Add managed credentials to the D&D pipeline

tasks/main.yml

@@ -7,6 +7,51 @@
     update_cache: true
     cache_valid_time: 3600
 
+- name: Validate managed Narratio credential entries
+  ansible.builtin.assert:
+    that:
+      - item.key is string
+      - item.key is match('^[A-Za-z_][A-Za-z0-9_]*$')
+      - item.value is none or (item.value is string and item.value | length > 0)
+  loop: "{{ dnd_pipeline_secrets | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
+  no_log: true
+
+- name: Create the Narratio secrets directory
+  become: true
+  ansible.builtin.file:
+    path: /usr/local/etc/narratio/secrets
+    state: directory
+    owner: "{{ dnd_pipeline_runtime_user }}"
+    group: "{{ dnd_pipeline_runtime_group }}"
+    mode: "0750"
+
+- name: Converge managed Narratio credentials
+  become: true
+  ansible.builtin.copy:
+    content: "{{ item.value }}"
+    dest: "/usr/local/etc/narratio/secrets/{{ item.key }}"
+    owner: "{{ dnd_pipeline_runtime_user }}"
+    group: "{{ dnd_pipeline_runtime_group }}"
+    mode: "0640"
+  loop: "{{ dnd_pipeline_secrets | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
+  when: item.value is not none
+  no_log: true
+
+- name: Remove explicitly unmanaged Narratio credentials
+  become: true
+  ansible.builtin.file:
+    path: "/usr/local/etc/narratio/secrets/{{ item.key }}"
+    state: absent
+  loop: "{{ dnd_pipeline_secrets | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
+  when: item.value is none
+  no_log: true
+
 - name: Create the Notarius cache root
   become: true
   ansible.builtin.file: