This is a mini workshop as an introduction into using
Ansible for the administration of Debian systems.
As an example it s shown how this configuration management tool can be used to remotely set up a simple WSGI application running on an Apache web server on a Debian installation to make it available on the net.
The application which is used as an example is
httpbin by
Runscope.
This is an useful HTTP request service for the development of web software or any other purposes which features a number of specific endpoints that can be used for different testing matters.
For example, the address
http://<address>/user-agent of httpbin returns the user agent identification of the client program which has been used to query it (that s taken from the header of the request).
There are official instances of this request server running on the net, like the one at
http://httpbin.org/.
WSGI is a widespread standard for programming web application in Python, and httpbin is implemented in Python using the Flask web framework.
The basis of the workshop is a simple base installation of an up-to-date Debian 8 Jessie on a demonstration host, and the latest official release of that is 8.7.
As a first step, the installation has to be switched over to the testing branch of Debian, because the
Debian packages of httpbin are comparatively new and are going to be introduced into the stable branch of the archive the first time with the upcoming major release number 9 Stretch .
After that, the Apache packages which are needed to make it available (
apache2 and
libapache2-mod-wsgi other web servers of course could be used instead), and which are not part of a base installation, are installed from the archive.
The web server then gets launched remotely, and the httpbin package will be also pulled and the service is going to be integrated into Apache to run on that.
To achieve that, two configuration files must be deployed on the target system, and a few additional operations are needed to get everything working together.
Every step is preconfigured within Ansible so that the whole process could be launched by a single command on the control node, and could be run on a single or a number of comparable target machines automatically and reproducibly.
If a server is needed for trying this workshop out, straightforward cloud server instances are available on the net for example at
DigitalOcean, but let me underline this there are other cloud providers which offer the same things, too!
If it s needed for experiments or other purposes only for a limited time, low priced droplets are available here which are billed by the hour.
After being registered, the machine(s) which is/are wanted could be set up easily over the web interface (choose Debian 8.7 as OS), but there are also command line clients available like
doctl (which is not yet available as a Debian package).
For the convenient use of a droplet the user should generate a SSH key pair on the local machine, first:
$ ssh-keygen -t rsa -b 4096 -C "john@doe.com" -f ~/.ssh/mykey
The public part of the key
~/.ssh/mykey.pub then can be uploaded into the user account before the droplet is going to be created, it then could be integrated automatically.
There is a good introduction on the whole process available in the excellent tutorial series
serversforhackers.com,
here.
Ansible then can use the SSH keypair to login into a droplet without the need to type in the password every time.
On a cloud server like this carrying a Debian base system, the examples in this workshop can be tried well.
Ansible works client-less and doesn t need to be installed on the remote system but only on the control node, however a Python 2.7 interpreter is needed there (the base system of DigitalOcean includes that).
For that Ansible can do anything on them, remote servers which are going to be controlled must be added to
/etc/ansible/hosts.
This is a configuration file in the
INI format for DNS names and IP addresses.
For a flexible organisation of the server inventory it s possible to group hosts here, IP ranges could be given, and optional variables can be used among other useful things (the default file contains a couple of examples).
One or a couple of servers (in Ansible they are called hosts ) on which something particular is going to be happening (like httpbin is going to be installed) could be added like this (the group name is arbitrary):
[httpbin]
192.0.2.0
Whether Ansible could communicate with the hosts in the group and actually can operate on them can be verified by just pinging them like this:
$ ansible httpbin -m ping -u root --private-key=~/.ssh/mykey
192.0.2.0 SUCCESS =>
"changed": false,
"ping": "pong"
The command succeeded well, so it appears there isn t no significant problem regarding this machine.
The return value
changed:false indicates that there haven t been any changes on that host as a result of the execution of this command.
Next to
ping there are several other
modules which could be used with the command line tool
ansible the same way, and these modules are actually something like the core components of Ansible.
The module
shell for example can be used to execute shell commands on the remote machine like
uname to get some system information returned from the server:
$ ansible httpbin -m shell -a "uname -a" -u root --private-key=~/.ssh/mykey
192.0.2.0 SUCCESS rc=0 >>
Linux debian-512mb-fra1-01 3.16.0-4-amd64 #1 SMP Debian 3.16.36-1+deb8u2 (2016-10-19) x86_64 GNU/Linux
In the same way, the module
apt could be used to remotely install packages.
But with that there s no major advantage over other software products that offer a similar functionality, and using those modules on the command line is just the basics of Ansible usage.
Playbooks in Ansible are YAML scripts for the manipulation of the registered hosts in
/etc/ansible/hosts.
Different tasks can be defined here for successive processing, like a simple playbook for changing the package source from stable to testing for example goes like this:
---
- hosts: httpbin
tasks:
- name: remove "jessie" package source
apt_repository: repo='deb http://mirrors.digitalocean.com/debian jessie main' state=absent
- name: add "testing" package source
apt_repository: repo='deb http://httpredir.debian.org/debian testing main contrib non-free' state=present
- name: upgrade packages
apt: update_cache=yes upgrade=dist
First, like used with the CLI tool
ansible above, the targeted host group
httpbin is chosen.
The default user root and the SSH key could be fixed here, too, to spare the need to give them on the command line.
Then there are three tasks defined to get worked down consecutively:
With the module
apt_repository the preset package source jessie is removed from
/etc/apt/sources.list.
Then, a new package source for the testing archive gets added to
/etc/apt/sources.list.d/ by using the same module (by the way,
mirrors.digitalocean.org also provides testing, though, and that might be faster).
After that, the
apt module is used to upgrade the package inventory (it performs
apt-get dist-upgrade), after an update of the package cache has taken place (by running
apt-get update)
A playbook like this (the filename is arbitrary, but commonly carries the suffix
.yml) can be run by the CLI tool
ansible-playbook, like this:
$ ansible-playbook httpbin.yml -u root --private-key=~/.ssh/mykey
Ansible then works down the individual plays of the tasks on the remote server(s) top-down, and due to a high speed net connection and SSD block device hardware the change of the system to being a Debian Testing base installation only takes around a minute to complete in the cloud.
While working, Ansible puts out status reports for the individual operations.
If certain changes on the base system have been taken place already like when a playbook is run through one more time, the modules of course sense that and return just the information that the system haven t been changed because it s already there what have been wanted to change to.
Beyond the basic playbook which is shown here there are more advanced features like
register and
when available to bind the execution of a play to the error-free result of a previous one.
The
apt module then can be used in the playbook to install the three needed binary packages one after another:
- name: install apache2
apt: pkg=apache2 state=present
- name: install mod_wsgi
apt: pkg=libapache2-mod-wsgi state=present
- name: install httpbin
apt: pkg=python-httpbin state=present
The Debian packages are configured in a way that the Apache web server is running immediately after installation, and the Apache module
mod_wsgi is automatically integrated.
If that would be otherwise desired, there are Ansible modules available for operating on Apache which can reverse this if that is wanted.
By the way, after the package have been installed the httpbin server can be launched with
python -m httpbin.core, but this runs only a mini web server which is not suitable for productive use.
To get httpbin running on the Apache web server two configuration files are needed.
They could be set up in the project directory on the control node and then uploaded onto the remote machine with another Ansible module.
The file
httpbin.wsgi (the name is again arbitrary) contains only a single line which is the starter for the WSGI application to run:
from httpbin import app as application
The module
copy can be used to deploy that script on the host, while the target folder
/var/www/httpbin must be set up before that by the module
file.
In addition to that, a separate user account like httpbin (the name is also arbitrary but picked up in the other config file) is needed to run it, and the module
user can set this up.
The demonstrational playbook continues, and the plays which are performing these three operations are going like this:
- name: mkdir /var/www/httpbin
file: path=/var/www/httpbin state=directory
- name: set up user "httpbin"
user: name=httpbin
- name: copy WSGI starter
copy: src=httpbin.wsgi dest=/var/www/httpbin/httpbin.wsgi owner=httpbin group=httpbin mode=0644
Another configuration script
httpbin.conf is needed for Apache on the remote server to include the WSGI application httpbin running as a virtual host.
It goes like this:
<VirtualHost *>
WSGIDaemonProcess httpbin user=httpbin group=httpbin threads=5
WSGIScriptAlias / /var/www/httpbin/httpbin.wsgi
<Directory /var/www/httpbin>
WSGIProcessGroup httpbin
WSGIApplicationGroup % GLOBAL
Order allow,deny
Allow from all
</Directory>
</VirtualHost>
This file needs to be copied into the folder
/etc/apache2/sites-available on the host, which already exists when the
apache2 package is installed.
The remaining operations which are missing to get anything running together are:
The default welcome screen of Apache blocks anything else and should be disabled by Apache s CLI tool
a2dissite.
And after that, the new virtual host needs to be activated with the complementary tool
a2ensite both could be run remotely by the module
command.
Then the Apache server on the remote machine must be restarted to read in the new configuration.
You ve guessed it already, that s all easy to perform with Ansible:
- name: deploy configuration script
copy: src=httpbin.conf dest=/etc/apache2/sites-available owner=root group=root mode=0644
- name: deactivate default welcome screen
command: a2dissite 000-default.conf
- name: activate httpbin virtual host
command: a2ensite httpbin.conf
- name: restart Apache
service: name=apache2 state=restarted
That s it.
After this playbook has been performed by Ansible on a (or several) freshly set up remote Debian base installation completely, then the httpbin request server is available running on the Apache web server and could be queried from anywhere by a web browser, or for example by
curl:
$ curl http://192.0.2.0/user-agent
"user-agent": "curl/7.50.1"
With the broad set of Ansible modules and the playbooks a lot of tasks can be accomplished like the example problem which has been explained here.
But the range of functions of Ansible however is still even more comprehensive, but to discuss that would have blown the frame of this blog post.
For example the playbooks offer more advanced features like event handler which can be used for recurring operations like the restart of Apache in more extensive projects.
And beyond playbooks, templates could be set up in the
roles which can behave differently on selected machine groups Ansible uses Jinja2 as template engine for that.
And the scope of functions of the basic modules could be expanded by employing external tools.
To drop a word on why it could be useful in certain situations to run own instances of the httpbin request server instead of using the official ones which are provided on the net by Runscope:
Like some people would prefer to run a private instance for example in the local network instead of querying the one on the internet.
Or for some development reasons a couple or even a large number of identical instances might be needed Ansible is ideal for setting them up automatically.
Anyway, the Javascript bindings to the tracking services like Google Analytics in
httpbin/templates/trackingscripts.html are patched out in the Debian package.
That could be another reason to prefer to set up an own instance on a Debian server.
This month I started working on ways to make hosting access easier for Debian Developers. I also did some work and planning for the MiniDebConf Online Gaming Edition that we ll likely announce within the next 1-2 days. Just a bunch of content that needs to be fixed and a registration bug then I think we ll be ready to send out the call for proposals.
In the meantime, here s my package uploads and sponsoring for September:
2020-09-07: Upload package calamares (3.2.30-1) to Debian unstable.
2020-09-07: Upload package gnome-shell-extension-dash-to-panel (39-1) to Debian unstable.
2020-09-08: Upload package gnome-shell-extension-draw-on-your-screen (6.2-1) to Debian unstable.
2020-09-08: Sponsor package sqlobject (3.8.0+dfsg-2) for Debian unstable (Python team request).
2020-09-08: Sponsor package bidict (0.21.0-1) for Debian unstable (Python team request).
2020-09-11: Upload package catimg (2.7.0-1) to Debian unstable.
2020-09-16: Sponsor package gamemode (1.6-1) for Debian unstable (Games team request).
2020-09-21: Sponsor package qosmic (1.6.0-3) for Debian unstable (Debian Mentors / e-mail request).
2020-09-22: Upload package gnome-shell-extension-draw-on-your-screen (6.4-1) to Debian unstable.
2020-09-22: Upload package bundlewrap (4.2.0-1) to Debian unstable.
2020-09-25: Upload package gnome-shell-extension-draw-on-your-screen (7-1) to Debian unstable.
2020-09-27: Sponsor package libapache2-mod-python (3.5.0-1) for Debian unstable (Python team request).
2020-09-27: Sponsor package subliminal (2.1.0-1) for Debian unstable (Python team request).
My laptop battery started to explode in slow motion. HP requires 10 business
days to repair my laptop under warranty, and I cannot afford that length of
downtime.
Alternatively, HP quoted me 375 + VAT for on-site repairs, which I tought was
very funny.
For 376.55 + VAT, which is pretty much exactly the same amount, I bought
instead a refurbished ThinkPad X240 with a dual-core I5, 8G of RAM, 250G SSD,
and a 1920x1080 IPS display, to use as a spare while my laptop is being
repaired. I'd like to thank HP for giving me the opportunity to own a ThinkPad.
Since I'm migrating all my system to the spare and then (hopefully) back, I'm
documenting what I need to be fully productive on new hardware.
Install Debian
A basic Debian netinst with no tasks selected is good enough to get going.
Note that if wifi worked in Debian Installer, it doesn't mean that it will work
in the minimal system it installed. 
Welcome to gambaru.de. Here is my monthly report (+ the first week in June) that covers what I have been doing for Debian. If you re interested in Java, Games and LTS topics, this might be interesting for you.
Debian Games
Now I'm not sure if someone enocountered the same issue, or people just registered
random domains just because they could. I found registrations for
This year s 
) or make something up, which occasionally is wrong and not the actual component-ID their software component should have.
The MetaInfo Creator
It was actually suggested to me twice that what people really would like to have is a simple tool to put together a MetaInfo file for their software. Basically a simple form with a few questions which produces the final file. I always considered this a nice to have, but not essential feature, but now I was convinced that this actually has a priority attached to it.
So, instead of jumping into my favourite editor and writing a bunch of C code to create this make MetaInfo file form as part of 
Also, if you want to create a form for a new component type, please submit a patch as well.
C developer s experience notes for Angular, TypeScript, NodeJS
This section is just to ramble a bit about random things I found interesting as a developer who mostly works with C/C++ and Python and stepped into the web-application developer s world for the first time.
For a project like this, I would usually have gone with my default way of developing something for the web: Creating a Flask-based application in Python. I really love Python and Flask, but of course using them would have meant that all processing would have had to be done on the server. One the one hand I could have used 
For many years now, I have been driving a diesel based VW Passat Estate. It
has served me very well and been as reliable as I might have hoped given how
awful I am with cars. Sadly Gunther was reaching the point where it was
going to cost more per year to maintain than the car was worth, and also I've
been being more and more irked by not having a car from the future.
I spent many months doing spreadsheets, trying to convince myself I could
somehow afford a Tesla of some variety. Sadly I never quite managed it. As
such I set my sights on the more viable BEVs such as the Nissan Leaf. For a
while, nothing I saw was something I wanted. I am quite unusual it seems, in
that I don't want a car which is a "Look at me, I'm driving an electric car"
fashion statement. I felt like I'd never get something which looked like a
normal car, but happened to be a BEV.
Then along came the Hyundai Ioniq. Hybrid, Plug-in Hybrid, and BEV all looking
basically the same, and not in-your-face-special. I began to covet.
Eventually I caved and arranged a test drive of an Ioniq plug-in hybrid because
the BEV was basically on 9 month lead. I enjoyed the drive and was instantly
very sad because I didn't want a plug-in hybrid, I wanted a BEV. Despondent,
I left the dealership and went home.
I went online and found a small number of second-hand Ioniq BEVs but as I
scrolled through the list, none seemed to be of the right trim level. Then,
just as I was ready to give up hope, I saw a new listing, no photo, of the
right thing. One snag, it was 200 miles away. No matter, I rang the place,
confirmed it was available, and agreed to sleep on the decision.
The following morning, I hadn't decided to not buy, so I called them up, put
down a deposit to hold the car until I could test drive it, and then began the
long and awkward process of working out how I would charge the car given I have
no off-street parking so I can't charge at home. (Yeah yeah, you'd think I'd
have checked that first, but no I'm just not that sensible). Over the week
I convinced myself I could do it, I ordered RFID cards for various schemes,
signed up with a number of services, and then, on Friday last week, I drove
down to a hotel near the dealership and had a fitful night's sleep.
I rocked up to the dealership exactly as they opened for business, shook the
hand of the very helpful salesman who had gone through the purchase process
with me over the phone during the week, and got to see the car. Instant want
coursed through me as I sat in it and decided "Yes, this somehow feels right".
I took the car for about a 45 minute test drive just to see how it felt
relative to the plug-in hybrid I'd driven the week before and it was like night
and day. The BEV felt so much better to drive. I was hooked. Back to the
dealership and we began the paperwork. Emptying Gunther of all of the bits
and bobs scattered throughout his nooks and crannies took a while and gave me a
chance to say goodbye to a car which, on reflection, had actually been a
pleasure to own, even when its expensive things went wrong, more than once.
But once I'd closed the Passat for the last time, and handed the keys over, it
was quite a bittersweet moment as the salesman drove off in what still felt
like my car, despite (by this point) it not being so.
Sitting in the Ioniq though, I headed off for the 200 mile journey back home.
With about 90% charge left after the test drive, I had two stops planned at
rapid chargers and I headed toward my first.
Unfortunately disaster struck, the rapid (50KW) charger refused to initialise,
and I ended up with my car on the slower (7KW) charger to get enough juice into
it to drive on to the next rapid charger enabled service station. When I got
the message that my maximum charge period (45m) had elapsed, I headed back to
the car to discover I couldn't persuade it to unlock from the car. Much hassle
later, and an AA man came and together we learned that it takes 2 to tango, one
to pull the emergency release in the boot, the other to then unplug the cable.
Armed with this knowledge, I headed on my way to a rapid charger I'd found on
the map which wasn't run by the same company. Vainly hoping that this would
work better, I plugged the car in, set the charger going, and headed into the
adjacent shop for a rest break. I went back to the car about 20 minutes later
to see the charger wasn't running. Horror of horrors. I imagined maybe some
nasty little oik had pressed 'stop' so I started the charger up again, and sat
in the car to read my book. After about 3 minutes, the charge stopped. Turns
out that charger was slightly iffy and couldn't cope with the charge current
and kept emergency-stopping as a result. The lovely lady I spoke to about it
directed me to a nearby (12 miles or so, easily done with the charge I had)
charger in the grounds of a gorgeous chateau hotel. That one worked perfectly
and I filled up. I drove on to my second planned stop and that charge went
perfectly too. In fact, every charge since has gone flawlessly. So perhaps my
baptism of failed charges has hardened me to the problems with owning a BEV.
I've spent the past few days trying different charge points around Manchester
enjoying my free charge capability, and trying different names for the car
before I finally settled on which is a reasonable Korean boy's name
(since the car is Korean I even got to set that as the bluetooth ID) and it's
roughly pronounced sock/gin which are two wonderful things in life.
I'm currently sat in a pub, eating a burger, enjoying myself while suckles
on the teat of "free" electricity to make up for the fact that I've developed a
non-trivial habit of leaving Audi drivers in the dust at traffic lights.
Further updates may happen as I play with Android Auto and other toys in an
attempt to eventually be able to ask the car to please "freeze my buttocks"
(a feature it has in the form of air-conditioned seats.)
If you read 
I ve had a kludgy mess of electronic address books for most of two decades,
and have got rather fed up with it. My stack consisted of:
Since I use this as base for other PHP packages like 
In one of the good parts of the very mixed bag that is "
Whilst there is an in-depth report forthcoming, the