Re: [gentoo-user] Usign ansible (was: another old box to update)

[Tomas Mozes]

On 2015-01-09 10:25, Stefan G. Weichinger wrote:
> Am 08.01.2015 um 19:29 schrieb Alan McKinnon:
>
>> The directory layout in the best practice page is indeed way more than
>> you need, it lists most of the directories in common use across a wide
>> array of deployments. In reality you create just the directories you
>> need.
>>
>> Global stuff goes in the top level (like inventory).
>> Variables for groups and individual hosts go into suitably named files
>> inside group_vars and host_vars.
>> Roles have a definite structure, in practice you'll use tasks/ and
>> templates/ a lot, everything else only when you need them.
>>
>> This is a good design I feel. If a file describes variables, you don't
>> have to tag it as such or explicitly include it anywhere. Instead,
>> files
>> inside a *vars/ directory contain variables, the system knows when to
>> use them based on the name of the file. It's really stunningly obvious
>> once you train your brain to stop thinking in terms of complexity :-)
>
> Thanks a lot ... I spent some time with it already and learn to like it
> ;)
>
> I am nearly done with setting up an inventory file for all the customer
> boxes I am responsible for. Just using the ad-hoc-commands is very
> useful already!
>
> For example I could store the output of the "setup" module for local
> reference ... this gives me loads of basic information.
>
> I know it is not a backup program but I think I could also use it to
> rsync all the /etc directories to my ansible host? Or trigger a "git
> push" on the remote machines to let them push their configs up to some
> central git-repo I provide here (having /etc and the @world-file is
> quite a good start here and then ... ).
>
> It is also great to be able to check for let's say
> shellshock-vulnerability by adding a playbook and running it to
> all/some
> of the servers out there ... I am really starting to come up with lots
> of ideas!
>
> My current use case will be more of an inventory to track all the boxes
> ... deploying stuff out to them seems not so easy in my slightly
> heterogeneous "zoo". But this can lead to a more standardized setup,
> sure.
>
> One question:
>
> As far as I see the hostname in the inventory does not have to be
> unique? I have some firewalls out there without a proper FQDN, so there
> are several "pfsense" lines in various groups (I have now groups in
> there with the name of the [customer] and some of them have child
> groups
> like [customer-sambas] ...).
>
> I would like to be able to also access all the ipfires or sambas in
> another group ... so I would have to list them again in that group
> [ipfires] ?
>
> Thanks for the great hint to ansible, looking great so far!
> Stefan

Ansible is a not a backup solution. You don't need to download your /etc 
from the machines because you deploy your /etc to machines via ansible.

I was also thinking about putting /etc in git and then deploying it but:
- on updates, will you update all configurations in all /etc repos?
- do you really want to keep all the information in git, is it 
necessary?

Opposite to this, you can define roles like apache, mysql, 
common-gentoo, firewall etc. where you describe how to install that 
software and do some basic configuration that is to be shared among the 
most of your machines. You can also define "default" values (like the 
bind address, the listen port) and then override it in your machine 
group role (if it's used with multiple servers).

If you have all the software pieces written down in roles and you use 
the defaults of that role, you simply get to that a server configuration 
is just a compound of that roles (plus some configuration copy). Like 
this an apache+php application server with firewall and centralized 
logging is just like around 20-30 lines.

You don't need to use roles, you can put all this information in task 
files and then you include this files, however then you don't have 
encapsulation and the default values.

It really doesn't matter how your servers diverge, if you keep the 
details split up in roles, you just cherry-pick the roles, overriding 
their defaults and copying configuration. However it is true that 
ansible tries to keep your configuration identical among server (for 
example to not install apache absolutely differently on two machines, 
but to use as much common pieces as possible).

Check out ansible galaxy and search for some roles (like apache, cron, 
redis etc.). Regarding configuration, you can template or just copy the 
configuration to a server (like when installing postfix for example) but 
you need to keep the template up to date with the shipped configuration 
(or ship your own configuration and diverge from mainstream). An 
alternative is to just make some changes to the default configuration 
(replace line, add some line). Then you don't need to update your 
templates, on updates you can copy over the new configuration from 
._cfgXXX and make the same changes as before, most probably it will 
work. A good trick is to use include directories where possible (don't 
edit /etc/sudoers but copy your stuff to /etc/sudoers.d).