112 lines
4.6 KiB
Markdown
112 lines
4.6 KiB
Markdown
# Ansible Role: Audita
|
|
|
|
Installs and configures [Audita](https://gitea.maximumdirect.net/eric/audita)
|
|
from source on Ubuntu 26.04 (`x86_64` or `aarch64`). The role requires gathered
|
|
facts and uses privilege escalation on tasks that install dependencies or
|
|
manage root-owned application state.
|
|
|
|
## Variables
|
|
|
|
```yaml
|
|
audita_version: v0.9.1
|
|
audita_repository_url: https://gitea.maximumdirect.net/eric/audita.git
|
|
audita_source_dir: /usr/local/src/audita
|
|
audita_binary_path: /usr/local/bin/audita
|
|
audita_manage_build_dependencies: true
|
|
audita_go_snap_channel: 1.26/stable
|
|
audita_go_binary: /snap/bin/go
|
|
audita_config_path: /usr/local/etc/audita/config.yml
|
|
audita_config_owner: root
|
|
audita_config_group: root
|
|
audita_config_directory_mode: "0755"
|
|
audita_config_file_mode: "0644"
|
|
audita_config_version: 1
|
|
audita_pipeline_modules: null
|
|
audita_output_schema: null
|
|
audita_llm_proposal_base_url: null
|
|
audita_llm_proposal_model: null
|
|
audita_llm_proposal_api_key_env: null
|
|
audita_llm_proposal_timeout: null
|
|
audita_llm_proposal_max_retries: null
|
|
audita_llm_validation_base_url: null
|
|
audita_llm_validation_model: null
|
|
audita_llm_validation_api_key_env: null
|
|
audita_llm_validation_timeout: null
|
|
audita_llm_validation_max_retries: null
|
|
audita_concurrency_total_llm: null
|
|
audita_concurrency_proposal_llm: null
|
|
audita_concurrency_validation_llm: null
|
|
audita_chunking_target_sections: null
|
|
audita_chunking_max_section_tokens: null
|
|
audita_chunking_min_section_tokens: null
|
|
audita_normalization_max_segment_gap: null
|
|
audita_normalization_ellipsis_gap: null
|
|
audita_normalization_max_segment_duration: null
|
|
audita_normalization_max_segment_tokens: null
|
|
audita_thresholds_glossary: null
|
|
audita_thresholds_homophones: null
|
|
audita_thresholds_spoken_word: null
|
|
audita_thresholds_grammar: null
|
|
audita_context_description: null
|
|
audita_diagnostics_work_dir: null
|
|
audita_diagnostics_retention: null
|
|
```
|
|
|
|
When `audita_manage_build_dependencies` is `false`, Git and the executable
|
|
selected by `audita_go_binary` must already be available. Otherwise, the role
|
|
installs Git with APT and the classic Go Snap from `audita_go_snap_channel`.
|
|
|
|
The checkout is authoritative: local source changes are discarded while
|
|
selecting `audita_version`. The role builds Audita directly to
|
|
`audita_binary_path` using `audita_go_binary`, `CGO_ENABLED=0`, `GOWORK=off`,
|
|
`GOTOOLCHAIN=local`, `-trimpath`, and release linker metadata. It rebuilds when
|
|
the checkout changes or the binary is absent. The source tree is recursively
|
|
owned by `root:root`; the binary is `root:root` mode `0755`.
|
|
|
|
The configuration variables map directly to Audita's versioned YAML fields.
|
|
Every optional variable defaults to `null`; null values and their empty parent
|
|
sections are omitted, allowing Audita to retain ownership of its built-in
|
|
defaults. `audita_config_version` always renders as `version` and defaults to
|
|
`1`. The role manages `audita_config_path | dirname` and the resulting file
|
|
with the `audita_config_owner`, `audita_config_group`,
|
|
`audita_config_directory_mode`, and `audita_config_file_mode` inputs. The
|
|
standalone defaults are `root:root`, directory mode `0755`, and file mode
|
|
`0644`. Composing roles may override these generic configuration inputs for
|
|
their own deployment policy.
|
|
|
|
LLM API-key settings name environment variables through
|
|
`audita_llm_proposal_api_key_env` and `audita_llm_validation_api_key_env`; they
|
|
must never contain secret values. The repository-local integration suite
|
|
validates the rendered file with Audita rather than executing the CLI during
|
|
production convergence.
|
|
|
|
## Example
|
|
|
|
```yaml
|
|
- hosts: audita_hosts
|
|
roles:
|
|
- role: ansible-role-audita
|
|
```
|
|
|
|
## Validation
|
|
|
|
The integration driver installs pinned collection dependencies, runs syntax
|
|
checking and ansible-lint, and validates the default configuration with Audita
|
|
before requiring clean repeated convergence. It also covers one representative
|
|
field-specific configuration with nested values, null omission, and intentional
|
|
falsey values, then validates it natively. A combined recovery scenario proves
|
|
that a missing binary is rebuilt with a caller-supplied Go executable while
|
|
dependency management is disabled. Audita currently has no native
|
|
release-identity command, so the suite intentionally does not use a source
|
|
commit as a version-test proxy.
|
|
On a fresh host, default convergence may also install Git through APT, refresh
|
|
the APT cache, and install the Go Snap. Application state is limited to
|
|
`/usr/local/src/audita`, `/usr/local/bin/audita`, and
|
|
`/usr/local/etc/audita/config.yml`; temporary test-specific files remain inside
|
|
the suite's private temporary directory. The suite restores the default
|
|
deployment during cleanup:
|
|
|
|
```sh
|
|
tests/integration
|
|
```
|