Skip to content

Operations

This page covers running the Ansible instance day to day: how it is secured, what to back up, how updates work and how to get help.

Security model

  • No open ports. ansible-core does not listen on the network, and the image runs no background service. Every playbook run is one you start.
  • Local by default. The inventory holds only the instance itself, with the local connection. Remote hosts are a choice you make.
  • No privilege escalation by default. Playbooks run as the user who starts them until you ask for become.
  • Host key checking on for SSH targets.
  • Per-instance vault password. The vault password is created on first boot and is readable by root only. The image contains none of these files.
  • Pinned software. ansible-core, its Python dependencies and the two collections are installed from checksum-verified, pinned packages.

Keep the security group closed to inbound traffic. If you add AWS access, give the instance role only the permissions your playbooks need.

First-boot service

sushi-ansible-core-firstboot runs once per boot. It creates any missing configuration, inventory, vault password or workspace, and never overwrites files that already exist. Check it with:

systemctl status sushi-ansible-core-firstboot
sudo journalctl -u sushi-ansible-core-firstboot --no-pager

Backups

Your playbooks, inventory and vault password live on the instance's root volume. Back up:

  • /etc/ansible/, including vault-password. Without it, vault-encrypted files cannot be decrypted.
  • /var/lib/ansible-core/workspace/.

Keep playbooks in version control too, but never commit the vault password. Snapshots of the root volume are a simple way to keep local artifacts.

To move to a replacement instance, launch it, copy both paths across with their ownership and permissions, and point your operators at the new host.

Updates

  • Ubuntu packages, including Python 3.12, receive unattended security updates.
  • ansible-core and the collections are pinned in their own environment and are not updated by apt. A new ansible-core release comes as a new version of the image. Running instances are not migrated: launch the new version and copy your files across as above.

Support

Software Sushi supports the packaging, first-boot setup and this documentation. Email info@softwaresushi.com with the output of ansible --version, the state of the first-boot service, and the failing command and error. Leave out vault passwords, credentials and customer data from your playbooks. Support coverage beyond installation questions requires a separate agreement. The Ansible project does not provide support for this image.