5 ms·

Has anyone tried to use this stuff at a scale of greater than a dozen servers? I briefly tried it in my homelab on CentOS 8, and immediately hit enough weirdnes

Has anyone tried to use this stuff at a scale of greater than a dozen servers? I briefly tried it in my homelab on CentOS 8, and immediately hit enough weirdness that I'm just back to SSH with Ansible now. I suppose having a GUI can be nice for a health overview of your infrastructure, but in general I dislike GUIs for actual administrative work, since using them is a practice that steers you away from automation. Most GUI tools don't provide you very good ways to make "atomic" changes, which is made very easy if you run your automation from a git repository, since the final review before hitting go is just "git diff".

tinco 6y ago
Tried it on ubuntu, it also has weirdness there. The whole tool is definitely rough around the edges. I would never use it to actually change machines though. Definitely Ansible over SSH is the way to go there. I've mixed feelings about controlling the machines through cockpit. In theory there shouldn't be any difference between SSH and HTTPS on the security of the protocol side, but it definitely feels iffy to have a python (I think?) web app execute administration commands on a server. I wonder what the security professionals think of it.
- chousuke 6y ago
  I have to admit the Cockpit architecture is not entirely clear to me, but at least it seems to allow using SSH as a remote transport, so you don't actually need to install the web stuff on all servers. GUIs are great for discoverability and observation, but they always make my life harder when I actually need to manage change in a system. As simple as it is, there's so far nothing that beats plain old text as the source of truth for how things should be; even if you have a fancy API to actually make changes into a system, you'd still want the desired state of that system to be stored as plain old text, so that changes may be tracked and reviewed easily.
  - lmns 6y ago
    You could have the best of both worlds and only modify the state of your system through a well defined API and then serialize the change in some kind of config file if and only if the change was successful (rollback to the last good state otherwise).

tinco 6y ago

Tried it on ubuntu, it also has weirdness there. The whole tool is definitely rough around the edges. I would never use it to actually change machines though. Definitely Ansible over SSH is the way to go there. I've mixed feelings about controlling the machines through cockpit. In theory there shouldn't be any difference between SSH and HTTPS on the security of the protocol side, but it definitely feels iffy to have a python (I think?) web app execute administration commands on a server. I wonder what the security professionals think of it.

chousuke 6y ago
I have to admit the Cockpit architecture is not entirely clear to me, but at least it seems to allow using SSH as a remote transport, so you don't actually need to install the web stuff on all servers. GUIs are great for discoverability and observation, but they always make my life harder when I actually need to manage change in a system. As simple as it is, there's so far nothing that beats plain old text as the source of truth for how things should be; even if you have a fancy API to actually make changes into a system, you'd still want the desired state of that system to be stored as plain old text, so that changes may be tracked and reviewed easily.
- lmns 6y ago
  You could have the best of both worlds and only modify the state of your system through a well defined API and then serialize the change in some kind of config file if and only if the change was successful (rollback to the last good state otherwise).