I usually connect with my server via ssh in a terminal and run basic commands. What’s a better, more efficient and modern way of doing that? Especially considering ai and documentation along the way? I wonder if there’s a better approach than “connect from remote and act local”. Is there a method to “code local and push to remote”?
I use a fedora server with podman, caddyfile and vi.
Local ansible playbook, easily replayable and documented. This in a git repo and you’re fine.
Maybe a bit more on the overkill side, but I use Talos Linux (declarative K8s distribution), then Terraform for initial setup and FluxCD for everything else (including VMs via Kubevirt). It’s a hell of an initial learning curve, but afterwards I just do my talosctl upgrade and upgrade-k8s from time to time, and don’t have to worry about anything else. Upside is, Kubernetes provides a unified, extensible API for everything, for example:
- reverse proxy via Ingress or Gateway-API
- firewall via NetworkPolicy
- even databases like Postgres through an Kubernetes Operator like CNPG, with a similar simplicity as with the big cloud providers (just a single yaml file with the specs like storage capacity, CPU and memory limits, backup target and schedule etc.)
- it is very scriptable (everything is managed via the API)
- automated image updates via either FluxCD itself or just dependabot/RenovateBot creating PRs to your GitOps repo
Downsides:
- you have to figure out persistent storage (CSI), which is slightly more complicated than just a single filesystem and manually specifying volume mounts like with docker, but if done right, you have a simple interface with powerful capabilities via the Kubernetes API
- there are simple CSI implementations that just expose node local disks via LVM or ZFS, so if you just have a single node, or don’t care about replication, it’s fairly easy to get started
- initial learning curve is quite high, especially if you have no prior experience with container orchestration in general
- definitely overkill if you just want something simple that “just works”
Tailscale service configs for HTTPS ingress and DNS resolution. Podman quadlets / podlets for everything except backup software and tailscale itself. I use the open version of VS code to edit config files in place, but I push them to a private git as well as having them backed up. Storage for app data, media, and configs (everything but OS) is via NFS shares from my gaming PC’s RAID volume. I can run a plenty of apps on an old thinkpad this way. After you configure the first few quadlets with tailscale, it gets real straightforward, but there is a learning curve. Yes, I use SSH, but it is the remote conmection and terminal in Code.
Oh yeah, podman let’s me run all the containers as user-space systemd services.
Premise: most, if not all, of my services run in containers.
I have recently moved to docker context. It’s a pretty cool feature that I don’t see mentioned that often. Essentially it allows to run docker commands from your machine and tunnel them via SSH to your server. What I like about this is that I need all the compose file in my main machine and structure them into a repository so that I don’t have everything scattered around. The new approach I have implemented very recently is this.
One monorepo with one folder per server and in each one a folder per service containing docker compose and .env files. With dotenv I sent the docker context whenever I enter a specific folder, so as soon as I cd into that folder, any docker command I run from there would be tunneled to the correct server.
For everything that does not run in docker, which is not much I think at the moment only vector to collect metrics and logs, I use Ansile. In this case the need is that I want Vector to run on all servers so Ansible is the better choice here.
Ansible.
That, and there is no change that isn’t done on ansible, or, when it required trying and research gets backported into a bit of ansible.
I ssh into it twice a year to perform updates but otherwise i leave it alone. Server’s been chugging along for like a decade now.
Twice a year is crazy. I suppose most of my maintainence is adding drives (I’m a creator and I definitely totally need to archive all of my footage), but I also run a fair few apps that have needed manual update steps, so I do all my updates manually so I can fix stuff if it breaks.
Similar, but you might want to update more frequently with the huge number of critical security bugs being discovered by AI recently
I have unattended upgrades configured
Hmm I need to figure out how to do that
If you are using aptitude (apt) it is quite simple: https://ubuntu.com/server/docs/how-to/software/automatic-updates/
If you just want security updates and are fine with the default configs:
# apt install unattended-upgrades
Poorly.
Hear hear
Hell yeah
I spent a while getting Ansible to be able to setup and maintain my server(s). And ended up not using it as much as I should, mostly because the computer I used to run Ansible from became a “Steam Machine” so I’m rarely sitting on it with a keyboard now and I don’t want to have personal info and keys on my work computer.
But it was a good learning, and useful while I used it. Now I just use ssh and compose files directly.
You upgraded from ansible to ssh. As someone forced to write yaml for ansible professionally and has used many other config management tools, I can only commend your success at escaping ansible.
Try mgmtconfig.
I just use ssh and manually type commands. Keep doing it and you will get good and it will become second nature.
No need to burn tokens on basic tasks.
Master your tools. Learn awk, sed, just, etc.
Some shell customisation can help. For example I’m fond of zsh-auto-suggestions and skim. Makes me quicker.
I wait for something to break. Then I yell “God fucking dammit, I don’t have time for this right now!” and spend an hour triaging things before I just try docker down, pull, up and everything works.
same. or i just df and see / 100%
Early on I wrote a script for my user account to run df and save the output to a file, then a second script to read that file and if the drive was full send me an email.
First, it failed because it couldn’t send the email because the email service failed under full disk conditions.
Second, it failed because it couldn’t write the file to disk because the disk was full.
Third, it failed because outbound SMTP was blocked by my ISP.
I learned a lot about how well you can fail if you really put your mind to it. Now I have Home Assistant grabbing the disk stats for my machines and flagging anything over 90%.
self hosted gitlab. each server has a repo with all the docker configs and application configs. also have any scripts for the server itself on there as well, things like required libs, network configs, etc.
I also have a repo dedicated for let’s encrypt SSL that retrieves new certs every month. then on each server is an install script scheduled that pulls the certs down, installs them, and restarts any services automatically.
should anything go wrong, I have a siem monitor that will alert me that a service failed to start etc.
currently running four servers like this with varying degrees of complexity.
A mix of prayer and bash scripts.
Remove bash scripts and add poorly configured logging and that’s me!
At least you have logging!
I write my NixOS configs in my PC, commit to the repo, then push it to the server. Then SSH in, and apply it. Or more likely, MOSH in.
It’s good to get comfortable in the command line, including over ssh.
Especially considering ai and documentation along the way?
If I am going to ask AI or Google about something, I just do that to help me find the answer and then apply the answer myself. That way I learn, and can double check the AI isn’t hallucinating, at least on in obvious ways.
As for documentation, I keep a notes folder with detailed notes on manual configuration I’ve done, how and why, and the things I’ve learned along the way. I’ve found it’s both useful to help remember the things I’ve learned, and it is useful to go back to refer to.
My target is terraform to provide VMs on my miniPC and ansible to configure them. For my nas, probably a basic distro then some ansible stuff to setup stomate.
