task 1-4

roles/woodpecker/defaults/main.yml

@@ -0,0 +1,5 @@
+---
+woodpecker_version: "v3.18.1"
+woodpecker_host: "https://ci.poc.mehl.mx"
+woodpecker_gitea_url: "https://src.mehl.mx"
+woodpecker_admin_user: "mxmehl"

roles/woodpecker/handlers/main.yml

@@ -0,0 +1,6 @@
+---
+- name: Restart woodpecker
+  ansible.builtin.command:
+    cmd: docker compose up -d --force-recreate
+    chdir: /opt/woodpecker
+  changed_when: true

roles/woodpecker/tasks/main.yml

@@ -0,0 +1,29 @@
+---
+# ponytail: UID/GID 1000 is hardcoded to match the woodpecker-server/agent
+# images' built-in "woodpecker" user (checked via /etc/passwd in the image).
+# If a future image version changes this UID, ownership here must follow.
+
+- name: Create woodpecker directories
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    mode: "0755"
+    owner: "1000"
+    group: "1000"
+  loop:
+    - /opt/woodpecker
+    - /opt/woodpecker/server-data
+    - /opt/woodpecker/agent-config
+
+- name: Deploy woodpecker compose file
+  ansible.builtin.template:
+    src: compose.yaml.j2
+    dest: /opt/woodpecker/compose.yaml
+    mode: "0600"
+  notify: Restart woodpecker
+
+- name: Start woodpecker via docker compose
+  ansible.builtin.command:
+    cmd: docker compose up -d
+    chdir: /opt/woodpecker
+  changed_when: true

roles/woodpecker/templates/compose.yaml.j2

@@ -0,0 +1,34 @@
+services:
+  woodpecker-server:
+    image: woodpeckerci/woodpecker-server:{{ woodpecker_version }}
+    restart: unless-stopped
+    ports:
+      - "127.0.0.1:8000:8000"
+    volumes:
+      - /opt/woodpecker/server-data:/var/lib/woodpecker/
+    environment:
+      - WOODPECKER_OPEN=false
+      - WOODPECKER_HOST={{ woodpecker_host }}
+      - WOODPECKER_GITEA=true
+      - WOODPECKER_GITEA_URL={{ woodpecker_gitea_url }}
+      - WOODPECKER_GITEA_CLIENT={{ woodpecker_gitea_client }}
+      - WOODPECKER_GITEA_SECRET={{ woodpecker_gitea_secret }}
+      - WOODPECKER_AGENT_SECRET={{ woodpecker_agent_secret }}
+      - WOODPECKER_ADMIN={{ woodpecker_admin_user }}
+      # ponytail: only this specific plugin image is allow-listed for
+      # privileged mode (needed to build images), not privileged mode in
+      # general - keep this list as narrow as possible.
+      - WOODPECKER_PLUGINS_PRIVILEGED=woodpeckerci/plugin-docker-buildx
+
+  woodpecker-agent:
+    image: woodpeckerci/woodpecker-agent:{{ woodpecker_version }}
+    command: agent
+    restart: unless-stopped
+    depends_on:
+      - woodpecker-server
+    volumes:
+      - /opt/woodpecker/agent-config:/etc/woodpecker
+      - /var/run/docker.sock:/var/run/docker.sock
+    environment:
+      - WOODPECKER_SERVER=woodpecker-server:9000
+      - WOODPECKER_AGENT_SECRET={{ woodpecker_agent_secret }}