers/systemd/semaphore-db.container.d
%config(noreplace) %{_sysconfdir}/containers/systemd/semaphore-db.container.d/credentials.conf

%changelog
* Tue Aug 18 2026 Zoran Pericic <zpericic@netst.org> - 2.19.8-1
- Initial package with service, container and postgresql subpackages