Automate your workstation installation !

@sylvain_metayer

🇫🇷 Sylvain MÉTAYER

https://sylvain.dev

Tech Lead @Onepoint

Pros and Cons

Goal

State

Manage configuration files

Manage installed software

Version Control

Maintainability

Manage personal and pro workstation

Can handle secrets

I had some criteria for choosing a solution, so I made the table that you can see here, to know if it fits my needs.

Managing configuration files, also called dotfiles, to keep the configuration of my installed software or my custom bash prompt, we’ll talk about it later.

Manage installed software is also part of my requirements because I don’t want to have to remember what is installed on a fresh install and I want to be able to start working with my habitual tools immediately.

I want to keep track of changes to my configuration, as you’d do with your code so I need something that I can version control.

I also don’t want to spend hours to configure something… To configure my computer, so I can work in the end. That’s why I’m looking for something that’s easy to maintain.

I’m working on multiple computer, so I have to take that into account too, since I share some configuration between my personal and professional computer, I need a portable solution, and I don’t want to have to start over or duplicate it.

Finally, like everyone in this room, I have various secrets, SSH keys, passwords. I want a safe way to back up these without exposing these to the world.

First we’ll start with a quick introduction of what dotfiles are, then we’ll see a few options to manage them, before talking about the one I’ve chosen that fits my needs.

What are dotfiles?

~/.bashrc

#!/usr/bin/env bash

if [ -f /etc/bashrc ]; then
 . /etc/bashrc
fi

export SSH_AUTH_SOCK=/run/user/1000/ssh-agent.socket
# ...

Others : vimrc, gitconfig, …

How to manage them?

https://dotfiles.github.io/

https://github.com/webpro/awesome-dotfiles

Stow

GNU Stow is a symlink farm manager which takes distinct sets of software and/or data located in separate directories on the filesystem, and makes them all appear to be installed in a single directory tree.

— https://www.gnu.org/software/stow/manual/stow.html#Bootstrapping

Pros and Cons

Goal

State

Manage configuration files

✅

Manage installed software

❌

Version Control

✅

Maintainability

✅

Manage personal and pro workstation

😐

Can handle secrets

❌

Homemade script

Bash, PHP… The choice is yours, let’s code!

Pros and Cons

Goal

State

Manage configuration files

✅

Manage installed software

✅

Version Control

✅

Maintainability

😐

Manage personal and pro workstation

✅

Can handle secrets

✅

Ansible

Structure

├── playbooks
│   ├── personal
│   ├── work
│   ├── ├── main.yaml
├── roles
│   ├── jetbrains_toolbox
│   │   ├── defaults
│   │   ├── tasks
│   │── git_config
│   │   ├── tasks
│   └── [...]

Playbook

- hosts: localhost
  tasks:
    - name: "Simple task"
      debug:
        msg: |-
Hello DevoxxUK ! :)
  roles:
    - role: geerlingguy.docker
      become: true
    - role: git_config

Usage

$ cat scripts/setup.sh
python3 -m pip install --user -r "requirements.txt"
ansible-galaxy role install -r "requirements.yml"
$ cat requirements.txt
ansible==7.0.0
$ cat requirements.yml
roles:
  - src: geerlingguy.docker
    version: 6.1.0

Usage

$ ansible-playbook playbooks/personal/main.yaml -K
BECOME password:

PLAY [localhost] ************************************

TASK [git_config : Ensure Git config file exists] ************************************
ok: [localhost]

TASK [git_config : Render Git config Template] ************************************
changed: [localhost]

PLAY RECAP ************************************
localhost                  : ok=1    changed=1    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0

Playbook run took 0 days, 0 hours, 0 minutes, 1 seconds

Our dependencies are installed, we are ready to go and can run ansible to configure our computer.

Ansible offers an ansible-playbook command to run a playbook, with the playbook name as parameter. The flag - (dash) K is used to provide the superuser password to perform superuser tasks when needed.

If we now look at the output ansible provides us, we can see it performs two tasks, but only one changed. Ansible is idempotent, which means it won’t retry a task if it does not need modification. In this example, the Git config file already exist so Ansible did nothing. If your file is already configured as it should, ansible will do nothing and just tell you everything is OK and move on to the next task. This means that, in theory, if you replay the same ansible-playbook command twice, the second time, no modification should occur.

Software installation

roles/commons/defaults/main.yaml

packages_to_install:
  - vim
  - firefox
  - code

roles/commons/tasks/main.yaml

- name: Install packages
  become: true
  ansible.builtin.package:
    name: "{{ packages_to_install }}"
    state: present

playbooks/personal/main.yaml

- hosts: localhost
  roles:
    - role: commons
      vars:
        packages_to_install: [vim, firefox]

Symlink

roles/symlink
├── files
│   ├── .config
│   │   ├── htop
│   │   │   └── htoprc
│   └── .vimrc

roles/symlink/tasks/main.yaml

---

# item = .vimrc
# [...] Create folders
# [...] Ensure file does not exists

- name: "{{ item }} : Update dotfile symlink"
  file:
    src: "{{ role_path }}/files/{{ item }}"
    dest: ~/{{ item }}
    state: link

Templating

- name: Template gitconfig
  ansible.builtin.template:
    src: templates/gitconfig.j2
    dest: "~/.gitconfig"

roles/git_config/templates/gitconfig.j2

[user]
{% if git_config_user is defined %}
  name = {{ git_config_user }}
{% endif %}
{% if git_config_email is defined %}
  email = {{ git_config_email }}
{% endif %}

https://docs.ansible.com/ansible/latest/playbook_guide/playbooks_templating.html

Secrets

- name: "Copy secret file"
  copy:
    src: "secret_data.txt"
    dest: ~/secret_data.txt
    mode: "0600"

Secrets

$ANSIBLE_VAULT;1.1;AES256
62653039646462626165653337346538626534306332323566353963656633333066383732306637
3930366539386637616137336166636233303231666537650a666539623066303731376631616532
38613836653466323132316331646137323665383939376362656535633130646265356434346563
3066363264313834320a333432613265393630313235303161363731356266663733343362356462
37396131643235313936653139353036306363646234366532386138393165383962

Secrets

ansible-vault create secret_data.txt
$ ansible-vault view secret_data.txt
Vault password:
Hello DevoxxUK ! :)
$ ansible-playbook playbooks/work/main.yaml --ask-vault-pass

Many workstation?

├── personal
│   ├── main.yaml
└── work
    └── main.yaml

Pros and Cons

Goal

State

Manage configuration files

✅

Manage installed software

✅

Version Control

✅

Maintainability

✅

Manage personal and pro workstation

✅

Can handle secrets

✅

What if…

https://docs.ansible.com/

https://galaxy.ansible.com/

Conclusion

https://github.com/sylvainmetayer/dotfiles

Slides

sylvain.dev

Feedback

Automate your workstation installation !

Pros and Cons

What are dotfiles?

How to manage them?

Stow

Pros and Cons

Homemade script

Pros and Cons

Ansible

Structure

Playbook

Usage

Usage

Software installation

Symlink

Templating

Secrets

Secrets

Secrets

Many workstation?

Pros and Cons

What if…​

Conclusion

What if…