Miguel Jacq
f5eaac9f75
Note: `--remote-host` must still be set, but it can be an 'alias' represented by the 'Host' value in the ssh config.
133 lines
6.2 KiB
Markdown
133 lines
6.2 KiB
Markdown
# 0.4.2
|
|
|
|
* Support `--remote-ssh-config [path-to-ssh-config]` as an argument in case extra params are required beyond `--remote-port` or `--remote-user`. Note: `--remote-host` must still be set, but it can be an 'alias' represented by the 'Host' value in the ssh config.
|
|
|
|
# 0.4.1
|
|
|
|
* Add interactive output when 'enroll diff --enforce' is invoking Ansible.
|
|
|
|
# 0.4.0
|
|
|
|
* Introduce `enroll validate` - a tool to validate a harvest against the state schema, or check for missing or orphaned obsolete artifacts in a harvest.
|
|
* Attempt to generate Jinja2 templates of systemd unit files and Postfix main.cf (now that JinjaTurtle supports it)
|
|
* Update pynacl dependency to resolve CVE-2025-69277
|
|
* Add `--exclude-path` to `enroll diff` command, so that you can ignore certain churn from the diff (stuff you still wanted to harvest as a baseline but don't care if it changes day to day)
|
|
* Add `--ignore-package-versions` to `enroll diff` command, to optionally ignore package upgrades (e.g due to patching) from the diff.
|
|
* Add tags to the playbook for each role, to allow easier targeting of specific roles during play later.
|
|
* Add `--enforce` mode to `enroll diff`. If there is diff detected between the two harvests, and it can enforce restoring the state from the older harvest, it will manifest the state and apply it with ansible. Only the specific roles that had diffed will be applied (via the new tags capability)
|
|
|
|
# 0.3.0
|
|
|
|
* Introduce `enroll explain` - a tool to analyze and explain what's in (or not in) a harvest and why.
|
|
* Centralise the cron and logrotate stuff into their respective roles, we had a bit of duplication between roles based on harvest discovery.
|
|
* Capture other files in the user's home directory such as `.bashrc`, `.bash_aliases`, `.profile`, if these files differ from the `/etc/skel` defaults
|
|
* Ignore files that end with a tilde or - (probably backup files generated by editors or shadow file changes)
|
|
* Manage certain symlinks e.g for apache2/nginx sites-enabled and so on
|
|
|
|
# 0.2.3
|
|
|
|
* Introduce --ask-become-pass or -K to support password-required sudo on remote hosts, just like Ansible. It will also fall back to this prompt if a password is required but the arg wasn't passed in.
|
|
|
|
# 0.2.2
|
|
|
|
* Fix stat() of parent directory so that we set directory perms correct on --include paths.
|
|
* Set pty for remote calls when sudo is required, to help systems with limits on sudo without pty
|
|
|
|
# 0.2.1
|
|
|
|
* Don't accidentally add `extra_paths` role to `usr_local_custom` list, resulting in `extra_paths` appearing twice in manifested playbook
|
|
* Ensure directories in the tree of anything included with --include are defined in the state and manifest so we make dirs before we try to create files
|
|
|
|
# 0.2.0
|
|
|
|
* Add version CLI arg
|
|
* Add ability to enroll RH-style systems (DNF5/DNF/RPM)
|
|
* Refactor harvest state to track package versions
|
|
|
|
# 0.1.7
|
|
|
|
* Fix an attribution bug for certain files ending up in the wrong package/role.
|
|
|
|
# 0.1.6
|
|
|
|
* DRY up some code logic
|
|
* More test coverage
|
|
|
|
# 0.1.5
|
|
|
|
* Consolidate logrotate and cron files into their main service/package roles if they exist.
|
|
* Standardise on `MAX_FILES_CAP` in one place
|
|
* Manage apt stuff in its own role, not in `etc_custom`
|
|
|
|
# 0.1.4
|
|
|
|
* Attempt to capture more stuff from /etc that might not be attributable to a specific package. This includes common singletons and systemd timers
|
|
* Avoid duplicate apt data in package-specific roles.
|
|
|
|
# 0.1.3
|
|
|
|
* Allow the user to add extra paths to harvest, or paths to ignore, using `--exclude-path` and `--include-path`
|
|
arguments.
|
|
* Add support for an enroll.ini config file to store arguments per subcommand, to avoid having to remember
|
|
them all for repetitive executions.
|
|
|
|
# 0.1.2
|
|
|
|
* Include files from `/usr/local/bin` and `/usr/local/etc` in harvest (assuming they aren't binaries or
|
|
symlinks) and store in `usr_local_custom` role, similar to `etc_custom`.
|
|
|
|
# 0.1.1
|
|
|
|
* Add `diff` subcommand which can compare two harvests and send email or webhook notifications in different
|
|
formats.
|
|
|
|
# 0.1.0
|
|
|
|
* Add remote mode for harvesting a remote machine via a local workstation (no need to install enroll remotely)
|
|
Optionally use `--no-sudo` if you don't want the remote user to have passwordless sudo when conducting the
|
|
harvest, albeit you'll end up with less useful data (same as if running `enroll harvest` on a machine without
|
|
sudo)
|
|
* Add `--dangerous` flag to capture even sensitive data (use at your own risk!)
|
|
* Add `--sops` flag which makes the harvest and the manifest 'out' data encrypted as a single SOPS data file.
|
|
This would make `--dangerous` a little bit safer, if your intention is just to store the Ansible manifest
|
|
in git or somewhere similar for disaster-recovery purposes (e.g encrypted at rest for safe-keeping).
|
|
* Do a better job at capturing other config files in `/etc/<package>/` even if that package doesn't normally
|
|
ship or manage those files.
|
|
* Don't collect files ending in `.log`
|
|
|
|
# 0.0.5
|
|
|
|
* Use JinjaTurtle to generate dynamic template/inventory if it's on the PATH
|
|
* Support --fqdn flag for site-specific inventory and an inventory hosts file.
|
|
This radically re-architects the roles to loop through abstract inventory
|
|
because otherwise different servers can collide with each other through use
|
|
of the same role. Use 'single site' mode (no `--fqdn`) if you want more readable,
|
|
self-contained roles (in which case, store each manifested output in its own
|
|
repo per server)
|
|
* Generate an ansible.cfg if not present, to support `host_vars` plugin and other params,
|
|
when using `--fqdn` mode
|
|
* Be more permissive with files that we previously thought contained secrets (ignore commented lines)
|
|
|
|
# 0.0.4
|
|
|
|
* Fix dash package detection issue
|
|
* Reorder which roles install first
|
|
|
|
# 0.0.3
|
|
|
|
* various bug fixes
|
|
* Add debian packaging
|
|
|
|
# 0.0.2
|
|
|
|
* Merge pkg_ and roles created based on file/service detection
|
|
* Avoid idempotency issue with users (`password_lock`)
|
|
* Rename subcommands/args ('export' is now 'enroll', '--bundle' is now '--harvest')
|
|
* Don't try and start systemd services that were Inactive at harvest time
|
|
* Capture miscellaneous files in /etc under their own `etc_custom` role, but not backup files
|
|
* Add tests
|
|
* Various other bug fixes
|
|
|
|
# 0.0.1
|
|
|
|
* Initial commit
|