ansible_role_gitea/tasks/gitea_secrets.yml

---
- name: Generate gitea SECRET_KEY if not provided
  become: true
  ansible.builtin.shell: 'umask 077; {{ gitea_full_executable_path }} generate secret SECRET_KEY > {{ gitea_configuration_path }}/gitea_secret_key'
  args:
    creates: '{{ gitea_configuration_path }}/gitea_secret_key'
  when: gitea_secret_key | string | length == 0

- name: Read gitea SECRET_KEY from file
  become: true
  ansible.builtin.slurp:
    src: '{{ gitea_configuration_path }}/gitea_secret_key'
  register: remote_secret_key
  when: gitea_secret_key | string | length == 0

- name: Set fact gitea_secret_key
  ansible.builtin.set_fact:
    gitea_secret_key: "{{ remote_secret_key['content'] | b64decode }}"
  when: gitea_secret_key | string | length == 0

- name: Generate gitea INTERNAL_TOKEN if not provided
  become: true
  ansible.builtin.shell: 'umask 077; {{ gitea_full_executable_path }} generate secret INTERNAL_TOKEN > {{ gitea_configuration_path }}/gitea_internal_token'
  args:
    creates: '{{ gitea_configuration_path }}/gitea_internal_token'
  when: gitea_internal_token | string | length == 0

- name: Read gitea INTERNAL_TOKEN from file
  become: true
  ansible.builtin.slurp:
    src: '{{ gitea_configuration_path }}/gitea_internal_token'
  register: remote_internal_token
  when: gitea_internal_token | string | length == 0

- name: Set fact gitea_internal_token
  ansible.builtin.set_fact:
    gitea_internal_token: "{{ remote_internal_token['content'] | b64decode }}"
  when: gitea_internal_token | string | length == 0