Squashed 'roles/pipeline/' content from commit 600eb21

git-subtree-dir: roles/pipeline
git-subtree-split: 600eb21cd967831607c087f1773063636ff2c31b

tasks/main.yml

@@ -0,0 +1,174 @@
+---
+- name: Install ACL support
+  become: true
+  ansible.builtin.apt:
+    name: acl
+    state: present
+    update_cache: true
+    cache_valid_time: 3600
+
+- name: Validate managed Narratio credential entries
+  ansible.builtin.assert:
+    that:
+      - item.key is string
+      - item.key is match('^[A-Za-z_][A-Za-z0-9_]*$')
+      - item.value is string
+  loop: "{{ dnd_pipeline_secrets | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
+  no_log: true
+
+- name: Create the Narratio secrets directory
+  become: true
+  ansible.builtin.file:
+    path: /usr/local/etc/narratio/secrets
+    state: directory
+    owner: "{{ dnd_pipeline_runtime_user }}"
+    group: "{{ dnd_pipeline_runtime_group }}"
+    mode: "0750"
+
+- name: Converge managed Narratio credentials
+  become: true
+  ansible.builtin.copy:
+    content: "{{ item.value }}"
+    dest: "/usr/local/etc/narratio/secrets/{{ item.key }}"
+    owner: "{{ dnd_pipeline_runtime_user }}"
+    group: "{{ dnd_pipeline_runtime_group }}"
+    mode: "0640"
+  loop: "{{ dnd_pipeline_secrets | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
+  no_log: true
+
+- name: Create the Notarius cache root
+  become: true
+  ansible.builtin.file:
+    path: "{{ dnd_pipeline_notarius_cache_root }}"
+    state: directory
+    owner: "{{ dnd_pipeline_runtime_user }}"
+    group: "{{ dnd_pipeline_runtime_group }}"
+    mode: "2775"
+
+- name: Converge access ACLs on shared pipeline writable roots
+  become: true
+  ansible.posix.acl:
+    path: "{{ item.0 }}"
+    etype: "{{ item.1.etype }}"
+    permissions: "{{ item.1.permissions }}"
+    state: present
+  loop: >-
+    {{
+      ['/var/lib/narratio', '/var/spool/narratio', '/var/cache/narratio', dnd_pipeline_notarius_cache_root] |
+      product([
+        {'etype': 'user', 'permissions': 'rwx'},
+        {'etype': 'group', 'permissions': 'rwx'},
+        {'etype': 'other', 'permissions': 'r-x'},
+        {'etype': 'mask', 'permissions': 'rwx'}
+      ]) | list
+    }}
+  loop_control:
+    label: "{{ item.0 }} {{ item.1.etype }}::{{ item.1.permissions }}"
+
+- name: Converge default ACLs on shared pipeline writable roots
+  become: true
+  ansible.posix.acl:
+    path: "{{ item.0 }}"
+    etype: "{{ item.1.etype }}"
+    permissions: "{{ item.1.permissions }}"
+    default: true
+    state: present
+  loop: >-
+    {{
+      ['/var/lib/narratio', '/var/spool/narratio', '/var/cache/narratio', dnd_pipeline_notarius_cache_root] |
+      product([
+        {'etype': 'user', 'permissions': 'rwx'},
+        {'etype': 'group', 'permissions': 'rwx'},
+        {'etype': 'other', 'permissions': 'r-x'},
+        {'etype': 'mask', 'permissions': 'rwx'}
+      ]) | list
+    }}
+  loop_control:
+    label: "{{ item.0 }} default:{{ item.1.etype }}::{{ item.1.permissions }}"
+
+- name: Create the prompt-library root
+  become: true
+  ansible.builtin.file:
+    path: "{{ dnd_pipeline_prompt_library_root }}"
+    state: directory
+    owner: root
+    group: "{{ dnd_pipeline_runtime_group }}"
+    mode: "0755"
+
+- name: Deploy the campaign registry
+  become: true
+  ansible.builtin.git:
+    repo: "{{ dnd_pipeline_campaigns_repository_url }}"
+    dest: "{{ dnd_pipeline_campaigns_root }}"
+    version: "{{ dnd_pipeline_campaigns_revision }}"
+    update: true
+    force: true
+
+- name: Deploy the prompt library
+  become: true
+  ansible.builtin.git:
+    repo: "{{ dnd_pipeline_prompt_library_repository_url }}"
+    dest: "{{ dnd_pipeline_prompt_library_root }}"
+    version: "{{ dnd_pipeline_prompt_library_revision }}"
+    update: true
+    force: true
+
+- name: Create Narratio configuration directories
+  become: true
+  ansible.builtin.file:
+    path: "/usr/local/etc/narratio/{{ item }}"
+    state: directory
+    owner: "{{ dnd_pipeline_runtime_user }}"
+    group: "{{ dnd_pipeline_runtime_group }}"
+    mode: "{{ dnd_pipeline_config_directory_mode }}"
+  loop:
+    - conf.d
+    - artifacts
+    - artifact-families
+    - profiles
+
+- name: Create the Notarius pipeline configuration directory
+  become: true
+  ansible.builtin.file:
+    path: /usr/local/etc/notarius/pipelines
+    state: directory
+    owner: "{{ dnd_pipeline_runtime_user }}"
+    group: "{{ dnd_pipeline_runtime_group }}"
+    mode: "{{ dnd_pipeline_config_directory_mode }}"
+
+- name: Deploy the Notarius D&D pipeline configuration
+  become: true
+  ansible.builtin.template:
+    src: dnd-session.yml.j2
+    dest: /usr/local/etc/notarius/pipelines/dnd-session.yml
+    owner: "{{ dnd_pipeline_runtime_user }}"
+    group: "{{ dnd_pipeline_runtime_group }}"
+    mode: "{{ dnd_pipeline_config_file_mode }}"
+
+- name: Deploy Narratio D&D configuration fragments
+  become: true
+  ansible.builtin.template:
+    src: "{{ item.src }}"
+    dest: "/usr/local/etc/narratio/{{ item.dest }}"
+    owner: "{{ dnd_pipeline_runtime_user }}"
+    group: "{{ dnd_pipeline_runtime_group }}"
+    mode: "{{ dnd_pipeline_config_file_mode }}"
+  loop:
+    - src: processing.yml.j2
+      dest: conf.d/processing.yml
+    - src: session-recap.yml.j2
+      dest: artifacts/session-recap.yml
+    - src: hostile-rumors.yml.j2
+      dest: artifacts/hostile-rumors.yml
+    - src: deranged-rumors.yml.j2
+      dest: artifacts/deranged-rumors.yml
+    - src: scene-map.yml.j2
+      dest: artifacts/scene-map.yml
+    - src: character-meta-analysis.yml.j2
+      dest: artifact-families/character-meta-analysis.yml
+    - src: testing.yml.j2
+      dest: profiles/testing.yml