Local single-host workflow

enroll harvest --out /tmp/enroll-harvest
enroll validate /tmp/enroll-harvest
enroll manifest --harvest /tmp/enroll-harvest --out /tmp/enroll-ansible
cd /tmp/enroll-ansible
ansible-galaxy collection install -r requirements.yml
ansible-playbook -i localhost, -c local playbook.yml --check --diff

Use this when the output is for one machine or a “golden” role set.

Remote harvest over SSH

enroll harvest \
  --remote-host app01.example.net \
  --remote-user mig \
  --out /tmp/enroll-app01-harvest
enroll manifest --harvest /tmp/enroll-app01-harvest --out /tmp/enroll-app01-ansible

Add -K if sudo requires a password. Use --no-sudo only when a limited harvest is acceptable.

Remote host using ssh_config alias

enroll harvest \
  --remote-host app01-alias \
  --remote-ssh-config ~/.ssh/config \
  --out /tmp/enroll-app01-harvest

--remote-host is still required; it may be the Host alias in your ssh config.

Encrypted SSH key in CI

export ENROLL_SSH_KEY_PASSPHRASE='correct horse battery staple'
enroll single-shot \
  --remote-host app01.example.net \
  --remote-user mig \
  --ssh-key-passphrase-env ENROLL_SSH_KEY_PASSPHRASE \
  --harvest /tmp/enroll-app01-harvest \
  --out /tmp/enroll-app01-ansible \
  --fqdn app01.example.net

--ask-key-passphrase is the interactive equivalent. The two key-passphrase options are mutually exclusive.

Include and exclude paths

enroll harvest --out /tmp/enroll-harvest \
  --include-path '/home/*/.profile' \
  --include-path 're:^/home/[^/]+/\.config/myapp/.*$' \
  --exclude-path '/home/*/.ssh/**'

Included files are still secret-scanned unless --dangerous is also set.

Dangerous mode, encrypted at rest

enroll harvest \
  --out /tmp/enroll-secure-harvest \
  --dangerous \
  --sops 54A91143AE0AB4F7743B01FE888ED1B423A3BC99

--dangerous disables likely-secret checks. Pair it with SOPS or equivalent storage controls.

Manifest encrypted harvest, then encrypt manifest

enroll manifest \
  --harvest /tmp/enroll-secure-harvest/harvest.tar.gz.sops \
  --out /tmp/enroll-secure-ansible \
  --sops 54A91143AE0AB4F7743B01FE888ED1B423A3BC99
cd /tmp/enroll-secure-ansible
sops -d manifest.tar.gz.sops | tar -xzvf -
cd manifest

Manifest SOPS mode outputs a single encrypted tarball. Extract it before using Ansible.

Multi-site output

fqdn=app01.example.net
enroll manifest \
  --harvest /tmp/enroll-app01-harvest \
  --out /srv/ansible-enroll \
  --fqdn "$fqdn"
cd /srv/ansible-enroll
ansible-playbook -i inventory/hosts.ini "playbooks/${fqdn}.yml" --check --diff

Multi-site mode stores host-specific variables and file artifacts in inventory.

Force or disable JinjaTurtle

# Error if jinjaturtle is not on PATH
enroll manifest --harvest ./harvest --out ./ansible --jinjaturtle

# Never use template integration even if it is installed
enroll manifest --harvest ./harvest --out ./ansible --no-jinjaturtle

Without either flag, Enroll auto-detects integration availability.

Compare harvests and notify a webhook

enroll diff \
  --old /srv/enroll/golden \
  --new /srv/enroll/current \
  --webhook https://example.net/enroll/webhook \
  --webhook-format json \
  --webhook-header 'Authorization: Bearer ...' \
  --ignore-package-versions \
  --exit-code

With --exit-code, detected drift exits 2 after producing the report and notifications.

Validate and fail CI on warnings

enroll validate ./harvest --format json --out validate.json --fail-on-warnings

Use --allow-remote-schema only when you intentionally want validation to fetch an HTTP(S) schema.

Explain what was harvested

enroll explain ./harvest --max-examples 25
enroll explain ./harvest.tar.gz.sops --sops --format json

Useful before committing generated Ansible or debugging why expected files were skipped.