ansible rework

ansible/roles/forgejo/tasks/main.yaml

@@ -1,42 +1,23 @@
 ---
+- name: Validate Forgejo variables
+  ansible.builtin.import_tasks: validate.yaml
+
 - name: Configure SSH passthrough
-  import_tasks: ssh-passthrough.yaml
+  ansible.builtin.import_tasks: ssh-passthrough.yaml
 
-- name: Create Forgejo directories
-  file:
-    path: "{{ item }}"
-    state: directory
-    mode: '0755'
-  loop:
-    - /opt/forgejo
-    - /opt/forgejo/data
-    - /opt/forgejo/config
-
-- name: Deploy Forgejo app.ini configuration
-  template:
-    src: app.ini.j2
-    dest: /opt/forgejo/config/app.ini
-    mode: '0644'
-  notify: Restart Forgejo
-
-- name: Deploy Forgejo docker-compose
-  template:
-    src: docker-compose.yml.j2
-    dest: /opt/forgejo/docker-compose.yml
-    mode: '0644'
-  notify: Restart Forgejo
-
-- name: Start Forgejo
-  community.docker.docker_compose_v2:
-    project_src: /opt/forgejo
-    state: present
-  register: forgejo_output
-
-- name: Wait for Forgejo to be healthy
-  uri:
-    url: http://localhost:{{ forgejo_http_port }}/
-    status_code: 200
-  retries: 15
-  delay: 5
-  register: result
-  until: result.status == 200
+- name: Deploy Forgejo using shared docker_service role
+  ansible.builtin.include_role:
+    name: docker_service
+  vars:
+    service_name: "forgejo"
+    service_base_path: "{{ forgejo_base_path }}"
+    service_directories:
+      - { path: "data", mode: "0755" }
+      - { path: "config", mode: "0755" }
+    service_templates:
+      - { src: "app.ini.j2", dest: "config/app.ini", mode: "0644" }
+      - { src: "docker-compose.yml.j2", dest: "docker-compose.yml", mode: "0644" }
+    health_check_enabled: true
+    health_check_url: "http://localhost:{{ forgejo_http_port }}/"
+    health_check_delay: 5
+    health_check_retries: 15

ansible/roles/forgejo/tasks/validate.yaml

@@ -0,0 +1,45 @@
+---
+# Variable validation for forgejo role
+
+- name: Validate Forgejo required variables
+  ansible.builtin.assert:
+    that:
+      - forgejo_base_path is defined
+      - forgejo_base_path | length > 0
+      - forgejo_http_port is defined
+      - forgejo_http_port | int > 0
+      - forgejo_http_port | int < 65536
+      - forgejo_ssh_port is defined
+      - forgejo_ssh_port | int > 0
+      - forgejo_ssh_port | int < 65536
+      - forgejo_domain is defined
+      - forgejo_domain | length > 0
+    fail_msg: |
+      Forgejo role requires:
+      - forgejo_base_path (installation directory)
+      - forgejo_http_port (1-65535)
+      - forgejo_ssh_port (1-65535)
+      - forgejo_domain (domain name)
+    success_msg: "Forgejo basic variables validated successfully"
+
+- name: Validate Forgejo secrets (if not using vault)
+  ansible.builtin.assert:
+    that:
+      - forgejo_secret_key is defined
+      - forgejo_secret_key | length >= 32
+      - forgejo_internal_token is defined
+      - forgejo_internal_token | length > 0
+      - forgejo_jwt_secret is defined
+      - forgejo_jwt_secret | length >= 32
+      - forgejo_lfs_jwt_secret is defined
+      - forgejo_lfs_jwt_secret | length >= 32
+    fail_msg: |
+      Forgejo role requires secrets:
+      - forgejo_secret_key (min 32 chars)
+      - forgejo_internal_token
+      - forgejo_jwt_secret (min 32 chars)
+      - forgejo_lfs_jwt_secret (min 32 chars)
+
+      WARNING: These should be stored in Ansible Vault!
+    success_msg: "Forgejo secrets validated (WARNING: should use Ansible Vault)"
+  when: not ansible_check_mode

ansible/roles/forgejo/templates/app.ini.j2

@@ -40,7 +40,7 @@ INTERNAL_TOKEN = {{ forgejo_internal_token | default('CHANGE-ME-PLEASE-GENERATE-
 PASSWORD_HASH_ALGO = pbkdf2
 
 [service]
-DISABLE_REGISTRATION = false
+DISABLE_REGISTRATION = true
 REQUIRE_SIGNIN_VIEW = false
 REGISTER_EMAIL_CONFIRM = false
 ENABLE_NOTIFY_MAIL = false