Hacker News Reader

Comment by yjftsjthsd-h | Hacker News Reader

It continues to surprise me that the official documentation seems to prefer using global configuration in /etc/ansible; it always seemed vastly preferable to me to put it in a repository under my home directory. This does mean that I have to put in a config file to point at my inventory, but that's a trivial one time change and now I don't have to touch system configuration owned by root every time I want to change my inventory or whatever.

View on HN

Yep! I think it's common to have small wrapper which locks down the variables, starting with ANSIBLE_CONFIG.

You just don't want variation in the run depending on what directory you happen to be.

Same here. I re-worked our config to be an entirely self contained git repository with it's own ansible.cfg in the root which contains:

[defaults] inventory = ./inventory/hosts

In case it's useful to you: You can have that be a directory.

    [defaults]
    inventory=./hosts.d

(This is what I use)

It seems like a lot of things are like that in Ansible. It seems like the preferred way to use it would be with a dynamic inventory, but most of the examples you'll find will have it hardcoded. Or you'd think you would to install it in a virtual environment or docker to deploy it in an isolated environment, but that is not recommended or even super easy to do. It sometimes feels more like you are tricking it into helping you.

I use the ansible-runner docker container, add openvpn and run this container in Gitlab CI/CD.

It's not too hard to figure out how to do this, but probably there isn't much blogging about something like this.

> It continues to surprise me that the official documentation seems to prefer using global configuration in /etc/ansible

Personally I want an env(1) of something like ANSIBLE_HOME where, if defined, it completely ignores [/usr/local]/etc/ansible/.

Ansible ships ansible.conf and most (all?) distributions will store that in /etc. It's trivial to change to override this by having ansible.cfg in your project's folder.

Yes, I know; that's what I do. But it seems like a very strange default way to handle it given that it includes things like your inventory which are very much specific to any individual project. It would be like if Firefox shipped with its default profile location in /var or /usr/share and suggested that if you really wanted to then you could use a local configuration to move your bookmarks into your home directory.

It's odd that you bring up FF since they they do have global configuration in /etc which is used by sysadmins to set mandatory or default preferences.

For default/mandatory options, sure, but for inventory? Roles? Plays? I completely get having a sane default /etc/ansible/ansible.cfg, but sticking your inventory under /etc seems like a terrible mismatch. I guess to me, it's that ansible {inventory,roles,playbooks} aren't "configuration" files so much as they are, in a sense, "documents", and as such they should live in my home directory like all other "documents".

I think the intent is to reduce the friction of people who are used to Puppet where all of your code lives in /etc/puppetlabs/code on the master.

It's not an uncommon workflow to have a central "Ansible server" with a service account (hence why Tower exists) that's essentially used as a privileged bastion host in environments where sysadmin laptops don't have a way to reach servers directly.

Good point. Yeah, to be honest, I have never used the files in /etc/ansible in 5 years of using Ansible.

Reply on news.ycombinator.com