0

I ssh into a remote 5$ debian:stable IaaS machine with Putty. The machine has only debian:stable and Ansible installed on it and I run an Ansible playbook locally on it with my current working user (that has sudo rights).

I aim to establish a LAMP server environment on this machine.

playbook.yml:

 - name: Establish a Debian-LAMP with some extras
  hosts: 127.0.0.1
  connection: local
  become: no
  tasks:

  - name: update the apt package index i.e. apt update
    apt: update_cache=yes

  - name: Install ufw
      apt: package=ufw state=present ## Install only if package-index is already present in the apt package-cache.

  # etcetra

$ ansible-playbook playbook.yml

That single Ansible playbook is an orchestration and deployment of my entire server environment (Installation and setup of ufw, unattended-upgrades, SSHGuard, Apache, MySQL, PHP, ssmtp and further tools like curl, wget, zip, unzip tree and so forth).

When I will learn enough Ansible I hope to add directives that will also transduce all my virtual-host files of Apache from say Apache 2.4 to 3.4 to 4.4 to 5.4 ecetra so I won't have to manually change all virtual host files in case I need to.

Given the playbook is filled with apt upgrade package1 package2 package3 etcetera I assume I should run this playbook (or at least parts of it) each time anew, if Ansible won't do it itself.

Should I run this Ansible playbook daily/wwekly with cron or Ansible will recursively run it itself by some internal scheduling mechanism of its own?

Improve this question
5
  • As written this question is too broad. Once you run your Ansible playbooks, your server is set up. Why would you ever run them again? Do they install security updates? Do they sync data from somewhere? Do they do anything that would need doing regularly?
    – l0b0
    Commented Dec 10, 2018 at 2:32
  • Hello @l0b0 ! It mainly because of the apt-get upgrade parts which resemble the pseudocode if package exists, upgrade package, else, install it. I edited the question.
    – user5176
    Commented Dec 10, 2018 at 7:10
  • I might have a fundamental misunderstanding about Ansible when I request such behavior --- please help me here.
    – user5176
    Commented Dec 10, 2018 at 7:10
  • Without knowing what you are trying to do it is impossible to give advice as to whether you should do something to achieve your goal.
    – l0b0
    Commented Dec 11, 2018 at 22:15
  • @l0b0 I believe my intentions are far more clearer now; I explained what I'm trying to do here basically.
    – user5176
    Commented Dec 11, 2018 at 23:14

2 Answers 2

Reset to default
1

I would discourage you from using Ansible to run Ansible (though this can be done) as you will run the risk of breaking idempotent rule of Ansible. Instead, choose a singular starting point for running your playbooks; either command line, cron or some other program.

With that said, I would use cron to run an Ansible playbook, however I would also setup your ansible.cfg file for logging and check the log periodically if there is breakage in your playbook.

Ansible by default doesn't do logging so I would set this up in ansible.cfg, just in case:

[defaults]
log_path = ./ansible.log

Also, make sure to check your email regularly to make sure your cron/Ansible job ran without any problem.

Improve this answer
6
  • Hello and welcome ! I misunderstand something you wrote and encourage you edit the answer per this comment: I would discourage you from using Ansible to run Ansible (though this can be done) as you will run the risk of breaking idempotent rule of Ansible. What do you mean by idempotent rule of Ansible? I mean, the creators of Ansible themselves allow it and people use this option and wrote tutorials about it. I personally think it's okay, especially for minimal actions that use newbies to train and develop capabilities with Ansible.
    – user5176
    Commented Dec 12, 2018 at 4:48
  • Not all modules in Ansible are safe from "clobbering" your changes on your machine (idempontent) such as a role that access the shell [link] (docs.ansible.com/ansible/2.6/modules/shell_module.html ) since it doesn't necessarily check if a change has already been made especially a new playbook you haven't tested completely. This is why I would make sure you have logging setup in your Ansible config just in case something breaks. I would test the playbook on a test machine (a expendable VM) first at the very least before putting it on a production machine.
    – Roadkillon101
    Commented Dec 14, 2018 at 16:29
  • As far as "should you run Ansible playbook under cron?" It depends on what you do. If your doing "simple software updates", sure. If your doing something like 'batching several hundread thousand dollars worth of credit card transaction every night"...I would want my eyes on what's going on since a problem with that could cripple your businesses cash flow and create many angry customers.
    – Roadkillon101
    Commented Dec 14, 2018 at 16:36
  • Only updating and upgrading with Ansible based on old codes on a LAMP system :) I have only one hardship with the answer dear Roadkiilon --- what is "idempotent" I understand it as a function that will always return the same factor it works with like x+0=0 always, or x*1=x (always), and so forth. I just miss why you relate this particular mathematical concept to Ansible (sorry, I'm not strong in math). Please edit to only explain this.
    – user5176
    Commented Dec 14, 2018 at 16:41
  • The reason shell scripting isn't considered idempotent is Ansible unlike shell scripting takes into account the prior state of the machine. If the software is already installed, Ansible will not install the software again thus "clobbering" or "corrupting" your previous installation of software. You need to test and work through the modules to make sure they check to see if the system changes you want to make haven't already been done. Package management module do check if the software is current and installed, the shell module doesn't unless you make it check for changes. I hope that helps.
    – Roadkillon101
    Commented Dec 14, 2018 at 16:53
0

I'm going to assume that the question is about keeping the server secure once deployed.

Should I run this Ansible playbook daily/wwekly with cron

This can't hurt, but it is not enough to keep the system secure. It is not guaranteed that upgrading a piece of software will be enough to keep your system secure. For example, security updates to the kernel require a reboot, and some security updates may require configuration changes and/or service restarts. If you are responsible for such a server you should subscribe to the relevant security updates (usually a mailing list or web feed) and respond to fixes as they arrive.

In more general terms there is no way to deploy a server exposed to the Internet and have it be secure for an indefinite period of time.

Improve this answer
1
  • Hello and thank you. Actually I didn't aim at security specifically nor to changes to the OS; I don't use Ansible to change the OS itself with maybe one exception of configuring ufw in Debians where in Bash I would do ufw --force enable && ufw allow 22,25,80,443. I don't change the OS at all actually besides that anyway; just install things above it...
    – user5176
    Commented Dec 11, 2018 at 22:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.