Ansible for Digital Provenance — Content Authenticity and C2PA Automation

---
- name: Deploy C2PA content signing service
  hosts: media_servers
  become: true
  vars:
    c2pa_version: "0.32.0"
    signing_cert_dir: /etc/c2pa/certs

  tasks:
    - name: Install c2patool
      ansible.builtin.get_url:
        url: "https://github.com/contentauth/c2patool/releases/download/v{{ c2pa_version }}/c2patool-v{{ c2pa_version }}-x86_64-unknown-linux-gnu.tar.gz"
        dest: /tmp/c2patool.tar.gz

    - name: Extract c2patool
      ansible.builtin.unarchive:
        src: /tmp/c2patool.tar.gz
        dest: /usr/local/bin/
        remote_src: true
        creates: /usr/local/bin/c2patool

    - name: Create certificate directory
      ansible.builtin.file:
        path: "{{ signing_cert_dir }}"
        state: directory
        mode: "0700"

    - name: Deploy signing certificate
      ansible.builtin.copy:
        src: "certs/c2pa-signing.pem"
        dest: "{{ signing_cert_dir }}/signing.pem"
        mode: "0600"
      no_log: true

    - name: Deploy signing key
      ansible.builtin.copy:
        src: "certs/c2pa-signing.key"
        dest: "{{ signing_cert_dir }}/signing.key"
        mode: "0600"
      no_log: true

    - name: Deploy C2PA manifest template
      ansible.builtin.template:
        src: c2pa-manifest.json.j2
        dest: /etc/c2pa/manifest.json

    - name: Create signing service
      ansible.builtin.template:
        src: c2pa-signer.service.j2
        dest: /etc/systemd/system/c2pa-signer.service
      notify:
        - Reload systemd
        - Restart C2PA signer

    - name: Verify c2patool installation
      ansible.builtin.command: c2patool --version
      register: c2pa_ver
      changed_when: false

  handlers:
    - name: Reload systemd
      ansible.builtin.systemd:
        daemon_reload: true
    - name: Restart C2PA signer
      ansible.builtin.service:
        name: c2pa-signer
        state: restarted

{# templates/c2pa-manifest.json.j2 #}
{
  "claim_generator": "{{ organization_name }}/AnsibleProvenance/1.0",
  "title": "Content Provenance Manifest",
  "assertions": [
    {
      "label": "stds.schema-org.CreativeWork",
      "data": {
        "@type": "CreativeWork",
        "author": [
          {
            "@type": "Organization",
            "name": "{{ organization_name }}"
          }
        ],
        "datePublished": "{{ ansible_date_time.iso8601 }}"
      }
    },
    {
      "label": "c2pa.actions",
      "data": {
        "actions": [
          {
            "action": "c2pa.created",
            "softwareAgent": "{{ software_agent | default('Content Pipeline v1.0') }}"
          }
        ]
      }
    }
  ]
}

- name: Deploy AI content watermarking
  hosts: ai_content_servers
  become: true
  tasks:
    - name: Install watermarking dependencies
      ansible.builtin.pip:
        name:
          - invisible-watermark
          - Pillow
          - numpy
        virtualenv: /opt/watermark/venv

    - name: Deploy watermarking service
      ansible.builtin.template:
        src: watermark-service.py.j2
        dest: /opt/watermark/service.py
        mode: "0755"

    - name: Deploy watermark configuration
      ansible.builtin.template:
        src: watermark-config.yml.j2
        dest: /opt/watermark/config.yml

    - name: Create systemd service
      ansible.builtin.copy:
        content: |
          [Unit]
          Description=AI Content Watermarking Service
          After=network.target

          [Service]
          Type=simple
          User=watermark
          ExecStart=/opt/watermark/venv/bin/python /opt/watermark/service.py
          Restart=always
          Environment=CONFIG_PATH=/opt/watermark/config.yml

          [Install]
          WantedBy=multi-user.target
        dest: /etc/systemd/system/watermark.service
      notify:
        - Reload systemd
        - Restart watermark

    - name: Start watermarking service
      ansible.builtin.service:
        name: watermark
        state: started
        enabled: true

  handlers:
    - name: Reload systemd
      ansible.builtin.systemd:
        daemon_reload: true
    - name: Restart watermark
      ansible.builtin.service:
        name: watermark
        state: restarted

- name: Deploy provenance verification API
  hosts: verification_servers
  become: true
  tasks:
    - name: Deploy verification service container
      community.docker.docker_container:
        name: provenance-verifier
        image: "{{ verification_image }}"
        state: started
        restart_policy: unless-stopped
        ports:
          - "8443:8443"
        volumes:
          - /etc/c2pa/trusted-certs:/certs:ro
        env:
          TRUSTED_CERT_DIR: /certs
          VERIFY_TIMESTAMPS: "true"
          LOG_LEVEL: info

    - name: Deploy trusted certificate store
      ansible.builtin.copy:
        src: "trusted-certs/"
        dest: /etc/c2pa/trusted-certs/
        mode: "0644"

    - name: Configure Nginx reverse proxy
      ansible.builtin.template:
        src: provenance-api.conf.j2
        dest: /etc/nginx/conf.d/provenance-api.conf
      notify: Reload Nginx

    - name: Test verification endpoint
      ansible.builtin.uri:
        url: https://localhost:8443/api/v1/health
        validate_certs: false
      register: verify_health

  handlers:
    - name: Reload Nginx
      ansible.builtin.service:
        name: nginx
        state: reloaded

- name: Integrate provenance into media pipeline
  hosts: media_pipeline
  become: true
  tasks:
    - name: Deploy pre-publish signing hook
      ansible.builtin.template:
        src: sign-on-publish.sh.j2
        dest: /opt/pipeline/hooks/sign-on-publish.sh
        mode: "0755"

    - name: Configure CMS to sign uploads
      ansible.builtin.lineinfile:
        path: /opt/cms/config.yml
        line: "{{ item }}"
      loop:
        - "provenance_signing: true"
        - "c2pa_manifest: /etc/c2pa/manifest.json"
        - "c2pa_cert: {{ signing_cert_dir }}/signing.pem"
        - "c2pa_key: {{ signing_cert_dir }}/signing.key"
      notify: Restart CMS

    - name: Deploy batch signing for existing content
      ansible.builtin.template:
        src: batch-sign.sh.j2
        dest: /opt/pipeline/batch-sign.sh
        mode: "0755"

    - name: Schedule nightly provenance signing
      ansible.builtin.cron:
        name: "Sign unsigned media"
        hour: "3"
        minute: "0"
        job: "/opt/pipeline/batch-sign.sh >> /var/log/c2pa-signing.log 2>&1"

- name: Content provenance compliance audit
  hosts: media_servers
  tasks:
    - name: Count signed vs unsigned media
      ansible.builtin.shell: |
        total=$(find /data/media -type f \( -name "*.jpg" -o -name "*.png" -o -name "*.mp4" \) | wc -l)
        signed=$(find /data/media -type f -name "*.c2pa" | wc -l)
        echo "total=$total signed=$signed unsigned=$((total-signed))"
      register: signing_stats
      changed_when: false

    - name: Report provenance coverage
      ansible.builtin.debug:
        msg: "{{ inventory_hostname }}: {{ signing_stats.stdout }}"

    - name: Verify signing certificates not expired
      community.crypto.x509_certificate_info:
        path: "{{ signing_cert_dir }}/signing.pem"
      register: cert_info

    - name: Alert on expiring signing certificate
      ansible.builtin.debug:
        msg: "⚠️ C2PA signing cert expires {{ cert_info.not_after }}"
      when: cert_info.not_after < (ansible_date_time.epoch | int + 2592000) | string