From 1ec54ad5025c15d8fafea0b1304d986660158750 Mon Sep 17 00:00:00 2001
From: bitwhisker <bitwhisker@noreply.git.hamburg.ccc.de>
Date: Fri, 7 Aug 2026 23:10:54 +0200
Subject: [PATCH] secrets(role): add parent folder settings

---
 roles/secrets/README.md                |  7 +++++++
 roles/secrets/meta/argument_specs.yaml | 10 ++++++++++
 roles/secrets/tasks/main.yaml          |  6 +++---
 3 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/roles/secrets/README.md b/roles/secrets/README.md
index ec04665eb0..dc5e5bd723 100644
--- a/roles/secrets/README.md
+++ b/roles/secrets/README.md
@@ -22,3 +22,10 @@ None.
   Defaults to `root`.
 - `secrets__secrets.*.mode`: The mode of the secret file.
   Defaults to `0640`.
+- `secrets__folder.owner`: The owner of `/etc/ansible_secrets`.
+  Defaults to `root`.
+- `secrets__folder.group`: The group of `/etc/ansible_secrets`.
+  Defaults to `root`.
+- `secrets__folder.mode`: The mode of `/etc/ansible_secrets`.
+  Defaults to `0750`.
+
diff --git a/roles/secrets/meta/argument_specs.yaml b/roles/secrets/meta/argument_specs.yaml
index 256213890d..2856d57762 100644
--- a/roles/secrets/meta/argument_specs.yaml
+++ b/roles/secrets/meta/argument_specs.yaml
@@ -4,3 +4,13 @@ argument_specs:
       secrets__secrets:
         type: list
         required: false
+      secrets__folder:
+        owner:
+          type: string
+          required: false
+        group:
+          type: string
+          required: false
+        mode:
+          type: string
+          required: false
diff --git a/roles/secrets/tasks/main.yaml b/roles/secrets/tasks/main.yaml
index 8923397d55..3d77b50be3 100644
--- a/roles/secrets/tasks/main.yaml
+++ b/roles/secrets/tasks/main.yaml
@@ -35,9 +35,9 @@
   ansible.builtin.file:
     path: "/etc/ansible_secrets"
     state: directory
-    owner: root
-    group: root
-    mode: "0750"
+    owner: "{{ secrets__folder.owner | default('root') }}"
+    group: "{{ secrets__folder.group | default('root') }}"
+    mode: "{{ secrets__folder.mode | default('0750') }}"
   become: true
 
 - name: ensure secrets are present