Hacker News Reader

Comment by pgroves | Hacker News Reader

I don't know Ansible very well... is it possible to install only a subset (namely, the vpn service you plan to actually use)? It seems like a large attack service to have every VPN software possible running on the machine.

View on HN

Yes. It depends on how well organized the Playbook is, but this one is nice. As long as they kept their dependencies clean edit:

https://github.com/jlund/streisand/blob/master/playbooks/str...

Comment out any roles you don't want with a # at the beginning of the line, YAML is very picky about syntax.

comment edit: Think of roles in ansible like building blocks or common chores you can apply to any server. It might be nice to not have so much stuff by default, but this tool isn't meant for complete technical novices, so it is expected (in my opinion) that you go in and prune anything out you don't want/need. What is nice is that you have lots of options and if you ever need to add a role you can just uncomment it and re-run the playbook.

I think you'd typically want to use tags [0] for controlling which portions of an ansible playbook run, for a one-off set of tasks like this. This one in particular isn't set up to work that way though.

[0] http://docs.ansible.com/ansible/playbooks_tags.html

This one is organized around roles instead (and role dependencies).

You can tag entire roles themselves.

Lately I've been using this as a way to quickly apply selective config. It feels 'hacked-on', but it works.

Reply on news.ycombinator.com