On 2015-01-09 10:25, Stefan G. Weichinger wrote:
Am 08.01.2015 um 19:29 schrieb Alan McKinnon:
The directory layout in the best practice page is indeed way more than
you need, it lists most of the directories in common use across a wide
array of deployments. In reality you create just the directories you
need.
Global stuff goes in the top level (like inventory).
Variables for groups and individual hosts go into suitably named files
inside group_vars and host_vars.
Roles have a definite structure, in practice you'll use tasks/ and
templates/ a lot, everything else only when you need them.
This is a good design I feel. If a file describes variables, you don't
have to tag it as such or explicitly include it anywhere. Instead,
files
inside a *vars/ directory contain variables, the system knows when to
use them based on the name of the file. It's really stunningly obvious
once you train your brain to stop thinking in terms of complexity :-)
Thanks a lot ... I spent some time with it already and learn to like it
;)
I am nearly done with setting up an inventory file for all the customer
boxes I am responsible for. Just using the ad-hoc-commands is very
useful already!
For example I could store the output of the "setup" module for local
reference ... this gives me loads of basic information.
I know it is not a backup program but I think I could also use it to
rsync all the /etc directories to my ansible host? Or trigger a "git
push" on the remote machines to let them push their configs up to some
central git-repo I provide here (having /etc and the @world-file is
quite a good start here and then ... ).
It is also great to be able to check for let's say
shellshock-vulnerability by adding a playbook and running it to
all/some
of the servers out there ... I am really starting to come up with lots
of ideas!
My current use case will be more of an inventory to track all the boxes
... deploying stuff out to them seems not so easy in my slightly
heterogeneous "zoo". But this can lead to a more standardized setup,
sure.
One question:
As far as I see the hostname in the inventory does not have to be
unique? I have some firewalls out there without a proper FQDN, so there
are several "pfsense" lines in various groups (I have now groups in
there with the name of the [customer] and some of them have child
groups
like [customer-sambas] ...).
I would like to be able to also access all the ipfires or sambas in
another group ... so I would have to list them again in that group
[ipfires] ?
Thanks for the great hint to ansible, looking great so far!
Stefan
Ansible is a not a backup solution. You don't need to download your /etc
from the machines because you deploy your /etc to machines via ansible.
I was also thinking about putting /etc in git and then deploying it but:
- on updates, will you update all configurations in all /etc repos?
- do you really want to keep all the information in git, is it
necessary?
Opposite to this, you can define roles like apache, mysql,
common-gentoo, firewall etc. where you describe how to install that
software and do some basic configuration that is to be shared among the
most of your machines. You can also define "default" values (like the
bind address, the listen port) and then override it in your machine
group role (if it's used with multiple servers).
If you have all the software pieces written down in roles and you use
the defaults of that role, you simply get to that a server configuration
is just a compound of that roles (plus some configuration copy). Like
this an apache+php application server with firewall and centralized
logging is just like around 20-30 lines.
You don't need to use roles, you can put all this information in task
files and then you include this files, however then you don't have
encapsulation and the default values.
It really doesn't matter how your servers diverge, if you keep the
details split up in roles, you just cherry-pick the roles, overriding
their defaults and copying configuration. However it is true that
ansible tries to keep your configuration identical among server (for
example to not install apache absolutely differently on two machines,
but to use as much common pieces as possible).
Check out ansible galaxy and search for some roles (like apache, cron,
redis etc.). Regarding configuration, you can template or just copy the
configuration to a server (like when installing postfix for example) but
you need to keep the template up to date with the shipped configuration
(or ship your own configuration and diverge from mainstream). An
alternative is to just make some changes to the default configuration
(replace line, add some line). Then you don't need to update your
templates, on updates you can copy over the new configuration from
._cfgXXX and make the same changes as before, most probably it will
work. A good trick is to use include directories where possible (don't
edit /etc/sudoers but copy your stuff to /etc/sudoers.d).
