It is not Semaphore CI. The name is shared with an unrelated continuous-integration product.

Headline features

• Ansible is in the image, not a prerequisite. The Ansible community bundle 9.2.0
  (ansible-core 2.16.3) and git ship inside, so a fresh install can clone a playbook repository
  and run it with nothing else installed anywhere.
• Cloudron single sign-on through the application's own OIDC support, not proxyAuth. That
  matters here: Semaphore has a full REST API and webhook triggers, and fencing the whole app behind
  a proxy would have broken both.
• Every install generates its own encryption keyring at first run. Upstream's default is either
  no key at all, which stores your SSH keys base64-encoded and calls it done, or the literal key
  published in their compose file. Neither ships here.
• Schedules, webhook integrations and a REST API, so playbooks can run on a cron, be triggered by
  another service, or be driven from your own tooling.
• Task concurrency capped at 10. Upstream defaults to 9999; since every task forks its own
  Ansible process, that default makes any memory limit theoretical.
• PostgreSQL through the platform addon. No bundled database to back up separately.

Links

Package repository: https://github.com/OrcVole/semaphore-cloudron

Versions feed: https://raw.githubusercontent.com/OrcVole/semaphore-cloudron/main/CloudronVersions.json

Upstream project: https://semaphoreui.com — source at https://github.com/semaphoreui/semaphore

How to install

The easiest route, and the one that gets you automatic updates: in the App Store, open the Add
custom app dropdown at the top right, choose Community app, and paste the versions URL above
into the box that appears.

https://raw.githubusercontent.com/OrcVole/semaphore-cloudron/main/CloudronVersions.json

️ Requirements and first run

Minimums: 1 GiB memory, addons localstorage, postgresql, oidc. No extra subdomain.

First run: an administrator is created for you. Open a Terminal for the app and run
cat /app/data/.initial-admin to get the password, sign in as admin, change it, then promote your
own account from Team → Users.

That last step is not optional bookkeeping. Accounts arriving through Cloudron single sign-on are external users and are never administrators, and upstream does not let non-administrators create
projects, so without promoting yourself, signing in with SSO leaves you looking at an empty app.

One more thing worth knowing: Semaphore's "disable password login" setting only hides the password
form. The login endpoint keeps accepting credentials. Treat the admin password as live.

Back up /app/data/keys. It holds the key that decrypts every credential the app stores. It is
inside Cloudron's normal backups, so the only way to lose it is to restore selectively, but if it does go, the app keeps running and looks healthy while every stored credential is permanently
unreadable. semaphore vaults check --config /run/semaphore/config.json tells you the truth; every
key should say active.

For users

Why try it: you have playbooks, and the people who need to run them keep asking you to run them.

What you get: a browser front end for playbooks, inventories and credentials; scheduled runs and webhook triggers; per-project members and permissions, so someone can run the deploy without holding the keys it uses.

Cloudron wins: single sign-on, TLS, backups and updates all handled by the platform, and the encryption key is generated per install rather than shared with everyone who downloaded the same compose file.

🧰 For packagers: what we learned

What helped the platform's postgresql and oidc addons covered the whole dependency list; nothing needed bundling. Existing community packages were the reference for the versions feed shape.

What was tricky:

• The runtime user's home is read-only, and Ansible wants $HOME/.ansible/tmp. It needs HOME, and
  separately ANSIBLE_REMOTE_TEMP — the second is the one that breaks module transfer, and a
  playbook using only debug will happily pass without revealing it.
• Semaphore runs tasks with a sanitised environment, forwarding only variables it is told to. So
  exporting from the start script does not reach Ansible; the configuration has to live somewhere the
  package owns, which is /etc/ansible/ansible.cfg.
• A platform restore returns /app/data owned by a different uid. Git then refuses every stored
  repository as "dubious ownership" and every task fails at the clone — while row counts, checksums,
  health and login all look perfect. The start script takes ownership of the whole volume.
• The PostgreSQL port belongs inside the host value as host:port; there is no separate port
  setting, and sslmode=disable is needed because the addon serves no TLS.

Still rough We would welcome a second pair of eyes on a cold install from the feed onto a fresh subdomain, and on behaviour with a large existing playbook repository.

️ For the Cloudron team

Maintenance burden: low. The package is a build of one Go binary plus Ansible from the distribution, with no patched application code, upstream releases drop straight in with a version bump. Upstream ships often, roughly fortnightly with point releases between.

Why it suits the App Store: Ansible is the obvious automation tool for exactly the audience that runs a Cloudron, and until now running it meant a terminal and a laptop that happened to be on. It uses the platform's own identity rather than reimplementing users, and it has no bundled datastore.

For Semaphore's developers

Thank you! The configuration surface is clean, the OIDC support is in the community build, and the keyring with vaults check and vaults rekey is a good piece of design that made the custody decision easy.

Two things we would raise: password_login_disable is not enforced at the login endpoint, only in the interface; and web/src/assets/logo.svg is a leftover from the Vue
scaffold rather than your mark, which is a small trap for anyone packaging you.

Unlocks

Server maintenance that someone other than you can run. Patch windows as a scheduled task rather than an evening. Credentials that live in one encrypted store instead of on four laptops.

Synergies

Semaphore + Gitea or Forgejo: keep playbook repositories on the same box that runs them; Semaphore clones over the internal network and never needs an outside git host.

Semaphore + Uptime Kuma: point a Kuma alert at a Semaphore webhook integration so a failed check triggers the remediation playbook instead of a notification you read in the morning.

Semaphore + n8n: n8n handles the branching and the approvals, Semaphore does the part that needs Ansible, called through its REST API.

Semaphore + Grafana: dashboards for the fleet, and the tool that changes the fleet, on the same
login.

Semaphore + ntfy: task results pushed to your phone, which is the difference between a scheduled
playbook you trust and one you check.