Ghost Hands - Automating The Stronghold With Ansible And Podman

Mission Update

Now we automate.

The pod.
The proxy.
The secrets.

One playbook to conjure the setup, one command to repeat the ritual.

Requirements

Ansible (core + community.containers)
Podman configured for rootless ops
X509 certs or automation for Let's Encrypt
Directory structure with:
- roles/semaphore/tasks/main.yml
- files/nginx.conf
- files/cert.pem, key.pem (or auto-gen task)

Playbook Strategy

Create Podman pod
Deploy MySQL container
Deploy Semaphore UI container
Deploy NginX container with volumes mounted

Secret Externalization

Store credentials in group_vars/containers.yml and encrypt with Ansible Vault.

Step 1: Create The Pod

-  name:  Create the pod
   containers.podman.podman_pod:
     name: p_semaphore
     state: created
     ports:
      -  "4430:443"

Step 2: Activate the MySQL Container

-  name:  Create the MySQL container
   containers.podman.podman_container:
     name: semaphore_mysql
     pod: p_semaphore
     state: started
     rm:  true
     detach:  true
     image: docker.io/mysql:lts
     volumes:
      - semaphore_mysql:/var/lib/mysql
     env:
       MYSQL_RANDOM_ROOT_PASSWORD:  'yes'
       MYSQL_DATABASE: semaphore
       MYSQL_USER: semaphore
       MYSQL_PASSWORD:  " {{  semaphore_mysql_pw  }} "

Step 3: Initiate the Semaphore container

-  name:  Create the Semaphore container
   containers.podman.podman_container:
     name: semaphore
     pod: p_semaphore
     state: started
     rm:  true
     detach:  true
     image: docker.io/semaphoreui/semaphore:latest
     env:
       SEMAPHORE_DB_USER: semaphore
       SEMAPHORE_DB_PASS:  " {{  semaphore_mysql_pw  }} "
       SEMAPHORE_DB_HOST: 127.0.0.1
       SEMAPHORE_DB_PORT: 3306
       SEMAPHORE_DB_DIALECT: mysql
       SEMAPHORE_DB: semaphore
       SEMAPHORE_PLAYBOOK_PATH: /tmp/semaphore/
       SEMAPHORE_ADMIN_PASSWORD:  " {{  semaphore_admin_pw  }} "
       SEMAPHORE_ADMIN_NAME: admin
       SEMAPHORE_ADMIN_EMAIL: admin@localhost
       SEMAPHORE_ADMIN: admin
       SEMAPHORE_ACCESS_KEY_ENCRYPTION: gs72mPntFATGJs9qK0pQ0rKtfidlexiMjYCH9gWKhTU=
       SEMAPHORE_LDAP_ACTIVATED:  'no'
       TZ: UTC

Step 4: The NginX Reverse Proxy

-  name:  Create the NginX container
   containers.podman.podman_container:
     name: semaphore_proxy
     pod: p_semaphore
     state: started
     rm:  true
     detach:  true
     image: docker.io/library/nginx
     volumes:
      -  " {{  role_path  }} /files/nginx.conf:/etc/nginx/conf.d/default.conf:ro"
      -  " {{  role_path  }} /files/cert.pem:/etc/nginx/cert.pem:ro"
      -  " {{  role_path  }} /files/key.pem:/etc/nginx/key.pem:ro"

Step 5: Verify

Final Signal

The stronghold stands.
Provisioned in silence. Hardened by code.

But this is just the surface. A faint signal.
There is much to do for a strong signal.

Need the full Ansible role?

Variables ready
Templates in place
Handlers sharpened
Deploy once, repeat forever

Buy the hardened role + full guide - forged in the silence.

Whisper to DeadSwitch on Matrix: @deadswitch:matrix.org
Maybe the Ghost signals back.

DeadSwitch | The Silent Architect
In silence, I rise. In structure, I endure.