Feedback from a semaphore newbie

[cadm-frank]

I'm currently testing ansible semaphore and I'm running into severall papercuts:

1. Documentation missing: Keystore, Inventory, Environment and Repositories page is empty, no information how these are linked together in Semaphore and how the dependencies are.
2. When creating resources I get the dialog to create them, even when requirements cannot be fulfilled, e.g. I try to create a new task template, but no environment has been defined yet, but an environment is required, so all data I enter will be lost as I head over to environments, then head back to create the template again.
3. No way to specify an inventory from a git repo without complicated workarounds
4. Semaphore has issues trusting ssh host keys, I get Warning: Permanently added 'myprivategit.example.com,1.2.3.4' (ECDSA) to the list of known hosts. twice, even on the fifth try, indicating that semaphore is just blindly accepting any host key, which indicates bad security practice. StrictHostKeyChecking=accept-new might be an idea here.
5. While semaphore blindly accepts any ssh host key for the playbook repo, it fails downloading roles from roles/requirements.yml from the exact same server due to a ssh host key verification failure, indicating that this process uses a different ssh configuration.
6. The task output window splits up lines randomly and copying the text, results in copying the timestamps as well in an unpractical interlaced format: one line timestamp, next line log output, another timestamp, another line of log output.

[jdhayes]

I can relate to your situation, I had some of the same issues.
Here are the answers how I see them, anyone correct me if I am wrong.

1. True, documentation could be more complete, how about something like this:

• Project - Basic organization unit, which can be used to control access via the team.
• Keystore - Store your passwords and SSH keys, to allow to access hosts, repos, etc...
• Repository - Add Git based repository that contains ansible playbooks
• Environment - Additional variables that can be passed to playbooks (optional, since it can be an empty set)
• Inventory - Location of static file (INI or YML) or script that produces ansible style inventory format, the path can be relative to the repository used in the project. For example, you can store a file inventories/production/hosts within a repo and use that same path (relative) when defining the inventory file.
• Task Templates - A reusable definition of how you would like your playbook task to run. From here you need to select all the previously created records.

2. I think the above items are in the order in which you need to create them (more or less).
3. You may need to be more specific about this issue, it seemed straight forward to me as indicated above.
4. I don't think this is specific to semaphore, you can use ssh-keyscan or similar method to pre-populate the known_hosts file if that works for your. Or use host_key_checking = False within the ansible.cfg (less secure?).
5. I don't know about that one.
6. I believe the output is mainly controlled by ansible itself. I suppose toggling the timestamps could be useful. Honestly found the output too verbose and added display_skipped_hosts = False and display_ok_hosts = no to my ansible.cfg. Also not for everyone, but I run 1 host per task, easier to read.

I hope that helps, or at least starts a conversation.

[cadm-frank]

3. Playbook in repo A, inventory in repo B. How do I do that? I only saw complicated workarounds.
4. I'm complaining about the default of semaphore not checking SSH keys and just blindly accepting them. My system is setup correctly to check SSH keys. Semaphore ignores that. Maybe something in the docker image?

I've decided against using semaphore for my use case, so this isn't something that needs to be solved for me.

[jdhayes]

3. Oh, I see...2 different repos. You can do that using a git sub-module, although I am unsure the reasoning why you would want to do that.
   I am doing something similar with the ansible plugins/mitogen directory, it is another repo for the mitogen plugin.
   You could do the same for the inventories/production directory.
4. I see. Still, I don't think this is specific to semaphore, perhaps this is more of a general ansible issue. You should be to configure how ansible reacts to SSH host keys with the same flags I pointed out. You may just need to turn them on instead of disabling them.

Just out of curiosity, have you decided against ansible in general or just semaphore?
Did you end up using another tool instead, which one?
This could also be helpful for others with the same requirements as you.

[cadm-frank]

3. So I'd need to create a third git repo with submodules that I need to bump on every commit to the other repos? Sounds like a complicated workaround to me.
4. My system never blindly accepts SSH keys. I don't know how the semaphore docker images are setup, but if that's the default there, that's a bad thing.

I'm on AWX, I can just tell it to get the inventory from one repo and the polaybooks and roles from other repos.

[gawainXX]

I'm running into #5 as well, which is a barrier for using it in my environment.

[gawainXX]

I figured out a workaround for #5.

I created a volume mount for my semaphore server's home directory,

Here's my current Docker Compose

services:
  semaphore_db:
    image: mysql:8
    restart: unless-stopped
    volumes:
      - semaphore_mysql:/var/lib/mysql
    environment:
      MYSQL_RANDOM_ROOT_PASSWORD: yes
      MYSQL_USER: semaphore
      MYSQL_DATABASE: semaphore
      MYSQL_PASSWORD: ${MYSQL_PASSWORD}
    networks:
      - semaphore_network
  semaphore:
    image: semaphoreui/semaphore:v2.11.2
    restart: unless-stopped
    ports:
      - 3000:3000
    environment:
      TZ: America/Los_Angeles
      SEMAPHORE_DB_DIALECT: mysql
      SEMAPHORE_DB_HOST: semaphore_db
      SEMAPHORE_DB_PORT: 3306 # change to 5432 for postgres
      SEMAPHORE_DB_NAME: semaphore
      SEMAPHORE_DB_USER: semaphore
      SEMAPHORE_DB_PASS: ${MYSQL_PASSWORD}
      SEMAPHORE_ADMIN: admin
      SEMAPHORE_ADMIN_PASSWORD: ${SEMAPHORE_ADMIN_PASSWORD}
      SEMAPHORE_ADMIN_NAME: Admin
      SEMAPHORE_ADMIN_EMAIL: [email protected]
    volumes:
      - semaphore_data:/var/lib/semaphore
      - semaphore_config:/etc/semaphore
      - semaphore_home:/home/semaphore
      - semaphore_tmp:/tmp/semaphore
    networks:
      - semaphore_network
    depends_on:
      - semaphore_db

volumes:
  semaphore_mysql: # to use postgres, switch to: semaphore-postgres
  semaphore_data: # Contains database data.
  semaphore_config: # Contains configuration files.
  semaphore_home: # Contains home for semaphore user for SSH Keys and such
  semaphore_tmp: # Contains configuration files.
networks:
  semaphore_network: {driver: "bridge"}

After that I created the directory /home/semaphore/.ssh
Generated a SSH ID_RSA and ID_RSA.pub (ssh-keygen -t rsa -b 4096)
Added the .pub as a deploy key to my repos on gitlab,
Created /home/semaphore/.ssh/config (600)

Host gitlab.com
    HostName gitlab.com
    User git
    IdentityFile ~/.ssh/id_rsa
    IdentitiesOnly yes