zpericic
2e971845d8
Semaphore UI packaged from the upstream community (MIT) release binaries, following the gitea packaging pattern: native systemd service and Podman quadlet variants (mutually exclusive), with an optional PostgreSQL backend via quadlet drop-ins. SQLite is the default database; session/encryption secrets are generated into /etc/semaphore/env on first install.
71 lines
2.6 KiB
Markdown
71 lines
2.6 KiB
Markdown
# semaphore
|
|
|
|
Semaphore UI (https://semaphoreui.com) packaged for InfoMaOS. Web UI and
|
|
API for running Ansible, Terraform, OpenTofu, Terragrunt, Bash and
|
|
PowerShell tasks.
|
|
|
|
Binaries are the upstream **community** (fully open source, MIT) release
|
|
builds. Download the source tarballs with:
|
|
|
|
spectool -g semaphore.spec
|
|
|
|
## Subpackages
|
|
|
|
- `semaphore` — common base: `semaphore` user/group (uid/gid 127),
|
|
`/etc/semaphore/config.json`, `/etc/semaphore/env` (secrets generated
|
|
on first install), `/var/lib/semaphore` data directory.
|
|
- `semaphore-service` — native binary + `semaphore.service` unit.
|
|
Requires `git` and `ansible`. Conflicts with `semaphore-container`.
|
|
- `semaphore-container` — Podman quadlet running
|
|
`docker.io/semaphoreui/semaphore:v<version>` in a pod
|
|
(`semaphore-pod`, web UI published on port 3000). The image bundles
|
|
Ansible, Terraform, OpenTofu and Terragrunt. Conflicts with
|
|
`semaphore-service`.
|
|
- `semaphore-postgresql` — optional PostgreSQL backend as a
|
|
`semaphore-db` quadlet container. With `-service` it runs standalone,
|
|
published on `127.0.0.1:5432`; with `-container` it joins the
|
|
semaphore pod. Without it, Semaphore uses SQLite at
|
|
`/var/lib/semaphore/database.sqlite` (zero configuration).
|
|
|
|
## Database
|
|
|
|
Default dialect is SQLite (`config.json`). Installing
|
|
`semaphore-postgresql` switches the dialect to PostgreSQL via
|
|
`SEMAPHORE_DB_*` environment drop-ins:
|
|
|
|
- service mode: `/etc/systemd/system/semaphore.service.d/database.conf`
|
|
- container mode: `/usr/share/containers/systemd/semaphore.container.d/database.conf`
|
|
|
|
Change the default `semaphore`/`semaphore` credentials in **both** the
|
|
relevant `database.conf` and
|
|
`/etc/containers/systemd/semaphore-db.container.d/credentials.conf`
|
|
before first start.
|
|
|
|
## First start
|
|
|
|
```bash
|
|
systemctl enable --now semaphore.service # service mode
|
|
systemctl start semaphore.service # container mode (enabled via pod drop-in)
|
|
|
|
# Create the initial admin user
|
|
semaphore user add --admin --login admin --name Admin \
|
|
--email admin@example.org --password '<password>' \
|
|
--config /etc/semaphore/config.json
|
|
```
|
|
|
|
In container mode `/usr/bin/semaphore` is a shim that runs the CLI
|
|
inside the running container.
|
|
|
|
Session/encryption secrets (`SEMAPHORE_COOKIE_HASH`,
|
|
`SEMAPHORE_COOKIE_ENCRYPTION`, `SEMAPHORE_ACCESS_KEY_ENCRYPTION`) are
|
|
generated into `/etc/semaphore/env` by the base package `%post` on first
|
|
install. Back up this file — `SEMAPHORE_ACCESS_KEY_ENCRYPTION` encrypts
|
|
the stored SSH keys and secrets, which are lost if it changes.
|
|
|
|
## Updating
|
|
|
|
1. Bump `Version` in the spec and the image tag in
|
|
`semaphore.container`.
|
|
2. `spectool -g semaphore.spec`
|
|
3. `./build.sh`
|