Hacker News Reader

Comment by sarcasmatwork | Hacker News Reader

Why not just use Ansible for something like this?

Thanks for the link! I've opened it and will look at it in more detail.

Here it is for anyone reading this discussion: https://www.ansible.com/

Basically the reason I created this rather than relying on something else is that I wanted an easy script that can setup a full production Web Server environment for PHP without any dependencies other than the minimum needed.

The script is completely free and open source any easy to change in case someone wants to use it for Laravel, Symfony, or something else. Most automation scripts are used to sell additional products like Ansible so this script avoids that.

Currently the script works on Ubuntu only but I will expand to RedHat and other OS's as time permits. Of course if anyone can help contribute I would gladly accept.

For a specific ansible role for nginx, suggest to look at

https://github.com/nginxinc/ansible-role-nginx

it is complete free, open source, not difficult to use, does not require any additional tools on the target host.

On the control (source) host you just need ansible and target hosts need python3.

And from there you can use this role to push nginx install on 10 or 100 target hosts (with same single command). The hosts do not have to run the same OS (they can run a mix Debian-based, or -redhat based Linuxes, and a FreeBSD.. I think (although did not try that) ).

This role automatically setups and download the appropriate versions of nginx binaries, and allows pretty flexible config of nginx itself, from load balancers to reverse proxies, to plain-jane web servers...

Any passwords that may need to be transmitted to target hosts (eg for cert files), are normally encrypted in crypto-secure ansible vault. So they get transferred with SSH over to the host, without being ever bein stored plain on the source/controller host.

With regards to

> Most automation scripts are used to sell additional products like Ansible so this script avoids that.

I think most open source software, nginx including, can be though of as 'promoting' something or somebody. Just like any other endeavor that meant to be publicly consumed.

I see you have a good amount of time in this script. I do appreciate the efforts.

I just see that writing large scripts like this is a waste of time when we have cool tech like Ansible that could do this far easier. Plus Ansible is idempotence!

Scripts like this take time to create, debug and read to those that are seeing it the first time, or the 100th. This is one reason imho why Ansible (Puppet, Chef) were created. Yaml synax is easy, just need a good editor that shows the spaces. I use Atom and sometimes Notepad++

For example, here is a Nginx role with php that I randomly found: https://github.com/geerlingguy/ansible-role-nginx

I don't understand why people keep saying Ansible is idempotent. Ansible is not somehow magically idempotent, nor is Bash "always not idempotent". You can write bad, non-idempotent code in Ansible too and good, idempotent code in Bash too.

Sure, if you are using some of Ansible's modules that are developed specifically to be idempotent, then yes, but there are plenty of "shell" module examples out there that aren't remotely idempotent

One of the benefit of using Ansible is that when something blows up in the middle, it can restart from there than do it all over again.

Also Ansible Tower (AWX for opensource version) can have user access control and keep a history of past execution whether they succeeded or not.

And there are bunch of community written recipes for many tasks.

While writing everything in yaml may or may not make you feel good but at least it's more readable than a complicated bash script.

A gold-plated wrench is undoubtedly better than a regular wrench. It will never rust and it's even more resistant to acids and alkoli than chrome plating. If you embed diamond dust in the surface, it's even better because now it's grippy and the grip will never wear out.

And yet, not everyone needs a diamong-encrusted gold-plated wrench. There is a place in the world for a regular simple wrench.

The existence of one does not invalidate the existence of everything else.

False analogy. Ansible is the regular wrench here, scripting everything again in bash is the needle in the haystack solution.

Yes, bash scripts have their places like running a repeating task on a machine but deploying an environment on multiple machines is exactly what Ansible is intended for.

Correct me if I'm wrong, but isn't Ansible's only dependency Python, which is already installed on 99% of linux distros? It may drag some extra python packages but those can be contained in a virtualenv to avoid bloating the OS installation.

There is room for DIY scripts but it's mostly in development and perhaps early testing. In production the most important thing would be ease of maintenance. DIY scripts just create technical debt down the line, unless your whole setup is so simple that you can completely replace Ansible or similar with a DIY script.

Sure, but then you need to install also python environment for Ansible,on a machine where only Apache or nginx are needed

Which OS comes without Python pre-installed? But I agree, the less is installed the better.

Windows?

Which can be resolved by running SCCM

Windows doesn't come with bash by default either ;)

Python is extremely easy to setup on Windows though.

Time have changed a lot though as you can now run complex bash scripts on the Windows Subsystem for Linux (published by Microsoft).

Windows Subsystem for Linux https://docs.microsoft.com/en-us/windows/wsl/about

Print Screens and Doc of running as Bash Script on Windows: https://fastsitephp.com/en/documents/file-encryption-windows

Alpine Linux, Busybox, ArchLinux are examples.

Alpine Linux doesn't have bash installed by Default either. Don't know about the others

ArchLinux - wrong, has python preinstalled even if you go with the base image. Alpine - doesn't even contain bash in the miniroot edition Busybox - similar to Alpine

If python happens to disappear from all linux distros ansible can still work with the raw module.

In any case, the bash script posted is based on apt install so it's not going to work on much less amount of distros rather than if it was just an ansible role.

The only supported OS is Ubuntu 18.04 LTS, which comes preinstalled with python 2.7 and 3.6. Not arguing that there are situations where a simple bash script is way better than an additional tool with dependencies

In a history of running ansible for ages against 5k-25k machines regularly in not a single case I had to install python on any one of those before running a playbook. There's a reason why it's described as agentless.

In fairness, there are some dependencies depending on what you're doing; ansible's use of apt needs python-apt (or maybe aptitude?), and I have hit that one hard (granted, on termux, which is a weird target). Oh, and I had to do the equivalent on Fedora. Which is fine, mind, just pointing out that dependencies do still happen in ansible.

Reply on news.ycombinator.com