On 11/01/2015 09:46, Tomas Mozes wrote: > On 2015-01-10 23:11, Alan McKinnon wrote: >> On 10/01/2015 21:40, Tomas Mozes wrote: >> >> >>> Ansible is a not a backup solution. You don't need to download your /etc >>> from the machines because you deploy your /etc to machines via ansible. >>> >>> I was also thinking about putting /etc in git and then deploying it but: >>> - on updates, will you update all configurations in all /etc repos? >>> - do you really want to keep all the information in git, is it >>> necessary? >> >> The set of fileS in /etc/ managed by ansible is always a strict subset >> of everything in /etc >> >> For that reason alone, it's a good idea to back up /etc anyway, >> regardless of having a CM system in place. The smallest benefit is >> knowing when things changed, by the cm SYSTEM or otherwise > > For what reason?
For the simple reason that ansible is not the only system that can make changes in /etc > And how does a workflow look like then? You commit changes to your git > repo of ansible. Then you deploy via ansible and check the /etc of each > machine and commit a message that you changed something via ansible? When you commit to the ansible repo, you are committing and tracking changes to the *ansible* config. You are not tracking changes to /etc on the actual destination host, that is a separate problem altogether and not directly related to the fact that ansible logs in and does various stuff. You can make your workflow whatever makes sense to you. The reason I'm recommending to keep all of /etc in it's own repo is that it's the simplest way to do it. /etc/ is a large mixture of ansible-controlled files, sysadmin-controlled files, and other arbitrary files installed by the package manager. It's also not very big, around 10M or so typically. So you *could* manually add to a repo every file you change manually, but that is error-prone and easy to forget. Simpler to just commit everything in /etc which gives you an independant record of all changes over time. Have you ever dealt with a compliance auditor? An independant change record that is separate from the CM itself is a feature that those fellows really like a lot. -- Alan McKinnon alan.mckin...@gmail.com
