Using CERMM
Playbooks
Ansible, without an inventory file or SSH keys: each machine's own agent runs the playbook on itself. Devices → Playbooks.
Linux only, and young. Templates and a captured playbook pass --syntax-check, and a capture of an Arch machine was saved and run in check mode through a real agent with nothing failed. Playbooks haven't yet been run for real, as root, on Debian or Fedora. Windows and macOS say so in the run dialog.
How a run works
- The first time, the job installs ansible-core (apt, dnf, pacman or zypper).
- It writes the playbook, its files and the variables to a temporary folder.
- It runs
ansible-playbook -i localhost, -c local.
A run is a batch like a saved script: one job per machine, an hour's limit, approval above the threshold, and the whole playbook kept with the job and in the audit log.
Fields
Ansible variables asked for at each run:
- Text.
- List, comma-separated.
- Password: sent only as its SHA-512 crypt hash, for a user's password.
- Secret: sent as typed, for things that need the real value (Samba).
Check only runs with --check --diff: what would change, changing nothing.
Templates
Harden SSH, Admin user, SFTP-only user, File share (Samba), Docker host. Copy one into the library to use it.
Capture a machine
Set a machine up once, capture it, and run the result on a fresh one. From the page's Capture a machine, or a Linux device's menu → Capture as playbook….
A read-only sh script runs as an ordinary job (no Python needed) and prints what the machine is:
- packages installed on purpose, with the base ones (kernel, bootloader, firmware, the installer's) marked as such, and Flatpaks;
- people (UID 1000 and up) and their groups;
- services enabled or disabled against the vendor's preset, and unit files someone wrote;
- config files a package shipped that were edited, and files in
/etcand/usr/localno package owns; - crontabs,
authorized_keys, Compose projects' files.
Never captured: SSH host keys, /etc/shadow (unless you tick Keep people's passwords), private keys, WireGuard or NetworkManager secrets, CERMM's own config, home folders or data. At most 256 KB a file and 500 KB in all.
In the review, untick what the next machine shouldn't get (network, disks and kernel files start unticked; View shows a file). It becomes a playbook that uses only ansible.builtin, so ansible-core is enough: package sources and keys, packages, groups, people, files with their owners and modes (with handlers to reload SSH, Samba, nginx, the firewall, sysctl, systemd), links, services, and docker compose up -d. Captured values are never templated by Ansible. Captured users and groups get no fixed IDs.
Who sees what
A playbook, its jobs' scripts and a capture's output are shown only to people who may run commands.