judo

> Which is why I ended up writing my own mini-ansible which instead runs a remote command executor which can be used to run commands remotely without the session cost. HMU on my email. I've been working on/with this since 2016, and I'd love to discuss: <https://github.com/rollcat/judo>

The pain of Ansible+Jinja2 is what eventually pushed me to write judo[1]... It works surprisingly well for what it was built for, but of course has limitations (e.g. there's no direct support for a templating language; you just plug env variables into a script). The idea is, do less, and allow other tools to fill the gaps. There's still a lot on my todo list, like env files, controlling parallelism, canaries/batches, etc. I'm currently doing these things using hacky shell scripts, which I don't like, so I'd prefer moving that into the main binary. But I still prefer it as-is over Ansible. [1]: https://github.com/rollcat/judo

Personally I prefer the approach that the BSDs took: your OS has a "base" that is designed and integrated as a whole, provides basic services (SSH, httpd, mail, etc) plus a spartan GUI and all the tools to support its own development. Everything else is in ports/packages, which theoretically can be erased all at once with no loss in core functionality. It's conceptually simple and works OK in practice. Notably, macOS (a BSD in my book) took the next logical step and completely sealed the base OS, all the way via logical volume management, verified boot chain, SEP (aka TPM), etc. I agree that NixOS solves configuration management in a much more elegant way, but that elegance carries a heavy cost: it requires domain knowledge to comprehend. Personally I just keep /etc in git, and use judo to propagate changes. <https://github.com/rollcat/ju

Don't get me wrong, I love Python, and I've been a user since the 2.4 days. You brought up plenty of good reasons to use it - and my own rule of thumb is to rewrite a shell script in Python once it goes past 100 lines. My point is that Lua-the-language provides similar expressive power to Python-the-language (including basic stuff like lookup tables), while remaining smaller and simpler to understand than the POSIX shell. It's also simpler to vendor than Python, and you probably want to vendor this kind of stuff to avoid the pain of bootstrapping / circular dependencies. Now I haven't built a build/packaging system like xbps or apk (few people did), but I've been in charge of devops/releng at work for a decade - and if I learned anything at all, it's that it's better to start with the simplest tool that can do the job, and slowly add what

I maintain two projects that I use daily for both work and personal stuff, that have attracted a modest, but appreciable amount of contributions. In both cases, the codebases are relatively small (500-1k sloc), and laser-focused on doing exactly one thing well. I'm very grateful for every contribution, no matter how small - people have found bugs, fixed real problems, done cleanups. The hardest part is telling someone that a feature/idea does not have a place in this project. I think the general emphasis on minimalism tends to help here - I've never had to deal with any drama. In terms of workload, again - the minimalist design and extremely clear goals have helped so much. I got trapped by that once before - I volunteered to build an internal automation tool (that saved someone else from doing like 1h/d of work), but literally couldn't s

"This simple tool solves X at my org" is probably the most underrated type of project. There's not enough room to overcomplicate something that isn't a core part of the business, it must be practical to maintain, simple&stupid enough so that onboarding is not a hurdle, etc. I encourage everyone to share your "splunk in 1kloc of Python" projects! Some of my own: - https://github.com/rollcat/judo is Ansible without Python or YAML - https://github.com/rollcat/zfs-autosnap manages rolling ZFS snapshots

Oh yes, I've run into this when creating judo[1] (which runs commands/scripts across a fleet of hosts via SSH). It's not even a problem with OpenSSH, the SSH protocol itself (RFC4254[2], Section 6.5) specifies that the command is sent as a string, and there's just no sane way to convert between an array of strings and a string that's also human-friendly to the command line. My work-around was to allow only a single argument in "judo -c CMD HOST", where CMD is to be interpreted by the target's shell. If you need to do anything more complex, the "judo -s SCRIPT HOST" form is more-or-less equivalent to "chmod +x SCRIPT && ./SCRIPT". [1]: http://github.com/rollcat/judo [2]: https://www.rfc-editor.org/rfc/rfc4254

I've written a minimalist replacement for Ansible. It started as a weekend hack, and I'm still using it daily after 7 years. Perhaps it's not technically impressive, but so wasn't the original UNIX, which served as a direct inspiration: how much work can you do with the simplest design and the least amount of code? https://github.com/rollcat/judo

Ansible and YAML were my primary (de)motivators to create Judo (https://github.com/rollcat/judo). This combo is extremely frustrating: for every line in a (hypothetical) shell script that would do one thing, I needed 3-5 (sometimes many more) lines of YAML. Most people on the team who were just getting started with Ansible, would often do half of their work just shelling out. I would usually push to do things "the Ansible way", but even I had to acknowledge the mental overhead of translating back & forth. I think what finally pushed me over the edge was when we started venturing into compose & k8s, and had to mix & juggle YAML+Jinja in two entirely different contexts, each with its own quirks, bugs, gotchas and brain damage. I figured I just need a layer of glue to run shell scripts across a bunch of remote hosts (hence Judo), and otherwi

You're right, once an adversary gains physical access (or even remote access as your main login account), all bets are off. This is the area where the traditional UNIX security model has failed to adapt at all: you need a password to install a random game from apt (a vetted and trusted source), but you don't need a password to install a cryptolocker, or exfiltrate personal data. However I like having a password (or some other form of confirmation), just so that I can stop to think for a second, whether what I'm about to do is a good idea. What's annoying is that I effectively need two different policies on workstations and on servers, since I still want to be able to escalate privileges from maintenance scripts[1]. [1]: https://github.com/rollcat/judo/issues/9

> https://github.com/rollcat/judo#passing-arguments-to-scripts implies that project is for sure not for me, but I wish you all the best with it! That's one of the design decisions, there should ideally be only one "obvious" way of achieving a certain goal. Per-invocation parameters can already be passed via environment variables ("-e FOO" to pass from your local environment; "-e BAR=42" to set explicitly); I'm also considering using envdir (or a similar scheme) to set per-host parameters (https://github.com/rollcat/judo/issues/11). I could allow specifying command line arguments somehow with the -s flag, but that would complicate parsing, quoting/unquoting, etc. I would have to teach the user about quoting rules, and probably shoot myself in the foot at least once in the process. I try to actively avoid creating hard problems by solving a

You're welcome to plug it, although the top-level thread is likely where you'll get more of the kind of exposure you're looking for: https://news.ycombinator.com/item?id=31399719 https://github.com/rollcat/judo#passing-arguments-to-scripts implies that project is for sure not for me, but I wish you all the best with it!

https://github.com/rollcat/judo - my side project.

I hope you don't mind me stealing your comment to plug my side project, Judo. It was created in 2016, out of my frustration with Ansible. Judging by the state of affairs, that motivation continues to be relevant. https://github.com/rollcat/judo

I wrote judo[1] because I was frustrated with Ansible. I wanted a very basic tool that could do 80% of the work in 1% of the code. It has one or two bugs, but I've been using it for personal and work stuff since 2016 and I'm not looking back. [1]: https://github.com/rollcat/judo