semaphore v0.1.0

Dev tools

Semaphore UI — a modern web UI for running Ansible playbooks, Terraform/OpenTofu, and shell scripts: schedule tasks, manage inventories and secrets, and view logs, with teams and role-based access. Deployed as a host-networked Nomad service using the embedded BoltDB with persistent volumes.

nomad-pack run semaphore --registry nomploy

…or one line (add registry + run)

curl -fsSL https://packs.nomploy.com/install.sh | sh -s -- semaphore

Needs nomad-pack on PATH. The script only adds the nomploy registry and runs this pack.

Source ↗ Project ↗ ★ 14.2k ⚑ Report an issue

1 task http 3000 2 volumes image semaphoreui/semaphore:latest tracks :latest image bumped today

Variables 14

values.hcl

Save as values.hcl, edit, then run:

nomad-pack run semaphore -f values.hcl --registry nomploy

# The name of the Nomad job.
job_name = "semaphore"

# The Nomad namespace to deploy into.
namespace = "default"

# The datacenters to deploy to.
datacenters = ["*"]

# The Semaphore UI container image. Pin a tag in production.
image = "semaphoreui/semaphore:latest"

# Host port for the Semaphore web UI. The container listens on 3000.
port = 3000

# Initial admin username (SEMAPHORE_ADMIN).
admin_user = "admin"

# Initial admin password (SEMAPHORE_ADMIN_PASSWORD). CHANGE THIS.
admin_password = "change-me-please"

# Initial admin display name (SEMAPHORE_ADMIN_NAME).
admin_name = "Admin"

# Initial admin email (SEMAPHORE_ADMIN_EMAIL).
admin_email = "admin@nomploy.local"

# Base64 key used to encrypt stored access keys/secrets (SEMAPHORE_ACCESS_KEY_ENCRYPTION). CHANGE THIS and keep it stable. Generate with: head -c32 /dev/urandom | base64.
access_key_encryption = "change-me-base64-32-byte-key"

# Named volume for Semaphore data (/var/lib/semaphore): the BoltDB database and repositories.
data_volume = "semaphore_data"

# Named volume for Semaphore config (/etc/semaphore).
config_volume = "semaphore_config"

# Placement constraints. Pin to the node holding the volumes. On a nomploy cluster: attribute = "$${meta.nomploy_control_plane}", operator = "=", value = "true".
constraints = []

# Resources for the Semaphore task.
resources = {
    cpu    = 500
    memory = 512
  }

Name	Type	Default	Description
job_name	string	"semaphore"	The name of the Nomad job.
namespace	string	"default"	The Nomad namespace to deploy into.
datacenters	list	["*"]	The datacenters to deploy to.
image	string	"semaphoreui/semaphore:latest"	The Semaphore UI container image. Pin a tag in production.
port	number	3000	Host port for the Semaphore web UI. The container listens on 3000.
admin_user	string	"admin"	Initial admin username (SEMAPHORE_ADMIN).
admin_password set me	string	"change-me-please"	Initial admin password (SEMAPHORE_ADMIN_PASSWORD). CHANGE THIS.
admin_name	string	"Admin"	Initial admin display name (SEMAPHORE_ADMIN_NAME).
admin_email	string	"admin@nomploy.local"	Initial admin email (SEMAPHORE_ADMIN_EMAIL).
access_key_encryption set me	string	"change-me-base64-32-byte-key"	Base64 key used to encrypt stored access keys/secrets (SEMAPHORE_ACCESS_KEY_ENCRYPTION). CHANGE THIS and keep it stable. Generate with: head -c32 /dev/urandom \| base64.
data_volume	string	"semaphore_data"	Named volume for Semaphore data (/var/lib/semaphore): the BoltDB database and repositories.
config_volume	string	"semaphore_config"	Named volume for Semaphore config (/etc/semaphore).
constraints	list	[]	Placement constraints. Pin to the node holding the volumes. On a nomploy cluster: attribute = "$${meta.nomploy_control_plane}", operator = "=", value = "true".
resources	object	{ cpu = 500 memory = 512 }	Resources for the Semaphore task.

Back up this pack

This pack stores data in 2 Docker named volumes: semaphore_datasemaphore_config

restic

# Run on the node hosting this pack. Point restic at your repo first:
#   export RESTIC_REPOSITORY="s3:https://<account>.r2.cloudflarestorage.com/<bucket>"
#   export RESTIC_PASSWORD="<repo-password>"
#   export AWS_ACCESS_KEY_ID=<key>  AWS_SECRET_ACCESS_KEY=<secret>
restic backup \
  /var/lib/docker/volumes/semaphore_data/_data \
  /var/lib/docker/volumes/semaphore_config/_data

rclone (sync to S3/R2)

rclone sync /var/lib/docker/volumes/semaphore_data/_data backup:<bucket>/semaphore_data
rclone sync /var/lib/docker/volumes/semaphore_config/_data backup:<bucket>/semaphore_config

Paths assume the default Docker volume location (/var/lib/docker/volumes). Restore by stopping the job, restoring files into the same volume, and re-running the pack.

Readme

semaphore

Semaphore UI — a modern web UI for infrastructure automation. Run and schedule Ansible playbooks, Terraform/OpenTofu, and shell scripts; manage inventories, repositories, and encrypted secrets; and give your team role-based access with a full run history.

Single host-networked Nomad service using the embedded BoltDB (no external database) with persistent data and config volumes.

Deploy

nomad-pack registry add nomploy https://github.com/Nomploy/nomad-packs
nomad-pack run semaphore --registry=nomploy

Configure

Variable	Default	Description
`port`	`3000`	Web UI port. The container listens on 3000.
`admin_user` / `admin_password`	`admin` / `change-me-…`	Initial admin (`SEMAPHORE_ADMIN`). Change the password.*
`admin_name` / `admin_email`	`Admin` / `admin@nomploy.local`	Admin display name & email.
`access_key_encryption`	`change-me-…`	`SEMAPHORE_ACCESS_KEY_ENCRYPTION` — base64 32-byte key that encrypts stored secrets. Change it and keep it stable (`head -c32 /dev/urandom \| base64`).
`data_volume`	`semaphore_data`	`/var/lib/semaphore` — the BoltDB database and repositories.
`config_volume`	`semaphore_config`	`/etc/semaphore`.
`image`	`semaphoreui/semaphore:latest`	Container image. Pin a tag in production.
`resources`	`{ cpu = 500, memory = 512 }`	Task resources.

Log in with your admin credentials, then set up a key store, repositories, inventory, and task templates. Keep access_key_encryption stable — changing it makes stored secrets unreadable. Serves plain HTTP — front it with a reverse proxy for TLS. Pin the job to the node holding the volumes with constraints.