Mac-dev-playbook – Mac setup and configuration via Ansible | Hacker News Reader

Mac-dev-playbook – Mac setup and configuration via Ansible

github.com

139 pointsgeerlingguy40 comments

Ansible is great and all, but I've been using a bash_profile to set up my workstations for years and it's worked great. Doesn't require third-party tools and uses bash, so it can literally run on anything, including Cygwin and LXSS (Windows).

For those interested: https://github.com/carlosonunez/setup

What is the stayfocusd.json for? It looks like it's for blocking certain sites but how does it work?

I used a Chrome Extension called StayFocusd to block out time wasting sites while trying to get some work done. That JSON configures its settings.

Haven't needed that extension for a while because I'm actually busy these days!

I don't have a problem with third party tools or need to run a setup scrip on Cygwin or LXSS, but shell scripting just seems easier than a tool like ansible because you have a full programming language (albeit a terrible one), and you can use familiar command line utilities to do everything. (You can use them in ansible too, but it is frowned on -- you are supposed to relearn how to do everything using modules that are usually less powerful than the equivalent command line utilities.) I have never had to manage a huge fleet of servers, so maybe ansible has advantages in that setting, but for setting up a single box it just seems to make everything harder.

I'm a fan of Ansible, so let me reply to a few of your points :)

1. Playbooks are not a complete programming language for a good reason. You just get a simple linear flow of tasks with limited loops and conditions, so they're hard to make unreadable, unlike full-blown programming languages, like Python in Fabric or Ruby in Chef.

2. Yes, using shell commands for things that can be done using modules is frowned upon, but nobody is going to physically frown at you, so don't worry about it too much :) I drop down to shell/command/script modules whenever I need to without giving it a single thought.

3. Yes, the modules are often less powerful than the underlying tools. The other side is that they return nicely parsed data and changed/not changed status, so you can analyze their results more easily than shell commands.

4. Yes, ansible has immense advantages over shell scripting whenever one or more applies (generally the "manage a fleet of servers" scenario, not the "set up a dev box" one): - you need to coordinate configuration between multiple machines (sshing back and forth is just clumsy in comparison) - the playbook is to be used more than once (e.g. evolving configuration) -- I can't imagine my life right now without diffs and check mode. This also makes developing/debugging playbooks much easier than scripts, e.g. I recently wrote a hairy migration tool as a playbook and could easily see all the changes it would do without applying them - some things are just easier in ansible (template and lineinfile come to the top of my head, plus everything is parsed for you into easily usable data structures)

5. I'd probably use ansible to set up my own machine if I ever got to automating the task, but you're right: learning ansible just for that makes little sense.

When you have three+ Macs to configure, it starts looking more like a fleet and less like a single computer :)

The main advantage I see is at it's a lot easier to reason with Yaml configuration than shell scripts with a ton of conditionals, and it's also easier to use Ansible's modules to make sure you can reprovision whenever you want to get new things added or old things removed.

That's exactly my use case as well, which I detailed in a writeup:

https://www.stavros.io/posts/provisioning-your-computer-one-...

It's a great way to synchronize state between computers, including installed packages, fonts, Vim plugins, etc.

It goes much further than dotfiles.

Have you seen Strap?

Strap is a script to bootstrap a minimal OS X development system. This does not assume you're doing Ruby/Rails/web development but installs the minimal set of software every OS X developer will want.

http://mikemcquaid.com/2016/06/15/replacing-boxen/

https://github.com/MikeMcQuaid/strap

Ah, a very seasoned bash profile. Thanks for sharing.

Since I've been playing with NixOS, this project reminded me of https://github.com/LnL7/nix-darwin which lets you use a system-wide configuration.nix on OS X. Never tried it but it looks neat.

I actually use this, using it to replace my old ansible setup. I've got a lot of things I need to merge into there after more testing but yep its neat.

Not as great as the nixos version but every bit helps.

nix & guix are great. Making whole-system configurations declarative and reproducible is a huge step forward once things get mildly complicated.

Nice, but I think the days of Chef/Puppet/Ansible-based setups might be gone. Boxen is deprecated in favour of the excellent Strap: https://github.com/mikemcquaid/strap which I have customized to use a post-completion script to configure defaults (e.g. https://github.com/mathiasbynens/dotfiles/blob/master/.macos) and initial setup of Vim. Homebrew and shell scripting.

What more could you need? :)

I thought several times about having an automated environment setup for my personal laptop, but I usually come to the conclusion that the time it would take me to maintain these scripts would probably exceed the time I spend doing the setup every 3-4 years (xkcd https://xkcd.com/1319/).

I usually now just install things as I need them and I feel that it is a smooth process. Installing software and managing packages has become much easier in recent years.

It's not just about whether the initial investment in time is worth it. It's also that your time-to-reinstall is predictable and short.

Once you've got a script, then it'll just be a minor annoyance if you have to reinstall at an inconvenient time. Personally, I've got a combination of a script, plus a set of notes. I haven't automated everything, just the easy parts.

But then again for a REAL quick installation, I've restored from Time Machine as well.

I've got a new workstation that's currently running Ubuntu 16.04 LTS but will soon be replaced with Arch Linux. This is my primary "work" machine so I want it to be back "fully-operational" as quickly as possible.

I performed an installation of Arch Linux on a ThinkPad W530, carefully documenting every little thing I did (lots of minor "tweaks" to get ZFS just the way I want it, my Yubikeys working with LUKS at boot, etc.).

Once that was up and running, I started writing Ansible roles to configure the system exactly to my liking. It was very time consuming at first, as I made sure to do every little thing "the right way" and so on. Eventually I started taking shortcuts in the interest of time, as I can always go back later and clean things up.

Once I get everything I need taken care of by Ansible, I'll reinstall the laptop and let Ansible loose as one last "verification", then I'll do the same thing for my workstation. I should end up with two almost identical machines that are configured exactly how I want them. Changes I make later can be "replicated" to the other host simply by updating my repo and re-running my playbooks. I'm going to try my best to avoid any ad-hoc changes but we'll see how that goes...

I work from home 95% of the time and the laptop is mostly for when SHTF and I have to grab it and go (network engineer for an ISP, so that usually means "something bad has happened"). I'm confident that I won't end up out in the field somewhere without access to certain files I need or documentation or whatever and the environments being almost identical means I won't have to deal with those annoying little inconsistencies between machines at the worst possible time.

It's time-consuming, for sure, but I think the end result will be worth it.

Me too. I've settled on just storing my dotfiles in dropbox as good enough. Just upgraded to a MBP and it was no issue.

In addition to dotfiles I keep a Brewfile around, so I can run the 'brew bundle' command and install everything, including brew casks.

`brew bundle` has become quite handy. There isn't much I can't automate the install of now that it supports the Mac App Store too.

By far the biggest benefit is the easy synchronization between machines. The fact that I can wipe my machine and reinstall in half an hour is just a nice side effect.

https://www.stavros.io/posts/provisioning-your-computer-one-...

I thought the exact same thing and recently put it to the test, and my estimate now is that in my case in about 15 years the time spent on creating the automation will likely have been payed off: 2 machines every 5 years, let's say 2 days to get them manually installed/configured completely vs about 6 days spent on the automation now. At least, if my stack or aplication preferences etc doesn't change too much. As a bonus: I learned some new stuff while doing it. So in the end for me it was worth it because of that learning and because I really dislike repeatedly installing stuff, waiting for installers to complete, customizing, ... But let's see again after a couple of iterations if I still think that way (e.g. if it turns out the automation scripts require too much caretaking, as per xkcd).

If you can have a good estimate of the time it would take to do it then this xkcd is better source! https://xkcd.com/1205/

https://github.com/geerlingguy/macos-virtualbox-vm

Thanks for this. I'm going to have to try these instructions at some point. A while back I was trying to do this, and couldn't make any of the instructions work. TL;DR: Installing macOS in a VM is more trouble than it's worth. I gave up and switched to VMWare instead, but I'd prefer to stick to VirtualBox since it's what I use for everything else.

Very nicely done, I do a clean install every point release of macOS so having automation such as this has been crucial.

First one of these in ages I've seen that isn't riddled with settings that will silently reduce system security for anyone foolish enough to run it.

Be aware it does apply some pretty idiosyncratic settings from his dotfiles, though, like disabling sleep and hibernate. I'd take some time to edit those prior to using.

The idea is you'd point the thing at your own dotfiles. I just have it use mine since I built it :)

Exactly. It makes sense when you have a 128 GB SSD, but for most people, it's a bad idea to disable hibernation. And local Time Machine.

wow - this is really cool, and it is a great initiative.

If someone would take a similar approach to installing (on linux) a particular version of ElementaryOS or linux, and puts together a set of recipes that would get it all souped up for development etc, that would be really great!!

One can even take it further to use an OS like Bodhi Linux which seems stripped down for the task, and use ansible instead of the native scripting etc.

One can get a superb development environment even with an older lower powered laptop; a lot of the grunt work can be automated away.

This has to be an open-sourced effort because a thousand combinations are possible and one needs a easy way to select what one needs, and this was my issue with ninite. It would install everything, and it also would configure etc .

This seems interesting. I use a Makefile to bootstrap my machine and manage my dotfiles.

I understand the appeal of Ansible, but I think it's more robust features are most useful in more complex environments than a personal laptop. My Makefile seems to do the trick.

Do you have your makefile on github?

Looks like this is it:

https://github.com/ttaylorr/dotfiles/blob/work-gh/Makefile

Yuck. What's the point of a Makefile if every single rule is phony?

i use a bash script not a makefile, but it's (mostly) idempotent:

https://gist.github.com/talentdeficit/253fd1eaf25cb41e5c24a4...

Windows equivalent for application installs(no configuring) https://ninite.com/.

I'd say that the Windows equivalent is https://chocolatey.org/. It has the largest amount of "packages" from all other similar efforts that I have seen.

I second Chocolatey. There's also a (supported by Choco) puppet plugin which makes client installations as simple as

  package { 'notepadplusplus':
    ensure            => '6.7.5',
    provider          => 'chocolatey',
  }

I've used it on a few client machines with no issues.

Which is just one of many, e.g. more scriptable example: Powershell DSC. Ansible should also run on Windows. There's also SaltStack and Otter.

itd be cool if theres way to install apps too

It is integrated with mas (the CLI helper for the Mac App Store). You just pass in the IDs of whatever apps you want installed, and it will do the rest (even prompting for the App Store login).

See the role it's using: https://github.com/geerlingguy/ansible-role-mas

He could have done this with the mas utility.

http://lifehacker.com/mas-updates-and-installs-mac-app-store...

The mas utility can be installed via a quick "brew install mas".

Reply on news.ycombinator.com