[07:33] morning boys and girls. [09:14] morning all [09:14] how are we all today? [09:28] Just tried installing corebird from a snap, and it tells me I also need to install a snap called gnome-3-26-1604 and connect it to the corebird snap. This I don't mind doing right now, and I understand why it technically needs to be done, but I don't know why it's not just automatic [09:29] morning, could be better, and you? [09:29] I'm slightly ill, so I could be better too [09:29] hope better soon. [09:56] did someone tell me that lets encypt can manage certs for sites with internal IP too? [09:56] apparently so [09:56] though I don't know how to get that working [09:56] I'm certainly looking forward to wildcard certs landing [10:35] Morning all [10:36] ahoy [10:39] How's the new job going SuperMatt ? [10:39] going well thank you. I've been there a month right now and I haven't wanted to murder anyone [10:40] The tech stack is brilliant [10:40] there's lots of free food [10:40] and fridays are a write off, which is mavellous [10:42] I do sometimes think I should look at something like that [10:42] But not sure I want to much pressure atm [10:42] And I guess that can be there [10:42] Well at the moment there's no pressure because I am too new [10:42] b [10:43] oops [10:43] But from what I've seen of the veterans is that there's no too much pressure either, at least not until the site goes down [10:43] but the stack is such that the customer is rarely affected when a node or two go down [10:44] I'd like to run stuff like that, we probably couldn't ( very old software ) [10:46] you gotta convice the bosses that stacks with service discovery and self healing are awesome [10:47] I could say it's awesome, just not enough staff to do anything about it [10:47] Most have been here 20ish years [10:57] eek! [10:58] An aging staff in tech is not a good idea. It increases the chance of knowledge residing solely in brains, rather than in documents [11:03] There were literally 3 documents when I joined, I've written 1000's of pages now in sphinx (rst ) and also in a seperate git repo too [11:03] And you're right, some things are only known by 1 or 2 people, I'm trying to change that [11:03] You need to do a bus test [11:04] Pretend that someone has been hit by a bus and send them home for a week, fully paid [11:04] Then see if you can get through the whole week and a DR recovery test without contacting them [11:08] Yeah, we can with the knowledge but it would be slow, they don't listen tbh but happy for me to start fixing the problems myself with not a lot of help [11:08] Gone from taking 1 1/2 days to deploy / set up our software to 20 mins with Ansible :) [11:08] 4-5 hours to install / setup new hardware to 5-6 mins [11:09] good man [11:11] They love it now, deploy ssh keys out to clients and remove them all when someone leaves, it's just a god damn slow process and hard work [11:11] puppet is good for ssh keys [11:11] I use ansible for that too [11:12] Just hard to keep on top of this plus doing everything else :) [11:12] Can't get my new Cent7 image to PXE boot either :/ [11:12] why would you need ssh keys, and accounts, on the servers when you have ansible though? ;-) [11:13] For out staff to logon to fix application specific issues at our clients [11:13] Oh noticed the smiley at the end :P [11:13] * diplo is tired [11:13] ansible -m command -a ? :-D [11:13] That would take users understanding anything apart from what they've learnt over 20 years [11:14] aye :-) [11:14] They still use some ps commands that don't really return what they really need, but it's what they've always used [11:14] not as easy to implement as it sounds always :-) [11:14] We only moved to SVN about 5-6 years ago, that was HELL! [11:14] thank god my home lab is different from $WORK ;-) [11:14] Trying to move to git now :) [11:15] I'm considering allowing ansible to ssh to the hosts and use the lxd connection plugin to actually manage the containers... and then stop having ssh :-P [11:15] could be a fun exercise ;-) [11:16] s/stop having ssh/& in the containers/ [11:20] yeah, removing ssh is a double plus good idea [11:29] hmm. ansible automates in netherlands 14/3 :-) [11:29] tempting [11:29] going abroad on the company dime ftw [11:31] aloha [11:37] hola czajkowski [11:42] Nafallo: howdy [12:17] So disabling sshd on the lxd's Nafallo ? sounds good.. may have to think about that, I use lxc currently and haven't had chance to setup/check out lxd and the slight changes [12:18] But I guess I ought to at some point [12:21] now I just need time to play with it ;-) [12:25] That's my problem too :) [12:29] ansible -m command -a "netstat -ltn" lxd <- working fine :-) [12:29] using the dynamic inventory on my laptop ;-) [12:29] did ansible -m service -a "name=ssh state=stopped" lxd before [12:32] I never use the single liners, how do you know what host that is being deployed against? [12:32] I take it that it reads /etc/ansible/hosts by default [12:33] I've specified inventory in ansible.cfg, and created a folder that contains lxd.ini lxd.py and localhost. [12:34] Ah right, I've never thought of playing in there, will take a look later, I've pretty much solely used playbooks so far as they suit my needs, but want to tinker some more at some point soon [12:34] localhost being a static inventory config with ansible_connection=local set, and the other files being slightly modified versions of the dynamic inventory scripts at ansible github contrib/inventory files. [12:35] the script is just set to put all the local lxd hosts in an lxd group, and tell it to use ansible_connection: lxd ;-) [12:35] ah OK, that sounds easy enough [12:36] Going to install it on my solus box as it is in the repos [12:36] obviously, running ansible binary instead of ansible-playbook above as well. just need to do one task on the lxd group quickly ;-) [12:37] yeah, I keep meaning to play [12:37] So going to try it right now [12:39] Also haven't tinkered with sudo yet, I have a playbook ready to do it and tinker [12:39] what are you planning for sudo? :-) [12:39] lxd connection always uses root, since that was lxc exec does ;-) [12:40] Running commands on all our customer sites as our one user so our staff don't need root - can run same commands on all sites out of hours [12:40] other than that, I tend to work around requiring to remember setting -B for playbooks by setting them to use become: false global and use a pre-task that runs sudo -v :-) [12:41] As I said earlier, we had lots of issues with the way our staff did things, like can't get something working, lets 777 the home directory [12:41] obviously for that sort of deployment your best options is probably public key + sudoers.d/ file with nopasswd locally for the deploy user :-) [12:43] Yeah, that's my intention, just got to get all the tasks they require root for :) [12:43] ah right. I see where you're going now... you want to modularise root a bit rather than allow all for these people that prefer logging in? :-P [13:18] SuperMatt: the installation of gnome-3-26-1604 is not automoatic because currently there's no way of defining that dependency, but if it is already installed then the "connect" part is done automatically - so other snaps depending on it will pick it up now you've got it installed [15:30] hrmpf. writing a module. I've spent half the day documenting it :-P [15:31] diplo, SuperMatt: if you Ansible guys use Ubuntu, I'm currently attempting to re-write https://code.launchpad.net/~tribaal/ubuntu-repository-cache/trunk in Ansible ;-) [15:31] might be helpful. [15:32] started writing and realised I need roles for apache2, squid and squid-deb-proxy as dependencies ;-) [16:31] Use it against CentOS boxes mainly for work, but will take a look on one of my ubuntu machines tomorrow [16:31] Afternoon has been manic :( [17:28] gog.com freebie: https://www.gog.com/#giveaway [23:36] hrmm got forward a few of the Google G Suite GDPR emails, so have to find out what the deal with that is... [23:36] my instinct is that being outside of the EU, there isn't much for us rock dwellers to do [23:45] you're not outside of the eu yet... and the final deal might mean it applies to you rock dwellers too? [23:46] yes we are :) never been in the EU [23:46] ...please send me a crate of happy sleepy sleep snoozy snooze... :-) [23:47] o0