Semaphore UI

Last reviewed Sep 13, 2026 · 836 words

Semaphore UI is the Ansible front end you can have running in 10 minutes on 256 MB of RAM, and it covers everything a homelab or small team needs from AWX without the Kubernetes operator, the four containers, and the 4 GB of memory AWX asks for before it does anything. It is a single Go binary with Ansible bundled into the Docker image, it stores state in an embedded BoltDB by default, and recent releases run Terraform and OpenTofu plans as well as playbooks. The honest limit is at the top end: if you need workflow orchestration across dozens of teams, AWX is still the bigger machine.

Ten minutes to a working playbook runner

services:
  semaphore:
    image: semaphoreui/semaphore:latest
    ports:
      - "3000:3000"
    environment:
      SEMAPHORE_DB_DIALECT: bolt
      SEMAPHORE_ADMIN: admin
      SEMAPHORE_ADMIN_PASSWORD: change-this-now
      SEMAPHORE_ADMIN_NAME: Admin
      SEMAPHORE_ADMIN_EMAIL: [email protected]
      SEMAPHORE_ACCESS_KEY_ENCRYPTION: paste-32-random-bytes-base64
    volumes:
      - ./semaphore:/var/lib/semaphore
    restart: unless-stopped

Generate the encryption key with head -c32 /dev/urandom | base64 before first start; it encrypts the SSH keys and passwords you will store in the key store, and changing it later means re-entering every secret. BoltDB is fine for one person or a small team. Switch SEMAPHORE_DB_DIALECT to postgres or mysql when several people are queuing runs at once or you want a database you already back up.

The five objects you set up, in order

Semaphore's model is small enough to hold in your head. A project contains a key store (SSH private keys, login/password pairs, vault passwords), repositories (a Git URL plus the key that can read it), inventories (a static host list or a file path inside the repo), environments (extra variables and secrets as JSON), and task templates that tie one of each together with a playbook path. Run a template and you get a live log streamed to the browser, a history entry with who ran what against which commit, and a stop button that actually stops.

Set them up in that order, because each one references the previous. The mistake I see most is putting the inventory in the UI as a static list: point it at inventory/hosts.yml inside the repository instead, so the inventory is versioned with the playbooks and a git push is the only deploy step.

Scheduling and access control are the reason to bother

You can run ansible-playbook from a shell. What the UI buys you is cron scheduling on any template, so the weekly apt upgrade playbook and the nightly backup verification run without you, and role-based access so the person who is allowed to restart a service is not the person who can rotate the SSH keys. Roles are per project: owner, manager, task runner, guest. Add LDAP or OpenID login and the audit log answers "who ran this at 02:00" without a Slack archaeology session. If you also run Gitea or Forgejo, a webhook from a push to a template's API endpoint turns Semaphore into a small deployment pipeline for infrastructure repos.

Terraform and OpenTofu, with a caveat

Templates can be typed as Ansible, Terraform, OpenTofu, PowerShell, Python, or plain Bash, so the same scheduler and audit trail cover a tofu apply on your Proxmox provider as they cover a playbook. State stays wherever your backend config says it does; Semaphore is the runner, not the state store, and I would keep it that way. A few features sit behind the Pro tier, mostly the higher-end team and workflow items, and the project is open about which. The open-source MIT core is not a crippled trial. OpenTofu is the default I'd pick for the Terraform-shaped templates, given the licensing history.

Where AWX is still the right answer

AWX gives you workflow templates that chain jobs with branching on success or failure, surveys that prompt the runner for inputs, execution environments as container images, and much deeper RBAC. Semaphore has survey-style variables and simple chaining but nothing like the workflow graph. If your organisation runs Ansible as a platform for 50 people, budget the Kubernetes and go with AWX. If you have a rack, a few VPSes, and 30 playbooks, AWX is a week of setup for features you will not touch. For the "cron with a UI and per-host secrets" job specifically, Rundeck is the other candidate, but it is a heavier Java service and does not understand Ansible natively.

What I'd do

Semaphore in Docker with Postgres from day one (BoltDB migrations are more hassle than one extra container), the key store encryption set before the first secret goes in, inventories in Git, and every recurring playbook moved onto a schedule within the first week. Back up the database and the encryption key together, because one without the other is useless. Revisit AWX only when you find yourself drawing workflow diagrams that Semaphore cannot express, which for most homelabs and small teams is never.