111 lines
4.4 KiB
Markdown
111 lines
4.4 KiB
Markdown
# Ansible Role: Audita
|
|
|
|
Installs and configures [Audita](https://gitea.maximumdirect.net/eric/audita)
|
|
from source on Ubuntu 26.04 (`x86_64` or `aarch64`). The role requires gathered
|
|
facts and uses privilege escalation on tasks that install dependencies or
|
|
manage root-owned application state.
|
|
|
|
## Variables
|
|
|
|
```yaml
|
|
audita_version: v2.0.1
|
|
audita_repository_url: https://gitea.maximumdirect.net/eric/audita.git
|
|
audita_source_dir: /usr/local/src/audita
|
|
audita_binary_path: /usr/local/bin/audita
|
|
audita_manage_build_dependencies: true
|
|
audita_go_snap_channel: 1.26/stable
|
|
audita_go_binary: /snap/bin/go
|
|
audita_config_path: /usr/local/etc/audita/config.yml
|
|
audita_config_owner: root
|
|
audita_config_group: root
|
|
audita_config_directory_mode: "0755"
|
|
audita_config_file_mode: "0644"
|
|
audita_config_version: 2
|
|
audita_profiles_dir: null
|
|
# Required caller inputs: audita_backends, audita_llm_proposal_profile
|
|
audita_pipeline_modules: null
|
|
audita_output_schema: null
|
|
audita_llm_validation_profile: null
|
|
audita_llm_transient_retries: null
|
|
audita_llm_repair_attempts: null
|
|
audita_llm_operation_timeout: null
|
|
audita_validation_max_prompt_tokens: null
|
|
audita_chunking_target_sections: null
|
|
audita_chunking_max_section_tokens: null
|
|
audita_chunking_min_section_tokens: null
|
|
audita_normalization_max_segment_gap: null
|
|
audita_normalization_ellipsis_gap: null
|
|
audita_normalization_max_segment_duration: null
|
|
audita_normalization_max_segment_tokens: null
|
|
audita_thresholds_glossary: null
|
|
audita_thresholds_homophones: null
|
|
audita_thresholds_spoken_word: null
|
|
audita_thresholds_grammar: null
|
|
audita_context_description: null
|
|
audita_reporting_enabled: null
|
|
audita_reporting_stdout_dir: null
|
|
audita_diagnostics_debug: null
|
|
audita_diagnostics_work_dir: null
|
|
```
|
|
|
|
When `audita_manage_build_dependencies` is `false`, Git and the executable
|
|
selected by `audita_go_binary` must already be available. Otherwise, the role
|
|
installs Git with APT and the classic Go Snap from `audita_go_snap_channel`.
|
|
|
|
The checkout is authoritative: local source changes are discarded while
|
|
selecting `audita_version`. The role builds Audita directly to
|
|
`audita_binary_path` using `audita_go_binary`, `CGO_ENABLED=0`, `GOWORK=off`,
|
|
`GOTOOLCHAIN=local`, `-trimpath`, and release linker metadata. It rebuilds when
|
|
the checkout changes or the binary is absent. The source tree is recursively
|
|
owned by `root:root`; the binary is `root:root` mode `0755`.
|
|
|
|
The configuration variables map directly to Audita's version-2 YAML fields.
|
|
`audita_backends` and `audita_llm_proposal_profile` are required caller inputs;
|
|
the role has no defaults for them. Callers own the selected PromptKit profile
|
|
files. Every optional variable defaults to `null`; null values and their empty
|
|
parent sections are omitted, allowing Audita to retain ownership of its built-in
|
|
defaults. `audita_config_version` always renders as `version` and defaults to
|
|
`2`. The role manages `audita_config_path | dirname` and the resulting file
|
|
with the `audita_config_owner`, `audita_config_group`,
|
|
`audita_config_directory_mode`, and `audita_config_file_mode` inputs. The
|
|
standalone defaults are `root:root`, directory mode `0755`, and file mode
|
|
`0644`. Composing roles may override these generic configuration inputs for
|
|
their own deployment policy.
|
|
|
|
Backend credential references name environment variables; they must never
|
|
contain secret values. The repository-local integration suite validates the
|
|
rendered file with Audita rather than executing the CLI during production
|
|
convergence.
|
|
|
|
## Example
|
|
|
|
```yaml
|
|
- hosts: audita_hosts
|
|
roles:
|
|
- role: ansible-role-audita
|
|
vars:
|
|
audita_backends:
|
|
local:
|
|
endpoint: http://127.0.0.1:11434/v1
|
|
credential: null
|
|
audita_llm_proposal_profile: local-proposal
|
|
```
|
|
|
|
The caller supplies `profiles/local-proposal.yaml` beside the managed
|
|
configuration before invoking Audita.
|
|
|
|
## Validation
|
|
|
|
The integration driver installs pinned collection dependencies, runs syntax
|
|
checking and ansible-lint, validates a caller-supplied local configuration and
|
|
profile offline, and requires clean repeated convergence. It also tests a
|
|
caller-supplied Go executable with dependency management disabled after removing
|
|
the managed binary. On a fresh host, the role may install Git through APT and
|
|
the Go Snap. The test uses a private temporary configuration and profile root;
|
|
the role still manages the local source checkout and binary. Cleanup removes
|
|
only the private fixture root:
|
|
|
|
```sh
|
|
tests/integration
|
|
```
|