DEV Community: Mike Sanders

Ansible playbooks for the Linux minimalist

Mike Sanders — Sat, 31 Jan 2026 20:31:01 +0000

Overview

I am sharing these playbooks because they have helped me manage virtual machines in my home lab and cloud instances. Users should have a basic knowledge of Ansible, some experience with Linux, and some familiarity with virtual machines. You can follow along with the repository at Git Hub here.

Environment

These playbooks were written with the following environment in place. You will need to adjust files and playbooks to meet your environment's needs.

Local network of 10.20.26.x
Working Bind/DNS service managing the home.internal domain
Working email service for the above domain
Working HashiCorp Vault instance to manage secrets
Debian 12 workstation to run the Ansible playbooks

Ansible Setup

To install Ansible and its dependencies on Debian 12 run the following command:

sudo apt install ansible

Next, clone this repository and change to the cloned directory. The next command will create an Ansible Vault file:

ansible-vault create secrets.yaml

This will ask you for an Ansible Vault password and then open secrets.yaml in a text editor. If you plan to use HashiCorp Vault to manage passwords, you can add your token to secrets.yaml here.

Otherwise you can add your sudo passwords to secrets.yaml for Ansible Vault to manage.

If using HashiCorp Vault, you will also need to install the hvac Python package via pip:

sudo apt install python3-pip
python3 -m venv myenv
source myenv/bin/activate
pip install hvac

If you are using vault.yaml, it will connect to your HashiCorp Vault instance. Edit the URL to match your Vault instance's URL. vault.yaml is treated as a vars file; it pulls keys from a HashiCorp Vault path. For this example the path is kv/data/ansible. It uses the Ansible secret named ansible_token to store the token for HashiCorp Vault.

The next file to edit is the inventory.yaml file. This example shows how to pull secrets from both HashiCorp Vault and Ansible Vault. For example, the ansible_become_password for dev.devsrv1 is stored in Ansible Vault. The ansible_become_password for network.debiansrv1 is stored in HashiCorp Vault and returned in the key list called vault_data, under the key debiansrv1_sudo.

The last step is to generate SSH key pairs if you don't already have them. This public key will be used to communicate with the servers that Ansible will manage.

ssh-keygen

Minimal Debian VM Setup

On to creating VM templates. The first template will be a fresh install of Debian 12. I changed the VM networking to use bridged mode. This places the VM on the local network using DHCP.

For a minimal install, deselect all options in Software Selection except SSH Server, since this is needed to manage the machine via Ansible.

After the instance is installed, stop it and clone the instance for further work. I call this template deb12base.

Preparing cloned template for Ansible

On a clean Debian 12 install, you cannot SSH in as root. Therefore, sudo and python3 need to be installed.

apt install sudo python3
/usr/sbin/usermod -a -G sudo <sudouser>

Next, edit /etc/network/interfaces to give the template a static IP on the network. Add the host to DNS so you can use the hostname in the inventory file. There is a playbook for that: bind-update.yaml.

If you want to change the template hostname, use the following command:

sudo hostnamectl set-hostname <hostname>.home.internal

To allow Ansible playbooks to connect, copy your SSH public key to the new VM:

ssh-copy-id <sudouser>@<hostname>

After these changes, stop the instance and clone it for further work. I call this template deb12work.

Ansible Playbook usage

Now, on to using the Ansible playbooks.

The first Ansible playbook to run sets the system clock to use systemd-timesyncd:

ansible-playbook --ask-vault-pass clock-setup.yaml

The second playbook sets up an email client so services or cron jobs can notify a network user via email. This playbook copies a couple of files from the assets folder to the server. These files should be reviewed and edited before running the playbook.

ansible-playbook --ask-vault-pass mail-setup.yaml

Test the email setup by sending an email from the guest machine.

The next playbook installs rkhunter and ClamAV. This script installs cron jobs to run these tools daily. The cron jobs also run an apt upgrade check and email the results of what packages need to be installed without actually installing them. Be sure to edit these so they notify the correct email address. The playbook will also copy a stricter /etc/ssh/sshd_config to prevent root logins and enforce safer TLS settings. rkhunter will complain if these are not set.

ansible-playbook --ask-vault-pass security-tools-install.yaml

This playbook will restart the server or guest instance.

Next playbook will use nftables as a firewall. It isn't very strict as it allows all outbound traffic. It does block inbound traffic except for SSH. Adjust it according to your needs.

ansible-playbook --ask-vault-pass nftables-install.yaml

Next playbook will install and configure fail2ban. This utility slows down attackers by putting them in a jail for a period of time. Adjust the configurations to your preference.

ansible-playbook --ask-vault-pass fail2ban-install.yaml

Apt Upgrades

This playbook will upgrade apt packages on multiple servers. Configure as needed.

ansible-playbook --ask-vault-pass apt-upgrade.yaml

Install Nginx Server

This playbook will install nginx and compile it with modsecurity. It will add modsecurity rules from OWASP. Also, it will add jails to fail2ban for modsecurity and for various 400 errors over periods of time to prevent system scanning. The playbook has a variable for the version of nginx you are using. Be sure to change this to the correct version you are targeting.

ansible-playbook --ask-vault-pass nginx-install.yaml

Shutdown and Restart

These playbooks can simply restart or shutdown a group of instances.

ansible-playbook --ask-vault-pass restart.yaml
ansible-playbook --ask-vault-pass shutdown.yaml

Change Hostname

When cloning new instances from templates, you might want to change the hostname for the new clone. This playbook will copy /etc/network/interfaces so you can set the static IP as well. Make sure to edit that before running. Here is the playbook call for that. This playbook shows how to pass environment variables to ansible.

ansible-playbook --ask-vault-pass change-hostname.yaml -e 'hostname=devsrv1'

Finalizing templates by regenerating host keys

Up until now, I have been cloning templates and reusing those templates. This is fine except for the fact that SSH host keys have been reused as well. For a final step I want to regenerate the SSH host keys and finalize a VM template to be re-used. This will cause Man in the Middle warnings the next time you try to connect, so you will have to follow the instructions to clear those up. I found this technique at this address, https://www.youtube.com/watch?v=oAULun3KNaI.

ansible-playbook --ask-vault-pass prep-template.yaml

A Custom Consent Management approach for GDPR compliance

Mike Sanders — Sat, 19 Jul 2025 20:33:47 +0000

The purpose of this post is to illustrate how GDPR implementations can satisfy the following requirements:

Provide a default non-script way for a user to opt-in or revoke consent based on category of cookies.
Redirect to a JavaScript implementation for the same when JavaScript is enabled.
Have the implementation work for both dotnet core and dotnet framework front ends.
The consent cookie should be protected and not accessible by JavaScript.

User Experience

A simple web template is used to illustrate the user experience.
The template has a simple header and footer with a body that
contains a consent banner at the bottom of the page.
The banner has a link to the privacy policy and a button to accept cookies.

After clicking the accept button, the user is redirected to a page
that shows that the consent has been accepted.

The user can manage consent by cookie category by clicking a link in the footer.

The Manage Cookies link defaults to a simple non-JavaScript UI. By default any unnecessary categories are not selected, using an Opt-In strategy.

If the user selects the marketing category, then the ads will be
shown on the pages. The user can deselect marketing cookies and
the ads will be removed from the pages.

Solution architecture

The code for the solution is located on GitHub.

The solution is illustrated in this diagram. The dotted lines with arrows denote dependency.

The central project to fulfill implementation for both dotnet core and dotnet framework clients is WebUtils.Standard, which is coded with .NET Standard 2.0. This library contains the service client for the Consent Service. That service along with the domain project
are coded with dotnet core 8.

Another item to note are the facades created around HTTP Context, Request, and Response objects. I passed in these facades to the WebUtils.Standard so that both .NET Framework and dotnet core clients
can use that library. The implementations for the facades are in the
WebUtils.Frmwk and WebUtils.Core libraries respectively.

In addition to the non-Javascript user interface, I have began a VueJS implementation of opting into cookie categories that exists in the Web.Core project. This implementation is only a starting point.

For the database, I chose Mysql/MariaDB as the implementation. That can be easily swapped out.

Test Coverage

There is a little room for improvement for test coverage, but not too bad for now.

Wrap up

I hope you enjoy this small template project and the code is something you can learn something from.

Journey into new Web Tech

Mike Sanders — Thu, 20 Jun 2024 19:07:18 +0000

Today's web offers many new technologies, the core of which is to employ a Content Management tool that the site owner can edit their content. From a development perspective, the next steps would be to pull that content, code the client side scripts and then finally to serve it as a web application.

While there are many tools to accomplish the above, the remainder of this post will outline the tools I chose to develop a site. Another goal is to re-use such work for creating any web applications for prospective clients. For content management, I decided upon Ghost CMS and for Static Site generation, I decided upon Astro.

Ghost CMS

Besides the installation located at https://ghost.org/docs/install/, the next step with using Ghost CMS, would be to create or use a theme. This has a learning curve to it if creating a new theme. Ghost themes are written using Handlebars, another templating language to learn if you have not already done so. Most of the existing themes I have looked at also use gulp to concatenate the CSS files. Ghost has some pretty good documentation on creating themes.

I have a working theme that I uploaded to git hub so that the reader can follow along for the rest of the post.

A good practice that I have seen many ghost theme authors do, is to separate concerns meaning to have separate CSS files for certain areas or components of a site. An example of how I did this is below.

One CSS file, I chose to name it main.css, imports the other CSS files that gulp will concatenate and minify. Here is how my main.css file looks.

Some may find some limitations with Ghost about theming. One such limitation would be with navigation links. Out of the box, there are no multi-level capabilities nor are there ways to assign icons to links if desired. Therefore, I made the choice to hard code the navigation for a site using some placeholders. Another limitation is the seemingly lack of ability to preview the theme. I have tried the express-handlebars package to do this, however ran into roadblocks with Ghost specific variables and statements. I may revisit that attempt later. Right now the only way I see to preview is to zip up the theme files and upload to the Ghost admin location. Then you can preview it on Ghost.

The project is fairly simple with the following npm steps outlined below.

The first step is a utility from Ghost called gscan. This allows you to check the syntax of your .hbs files and the theme overall to make sure it adheres to a valid Ghost theme. Next is the build step that gulp will use to pack the main.css file. Now to create the theme zip file with the npm zip script. It uses gulp again to do this. I chose not to build with this step as sometimes the errors that gscan produces are not detailed enough. If one uploads the zipped theme even with errors, the Ghost admin site will provide more details as to what specifically needs to be fixed.

A final optional step is to copy the theme or assets folder to the next project in Astro. Here is the example of the main site template, default.hbs.

Astro SSG

As of now, I have a Ghost instance with a theme of my liking and I have created the content on my Ghost instance. My next goal is to pull the content from Ghost CMS and to create the static assets needed for a web site. This is where Astro comes in. I have uploaded another repo to git hub for the user to follow along with.

The project structure looks like the following.

The public folder mostly contains the assets sub folder copied from the ghost theme. The src folder is broken down into the following:

components = Reusable parts to be included in layouts or pages.
content = The folder where blogs and pages will be imported to. This follows Astro's content collections instructions.
importer = This has the script used for importing content.
layouts = This has the main layout for the site. Can include multiple layouts if desired.
pages = This contains slugs to render pages or posts.

The meat of the project is with the importer/index.ts script. It uses an API that needs to be setup in the Ghost instance with an API Key. In order to get Astro and Ghost to work together nicely, some workarounds were needed for this step.

Ghost exports it's format as HTML. Astro is built for Markdown. Therefore the exported content should be stored as .MDX files to work. Next workaround is with the fact that Ghost does not always export well-formed HTML and therefore I was forced to use a tool like sanitize-html to take care of that. I had to use it like below.

The layout is pretty simple and mirrors what was used with the default layout for the Ghost theme.

The page slug looks like the following and shows how to use the 'page' content collection.

All of this results in a beautiful cover page for a new web site.

And there is a list of recent blog posts, including this one. Talk about eating your own dog food.

Astro vs Visual Studio 2022 as Static Site Generators

Mike Sanders — Thu, 23 May 2024 02:32:27 +0000

I have spent today learning the new Astro SSG. You can read about it at https://astro.build/ or better yet you can get started with it at https://docs.astro.build/en/install/auto/. While Visual Studio isn't exactly a SSG, they way you code with it can make static web pages. VS has so much more power than that.

What is a Static Site Generator?

Honestly, the term is sort of new to me. But basically, it means a tool that creates static web pages. What are those? Web pages that only need html, css, and if desired javascript. The official definition of course is at Wikipedia, https://en.wikipedia.org/wiki/Static_site_generator.

Setup

So, for the Astro side, I used the following

VS Code (latest)
Debian 11 OS w 16GB Ram
LxQt
node 18.6
astro 9.5.1

For Visual Studio, of course I need

Windows 11 w 32GB Ram

Comparisons

IDE Performance

Obviously VS Code is going to win this hands down.

Intellisense

Astro -- The intellisense for Astro related code is not too bad using the Astro extension in VSCode, but after adding Vue to the mix, I was a bit disappointed that some Vue code did not show up as missing variable errors. However, the hot swap debug environment with Astro did point out those errors.

Visual Studio -- When it came to choosing CSS classes, Visual Studio still knocks it out of the park for adding classes to elements. VS knows exactly what classes are available and gives very quick dropdowns to this affect. VS wins the intellisense compare.

Flexibility

This one I don't think you can compare. This is where each tool has it's purposes and both do excellent jobs towards that. I won't go into Visual Studio, but I would like to highlight some integration points that Astro offers.

CSS -- Tailwind
WebWorkers -- Partytown (have not been there in a while, but I do like the song)
UI/Javascript Frameworks -- React, Svelte, Vue, plus a few more
SSR -- Cloudfare, Vercel, Node, Netlify
Headless CMS Integration-- Too many to mention, but many are in development.

My Take

I will always opt for a strong backend tool to serve up static pages, like dotnet core. The question and goal I have is how to create a static site quickly and without having to refactor too much later. I might be in a place where I don't worry about styling the site too much and get the content done using Astro. This is where Astro's integration with headless cms systems could have a huge advantage. Plus I think from a templating and component perspective, developing with Astro will be a lot quicker. After all of that is done, then I might let Visual Studio take over for the styling of the sites pages.

Either way, I think it was a day well spent on learning the Astro SSG tool. It is a very promising project in the node/npm space.

A Command line memorable password generator. Now in Python.

Mike Sanders — Tue, 21 May 2024 03:39:06 +0000

I have been using this utility for a couple of years and thought I would share it, code and all. A few years back, I saw an article about best practices for passwords using a combination of a couple of words, numbers, and symbols. At the time, I had a Mac machine that had a nice generator, but I thought...

How can I make this usable across all operating systems?

Python to the rescue

Python is one of those languages that is easy to install on all Operating Systems. It basically is already installed on many, and for developers, it is a nice language to have around.

The script is pretty straightforward. It uses a word dictionary from Linux operating systems and randomly picks a couple of words, numbers, and symbols and creates a list of passwords for you to choose from.

Show Me the Passwords

Okay, so the script is going to ask what password length you want. It can generate passwords 8 to 36 characters long and yes, you can remember these!

Here is example output for 16 character passwords.

aerial3543?regal
baling58+Creator
hones34464%avert
rebind54%Sukkoth
halting8!gannets
inroads68^wattle
toehold5%salving
zenith91+curbing
crime859~Antaeus
bingo5375$rapist
brogan791-texted
dolled16*kindled
kismet86#leering
wrack87728*probe
prose521+prevail
bubble761~onward
pinups69=gristle
inkiest4$uniting
deftly131+Kansas
Orbison6?Nicobar

Here is some craziness with 36 character long passwords.

uncharacteristic162-characterization
segregationists9881,departmentalized
anthropocentric29567%deconstructions
agriculturalists7195-procrastinators
instantaneously88827^counterexamples
incompatibility1227+aristocratically
telecommunication8.anesthesiologists
indeterminately7818^circumscriptions
exemplification44961!authoritatively
counterclaiming52167*inaccessibility
industrialization96%nationalizations
septuagenarians78367%familiarization
obstructionists18361*inconsequential
instrumentation67833$uncommunicative
interchangeably23734#representatives
environmentalists134-radiotelephones
parliamentarians4914,particularities
disillusionment5514&acknowledgements
maintainability18449*exemplification
trustworthiness86634.consciousnesses

Show me the code

Sure, it's up on Git Hub at https://github.com/devdog66/memorable-password