ansible_role_gitea/tasks/jwt_secrets.yml

---
- name: generate OAuth2 JWT_SECRET if not provided
  become: true
  ansible.builtin.shell: 'umask 077; /usr/local/bin/gitea generate secret JWT_SECRET > /etc/gitea/gitea_oauth_jwt_secret'
  args:
    creates: '/etc/gitea/gitea_oauth_jwt_secret'
  when: gitea_oauth2_jwt_secret | length == 0

- name: read OAuth2 JWT_SECRET from file
  become: true
  ansible.builtin.slurp:
    src: '/etc/gitea/gitea_oauth_jwt_secret'
  register: oauth_jwt_secret
  when: gitea_oauth2_jwt_secret | length == 0

- name: set fact gitea_oauth2_jwt_secret
  ansible.builtin.set_fact:
    gitea_oauth2_jwt_secret: "{{ oauth_jwt_secret['content'] | b64decode }}"
  when: gitea_oauth2_jwt_secret | length == 0

- name: generate LFS JWT_SECRET if not provided
  become: true
  ansible.builtin.shell: 'umask 077; /usr/local/bin/gitea generate secret JWT_SECRET > /etc/gitea/gitea_lfs_jwt_secret'
  args:
    creates: '/etc/gitea/gitea_lfs_jwt_secret'
  when: gitea_lfs_jwt_secret | length == 0

- name: read LFS JWT_SECRET from file
  become: true
  ansible.builtin.slurp:
    src: '/etc/gitea/gitea_lfs_jwt_secret'
  register: lfs_jwt_secret
  when: gitea_lfs_jwt_secret | length == 0

- name: set fact gitea_lfs_jwt_secret
  ansible.builtin.set_fact:
    gitea_lfs_jwt_secret: "{{ lfs_jwt_secret['content'] | b64decode }}"
  when: gitea_lfs_jwt_secret | length == 0