Thoughts of a Geek

I have always built and released these courses locally: run make zip on my own laptop, copy the result somewhere, done. It works, but it is entirely manual — easy to forget a step, and only possible from that one laptop. I wanted a more standard way of doing this: push a tag, and have a real build happen somewhere else, the same way every time.

My AsciiDoc training repositories build workbooks, decks and zip bundles through make targets that need a real toolchain: Asciidoctor, decktape
Chromium for presentation PDFs, monolith for standalone HTML, ImageMagick for the frontpage art. None of that belongs on a shared, generic CI box, so I run my own Forgejo Actions runner, backed by Podman, on a dedicated machine.

During hands-on Linux training it is useful to let a trainee follow your terminal session live — without the risk of his accidentally typing something that derails the demo. tmux makes this straightforward through shared sockets and its built-in read-only attach mode.

The WarmDesk project now has a proper website.

You can find it at https://tonk.github.io/warmdesk/ where you can read about all the features, browse the documentation, and find installation instructions.

The site covers everything from a quick start to a full administrator guide, including database setup, reverse proxy configuration, and horizontal scaling with Redis.

The source of WarmDesk itself is, as always, on GitHub at https://github.com/tonk/warmdesk.

Modern software teams produce a constant stream of tasks, conversations, customer commitments, and billable hours. Most commercial tools that manage all of this run in somebody else’s cloud, lock data inside proprietary formats, and charge per seat. WarmDesk is a self-hosted alternative: a single binary that covers Kanban boards, Scrum sprints, team chat, discussion threads, customer contracts, and time tracking — owned and operated by you.

As you probably know, I’m completely addicted to Ansible, so my new project requires some Ansible love.

As I have set it up with an API that can do, almost, anything with the cards, it was a breeze to create an Ansible collection to manage the WarmDesk instance.

I have created a collection from all the modules and uploaded that to the Galaxy. https://galaxy.ansible.com/ui/repo/published/ansilabnl/warmdesk/

You can install it with

As I was typing along in my quest for success with Coworker, I noticed that the name was already used by multiple projects, so it was not wise to keep using this name. I really want to avoid name conflicts.

Asking Claude to come up with a new name, resulted in a lot of nice names, all where already taken.

Then the name WarmDesk came up. This is a warm environment, with a nice cup of coffee. And all the tickets and Kanban stuff on the desk.

I do quite a lot of development work for a customer, and this particular customer uses Ryver (https://ryver.com) for the management of the different projects. This works rather well and it’s not very expensive. But a big problem is that it looks like development of Ryver is completely shutdown. At least the last couple of years nothing has happened, nothing at all.

As Marcel (my Boss Mann) was pushing me to use Claude as a development aid, I got curious if Claude could give me a hand. I even went a step further and decided to go the very lazy route. I don’t want to write a single line of code.

Using Ansible Automation Platform is very handy to run Ansible playbooks in an orderly way. And Red Hat even offers a developer license so that it’s possible to test all features of AAP.

But one problem that I ran into, is that I often throw away machines and start from scratch again. As the developer license allows for 16 machines, I thought I was on the save side, as I have a maximum of 4, maybe 5 machines I use for testing.

When I was busy with a late spring-cleaning, I thought it to be a good idea to remove some old repositories from my Git server.

At home I am running Forgejo and when I want to remove a complete organization, I need to click and type a lot.

But Forgejo, just as Gitea has a wonderful API, so, why not use that??

I saw this at Justyns site and I stole ^W borrowed this script.

As CentOS 7 is getting to the end of it’s live it’s time to start thinking about an upgrade.

On my old server I tried LEAPP a couple of times (on a clone, of course), but success was not really guaranteed. So, a complete reinstall is in order.

But, as I move from CentOS 7 to Rocky Linux 9, this automatically means some packages are no longer available. I was using sslh to connect though SSH and HTTPS on port 443.

A couple of days ago we where debugging an Ansible AAP problem, when a co-worker mentioned something weird in our Hashicorp Vault.
Nothing major, just weird.

He told me that sometimes and not with all entries he only could see the JSON blob of the entry and the switch to go back to normal was greyed out.

Searching Github it turned out that this is related to pull-request 4913 (https://github.com/hashicorp/vault/pull/4913), when an entry is not a string, Vault switches to the display of the JSON blob. (Thanks Chris) But, the main problem is, what is not a string??

As I was planning an Ansible Meetup about the Ansible Automation Platform (AAP, the successor of Ansible Tower) I was contemplating about a demo environment for the attendants. This can be done with ease as it it nothing more than clicky-di-click.

You can imagine that’s not the way I went :-). There is a simple rule in life:
If you can automate it, automate it. The complete environment is going to be a multipart environment, so that the attendants can experiment and have an environment that slightly resembles real live.

When working for a customer I was installing an Ansible Automation Platform cluster and to keep track of all systems I decided to create a nice message of the day, of course with cowsay.

Something like this:

Early this week a co-worker asked if it was possible to access the Ansible command-line in a playbook. It seems that is not the case, in a normal, clean Ansible environment.

But in the meantime I was creating a playbook that served multiple purposes, stopping and starting services. These playbooks are completely the same, except for the start and stop keywords. Of course I could have solved that with a variabele, either hardcoded or as an extra variable on the commandline. But, where is the fun in that :-)

During my stay at CfgMgmtCamp I attended the presentation of Franziska Bühler (@bufrasch) titled Web Application Firewall - Friend of your DevOps pipeline?. She talked about Web Application Firewalls (WAF) and the Core Rule Set (CRS) for owasp

Being into security and stuff like that myself, I decided I wanted to try to get the web application with ModSecurity up and running in my own test environment.

My test environment consists of a CentOS8 machine with NGINX and it turned out to be a little trickier than I thought.

In our work environment we have role-based access for passwords (of course). But as we deploy all systems with Ansible, we could end up that someone with only deploy permission ends up with access to all passwords. It’s obvious that we don’t want that, so I started checking in to Ansible’s ability to have multiple vault passwords.

Since Ansible version 2.5 there is a lot of discussion and confusion about the loop syntax. There is also discussion if with_…​: will be replaced by loop: deprecating the with_…​ keywords. Even Ansibles documentation is not clear about this.

Should I use loop: or with_…​:, in fact nobody really knows. What would the correct syntax be?

I am a long time Ansible user and contributor (since 2012) and I have been struggling with a decent setup for a multi-environment case. I have been designing and re-designing a lot, until I came up with this design. And what a coincidence, a customer wanted a setup that was exactly this. So this concept is a real world setup, working in a production environment.

Did I get your attention? Read after the break, but take your time. it is a long read.

Some time ago I created a playbook to show the content of a rendered template. When you keep digging in the Ansible documentation, you suddenly stumble over the template lookup-plugin. And then it turns out that my playbook is a bit clumsy.

A nicer and shorter way to do it:

A couple of days ago a client asked me if I could solve the following problem:

As the new GDPR finds its way all over Europe I decided to have a closer look at my website. I have been using the Disqus comment system for some time now, but hardly ever someone really takes the time to comment.

As the Disqus systems uses a lot of Javascript and cookies, I decided it was time to get rid of these tools and make my site fly, again.

During my last Ansible training the students needed to create some Ansible templates for them selfs. As I do not want to run a testing template against some, or all, machines under Ansible control I created a small Ansible playbook to test templates.

This is the playbook:

Yesterday I removed a simple package from my Fedora 23 machine and after that I got the message

WTF??????

Searching the interwebs I found out I wasn’t the first, and probably not the last, to run into this problem.

It seems that, one way or another, the DNF package doesn’t know about the dependency it has on SQLite. So, when a package removal requests to remove SQLite, DNF removes it without questions. Ans thus break itself.

After a lot of thought I decided it was time for a new project, one I would enjoy and a project that would be useful for a long time.

Searching the web and reading articles I found the ErgoDox.

The ErgoDox is a split-hand ergonomic keyboard with mechanical switches and open source, layer-based firmware running on a Teensy microcontroller. While other keyboards offer dip-switches or GUI config tools, the firmware and layouts can be built from source on the command line or through a layout configuration tool. Flashing a new build onto the ErgoDox is easy with the multi-platform Teensy loader.