The target host does not have the op CLI installed, so op invocations
must run on the Semaphore controller (delegate_to: localhost, become:
false — the controller runs rootless). Generated/loaded secrets also
leak into task logs on failure, so mark the three op tasks and the
set_fact tasks with no_log: true.
The command module validates args.chdir before honoring check mode, so
dry runs fail with ENOENT on the stack dir (file task only pretends to
create it). Gate Deploy stack on ansible_check_mode — dry runs should
not run docker compose up anyway.
Shell tasks are skipped in check mode by default, leaving op_item.stdout
empty and breaking from_json in the set_fact. The op item get calls are
read-only, so mark them check_mode: no so dry runs reflect reality.
Move all sensitive and configurable values out of compose.yaml
into a .env file (mode 0600). compose.yaml now uses ${VAR}
substitution with no embedded secrets. Added planka.env.j2
template and a dedicated Deploy .env task in the playbook.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add `when: not ansible_check_mode` to the slurp and set_fact tasks
so that dry runs don't fail when .secrets hasn't been created yet.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
