Set-OPS/roles/serveurs_forgejo/tasks/main.yml

---
- name: Exiger les secrets Forgejo (Vault)
  ansible.builtin.assert:
    that:
      - serveurs_forgejo_secret_key | length > 0
      - serveurs_forgejo_internal_token | length > 0
      - serveurs_forgejo_admin_password | length > 0
    fail_msg: "secret_key, internal_token et admin_password sont requis (Ansible Vault)."

- name: Charger le registre des bases applicatives
  ansible.builtin.include_vars:
    file: "{{ role_path }}/../../docs/bases-donnees.yml"

- name: Resoudre l'entree de base Forgejo
  ansible.builtin.set_fact:
    serveurs_forgejo_entree: "{{ (bases_donnees | default({}))[serveurs_forgejo_db_cle] | default({}) }}"

- name: Exiger l'entree de registre et son secret
  ansible.builtin.assert:
    that:
      - serveurs_forgejo_entree.base is defined
      - serveurs_forgejo_entree.secret is defined
    fail_msg: "Entree '{{ serveurs_forgejo_db_cle }}' absente de docs/bases-donnees.yml."

- name: Resoudre le mot de passe de base (Vault)
  ansible.builtin.set_fact:
    serveurs_forgejo_db_password: "{{ lookup('vars', serveurs_forgejo_entree.secret) }}"
  no_log: true

- name: Creer l'utilisateur systeme git
  ansible.builtin.user:
    name: "{{ serveurs_forgejo_utilisateur }}"
    system: true
    shell: /bin/bash
    home: "/home/{{ serveurs_forgejo_utilisateur }}"
    create_home: true
    comment: "Git Version Control"

- name: Telecharger le binaire Forgejo
  ansible.builtin.get_url:
    url: "{{ serveurs_forgejo_url }}"
    dest: "/usr/local/bin/forgejo-{{ serveurs_forgejo_version }}"
    owner: root
    group: root
    mode: "0755"

- name: Activer la version courante du binaire
  ansible.builtin.file:
    src: "/usr/local/bin/forgejo-{{ serveurs_forgejo_version }}"
    dest: "{{ serveurs_forgejo_binaire }}"
    state: link
  notify: Redemarrer forgejo

- name: Creer les repertoires de donnees
  ansible.builtin.file:
    path: "{{ serveurs_forgejo_data }}/{{ item }}"
    state: directory
    owner: "{{ serveurs_forgejo_utilisateur }}"
    group: "{{ serveurs_forgejo_utilisateur }}"
    mode: "0750"
  loop:
    - ""
    - custom
    - data
    - log

- name: Creer le repertoire de configuration
  ansible.builtin.file:
    path: "{{ serveurs_forgejo_config_dir }}"
    state: directory
    owner: root
    group: "{{ serveurs_forgejo_utilisateur }}"
    mode: "0770"

- name: Deployer app.ini
  ansible.builtin.template:
    src: app.ini.j2
    dest: "{{ serveurs_forgejo_config }}"
    owner: root
    group: "{{ serveurs_forgejo_utilisateur }}"
    mode: "0640"
  no_log: true
  notify: Redemarrer forgejo

- name: Deployer l'unite systemd forgejo
  ansible.builtin.template:
    src: forgejo.service.j2
    dest: /etc/systemd/system/forgejo.service
    owner: root
    group: root
    mode: "0644"
  notify: Redemarrer forgejo

- name: Activer et demarrer Forgejo
  ansible.builtin.systemd:
    name: "{{ serveurs_forgejo_service }}"
    enabled: true
    state: started
    daemon_reload: true

- name: Creer le compte administrateur (une fois)
  ansible.builtin.shell:
    cmd: >-
      {{ serveurs_forgejo_binaire }} admin user create
      --admin --username {{ serveurs_forgejo_admin_user }}
      --email {{ serveurs_forgejo_admin_email }}
      --password '{{ serveurs_forgejo_admin_password }}'
      --config {{ serveurs_forgejo_config }}
      && touch {{ serveurs_forgejo_data }}/.admin-created
    creates: "{{ serveurs_forgejo_data }}/.admin-created"
  become: true
  become_user: "{{ serveurs_forgejo_utilisateur }}"
  environment:
    GITEA_WORK_DIR: "{{ serveurs_forgejo_data }}"
  no_log: true