eric/ansible-role-dnd-pipeline
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Document and test pipeline credential delivery

Browse Source
This commit is contained in:
Eric Rakestraw
2026-09-16 20:05:53 +00:00
parent 28a4d2762f
commit 8ff0761820
2 changed files with 79 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

54
README.md
View File

@@ -40,7 +40,7 @@ The compatible application versions are selected through these variables:
| Variable | Default |
| --- | --- |
| `dnd_pipeline_audita_version` | `v0.9.1` |
| `dnd_pipeline_narratio_version` | `v2.0.0` |
| `dnd_pipeline_narratio_version` | `v2.1.0` |
| `dnd_pipeline_notarius_version` | `v0.7.0` |
| `dnd_pipeline_seriatim_version` | `v1.5.0` |
| `dnd_pipeline_scriptorium_version` | `v0.13.0` |
@@ -97,7 +97,7 @@ chosen policy value when their deployment requires it.
| `dnd_pipeline_audita_pipeline_modules` | `glossary`, `homophones`, `glossary`, `spoken_word`, `grammar` |
| `dnd_pipeline_audita_output_schema` | `audita-v1` |
| `dnd_pipeline_audita_llm_proposal_*` | `https://inference.ai.rakestrawhome.com/v1`, `google/gemma-4-31b-it`, `AUDITA_LLM_API_KEY`, `900s`, `3` |
| `dnd_pipeline_audita_llm_validation_*` | `https://inference.ai.rakestrawhome.com/v1`, `google/gemma-4-31b-it`, `AUDITA_VALIDATION_LLM_API_KEY`, `900s`, `3` |
| `dnd_pipeline_audita_llm_validation_*` | `https://inference.ai.rakestrawhome.com/v1`, `google/gemma-4-31b-it`, `AUDITA_LLM_API_KEY`, `900s`, `3` |
| `dnd_pipeline_audita_concurrency_*` | total, proposal, and validation concurrency of `4` |
| `dnd_pipeline_audita_chunking_*` | `8` target sections, `6144` maximum and `2048` minimum section tokens |
| `dnd_pipeline_audita_normalization_*` | `3s` maximum and ellipsis gaps, `240s` maximum duration, `2048` maximum tokens |
@@ -105,10 +105,11 @@ chosen policy value when their deployment requires it.
| `dnd_pipeline_audita_context_description` | D&D-game transcript context, including possible pre- and post-session banter |
| `dnd_pipeline_audita_diagnostics_*` | `/tmp/audita`, retained automatically |
The API-key values themselves are never managed by this role. The two
environment-variable names above are configuration only. Audita owns its
endpoint, model, tuning, and diagnostics configuration; Narratio receives its
managed Audita configuration path and supplies the run-specific output path.
Audita's proposal and validation settings independently remain overrideable,
but both default to the one typed `AUDITA_LLM_API_KEY` reference Narratio can
forward. Audita owns its endpoint, model, tuning, and diagnostics configuration;
Narratio receives its managed Audita configuration path and supplies the
run-specific output path.
| Variable | Default |
| --- | --- |
@@ -188,6 +189,8 @@ The Notarius root configuration imports the fixed
| `dnd_pipeline_notarius_cache_chunk_plans_mode` | `auto` |
| `dnd_pipeline_notarius_cache_checkpoints_enabled` | `true` |
| `dnd_pipeline_narratio_notarius_pipeline_id` | `dnd-session` |
| `dnd_pipeline_narratio_notarius_llm_api_key` | `OPENROUTER_API_KEY` |
| `dnd_pipeline_narratio_notarius_resume` | `true` |
| `dnd_pipeline_narratio_notarius_references` | `party`, `players`, and `glossary` prepared sources |
| `dnd_pipeline_narratio_notarius_outputs` | Complete native map of ten accepted D&D lanes |
@@ -203,7 +206,10 @@ that input. The accepted sources are
`scene_descriptions`, `item_occurrences`, `spells`, `combat_turns`,
`npc_occurrences`, `location_occurrences`, and `enemy_events`.
Chunk plans use `auto` caching and checkpoints are recorded but not resumed.
Narratio forwards the typed `OPENROUTER_API_KEY` reference to the selected
Notarius profile and ordinary extraction requests checkpoint reuse with
`resume: true`. Chunk plans use Notarius's root-owned `auto` policy; the
pipeline deliberately leaves Narratio's optional `chunk_cache` override unset.
The `chunk-plans` and `checkpoints` paths derive from the cache root and are
created by Notarius during use. Base and `testing` configurations select the
same `dnd-extraction` profile and Notarius pipeline; the testing overlay changes
@@ -232,9 +238,8 @@ inspection shows enabled sources, inferred dependencies, and generated family
members; the diff shows the overlay's profile selections without modifying
managed files.
API keys, storage and publishing, operator selection and
group-membership management, scheduling, and end-to-end external execution
remain deferred.
Storage and publishing, operator selection and group-membership management,
scheduling, and end-to-end external execution remain deferred.
### Shared execution filesystem
@@ -258,9 +263,32 @@ play can manage its selected operator separately:
```
Configuration, transcripts, caches, generated artifacts, campaign data,
prompts, and logs are non-secret D&D content. API keys and other credentials
remain deferred to a future restricted `secrets/` subtree; this role does not
create or populate that subtree.
prompts, and logs are non-secret D&D content. Credentials use the restricted
`/usr/local/etc/narratio/secrets` subtree, owned by the selected runtime user
and group with mode `0750`; managed files use mode `0640`. Runtime-group
membership authorizes use of these shared credentials, while the subtree grants
no world access. Ordinary configuration remains world-readable and contains
only reference names.
### Managed credentials
`dnd_pipeline_secrets` defaults to `{}`. Its keys must be valid environment
variable names, and each value is either a nonempty string to manage as the
exact named credential file or `null` to remove that exact file. Omitted names
are unmanaged: the role neither mirrors nor purges the directory. Narratio
loads this conventional sibling directory before configuration resolution; an
already-set process environment value takes precedence. The role adds no
wrapper, service, or parallel credential loader.
Keep values in encrypted inventory, for example with Ansible Vault; Vault is a
consumer workflow, not role functionality:
```yaml
dnd_pipeline_secrets:
AUDITA_LLM_API_KEY: "{{ vault_dnd_audita_llm_api_key }}"
OPENROUTER_API_KEY: "{{ vault_dnd_openrouter_api_key }}"
RETIRED_PROVIDER_KEY: null
```
## Validation

38
tests/integration
View File

@@ -123,6 +123,10 @@ grep -Fq 'lane_id: item-registry' "$narratio_effective_config"
/usr/bin/sudo -u "$operator_user" /usr/local/bin/notarius config validate \
--config /usr/local/etc/notarius/config.yml --pipeline dnd-session
/usr/bin/sudo -u nobody /bin/cat /usr/local/etc/narratio/pipeline.yml >/dev/null
if /usr/bin/sudo -u nobody /usr/local/bin/narratio config validate \
--config /usr/local/etc/narratio/pipeline.yml --campaign centaurs; then
exit 1
fi
/usr/bin/sudo -u narratio /bin/sh -c \
"umask 077; mkdir '$shared_fixture_root'; printf '%s\\n' service-created > '$service_fixture_file'"
/usr/bin/sudo -u "$operator_user" /bin/sh -c \
@@ -155,6 +159,40 @@ baseline_repeat_log="$test_tmp/baseline-repeat.log"
run_converge "$baseline_repeat_log" "${baseline_args[@]}"
require_clean_recap "$baseline_repeat_log"
invalid_key_log="$test_tmp/invalid-key.log"
if run_converge "$invalid_key_log" "${baseline_args[@]}" \
-e '{"dnd_pipeline_secrets":{"INVALID-KEY":"invalid-key-synthetic-value"}}'; then
exit 1
fi
invalid_value_log="$test_tmp/invalid-value.log"
if run_converge "$invalid_value_log" "${baseline_args[@]}" \
-e '{"dnd_pipeline_secrets":{"EMPTY_VALUE_KEY":""}}'; then
exit 1
fi
removal_key=NARRATIO_TEST_REMOVAL_KEY
removal_value=removal-synthetic-value
removal_present_config="{\"dnd_pipeline_secrets\":{\"AUDITA_LLM_API_KEY\":\"$synthetic_audita_api_key\",\"OPENROUTER_API_KEY\":\"$synthetic_notarius_api_key\",\"$removal_key\":\"$removal_value\"},\"dnd_pipeline_narratio_notarius_llm_api_key\":\"$removal_key\"}"
removal_present_log="$test_tmp/removal-present.log"
run_converge "$removal_present_log" "${baseline_args[@]}" -e "$removal_present_config"
removal_present_validation_log="$test_tmp/removal-present-validation.log"
/usr/bin/sudo -u narratio /usr/local/bin/narratio config validate \
--config /usr/local/etc/narratio/pipeline.yml --campaign centaurs | tee "$removal_present_validation_log"
removal_absent_config="{\"dnd_pipeline_secrets\":{\"AUDITA_LLM_API_KEY\":\"$synthetic_audita_api_key\",\"OPENROUTER_API_KEY\":\"$synthetic_notarius_api_key\",\"$removal_key\":null},\"dnd_pipeline_narratio_notarius_llm_api_key\":\"$removal_key\"}"
removal_absent_log="$test_tmp/removal-absent.log"
run_converge "$removal_absent_log" "${baseline_args[@]}" -e "$removal_absent_config"
removal_absent_validation_log="$test_tmp/removal-absent-validation.log"
if /usr/bin/sudo -u narratio /usr/local/bin/narratio config validate \
--config /usr/local/etc/narratio/pipeline.yml --campaign centaurs | tee "$removal_absent_validation_log"; then
exit 1
fi
removal_absent_repeat_log="$test_tmp/removal-absent-repeat.log"
run_converge "$removal_absent_repeat_log" "${baseline_args[@]}" -e "$removal_absent_config"
require_clean_recap "$removal_absent_repeat_log"
! grep -Fq "$synthetic_audita_api_key" "$baseline_log" "$removal_present_log" "$removal_absent_log" "$removal_present_validation_log" "$removal_absent_validation_log"
! grep -Fq "$synthetic_notarius_api_key" "$baseline_log" "$removal_present_log" "$removal_absent_log" "$removal_present_validation_log" "$removal_absent_validation_log"
! grep -Fq "$removal_value" "$removal_present_log" "$removal_absent_log" "$removal_present_validation_log" "$removal_absent_validation_log"
testing_profile_log="$test_tmp/testing-profile.log"
run_converge "$testing_profile_log" "${baseline_args[@]}" \
-e 'dnd_pipeline_narratio_testing_scriptorium_profile=endpoint-profile'