Add forgejo role

On alpine, with OIDC auth and a podman runner.

roles/forgejo/tasks/main.yml

@@ -0,0 +1,170 @@
+- name: Add testing repo
+  lineinfile:
+    path: /etc/apk/repositories
+    line: '@testing https://dl-cdn.alpinelinux.org/alpine/edge/testing'
+  notify: update package cache
+  register: repo
+
+- name: Install forgejo
+  package:
+    update_cache: '{{ repo.changed }}'
+    name:
+      - forgejo@testing
+      - forgejo-runner@testing
+      - podman
+
+- name: Enable forgejo service
+  service:
+    name: forgejo
+    state: started
+    enabled: yes
+
+- name: Create nginx site
+  template:
+    dest: /etc/nginx/http.d/forgejo.conf
+    src: forgejo.conf.j2
+  notify: reload nginx
+
+- meta: flush_handlers
+
+- name: Get passwords
+  set_fact:
+    password: '{{ lookup("passwordstore", "vm/"~inventory_hostname, returnall=true) | from_yaml }}'
+
+- name: Post installation data
+  uri:
+    creates: /var/lib/forgejo/db/forgejo.db
+    url: 'https://{{ fqdns | first }}'
+    method: POST
+    body_format: form-urlencoded
+    body:
+      - [ db_type, sqlite3 ]
+      - [ db_path, /var/lib/forgejo/db/forgejo.db ]
+      - [ app_name, 'FRI git' ]
+      - [ repo_root_path, /var/lib/forgejo/git ]
+      - [ lfs_root_path, /var/lib/forgejo/data/lfs ]
+      - [ run_user, forgejo ]
+      - [ http_port, 3000 ]
+      - [ ssh_port, 22 ]
+      - [ domain, '{{ fqdns | first }}' ]
+      - [ app_url, 'https://{{ fqdns | first }}/' ]
+      - [ log_root_path, /var/lib/forgejo/log ]
+      - [ allow_only_external_registration, on ]
+      - [ default_allow_create_organization, on ]
+      - [ default_enable_timetracking, on ]
+      - [ enable_open_id_sign_up, on ]
+      - [ offline_mode, on ]
+      - [ disable_gravatar, on ]
+      - [ admin_name, '{{ password.admin_user }}' ]
+      - [ admin_email, '{{ password.admin_mail }}' ]
+      - [ admin_passwd, '{{ password.admin_pass }}' ]
+      - [ admin_confirm_passwd, '{{ password.admin_pass }}' ]
+      #- [ no_reply_address, noreply.localhost ]
+
+- name: Configure forgejo
+  ini_file:
+    path: /etc/forgejo/app.ini
+    section: '{{ item.section }}'
+    option: '{{ item.option }}'
+    value: '{{ item.value }}'
+  loop:
+    - section: repository
+      option: DEFAULT_BRANCH
+      value: master
+    - section: repository
+      option: ENABLE_PUSH_CREATE_ORG
+      value: true
+    - section: repository
+      option: ENABLE_PUSH_CREATE_USER
+      value: true
+  notify: restart forgejo
+
+- name: Set up SSO
+  become: yes
+  become_method: su
+  become_user: forgejo
+  command: |
+    forgejo admin auth add-oauth --provider=openidConnect \
+        --name '{{ password.oidc_name }}'
+        --auto-discover-url '{{ password.oidc_endpoint }}'
+        --key '{{ password.oidc_client_id }}'
+        --secret '{{ password.oidc_client_secret }}'
+  register: result
+  changed_when:
+    - result.rc == 0
+  failed_when:
+    # task fails when both are true
+    - result.rc != 0
+    - '"login source already exists" not in result.stderr'
+
+- name: Get forgejo-runner user
+  user:
+    name: forgejo-runner
+  register: user_info
+
+- name: Configure subuid
+  lineinfile:
+    path: /etc/subuid
+    line: '{{ user_info.name }}:{{ user_info.uid }}00000:65536'
+    regexp: '^{{ user_info.name }}:'
+
+- name: Configure subgid
+  lineinfile:
+    path: /etc/subgid
+    line: '{{ user_info.name }}:{{ user_info.group }}00000:65536'
+    regexp: '^{{ user_info.name }}:'
+
+- name: Create podman service for forgejo-runner
+  file:
+    path: /etc/init.d/podman.forgejo-runner
+    src: podman
+    state: link
+
+- name: Configure podman service for forgejo-runner
+  copy:
+    dest: /etc/conf.d/podman.forgejo-runner
+    content: podman_user="forgejo-runner"
+
+- name: Configure forgejo-runner
+  template:
+    dest: /etc/forgejo-runner/config.yaml
+    src: config.yaml.j2
+    owner: forgejo-runner
+    group: forgejo-runner
+    mode: 0600
+  notify: restart forgejo-runner
+
+- name: Check runner registration
+  stat:
+    path: /var/lib/forgejo-runner/.runner
+  register: runner_config
+
+- name: Register runner
+  when: not runner_config.stat.exists
+  notify: restart forgejo-runner
+  block:
+    - name: Get runner token
+      become: yes
+      become_method: su
+      become_user: forgejo
+      command: forgejo actions generate-runner-token
+      register: token
+
+    - name: Register runner
+      become: yes
+      become_method: su
+      become_user: forgejo-runner
+      become_flags: '-s /bin/sh -l'
+      command: |
+        forgejo-runner register --no-interactive --name runner
+            --instance https://git.fri.uni-lj.si
+            --token '{{ token.stdout }}'
+
+- name: Enable forgejo-runner services
+  service:
+    name: '{{ item }}'
+    state: started
+    enabled: yes
+  loop:
+    - forgejo-runner
+    - podman.forgejo-runner