@yunuseon/kayra 0.0.0-stage → 0.4.0

package/ansible/roles/forgejo-config/tasks/main.yml

@@ -0,0 +1,292 @@
+---
+# =============================================================================
+# forgejo-config role — what a Forgejo holds beyond its own config file, as
+# code: users and their SSH keys, Actions runners, repos (created empty
+# where missing) and their settings (issues, pull requests, actions), Actions
+# secrets, collaborators, webhooks and push mirrors, from
+# forgejo_config in the server's vars.yml. Adds what is missing through the
+# API, adopts what already matches, never deletes. Talks to Forgejo on the
+# server itself (forgejo_config.url) with forgejo_admin_token, and mints the
+# tokens the platform's own services use there (forgejo_config.tokens).
+# =============================================================================
+
+- name: Wait for Forgejo's API
+  ansible.builtin.uri:
+    url: "{{ forgejo_config.url }}/api/v1/version"
+  register: forgejo_version
+  until: forgejo_version.status == 200
+  retries: 30
+  delay: 2
+
+- name: Look up users
+  ansible.builtin.uri:
+    url: "{{ forgejo_config.url }}/api/v1/users/{{ item.name }}"
+    headers: {Authorization: "token {{ forgejo_admin_token }}"}
+    status_code: [200, 404]
+  register: forgejo_users
+  loop: "{{ forgejo_config.users | default([]) }}"
+  loop_control: {label: "{{ item.name }}"}
+  no_log: true
+
+# Random password, never stored: these users work with tokens.
+- name: Create missing users
+  ansible.builtin.uri:
+    url: "{{ forgejo_config.url }}/api/v1/admin/users"
+    method: POST
+    headers: {Authorization: "token {{ forgejo_admin_token }}"}
+    body_format: json
+    body:
+      username: "{{ item.name }}"
+      email: "{{ item.email }}"
+      password: "{{ lookup('ansible.builtin.password', '/dev/null', length=32) }}"
+      must_change_password: false
+    status_code: [201]
+  changed_when: true
+  loop: "{{ forgejo_users.results | selectattr('status', 'eq', 404) | map(attribute='item') | list }}"
+  loop_control: {label: "{{ item.name }}"}
+  no_log: true
+
+- name: Look up SSH keys
+  ansible.builtin.uri:
+    url: "{{ forgejo_config.url }}/api/v1/users/{{ item.user }}/keys"
+    headers: {Authorization: "token {{ forgejo_admin_token }}"}
+  register: forgejo_keys
+  loop: "{{ forgejo_config.ssh_keys | default([]) }}"
+  loop_control: {label: "{{ item.user }} {{ item.title }}"}
+  no_log: true
+
+# Matched by type and key, whatever title or comment either side carries.
+- name: Add missing SSH keys
+  ansible.builtin.uri:
+    url: "{{ forgejo_config.url }}/api/v1/admin/users/{{ item.item.user }}/keys"
+    method: POST
+    headers: {Authorization: "token {{ forgejo_admin_token }}"}
+    body_format: json
+    body: {title: "{{ item.item.title }}", key: "{{ item.item.key }}", read_only: false}
+    status_code: [201]
+  changed_when: true
+  when: >-
+    (item.item.key.split()[:2] | join(' ')) not in
+    (item.json | map(attribute='key') | map('split') | map('batch', 2) | map('first') | map('join', ' ') | list)
+  loop: "{{ forgejo_keys.results }}"
+  loop_control: {label: "{{ item.item.user }} {{ item.item.title }}"}
+  no_log: true
+
+# Idempotent with the same secret; the runner side registers itself with it.
+# --keep-labels: the runner declares its labels when it starts, and a
+# register without it replaces them with none, so no job finds a runner
+# until the runner restarts.
+- name: Register runners
+  ansible.builtin.command:
+    argv: [docker, exec, -i, "{{ forgejo_config.container }}", forgejo, forgejo-cli, actions, register,
+           --secret-file, /dev/stdin, --name, "{{ item.name }}", --scope, "{{ item.scope }}", --keep-labels]
+    stdin: "{{ forgejo_runner_secrets[item.name] }}"
+    # Exactly 40 characters: a trailing newline would be a 41st.
+    stdin_add_newline: false
+  changed_when: false
+  loop: "{{ forgejo_config.runners | default([]) }}"
+  loop_control: {label: "{{ item.name }}"}
+  no_log: true
+
+- name: Look up repos
+  ansible.builtin.uri:
+    url: "{{ forgejo_config.url }}/api/v1/repos/{{ item.name }}"
+    headers: {Authorization: "token {{ forgejo_admin_token }}"}
+    status_code: [200, 404]
+  register: forgejo_repos
+  loop: "{{ forgejo_config.repos }}"
+  loop_control: {label: "{{ item.name }}"}
+  no_log: true
+
+# Empty, and private from the start where its settings say so (the settings
+# are applied below too, but a public repo, even for a moment, is published);
+# the content is pushed by hand.
+- name: Create missing repos
+  ansible.builtin.uri:
+    url: "{{ forgejo_config.url }}/api/v1/admin/users/{{ item.name.split('/')[0] }}/repos"
+    method: POST
+    headers: {Authorization: "token {{ forgejo_admin_token }}"}
+    body_format: json
+    body:
+      name: "{{ item.name.split('/')[1] }}"
+      private: "{{ item.settings.private | default(false) }}"
+    status_code: [201]
+  changed_when: true
+  loop: "{{ forgejo_repos.results | selectattr('status', 'eq', 404) | map(attribute='item') | list }}"
+  loop_control: {label: "{{ item.name }}"}
+  no_log: true
+
+- name: Look up collaborator permissions
+  ansible.builtin.uri:
+    url: "{{ forgejo_config.url }}/api/v1/repos/{{ item.0.name }}/collaborators/{{ item.1.user }}/permission"
+    headers: {Authorization: "token {{ forgejo_admin_token }}"}
+    status_code: [200, 403, 404]
+  register: forgejo_permissions
+  loop: "{{ forgejo_config.repos | subelements('collaborators', skip_missing=True) }}"
+  loop_control: {label: "{{ item.0.name }} {{ item.1.user }}"}
+  no_log: true
+
+- name: Grant collaborators their permission
+  ansible.builtin.uri:
+    url: "{{ forgejo_config.url }}/api/v1/repos/{{ item.item.0.name }}/collaborators/{{ item.item.1.user }}"
+    method: PUT
+    headers: {Authorization: "token {{ forgejo_admin_token }}"}
+    body_format: json
+    body: {permission: "{{ item.item.1.permission }}"}
+    status_code: [204]
+  changed_when: true
+  when: item.status != 200 or item.json.permission != item.item.1.permission
+  loop: "{{ forgejo_permissions.results }}"
+  loop_control: {label: "{{ item.item.0.name }} {{ item.item.1.user }}"}
+  no_log: true
+
+# A converted mirror keeps issues and pull requests off.
+- name: Apply repo settings
+  ansible.builtin.uri:
+    url: "{{ forgejo_config.url }}/api/v1/repos/{{ item.item.name }}"
+    method: PATCH
+    headers: {Authorization: "token {{ forgejo_admin_token }}"}
+    body_format: json
+    body: "{{ item.item.settings }}"
+  changed_when: true
+  # Differs if laying the wanted settings over the repo changes anything.
+  when: item.json | combine(item.item.settings) != item.json
+  loop: "{{ forgejo_repos.results | selectattr('item.settings', 'defined') | list }}"
+  loop_control: {label: "{{ item.item.name }}"}
+  no_log: true
+
+# Write-only in Forgejo, so no comparing: the same value every run.
+- name: Set Actions secrets
+  ansible.builtin.uri:
+    url: "{{ forgejo_config.url }}/api/v1/repos/{{ item.repo }}/actions/secrets/{{ item.name }}"
+    method: PUT
+    headers: {Authorization: "token {{ forgejo_admin_token }}"}
+    body_format: json
+    body: {data: "{{ item.value }}"}
+    status_code: [201, 204]
+  changed_when: false
+  loop: "{{ forgejo_action_secrets | default([]) }}"
+  loop_control: {label: "{{ item.repo }} {{ item.name }}"}
+  no_log: true
+
+- name: Look up webhooks and push mirrors
+  ansible.builtin.uri:
+    url: "{{ forgejo_config.url }}/api/v1/repos/{{ item.0.name }}/{{ item.1 }}"
+    headers: {Authorization: "token {{ forgejo_admin_token }}"}
+  register: forgejo_existing
+  loop: "{{ forgejo_config.repos | product(['hooks', 'push_mirrors']) | list }}"
+  loop_control: {label: "{{ item.0.name }} {{ item.1 }}"}
+  no_log: true
+
+# A push to any branch calls the URL (with notifyCommit: Jenkins polls).
+- name: Add missing webhooks
+  ansible.builtin.uri:
+    url: "{{ forgejo_config.url }}/api/v1/repos/{{ item.0.name }}/hooks"
+    method: POST
+    headers: {Authorization: "token {{ forgejo_admin_token }}"}
+    body_format: json
+    body:
+      type: forgejo
+      active: true
+      events: [push]
+      branch_filter: "*"
+      config: {url: "{{ item.1 }}", content_type: json, http_method: post}
+    status_code: [201]
+  changed_when: true
+  when: >-
+    item.1 not in (forgejo_existing.results
+      | selectattr('item.0.name', 'eq', item.0.name) | selectattr('item.1', 'eq', 'hooks')
+      | first).json | map(attribute='config.url') | list
+  loop: "{{ forgejo_config.repos | subelements('webhooks', skip_missing=True) }}"
+  loop_control: {label: "{{ item.0.name }} {{ item.1 }}"}
+  no_log: true
+
+- name: Add missing push mirrors
+  ansible.builtin.uri:
+    url: "{{ forgejo_config.url }}/api/v1/repos/{{ item.name }}/push_mirrors"
+    method: POST
+    headers: {Authorization: "token {{ forgejo_admin_token }}"}
+    body_format: json
+    body:
+      remote_address: "{{ item.push_mirror }}"
+      remote_username: "{{ forgejo_push_mirror_credentials.username }}"
+      remote_password: "{{ forgejo_push_mirror_credentials.password }}"
+      sync_on_commit: true
+      interval: 8h0m0s
+    status_code: [200, 201]
+  changed_when: true
+  register: forgejo_new_mirrors
+  when: >-
+    item.push_mirror is defined and item.push_mirror not in (forgejo_existing.results
+      | selectattr('item.0.name', 'eq', item.name) | selectattr('item.1', 'eq', 'push_mirrors')
+      | first).json | map(attribute='remote_address') | list
+  loop: "{{ forgejo_config.repos }}"
+  loop_control: {label: "{{ item.name }}"}
+  no_log: true
+
+# A new push mirror would wait for the next push or its interval.
+- name: Sync new push mirrors once
+  ansible.builtin.uri:
+    url: "{{ forgejo_config.url }}/api/v1/repos/{{ item.item.name }}/push_mirrors-sync"
+    method: POST
+    headers: {Authorization: "token {{ forgejo_admin_token }}"}
+  changed_when: true
+  when: item is changed
+  loop: "{{ forgejo_new_mirrors.results }}"
+  loop_control: {label: "{{ item.item.name }}"}
+  no_log: true
+
+# Tokens for the platform's services on this server (Jenkins, Renovate), into
+# the files the platform role would otherwise fill from the vault. Nobody ever
+# sees one: kept only in that file, minted again when it is missing, wrong or
+# revoked. Unique names, since the admin token cannot delete a user's tokens.
+- name: Read service tokens
+  ansible.builtin.slurp:
+    src: "{{ platform_dir }}/platform-secrets/{{ item.secret }}"
+  register: service_token_files
+  loop: "{{ forgejo_config.tokens | default([]) }}"
+  loop_control: {label: "{{ item.secret }}"}
+  become: true
+  no_log: true
+
+- name: Check service tokens
+  ansible.builtin.uri:
+    url: "{{ forgejo_config.url }}/api/v1/user"
+    headers: {Authorization: "token {{ item.content | b64decode | trim }}"}
+    status_code: [200, 400, 401, 403]
+  register: service_token_checks
+  loop: "{{ service_token_files.results }}"
+  loop_control: {label: "{{ item.item.secret }}"}
+  no_log: true
+
+- name: Mint service tokens
+  ansible.builtin.command:
+    argv: [docker, exec, "{{ forgejo_config.container }}", forgejo, admin, user, generate-access-token,
+           --username, "{{ item.item.item.user }}",
+           --token-name, "{{ item.item.item.name }}-{{ now(utc=true, fmt='%Y%m%d%H%M') }}",
+           --scopes, "{{ (item.item.item.scopes + ['read:user']) | unique | join(',') }}", --raw]
+  register: service_tokens_minted
+  changed_when: true
+  when: item.status != 200 or item.json.login != item.item.item.user
+  loop: "{{ service_token_checks.results }}"
+  loop_control: {label: "{{ item.item.item.secret }}"}
+  no_log: true
+
+- name: Store service tokens
+  ansible.builtin.copy:
+    content: "{{ item.stdout | trim }}"
+    dest: "{{ platform_dir }}/platform-secrets/{{ item.item.item.item.secret }}"
+    owner: "1000"
+    group: "1000"
+    mode: "0400"
+  when: item is changed
+  loop: "{{ service_tokens_minted.results }}"
+  loop_control: {label: "{{ item.item.item.item.secret }}"}
+  become: true
+  no_log: true
+
+- name: Reload JCasC with the new tokens
+  ansible.builtin.command: "{{ platform_dir }}/bin/jenkins-reload"
+  when: service_tokens_minted is changed
+  become: true
+  changed_when: true

package/ansible/roles/platform/defaults/main.yml

@@ -0,0 +1,76 @@
+---
+# =============================================================================
+# Default variables for the platform role
+# App-agnostic: only knows about infrastructure concerns
+# =============================================================================
+# The server-side contract apps rely on: they drop files into platform_dir and
+# live under apps_dir/<name>. Changing either means changing every app.
+platform_dir: /opt/platform
+apps_dir: /opt/apps
+# The ref of git_remote_url (kayra's repo) Jenkins loads the pipeline library
+# and platform jobs from: the tag of the release the operator ran
+# (kayra_version, passed by kayra), so the Mac and the server run the same
+# kayra. Only a test server sets a branch here instead.
+platform_ref: "v{{ kayra_version }}"
+domain: localhost
+# The engine's files (compose files, scripts) lie above the playbooks, wherever
+# the fleet it serves is; the fleet's (servers/, .cache/) above the server's
+# folder.
+kayra_root: "{{ playbook_dir }}/../.."
+fleet_root: "{{ server_dir }}/../.."
+
+# Certificates by DNS-01 instead of HTTP-01, for a server the internet never
+# reaches (target home): "hetzner" (the only provider so far), with
+# acme_dns_token, a token of the Hetzner project holding the zone. Traefik then
+# gets a certificate per hostname that way (each router names its resolver,
+# so an entrypoint wildcard would go unused), and no mkcert cert is used.
+acme_dns: ""
+acme_dns_token: ""
+
+# Jenkins
+jenkins_admin_user: admin
+jenkins_admin_password: admin
+
+# Git
+git_remote_url: ""
+git_token: ""
+
+# owner/repo of the repos this server's platform-renovate keeps up to date
+# (weekly version-bump PRs); the job exists only where the list is not empty.
+# renovate_token is a PAT reaching each of them: Contents, Pull requests and
+# Issues (the dependency dashboard) read & write. On a server whose own
+# Forgejo hosts them, forgejo_config.tokens mints it (and git_token) instead.
+renovate_repositories: []
+renovate_token: ""
+# When platform-renovate runs, as a Jenkins cron spec: weekly suits other
+# people's releases; a server whose repos carry the operator's own images
+# runs it more often, so a new build reaches a PR soon after it is pushed.
+renovate_schedule: "H 4 * * 1"
+# Where those repos live: github, or forgejo with renovate_endpoint, its API
+# on platform-internal (http://forgejo:3000/api/v1). With a Forgejo, also
+# renovate_git_url: endpoint, so Renovate clones over that address and not the
+# public one the API reports, and a renovate_host_rules entry allowing it as
+# an internal host.
+renovate_platform: github
+renovate_endpoint: ""
+renovate_git_url: ""
+renovate_host_rules: []
+# Off GitHub, Renovate still looks versions up there (github-releases,
+# github-tags) and refuses to without a token: a fine-grained one with
+# public-repository read access only, no other permissions.
+renovate_github_com_token: ""
+
+# --- Authelia ---------------------------------------------------------------
+# Secrets are per server and belong in servers/<server>/vars.yml (vault for prod).
+authelia_session_secret: ""
+authelia_storage_encryption_key: ""
+# Leave the address empty to fall the notifier back to a file, which is what
+# dev does. Passkey enrolment needs real SMTP; see the runbook.
+authelia_smtp_address: ""
+authelia_smtp_username: ""
+authelia_smtp_sender: ""
+authelia_smtp_password: ""
+authelia_users: {}
+
+# two_factor or one_factor. Lower it per environment, never here.
+authelia_policy: "two_factor"

package/ansible/roles/platform/tasks/main.yml

@@ -0,0 +1,298 @@
+---
+# =============================================================================
+# Platform role — Traefik, Authelia, Registry, BuildKit and Jenkins as compose
+# project "platform" in {{ platform_dir }}. App-agnostic.
+#
+# {{ platform_dir }}/.env sets COMPOSE_FILE, so on the server every compose
+# command is just `docker compose ...` run in {{ platform_dir }}.
+# =============================================================================
+
+- name: Check Renovate has a token
+  ansible.builtin.assert:
+    that: renovate_token | length > 0 or 'RENOVATE_TOKEN' in (forgejo_config.tokens | default([]) | map(attribute='secret'))
+    fail_msg: renovate_repositories is set, so renovate_token must be set in servers/{{ server }}/secrets.yml
+  when: renovate_repositories | length > 0
+
+- name: Create platform directories
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: deploy
+    group: deploy
+    mode: "0755"
+  loop:
+    - "{{ apps_dir }}"
+    - "{{ platform_dir }}"
+    - "{{ platform_dir }}/traefik/dynamic"
+    - "{{ platform_dir }}/traefik/certs"
+    - "{{ platform_dir }}/authelia/secrets"
+  become: true
+
+# Written by bin/jenkins-app-apply as root and chowned per app to the
+# controller's uid, so the directory itself stays root's.
+- name: Create Jenkins app secrets directory
+  ansible.builtin.file:
+    path: "{{ platform_dir }}/jenkins-secrets"
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  become: true
+
+# buildkit/ matters more than it looks: without buildkitd.toml the bind mount
+# has no source, Docker creates a directory in its place, and buildkitd
+# crash-loops until the container is recreated.
+- name: Copy platform files
+  ansible.builtin.copy:
+    src: "{{ kayra_root }}/compose/{{ item }}"
+    dest: "{{ platform_dir }}/{{ item }}"
+    owner: deploy
+    group: deploy
+    mode: "0644"
+  loop:
+    - docker-compose.yml
+    - docker-compose.ci.yml
+    - docker-compose.acme-dns.yml
+    - traefik/dynamic/
+    - authelia/configuration.yml
+    - jenkins/
+    - jenkins-agent/
+    - buildkit/
+  become: true
+  register: platform_files
+
+# Apps register with Jenkins through these, never by touching the controller.
+- name: Install platform scripts
+  ansible.builtin.copy:
+    src: "{{ kayra_root }}/scripts/server/"
+    dest: "{{ platform_dir }}/bin/"
+    owner: root
+    group: root
+    mode: "0755"
+  become: true
+
+- name: Render Traefik static config
+  ansible.builtin.copy:
+    content: "{{ (traefik_static_dns if acme_dns else traefik_static) ~ '\n' }}"
+    dest: "{{ platform_dir }}/traefik/traefik.yml"
+    owner: deploy
+    group: deploy
+    mode: "0644"
+  vars:
+    # Traefik does not expand env vars in its static file.
+    traefik_static: "{{ lookup('file', kayra_root ~ '/compose/traefik/traefik.yml') | regex_replace('(?m)^(\\s+email:).*$', '\\1 \"' ~ acme_email ~ '\"') }}"
+    # DNS-01: the challenge instead of HTTP-01, checked with public resolvers
+    # (a home server's own DNS may answer its zone itself), a minute after the
+    # record is set: Hetzner's three nameservers take that long to agree, and
+    # Let's Encrypt asks more than one.
+    traefik_static_dns: >-
+      {{ traefik_static | from_yaml
+         | combine({'certificatesResolvers': {'le': {'acme': {
+             'email': acme_email, 'storage': '/acme/acme.json',
+             'dnsChallenge': {'provider': acme_dns, 'resolvers': ['8.8.8.8:53', '9.9.9.9:53'],
+                              'propagation': {'delayBeforeChecks': '60s'}}}}}})
+         | to_nice_yaml(indent=2) }}
+  become: true
+  register: traefik_static_config
+
+# Vault values rendered to files rather than .env lines, which Authelia reads
+# via *_FILE. Authelia never writes the user database back — password change
+# and reset are disabled — so rendering it every run is safe.
+- name: Render Authelia user database
+  ansible.builtin.template:
+    src: authelia-users.yml.j2
+    dest: "{{ platform_dir }}/authelia/users_database.yml"
+    owner: deploy
+    group: deploy
+    mode: "0600"
+  become: true
+
+- name: Render Authelia secrets
+  ansible.builtin.copy:
+    content: "{{ item.value }}"
+    dest: "{{ platform_dir }}/authelia/secrets/{{ item.name }}"
+    owner: deploy
+    group: deploy
+    mode: "0600"
+  loop:
+    - { name: session, value: "{{ authelia_session_secret }}" }
+    - { name: storage_encryption, value: "{{ authelia_storage_encryption_key }}" }
+    - { name: smtp_password, value: "{{ authelia_smtp_password }}" }
+  loop_control:
+    label: "{{ item.name }}"
+  when: item.name != 'smtp_password' or authelia_smtp_address | length > 0
+  no_log: true
+  become: true
+
+# Servers not on the internet (multipass, home) without acme_dns. Elsewhere
+# Traefik's ACME resolver issues the certs, and it skips ACME for any hostname
+# a file-provided cert already covers — a stray mkcert cert would be served
+# as-is, hence removed below.
+- name: Copy mkcert TLS cert + key
+  ansible.builtin.copy:
+    src: "{{ fleet_root }}/.cache/certs/{{ item.name }}"
+    dest: "{{ platform_dir }}/traefik/certs/{{ item.name }}"
+    owner: deploy
+    group: deploy
+    mode: "{{ item.mode }}"
+  loop:
+    - { name: cert.pem, mode: "0644" }
+    - { name: key.pem, mode: "0600" }
+  when: target != 'hetzner' and not acme_dns
+  become: true
+
+- name: Remove a mkcert cert where DNS-01 issues them
+  ansible.builtin.file:
+    path: "{{ platform_dir }}/traefik/certs/{{ item }}"
+    state: absent
+  loop: [cert.pem, key.pem]
+  when: acme_dns | length > 0
+  become: true
+
+# Read by lego through HETZNER_API_TOKEN_FILE (docker-compose.acme-dns.yml).
+- name: Create the DNS-01 token directory
+  ansible.builtin.file:
+    path: "{{ platform_dir }}/traefik/secrets"
+    state: directory
+    owner: root
+    group: root
+    mode: "0700"
+  when: acme_dns | length > 0
+  become: true
+
+- name: Render the DNS-01 token
+  ansible.builtin.copy:
+    content: "{{ acme_dns_token }}"
+    dest: "{{ platform_dir }}/traefik/secrets/acme-dns-token"
+    owner: root
+    group: root
+    mode: "0600"
+  when: acme_dns | length > 0
+  no_log: true
+  become: true
+
+- name: Look up the docker group
+  ansible.builtin.getent:
+    database: group
+    key: docker
+
+# Read by the controller as uid 1000. An empty var leaves the file as it is:
+# on a server whose Forgejo mints them (forgejo_config.tokens), that role
+# writes them.
+- name: Create platform secrets directory
+  ansible.builtin.file:
+    path: "{{ platform_dir }}/platform-secrets"
+    state: directory
+    owner: "1000"
+    group: "1000"
+    mode: "0500"
+  become: true
+
+- name: Render platform tokens
+  ansible.builtin.copy:
+    content: "{{ item.value }}"
+    dest: "{{ platform_dir }}/platform-secrets/{{ item.name }}"
+    owner: "1000"
+    group: "1000"
+    mode: "0400"
+    force: "{{ item.value | length > 0 }}"
+  loop:
+    - {name: GIT_TOKEN, value: "{{ git_token }}"}
+    - {name: RENOVATE_TOKEN, value: "{{ renovate_token }}"}
+  loop_control:
+    label: "{{ item.name }}"
+  no_log: true
+  become: true
+  register: platform_tokens
+
+- name: Render platform .env
+  ansible.builtin.template:
+    src: platform.env.j2
+    dest: "{{ platform_dir }}/.env"
+    owner: deploy
+    group: deploy
+    mode: "0600"
+  become: true
+
+# The registry used to have a public, basic-auth router. Nothing outside the
+# server pushes or pulls, so it is gone; the copy above never deletes files.
+- name: Remove the retired registry basic auth
+  ansible.builtin.file:
+    path: "{{ platform_dir }}/traefik/dynamic/{{ item }}"
+    state: absent
+  loop: [registry-auth.yml, registry-htpasswd]
+  become: true
+
+# ---------------------------------------------------------------------------
+# Start. `up` recreates any container whose interpolated config changed, so
+# a changed .env needs nothing extra.
+# ---------------------------------------------------------------------------
+- name: Pull platform images
+  community.docker.docker_compose_v2_pull:
+    project_src: "{{ platform_dir }}"
+    ignore_buildable: true
+
+- name: Start platform
+  community.docker.docker_compose_v2:
+    project_src: "{{ platform_dir }}"
+    build: always
+
+# Only dynamic/ is watched; the static file is read once at startup.
+- name: Restart Traefik when its static config changed
+  ansible.builtin.command: docker compose restart traefik
+  args:
+    chdir: "{{ platform_dir }}"
+  when: traefik_static_config is changed
+  changed_when: true
+
+# Inside the controller, not through Traefik: jenkins.<domain> sits behind
+# Authelia, which would answer every call here with a login redirect.
+- name: Wait for Jenkins
+  ansible.builtin.command: docker compose exec -T jenkins-controller curl -sf -o /dev/null http://127.0.0.1:8080/login
+  args:
+    chdir: "{{ platform_dir }}"
+  register: jenkins_health
+  retries: 30
+  delay: 10
+  until: jenkins_health.rc == 0
+  changed_when: false
+
+# casc/ is a bind mount, so a changed 00-platform.yaml only takes effect on
+# a reload; so do new tokens, read from files by ${readFile:…}.
+- name: Reload JCasC
+  ansible.builtin.command: "{{ platform_dir }}/bin/jenkins-reload"
+  when: >-
+    platform_files.results | selectattr('item', 'equalto', 'jenkins/') | selectattr('changed') | list | length > 0
+    or platform_tokens is changed
+  become: true
+  changed_when: true
+
+# ---------------------------------------------------------------------------
+# Agent secret. Fetched every run and kept in its own file: it is derived
+# from Jenkins' own state, so it has no var source, and re-rendering .env must
+# never be able to blank it. Refetching also heals a reset jenkins_home.
+# ---------------------------------------------------------------------------
+- name: Fetch Jenkins agent secret
+  ansible.builtin.command: "{{ platform_dir }}/bin/jenkins-api GET /computer/builder/jenkins-agent.jnlp"
+  register: agent_jnlp
+  no_log: true
+  changed_when: false
+  check_mode: false
+
+- name: Write Jenkins agent secret
+  ansible.builtin.copy:
+    content: "JENKINS_SECRET={{ agent_jnlp.stdout | regex_findall('<argument>([a-f0-9]{64})</argument>') | first }}\n"
+    dest: "{{ platform_dir }}/jenkins-agent.env"
+    owner: deploy
+    group: deploy
+    mode: "0600"
+  no_log: true
+  become: true
+  register: agent_secret
+
+- name: Recreate Jenkins agent with its secret
+  ansible.builtin.command: docker compose up -d --no-deps --force-recreate jenkins-agent
+  args:
+    chdir: "{{ platform_dir }}"
+  when: agent_secret is changed
+  changed_when: true

package/ansible/roles/platform/templates/authelia-users.yml.j2

@@ -0,0 +1,17 @@
+# =============================================================================
+# Authelia user database — rendered by Ansible from authelia_users.
+# Do not edit on the server: this file is regenerated on every platform run.
+#
+# Password hashes are argon2id, generated with:
+#   docker run --rm authelia/authelia:4.39 authelia crypto hash generate argon2 \
+#     --variant argon2id --iterations 3 --memory 32768 --parallelism 2
+# =============================================================================
+users:
+{% for username, user in authelia_users.items() %}
+  {{ username }}:
+    disabled: {{ user.disabled | default(false) | lower }}
+    displayname: '{{ user.displayname }}'
+    password: '{{ user.password }}'
+    email: '{{ user.email }}'
+    groups: [{% for group in user.groups %}'{{ group }}'{% if not loop.last %}, {% endif %}{% endfor %}]
+{% endfor %}