{"id":13295497,"url":"https://github.com/troykinsella/ansible-concourse","last_synced_at":"2026-01-17T12:40:02.546Z","repository":{"id":46308555,"uuid":"68656016","full_name":"troykinsella/ansible-concourse","owner":"troykinsella","description":"An ansible role to manage Concourse CI","archived":false,"fork":false,"pushed_at":"2024-02-16T13:34:31.000Z","size":56,"stargazers_count":24,"open_issues_count":5,"forks_count":12,"subscribers_count":5,"default_branch":"master","last_synced_at":"2025-03-10T08:35:36.781Z","etag":null,"topics":["ansible","ansible-role","ci","concourse","concourse-ci","configuration-management","role"],"latest_commit_sha":null,"homepage":null,"language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/troykinsella.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2016-09-19T23:45:29.000Z","updated_at":"2024-09-08T17:40:58.000Z","dependencies_parsed_at":"2024-10-23T10:04:54.198Z","dependency_job_id":"2e86a607-d417-4dcf-8009-df93c187acbd","html_url":"https://github.com/troykinsella/ansible-concourse","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/troykinsella/ansible-concourse","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/troykinsella%2Fansible-concourse","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/troykinsella%2Fansible-concourse/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/troykinsella%2Fansible-concourse/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/troykinsella%2Fansible-concourse/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/troykinsella","download_url":"https://codeload.github.com/troykinsella/ansible-concourse/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/troykinsella%2Fansible-concourse/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28508522,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-17T11:50:55.898Z","status":"ssl_error","status_checked_at":"2026-01-17T11:50:55.569Z","response_time":85,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ansible","ansible-role","ci","concourse","concourse-ci","configuration-management","role"],"created_at":"2024-07-29T17:17:06.277Z","updated_at":"2026-01-17T12:40:02.522Z","avatar_url":"https://github.com/troykinsella.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# ansible-concourse\n\n[![Build Status][travis-image]][travis-url]\n\nAn Ansible role to manage [Concourse CI](https://concourse-ci.org).\n\n## Scope\n\nThis role understands how to manage a Concourse CI web (ATC/TSA) or worker service installation.\n\nIt:\n* (Optionally) creates a `concourse` user and group with which to run the daemon process.\n* (Optionally) formats and mounts a volume in which Concourse work is done.\n* Installs a `systemd` service called `concourse-web` and/or `concourse-worker`.\n* Fetches the Concourse binary tarball from the official site.\n* Creates a wrapper script that captures options passed into the binary executable.\n* Installs necessary ssh key files, provided through variables.\n\nIt does not:\n* Generate ssh key-pairs.\n* Manage the Postgres database.\n* Manage any cloud infrastructure.\n\n## Installation\n\n```bash\nansible-galaxy install troykinsella.concourse\n```\n\n## Branches\n\n* `master`: Concourse 7.x (7.1.0)\n* `support/6.x`: Concourse 6.x\n* `support/5.x`: Concourse 5.x\n* `support/4.x`: Concourse 4.x\n* `support/3.x`: Concourse 3.x\n\nNote: Concourse makes backwards-incompatible command option changes within major versions, so these branches\nwill likely not support early minor or patch revisions of a major version. The latest version\nused in testing is shown in brackets.\n\n## Role Variables\n\nSee `defaults/main.yml` for default values not specified below. Many of these variables map sensibly to options supplied\nto the concourse binary at launch time. Run `concourse web -h` or `concourse worker -h` for more detail.\n\nNote: The vast majority of variables have sensible defaults and normally need not be defined,\nbut exist for when control over related behaviour is needed. See examples for a minimal configuration set.\n\n### Maintenance Variables\n\n* `concourse_force_restart`: Optional. Default: \"no\". Triggers a restart of the web and/or worker services regardless as to whether or not configuration has changed.\n\n### User Variables\n\n* `concourse_manage_user`: Optional. Default: \"yes\". Manage the system user to which file ownership is assigned.\n* `concourse_user`: Optional. The user that will own the Concourse install directory and the running process.\n* `concourse_uid`: Optional. The user ID.\n* `concourse_group`: Optional. The group that will own the Concourse install directory and the running process.\n* `concourse_gid`: Optional. The group ID.\n\n### Installation Variables\n\n* `concourse_version`: Optional. The version of Concourse to install.\n* `concourse_install_prefix_dir`: Optional. The prefix directory under which the Concourse installation directory will be placed. The Concourse tarball is also downloaded into this directory during installation.\n* `concourse_install_dir`: Optional. The directory path into which the Concourse tarball is extracted.\n* `concourse_binary_path`: Optional. The absolute path to the Concourse binary.\n* `concourse_bin_dir`: Optional. A directory in which the Concourse binary and related shell scripts live.\n* `concourse_etc_dir`: Optional. A directory in which Concourse-related generated or managed files are created.\n* `concourse_archive_name`: Optional. The file name of the Concourse release tarball to install.\n* `concourse_archive_url`: Optional. The URL at which the Concourse release tarball can be downloaded.\n* `concourse_archive_checksum`: Optional. The checksum of the Concourse release tarball used to validate the downloaded archive.\n* `concourse_archive_os`: Optional. The operating system for which to fetch the Concourse release tarball.\n* `concourse_archive_arch`: Optional. The system architecture for which to fetch the Concourse release tarball.\n* `concourse_archive_fetch_timeout`: Optional. The timeout in seconds for fetching the Concourse release tarball.\n* `concourse_archive_delete_after_unarchive`: Optional. Default: \"yes\". Delete the release tarball after it is unpacked.\n* `concourse_binary_mode`: Optional. The file mode of the Concourse binary.\n* `concourse_etc_files_mode`: Optional. The file mode of all files stored in `concourse_etc_dir`.\n\n### Common Variables\n\n* `concourse_service_enabled`: Optional. Default: \"yes\". Manage a `systemd` service for a Concourse `web` and/or `worker` instance.\n* `concourse_service_start`: Optional. Default: \"yes\". Start the `systemd` service(s) for Concourse `web` and/or `worker`.\n* `concourse_log_level`: Optional. The minimum level of logs to see. [debug|info|error|fatal]\n* `concourse_env_file`: Optional. A file containing environment variables which is fed into the `EnvironmentFile` attribute of the \n  `systemd` service unit file. This is useful for configuration managed outside of the playbook. If\n  the configuration should be managed by the playbook, `concourse_web_env` and/or `concourse_worker_env` is\n  the better choice.\n\n### Web Variables\n\n* `concourse_web`: Optional. Set to \"yes\" to install the Concourse ATC.\n* `concourse_bind_ip`: Optional. The IP address on which to listen to web traffic.\n* `concourse_bind_port`: Optional. The port on which to listen for HTTP traffic.\n* `concourse_tls_bind_port`: Optional. The port on which to listen for HTTPS traffic.\n* `concourse_tls_certificate`: Optional. The content of the TLS certificate to use for HTTPS termination.\n* `concourse_tls_certificate_path`: Optional. The remote file path of the TLS certificate to use for HTTPS termination.\n  Normally, only `concourse_tls_certificate` needs to be defined.  \n* `concourse_tls_key`: Optional. Optional. The content of the TLS key to use for HTTPS termination.\n* `concourse_tls_key_path`: Optional. The remote file path of the TLS key to use for HTTPS termination.\n  Normally, only `concourse_tls_key` needs to be defined. \n* `concourse_peer_address`: Optional. The URL at which this ATC can be reached from other ATCs in the cluster.\n* `concourse_external_url`: Optional. The URL at which any ATC can be reached from the outside.\n* `concourse_web_launcher_path`: Optional. The path to the script that launches the Concourse web process.\n* `concourse_web_launcher_mode`: Optional. The file mode of the web launcher script.\n* `concourse_cli_artifacts_dir`: Optional. The value of the `--cli-artifacts-dir` option.\n* `concourse_authorized_worker_keys_path`: Optional. The path to the authorized worker keys file.\n* `concourse_host_key_path`: Optional. The path to the host key file.\n* `concourse_session_signing_key`: Required. The session signing key.\n* `concourse_session_signing_key_path`: Optional. The path to the session signing key file.\n* `concourse_encryption_key`: Optional. A 16 or 32 length key used to encrypt sensitive data before storing\n  it in the database \n* `concourse_old_encryption_key`: Optional. An encryption key previously used. If provided without a new key, \n  data is encrypted. If provided with a new key, data is re-encrypted.\n* `concourse_host_key`: Required. The host key.\n* `concourse_authorized_worker_keys`: Required. Concatenated authorized worker keys.\n* `concourse_auth_duration`: Optional. The length of time for which tokens are valid.\n* `concourse_resource_checking_interval`: Optional. Interval on which to check for new versions of resources. \n* `concourse_base_resource_type_defaults`: Optional. A hash of cluster-wide defaults for resource types.\n* `concourse_base_resource_type_defaults_file`: Optional. The path to the resource type defaults file.\n* `concourse_web_options`: Optional. Other non-managed options to pass to `concourse`.\n* `concourse_web_env`: Optional. A hash of environment variables made available to the `concourse web` process.\n\n#### Web PostgreSQL Variables\n\n* `concourse_postgres_host`: Optional. The Postgres host to connect to.\n* `concourse_postgres_port`: Optional. The Postgres port to connect to.\n* `concourse_postgres_socket`: Optional. The path to a Unix domain socket to connect to.\n* `concourse_postgres_user`: Optional. The Postgres user to sign in as. \n* `concourse_postgres_password`: Optional. The Postgres user's password.\n* `concourse_postgres_ssl_mode`: Optional. Whether or not to use SSL with the Postgres connection.\n* `concourse_postgres_ca_cert`: Optional. The Postgres CA cert file location.\n* `concourse_postgres_client_cert`: Optional. The Postgres client cert file location.\n* `concourse_postgres_client_key`: Optional. The Postgres client key file location.\n* `concourse_postgres_connect_timeout`: Optional. The Postgres dialing timeout.\n* `concourse_postgres_database`: Optional. The Postgres database name.\n\n#### Web Local Authentication Variables\n\n* `concourse_local_users`: Optional. A list of concourse user credentials that are added as local users. \n  Entries are objects having `name` and `password` fields (see example). Passwords can be plain text or bcrypted.\n* `concourse_main_team_local_users`: Optional. List of whitelisted local concourse users (of the supplied local user list).\n\n#### Web GitHub Authentication Variables\n\n* `concourse_github_client_id`: Optional. GitHub client ID.\n* `concourse_github_client_secret`: Optional. GitHub client secret.\n* `concourse_main_team_github_users`: Optional. List of whitelisted GitHub users.\n* `concourse_main_team_github_orgs`: Optional. List of whitelisted GitHub orgs.\n* `concourse_main_team_github_teams`: Optional. List of whitelisted GitHub teams formatted as \"org:team\".\n\n#### Web Other Authentication Methods\n\nUnsupported. Do it yer dang self by supplying `concourse web` command options with the `concourse_web_options` variable.\n\n### Worker Variables\n\n* `concourse_worker`: Optional. Set to \"yes\" to install a Concourse worker.\n* `concourse_worker_launcher_path`: Optional. The path to the script that launches the Concourse worker process.\n* `concourse_worker_land_path`: Optional. The path to the script that lands a worker.\n* `concourse_worker_retire_path`: Optional. The path to the script that retires a worker.\n* `concourse_worker_binary_mode`: Optional. The file mode of the worker launcher, land, and retire scripts.\n* `concourse_worker_land_on_stop`: Optional. Default: \"no\". Run `concourse land-worker` upon stopping the service.\n* `concourse_worker_retire_on_stop`: Optional. Default: \"yes\". Run `concourse retire-worker` upon stopping the service.\n* `concourse_work_dir`: Optional. The directory in which the worker does work.\n* `concourse_tsa_public_key_path`: Optional. The path to the tsa public key file.\n* `concourse_tsa_worker_key_path`: Optional. The path to the worker private key file.\n* `concourse_tsa_host`: Required. The value of the `--tsa-host` option.\n* `concourse_tsa_public_key`: Required. The tsa public key.\n* `concourse_tsa_worker_key`: Required. The tsa worker private key.\n* `concourse_worker_tag`: Optional. The value of the `--tag` option.\n* `concourse_baggageclaim_driver`: Optional. The driver to use for managing volumes.\n* `concourse_worker_options`: Optional. Other non-managed options to pass to `concourse`.\n* `concourse_worker_env`: Optional. A hash of environment variables made available to the `concourse worker` process.\n* `concourse_manage_work_volume`: Optional. Default: \"no\". Activate management of the work volume.\n* `concourse_work_volume_device`: Required when `concourse_manage_work_volume` is \"yes\". The device to mount as the work volume.\n* `concourse_work_volume_fs_type`: Optional. The filesystem type of the work volume. By default, this is calculated to be `btrfs` or `ext4` based on the value of `concourse_baggageclaim_driver`.\n* `concourse_work_volume_fs_opts`: Optional. A list of options to be passed to mkfs command when creating the work volume filesystem.\n* `concourse_work_volume_fs_force_create`: Optional. Default: \"no\". If yes, allows to create a new work volume filesystem on a device that already has a filesystem.\n* `concourse_work_volume_fs_resize`: Optional. Default: \"no\". If yes, if the work volume block device and filesystem size differ, grow the filesystem into the space.\n* `concourse_work_volume_mount_path`: Optional. The directory to which the work volume will be mounted.\n* `concourse_work_volume_mount_opts`: Optional. Work volume mount options.\n\n## Example Playbook\n\n    - hosts: atc\n      roles:\n      - role: troykinsella.concourse\n        concourse_web: yes\n        concourse_authorized_worker_keys:\n        - \"{{ worker_public_key }}\"\n        concourse_postgres_host: concoursedb.abc123.us-east-1.rds.amazonaws.com\n        concourse_postgres_user: concourse\n        concourse_postgres_password: changeme\n        concourse_postgres_database: atc\n        concourse_local_users:\n        - name: admin\n          password: my_bcrypted_password\n        concourse_main_team_local_users:\n        - admin\n        concourse_external_url: http://concourse.example.com\n\n    - hosts: workers\n      roles:\n      - role: troykinsella.concourse\n        concourse_worker: yes\n        concourse_tsa_host: my-atc\n        concourse_tsa_public_key: \"{{ host_pub_key }}\"\n        concourse_tsa_worker_key: \"{{ worker_key }}\"\n        concourse_worker_env:\n          CONCOURSE_GARDEN_NETWORK_POOL: 10.254.0.0/16\n          CONCOURSE_GARDEN_MAX_CONTAINERS: 512\n          CONCOURSE_GARDEN_DOCKER_REGISTRY: https://docker.my-private-registry.org\n\n## Testing\n\nPrerequisites:\n* Install Docker\n\nTo run serverspec tests:\n\n```bash\ndocker build .\n```\n\n## Contributors\n\n* [gaelL](https://github.com/gaelL)\n* [troykinsella](https://github.com/troykinsella) (Maintainer)\n\n## License\n\nMIT © Troy Kinsella\n\n[travis-image]: https://travis-ci.org/troykinsella/ansible-concourse.svg?branch=master\n[travis-url]: https://travis-ci.org/troykinsella/ansible-concourse\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftroykinsella%2Fansible-concourse","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftroykinsella%2Fansible-concourse","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftroykinsella%2Fansible-concourse/lists"}