secrets(role): add parent folder settings

roles/secrets/README.md

@@ -22,3 +22,10 @@ None.
   Defaults to `root`.
 - `secrets__secrets.*.mode`: The mode of the secret file.
   Defaults to `0640`.
+- `secrets__folder.owner`: The owner of `/etc/ansible_secrets`.
+  Defaults to `root`.
+- `secrets__folder.group`: The group of `/etc/ansible_secrets`.
+  Defaults to `root`.
+- `secrets__folder.mode`: The mode of `/etc/ansible_secrets`.
+  Defaults to `0750`.
+

roles/secrets/meta/argument_specs.yaml

@@ -4,3 +4,13 @@ argument_specs:
       secrets__secrets:
         type: list
         required: false
+      secrets__folder:
+        owner:
+          type: string
+          required: false
+        group:
+          type: string
+          required: false
+        mode:
+          type: string
+          required: false

roles/secrets/tasks/main.yaml

@@ -35,9 +35,9 @@
   ansible.builtin.file:
     path: "/etc/ansible_secrets"
     state: directory
-    owner: root
+    owner: "{{ secrets__folder.owner | default('root') }}"
-    group: root
+    group: "{{ secrets__folder.group | default('root') }}"
-    mode: "0750"
+    mode: "{{ secrets__folder.mode | default('0750') }}"
   become: true
 
 - name: ensure secrets are present