mastodontech.de ist einer von vielen unabhängigen Mastodon-Servern, mit dem du dich im Fediverse beteiligen kannst.
Offen für alle (über 16) und bereitgestellt von Markus'Blog

Serverstatistik:

1,5 Tsd.
aktive Profile

#ansible

21 Beiträge17 Beteiligte0 Beiträge heute

CyMaIS statt Workday: Digitale Souveränität für HR & Organisationen

Während viele Organisationen sich von Workday begeistern lassen, wird oft übersehen, dass diese Lösung in einer proprietären Blackbox läuft – mit allen Risiken von Vendor-Lock-in, Datenspeicherung in Drittstaaten und hohen Lizenzkosten.Doch es gibt eine echte Alternative: CyMaIS, das freie Framework für selbstbestimmte IT-Infrastruktur.

[…]

blog.cymais.cloud/blog/2025/06

#akaunting#ansible#attendize

More progress with the home lab cleanup and move to infrastructure as code tonight. Slow and steady but it's progress. I'm currently trying to find the most efficient way to structure my Ansible playbooks to improve performance and readily.

I'm working in a mass cleanup of my rather clumsy Ansible playbook at home.

I'll spare you all the details but I'm trying to get a single playbook running across all my hosts and targetting tasks based on the group membership such that the right task only runs on a host in the `software_curl` group.

I've found an option that works but it throws a warning because "conditional statements should not include jinja2 templating"...

- name: Install curl
ansible.builtin.apt:
name: curl
state: latest
update_cache: yes
when: "'software_curl' in {{ group_names }}"
tags: curl

Are there any #ansible gurus out there who can suggest a less "warning filled" approach?

The evenings this week have been a bit of an adventure with the home lab. I'm migrating a number of random services onto a pair of new VM's, one on each of my two Proxmox hosts. They'll become DNS servers (authoritative using nsd and recursive using Unbound), including basic DNS filtering of the bad stuff as well as DNS64/NAT64 services so I can move to more IPv6 mostly systems at home. They'll probably also pickup NTP and any other services that make sense along the way.

My challenge has been to perform as much of the setup as possible using Ansible. I'm still very much a beginner but I seem to be making good progress.

I've been fighting with NSD/Unbound and reverse DNS but after a couple of days that's on hold. Forward resolution is working so I've moved some of the home VLAN's over to add some load. Holy crap they are fast. There's a little delay for a new site not in the cache but it soon picks up. It feels like an order of magnitude faster than my venerable pi 3b+ running pihole with the same DNS filtered list.

I'll crack the reverse DNS stuff at some point and now I've realised the reason I couldn't restart NSD after a change (so I was rebooting the VM) was because I didn't realise the "remote control" options are also needed for local control on the VM, it's a lot faster to get updates on place.

More work tomorrow night on the Ansible playbook with some better tags to manage operations without updating everything.

#HomeLab#OpenBSD#Unbound

7 Gründe, warum Bildungseinrichtungen CyMaIS nutzen sollten

In einer Welt, in der Bildung zunehmend digitaler wird, stellen sich Schulen die Frage: Wie schützen wir unsere Daten, behalten die Kontrolle und bleiben unabhängig von großen Konzernen?CyMaIS liefert die Antwort – eine selbstgehostete IT-Plattform, speziell für Bildungseinrichtungen.

In diesem Artikel zeigen wir Ihnen in 7 klaren Punkten, warum CyMaIS die bessere Alternative zu klassischen Cloudlösungen ist.

[…]

blog.cymais.cloud/blog/2025/06

An evening filled with gardening and #ansible, plus some movie watching in the background. Slow progress on a couple of new home servers to provide redundancy and consolidation, but slow progress is still progress.

i am considering doing a private local #ansible playbook with a locally running woodpecker ci (on my raspi) that houses app roles using git submodules which are eligible for unattended updates. my inventory and vault will also be a submodule (that's why it would be a "local" repo).
my nvchecker script that already posts release notifications to matrix and via mail (for todolist), would then also post against the woodpecker api in order to trigger a run.

that should work somehow, shouldn't it? or are there arguments to still go for tower, semaphore, rundeck or a fragile local script trigger instead for this small teamless scenario?

Antwortete im Thread

@ramin_hal9001 OFC this mostly considers stuff in /etc/, /opt/, ... and is intended to be an explicit "opt-in" - style configuration managment.

For me it's more of a way to find a better & simpler alternative to #Ansible that doesn't require me to install something on the target #Server (or "#EdgeComputing node") and "just works"...

We've been hard at work the past few months!

1. Leaving the Westin datacenter in downtown Seattle and moving on from expensive co-location

2. Moving our gear to Fremont, California

3. Bringing on board a few new Advisory Board members, including @whil who has been an incredible help deploying our #Proxmox infrastructure, and @alexhaydock who has been instrumental in deploying our new #Ansible infra, new recursive #DNS resolution infra, and new #Tor exit relays in California! See: infosec.exchange/@alexhaydock/ with more updates to follow

4. Installing new co-location with some older low-power systems in Amsterdam for our self-hosted #ActivityPub infra @ disobey.net, where we just moved our #Mastodon profile to!

5. Deploying a new #XMTP node @ xmtp.disobey.net, and testing a new #DeltaChat relay!

6. Deploying some new #obfs4 private bridges for use in a country who's conducting heavy internet surveillance and censorship, blocking access to @torproject

and today is our birthday!!! we're 8 years old today ^_^ stay tuned for more updates to come!

A screenshot of the Tor Browser showing https://dnscheck.tools open with an Emerald Onion exit relay relaying the traffic. It shows that our current IPv4 and IPv6 addresses are within Emerald Onion's AS space, and our 6 upstream DNS resolvers are too.
Infosec ExchangeAlex Haydock (@alexhaydock@infosec.exchange)Angehängt: 1 Bild We deployed 24x new Tor exit relays today for @emeraldonion@disobey.net ! 🧅 I'm excited to post (or maybe talk) about our deployment architecture soon. We're deploying relays as diskless VMs that each boot from a single EFI binary. No logging, no persistence. Pretty much just the Tor daemon. https://metrics.torproject.org/rs.html#search/family:186F046D8895E13626B363B879BD15F38A52C6BC