Manage shared pipeline access with ACLs

collections/requirements.yml

@@ -1,4 +1,6 @@
 ---
 collections:
+  - name: ansible.posix
+    version: 2.2.0
   - name: community.general
     version: 13.3.0

tasks/main.yml

@@ -1,4 +1,53 @@
 ---
+- name: Install ACL support
+  become: true
+  ansible.builtin.apt:
+    name: acl
+    state: present
+    update_cache: true
+    cache_valid_time: 3600
+
+- name: Converge access ACLs on Narratio writable roots
+  become: true
+  ansible.posix.acl:
+    path: "{{ item.0 }}"
+    etype: "{{ item.1.etype }}"
+    permissions: "{{ item.1.permissions }}"
+    state: present
+  loop: >-
+    {{
+      ['/var/lib/narratio', '/var/spool/narratio', '/var/cache/narratio'] |
+      product([
+        {'etype': 'user', 'permissions': 'rwx'},
+        {'etype': 'group', 'permissions': 'rwx'},
+        {'etype': 'other', 'permissions': 'r-x'},
+        {'etype': 'mask', 'permissions': 'rwx'}
+      ]) | list
+    }}
+  loop_control:
+    label: "{{ item.0 }} {{ item.1.etype }}::{{ item.1.permissions }}"
+
+- name: Converge default ACLs on Narratio writable roots
+  become: true
+  ansible.posix.acl:
+    path: "{{ item.0 }}"
+    etype: "{{ item.1.etype }}"
+    permissions: "{{ item.1.permissions }}"
+    default: true
+    state: present
+  loop: >-
+    {{
+      ['/var/lib/narratio', '/var/spool/narratio', '/var/cache/narratio'] |
+      product([
+        {'etype': 'user', 'permissions': 'rwx'},
+        {'etype': 'group', 'permissions': 'rwx'},
+        {'etype': 'other', 'permissions': 'r-x'},
+        {'etype': 'mask', 'permissions': 'rwx'}
+      ]) | list
+    }}
+  loop_control:
+    label: "{{ item.0 }} default:{{ item.1.etype }}::{{ item.1.permissions }}"
+
 - name: Create the prompt-library root
   become: true
   ansible.builtin.file: