ansible rework

ansible/roles/forgejo/tasks/validate.yaml

@@ -0,0 +1,45 @@
+---
+# Variable validation for forgejo role
+
+- name: Validate Forgejo required variables
+  ansible.builtin.assert:
+    that:
+      - forgejo_base_path is defined
+      - forgejo_base_path | length > 0
+      - forgejo_http_port is defined
+      - forgejo_http_port | int > 0
+      - forgejo_http_port | int < 65536
+      - forgejo_ssh_port is defined
+      - forgejo_ssh_port | int > 0
+      - forgejo_ssh_port | int < 65536
+      - forgejo_domain is defined
+      - forgejo_domain | length > 0
+    fail_msg: |
+      Forgejo role requires:
+      - forgejo_base_path (installation directory)
+      - forgejo_http_port (1-65535)
+      - forgejo_ssh_port (1-65535)
+      - forgejo_domain (domain name)
+    success_msg: "Forgejo basic variables validated successfully"
+
+- name: Validate Forgejo secrets (if not using vault)
+  ansible.builtin.assert:
+    that:
+      - forgejo_secret_key is defined
+      - forgejo_secret_key | length >= 32
+      - forgejo_internal_token is defined
+      - forgejo_internal_token | length > 0
+      - forgejo_jwt_secret is defined
+      - forgejo_jwt_secret | length >= 32
+      - forgejo_lfs_jwt_secret is defined
+      - forgejo_lfs_jwt_secret | length >= 32
+    fail_msg: |
+      Forgejo role requires secrets:
+      - forgejo_secret_key (min 32 chars)
+      - forgejo_internal_token
+      - forgejo_jwt_secret (min 32 chars)
+      - forgejo_lfs_jwt_secret (min 32 chars)
+
+      WARNING: These should be stored in Ansible Vault!
+    success_msg: "Forgejo secrets validated (WARNING: should use Ansible Vault)"
+  when: not ansible_check_mode