Apply shared configuration ownership to the D&D pipeline

defaults/main.yml

@@ -7,6 +7,10 @@ dnd_pipeline_scriptorium_version: v0.13.0
 dnd_pipeline_manage_build_dependencies: true
 dnd_pipeline_go_snap_channel: 1.26/stable
 dnd_pipeline_go_binary: /snap/bin/go
+dnd_pipeline_runtime_user: narratio
+dnd_pipeline_runtime_group: narratio
+dnd_pipeline_config_directory_mode: "0755"
+dnd_pipeline_config_file_mode: "0644"
 dnd_pipeline_campaigns_repository_url: https://gitea.maximumdirect.net/eric/campaigns.git
 dnd_pipeline_campaigns_revision: main
 dnd_pipeline_campaigns_root: /usr/local/share/narratio/campaigns

meta/argument_specs.yml

@@ -35,6 +35,22 @@ argument_specs:
         type: path
         required: true
         description: Go executable passed to every application role.
+      dnd_pipeline_runtime_user:
+        type: str
+        required: true
+        description: Service account that owns suite-managed configuration.
+      dnd_pipeline_runtime_group:
+        type: str
+        required: true
+        description: Shared group for suite-managed configuration.
+      dnd_pipeline_config_directory_mode:
+        type: str
+        required: true
+        description: Mode for suite-managed configuration directories.
+      dnd_pipeline_config_file_mode:
+        type: str
+        required: true
+        description: Mode for suite-managed configuration files.
       dnd_pipeline_whisperx_transcribe_url:
         type: str
         required: true

meta/main.yml

@@ -17,6 +17,35 @@ galaxy_info:
     - transcript
     - processing
 dependencies:
+  - role: rakestraw.narratio
+    vars:
+      narratio_version: "{{ dnd_pipeline_narratio_version }}"
+      narratio_manage_build_dependencies: "{{ dnd_pipeline_manage_build_dependencies }}"
+      narratio_go_snap_channel: "{{ dnd_pipeline_go_snap_channel }}"
+      narratio_go_binary: "{{ dnd_pipeline_go_binary }}"
+      narratio_user: "{{ dnd_pipeline_runtime_user }}"
+      narratio_group: "{{ dnd_pipeline_runtime_group }}"
+      narratio_config_path: /usr/local/etc/narratio/pipeline.yml
+      narratio_config_owner: "{{ dnd_pipeline_runtime_user }}"
+      narratio_config_group: "{{ dnd_pipeline_runtime_group }}"
+      narratio_config_directory_mode: "{{ dnd_pipeline_config_directory_mode }}"
+      narratio_config_file_mode: "{{ dnd_pipeline_config_file_mode }}"
+      narratio_whisperx_transcribe_url: "{{ dnd_pipeline_whisperx_transcribe_url }}"
+      narratio_campaigns_root: "{{ dnd_pipeline_campaigns_root }}"
+      narratio_configkit_imports:
+        - path: conf.d/processing.yml
+        - path: artifacts/session-recap.yml
+        - path: artifacts/hostile-rumors.yml
+        - path: artifacts/deranged-rumors.yml
+        - path: artifacts/scene-map.yml
+        - path: artifact-families/character-meta-analysis.yml
+      narratio_seriatim_binary: /usr/local/bin/seriatim
+      narratio_audita_binary: /usr/local/bin/audita
+      narratio_audita_config_path: /usr/local/etc/audita/config.yml
+      narratio_notarius_binary: /usr/local/bin/notarius
+      narratio_notarius_config_path: /usr/local/etc/notarius/config.yml
+      narratio_scriptorium_binary: /usr/local/bin/scriptorium
+      narratio_scriptorium_config_path: /usr/local/etc/scriptorium/config.yml
   - role: rakestraw.seriatim
     vars:
       seriatim_version: "{{ dnd_pipeline_seriatim_version }}"
@@ -29,6 +58,10 @@ dependencies:
       audita_manage_build_dependencies: "{{ dnd_pipeline_manage_build_dependencies }}"
       audita_go_snap_channel: "{{ dnd_pipeline_go_snap_channel }}"
       audita_go_binary: "{{ dnd_pipeline_go_binary }}"
+      audita_config_owner: "{{ dnd_pipeline_runtime_user }}"
+      audita_config_group: "{{ dnd_pipeline_runtime_group }}"
+      audita_config_directory_mode: "{{ dnd_pipeline_config_directory_mode }}"
+      audita_config_file_mode: "{{ dnd_pipeline_config_file_mode }}"
       audita_pipeline_modules: "{{ dnd_pipeline_audita_pipeline_modules }}"
       audita_output_schema: "{{ dnd_pipeline_audita_output_schema }}"
       audita_llm_proposal_base_url: "{{ dnd_pipeline_audita_llm_proposal_base_url }}"
@@ -64,35 +97,19 @@ dependencies:
       notarius_manage_build_dependencies: "{{ dnd_pipeline_manage_build_dependencies }}"
       notarius_go_snap_channel: "{{ dnd_pipeline_go_snap_channel }}"
       notarius_go_binary: "{{ dnd_pipeline_go_binary }}"
+      notarius_config_owner: "{{ dnd_pipeline_runtime_user }}"
+      notarius_config_group: "{{ dnd_pipeline_runtime_group }}"
+      notarius_config_directory_mode: "{{ dnd_pipeline_config_directory_mode }}"
+      notarius_config_file_mode: "{{ dnd_pipeline_config_file_mode }}"
   - role: rakestraw.scriptorium
     vars:
       scriptorium_version: "{{ dnd_pipeline_scriptorium_version }}"
       scriptorium_manage_build_dependencies: "{{ dnd_pipeline_manage_build_dependencies }}"
       scriptorium_go_snap_channel: "{{ dnd_pipeline_go_snap_channel }}"
       scriptorium_go_binary: "{{ dnd_pipeline_go_binary }}"
+      scriptorium_config_owner: "{{ dnd_pipeline_runtime_user }}"
+      scriptorium_config_group: "{{ dnd_pipeline_runtime_group }}"
+      scriptorium_config_directory_mode: "{{ dnd_pipeline_config_directory_mode }}"
+      scriptorium_config_file_mode: "{{ dnd_pipeline_config_file_mode }}"
       scriptorium_prompt_dir: "{{ dnd_pipeline_prompt_library_root ~ '/prompts' }}"
       scriptorium_schema_dir: "{{ dnd_pipeline_prompt_library_root ~ '/schemas' }}"
-  - role: rakestraw.narratio
-    vars:
-      narratio_version: "{{ dnd_pipeline_narratio_version }}"
-      narratio_manage_build_dependencies: "{{ dnd_pipeline_manage_build_dependencies }}"
-      narratio_go_snap_channel: "{{ dnd_pipeline_go_snap_channel }}"
-      narratio_go_binary: "{{ dnd_pipeline_go_binary }}"
-      narratio_group: narratio
-      narratio_config_path: /usr/local/etc/narratio/pipeline.yml
-      narratio_whisperx_transcribe_url: "{{ dnd_pipeline_whisperx_transcribe_url }}"
-      narratio_campaigns_root: "{{ dnd_pipeline_campaigns_root }}"
-      narratio_configkit_imports:
-        - path: conf.d/processing.yml
-        - path: artifacts/session-recap.yml
-        - path: artifacts/hostile-rumors.yml
-        - path: artifacts/deranged-rumors.yml
-        - path: artifacts/scene-map.yml
-        - path: artifact-families/character-meta-analysis.yml
-      narratio_seriatim_binary: /usr/local/bin/seriatim
-      narratio_audita_binary: /usr/local/bin/audita
-      narratio_audita_config_path: /usr/local/etc/audita/config.yml
-      narratio_notarius_binary: /usr/local/bin/notarius
-      narratio_notarius_config_path: /usr/local/etc/notarius/config.yml
-      narratio_scriptorium_binary: /usr/local/bin/scriptorium
-      narratio_scriptorium_config_path: /usr/local/etc/scriptorium/config.yml

requirements.yml

@@ -7,16 +7,16 @@ roles:
   - name: rakestraw.audita
     src: https://gitea.maximumdirect.net/eric/ansible-role-audita.git
     scm: git
-    version: d2d0b9d00b3b491ce7613ccfc8f686f3d1fa0896
+    version: 66ebea9a47ce82bfdbdc5e2855f3dfaaff8e2a16
   - name: rakestraw.notarius
     src: https://gitea.maximumdirect.net/eric/ansible-role-notarius.git
     scm: git
-    version: cfecf37261f2595d45113235c591ee102d6f181f
+    version: e9ae2dc34023e1e8462bf0991de62b97d8c0e0ee
   - name: rakestraw.scriptorium
     src: https://gitea.maximumdirect.net/eric/ansible-role-scriptorium.git
     scm: git
-    version: 8f47aa802a5e0c9dae9c0f43a1c70b3512b2c8b2
+    version: 8b4c86e48e7d8655e479b26dc510bf01683a0c8f
   - name: rakestraw.narratio
     src: https://gitea.maximumdirect.net/eric/ansible-role-narratio.git
     scm: git
-    version: 7feff4728a5968b6b1dd87e83add9fa1a9066b18
+    version: eeb1105590e638c1f46b42c98a5dbbce4ddeea86

tasks/main.yml

@@ -5,7 +5,7 @@
     path: "{{ dnd_pipeline_prompt_library_root }}"
     state: directory
     owner: root
-    group: narratio
+    group: "{{ dnd_pipeline_runtime_group }}"
     mode: "0755"
 
 - name: Deploy the campaign registry
@@ -31,9 +31,9 @@
   ansible.builtin.file:
     path: "/usr/local/etc/narratio/{{ item }}"
     state: directory
-    owner: root
-    group: narratio
-    mode: "0750"
+    owner: "{{ dnd_pipeline_runtime_user }}"
+    group: "{{ dnd_pipeline_runtime_group }}"
+    mode: "{{ dnd_pipeline_config_directory_mode }}"
   loop:
     - conf.d
     - artifacts
@@ -45,9 +45,9 @@
   ansible.builtin.template:
     src: "{{ item.src }}"
     dest: "/usr/local/etc/narratio/{{ item.dest }}"
-    owner: root
-    group: narratio
-    mode: "0640"
+    owner: "{{ dnd_pipeline_runtime_user }}"
+    group: "{{ dnd_pipeline_runtime_group }}"
+    mode: "{{ dnd_pipeline_config_file_mode }}"
   loop:
     - src: processing.yml.j2
       dest: conf.d/processing.yml