Make Audita configuration ownership configurable

README.md

@@ -16,6 +16,10 @@ audita_manage_build_dependencies: true
 audita_go_snap_channel: 1.26/stable
 audita_go_binary: /snap/bin/go
 audita_config_path: /usr/local/etc/audita/config.yml
+audita_config_owner: root
+audita_config_group: root
+audita_config_directory_mode: "0755"
+audita_config_file_mode: "0644"
 audita_config_version: 1
 audita_pipeline_modules: null
 audita_output_schema: null
@@ -63,8 +67,12 @@ The configuration variables map directly to Audita's versioned YAML fields.
 Every optional variable defaults to `null`; null values and their empty parent
 sections are omitted, allowing Audita to retain ownership of its built-in
 defaults. `audita_config_version` always renders as `version` and defaults to
-`1`. The role writes the resulting file to `audita_config_path` as `root:root`
+`1`. The role manages `audita_config_path | dirname` and the resulting file
-mode `0644`.
+with the `audita_config_owner`, `audita_config_group`,
+`audita_config_directory_mode`, and `audita_config_file_mode` inputs. The
+standalone defaults are `root:root`, directory mode `0755`, and file mode
+`0644`. Composing roles may override these generic configuration inputs for
+their own deployment policy.
 
 LLM API-key settings name environment variables through
 `audita_llm_proposal_api_key_env` and `audita_llm_validation_api_key_env`; they

defaults/main.yml

@@ -7,6 +7,10 @@ audita_manage_build_dependencies: true
 audita_go_snap_channel: 1.26/stable
 audita_go_binary: /snap/bin/go
 audita_config_path: /usr/local/etc/audita/config.yml
+audita_config_owner: root
+audita_config_group: root
+audita_config_directory_mode: "0755"
+audita_config_file_mode: "0644"
 audita_config_version: 1
 audita_pipeline_modules: null
 audita_output_schema: null

meta/argument_specs.yml

@@ -35,6 +35,22 @@ argument_specs:
         type: path
         required: true
         description: Managed Audita configuration path.
+      audita_config_owner:
+        type: str
+        required: true
+        description: Owner of the managed Audita configuration directory and file.
+      audita_config_group:
+        type: str
+        required: true
+        description: Group of the managed Audita configuration directory and file.
+      audita_config_directory_mode:
+        type: str
+        required: true
+        description: Mode of the managed Audita configuration directory.
+      audita_config_file_mode:
+        type: str
+        required: true
+        description: Mode of the managed Audita configuration file.
       audita_config_version:
         type: int
         required: true

tasks/main.yml

@@ -36,7 +36,15 @@
   loop:
     - "{{ audita_source_dir | dirname }}"
     - "{{ audita_binary_path | dirname }}"
-    - "{{ audita_config_path | dirname }}"
+
+- name: Create the Audita configuration directory
+  become: true
+  ansible.builtin.file:
+    path: "{{ audita_config_path | dirname }}"
+    state: directory
+    owner: "{{ audita_config_owner }}"
+    group: "{{ audita_config_group }}"
+    mode: "{{ audita_config_directory_mode }}"
 
 - name: Check out Audita source
   become: true
@@ -96,6 +104,6 @@
   ansible.builtin.template:
     src: config.yml.j2
     dest: "{{ audita_config_path }}"
-    owner: root
+    owner: "{{ audita_config_owner }}"
-    group: root
+    group: "{{ audita_config_group }}"
-    mode: "0644"
+    mode: "{{ audita_config_file_mode }}"