4 ms·

> Not trying to start a Docker vs. Ansible flame war Don't worry, they serve very different purposes. You already probably know but Docker is for running appli

> Not trying to start a Docker vs. Ansible flame war Don't worry, they serve very different purposes. You already probably know but Docker is for running applications in isolation, while Ansible is for provisioning and configuring hosts. For instance, you won't use Docker to harden sshd on your hosts but Ansible.

bwbmr 7y ago
Are there any good resources (besides OP) for using Ansible in a home-server environment? Especially in a mixed docker + Ansible environment.
- jefurii 7y ago
  After figuring out Ansible work I started using it to manage several personal VPS machines and the various boxes at home. I just used the Ansible docs, which are pretty good.
- S04dKHzrKT 7y ago
  https://github.com/davestephens/ansible-nas https://github.com/davestephens/ansible-nas Uses ansible + docker to setup and run a home server. Its feature-set is close to that of a typical FreeNAS setup in a home environment.
- ggregoire 7y ago
  The official doc, StackOverflow and /r/ansible are good resources imo.
- VvR-Ox 7y ago
  Just start a simple project with Ansible and have a look at the repositories using Ansible to install Docker and deploy containers on your host afterwards. You may want to put some effort (not that much) into managing your credentials with Ansible Vault[0] and you can try your playbooks e.g. on a Vagrant Machine[1] before applying them to a real host. Any tutorial will do for the beginning but you should always notice what version of Ansible you are using (vs. the one used in the tutorial) as features change and also there have been some changes to the syntax to improve readability of your playbooks. [0]: https://docs.ansible.com/ansible/latest/user_guide/vault.html https://docs.ansible.com/ansible/latest/user_guide/vault.htm... [1]: https://www.vagrantup.com/docs/provisioning/ansible.html https://www.vagrantup.com/docs/provisioning/ansible.html
chishaku 7y ago
They definitely have overlap. People use Ansible for much more than hardening sshd.
eeZah7Ux 7y ago
Yet they are both security disasters.
- grosswait 7y ago
  How is Ansible a security disaster?
  - eeZah7Ux 7y ago
    A system designed to SSH into production host with high privileges and make changes automatically instead of enforcing staging...
    - apple4ever 7y ago
      That’s not really a security disaster unless you consider all of SSH a security disaster. If you are concerned about Ansible SSH’ing in (which means you are concerned about any person SSH’ing in), you just do the standard SSH hardening.
      - eeZah7Ux 7y ago
        ...and yet SSHing on a production system to make configuration changes is prohibited in many large companies including some FAANGs. Because you (or some intern hired a week ago) are 1 typo away from making a disaster. For the record, security includes availability and this is an availability risk.
- neop1x 7y ago
  How is docker container, running a process as unprivileged user with reduced capabilities security disaster? With Kubernetes you can even have network policy or service mesh with mTLS. Compare it to bunch of bare processes running on the same machine, lots of services listening on localhost, difficult updates due to different dependency version requirements by different software, requiring you do the manual, painful update only once a year. It may look bad at first, but container can be far more secure that common non-container environments. It's always matter of configuration and maintenance.

bwbmr 7y ago

Are there any good resources (besides OP) for using Ansible in a home-server environment? Especially in a mixed docker + Ansible environment.

jefurii 7y ago
After figuring out Ansible work I started using it to manage several personal VPS machines and the various boxes at home. I just used the Ansible docs, which are pretty good.
S04dKHzrKT 7y ago
https://github.com/davestephens/ansible-nas https://github.com/davestephens/ansible-nas Uses ansible + docker to setup and run a home server. Its feature-set is close to that of a typical FreeNAS setup in a home environment.
ggregoire 7y ago
The official doc, StackOverflow and /r/ansible are good resources imo.
VvR-Ox 7y ago
Just start a simple project with Ansible and have a look at the repositories using Ansible to install Docker and deploy containers on your host afterwards. You may want to put some effort (not that much) into managing your credentials with Ansible Vault[0] and you can try your playbooks e.g. on a Vagrant Machine[1] before applying them to a real host. Any tutorial will do for the beginning but you should always notice what version of Ansible you are using (vs. the one used in the tutorial) as features change and also there have been some changes to the syntax to improve readability of your playbooks. [0]: https://docs.ansible.com/ansible/latest/user_guide/vault.html https://docs.ansible.com/ansible/latest/user_guide/vault.htm... [1]: https://www.vagrantup.com/docs/provisioning/ansible.html https://www.vagrantup.com/docs/provisioning/ansible.html

chishaku 7y ago

They definitely have overlap. People use Ansible for much more than hardening sshd.

eeZah7Ux 7y ago

Yet they are both security disasters.

grosswait 7y ago
How is Ansible a security disaster?
- eeZah7Ux 7y ago
  A system designed to SSH into production host with high privileges and make changes automatically instead of enforcing staging...
  - apple4ever 7y ago
    That’s not really a security disaster unless you consider all of SSH a security disaster. If you are concerned about Ansible SSH’ing in (which means you are concerned about any person SSH’ing in), you just do the standard SSH hardening.
    - eeZah7Ux 7y ago
      ...and yet SSHing on a production system to make configuration changes is prohibited in many large companies including some FAANGs. Because you (or some intern hired a week ago) are 1 typo away from making a disaster. For the record, security includes availability and this is an availability risk.
neop1x 7y ago
How is docker container, running a process as unprivileged user with reduced capabilities security disaster? With Kubernetes you can even have network policy or service mesh with mTLS. Compare it to bunch of bare processes running on the same machine, lots of services listening on localhost, difficult updates due to different dependency version requirements by different software, requiring you do the manual, painful update only once a year. It may look bad at first, but container can be far more secure that common non-container environments. It's always matter of configuration and maintenance.