Using templates, variables and an inventory

[haary]

First of all I wanted to say what a great tool efs2 is. I generally prefer small and simple software and efs2 is the perfect tool for simple remote automation tasks. No more tinkering with Ansible's complicated YAML files for rather simple jobs.

However, I do sometimes need an inventory file, variables and templates. I did found a simple solution by writing a small wrapper script and using ESH as a template engine.

A real world example that I use is as follows

Efs2file

RUN DEBIAN_FRONTEND=noninteractive apt-get -yq install iptables-persistent
RUN mkdir -p /etc/iptables/
PUT rules.v4 /etc/iptables/rules.v4 0644
RUN iptables-restore < /etc/iptables/rules.v4

Inventory (inventory file)

host1
host2
host3

Vars (variables file)

FWACCEPTIP=1.2.3.4
FWACCEPTIP=5.6.7.8
FWACCEPTIP=9.10.11.12
SSHPort=2222

rules.v4.esh - template for iptables-persistent rules

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [18299:1945378]
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport <%= $(grep ^SSHPort= Vars|cut -d= -f2) %> -j ACCEPT
<% for i in `grep ^FWACCEPTIP= Vars|cut -d= -f2`; do -%>
<% echo "-A INPUT -s ${i}/32 -i eth0 -j ACCEPT" -%>
<% done -%>
-A INPUT -i eth0 -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -i eth0 -j REJECT --reject-with icmp-port-unreachable
COMMIT

Glueing it all together in the wrapper script runefs2.sh

#!/bin/bash
KEYFILE="/home/user/.ssh/id_ed25519"
SSHPORT=2222
USR=root

if [ "$1" = "" ]; then
    echo "Usage $0: inventory-file"
    exit 1
fi
IFILE="$1"
if [ ! -f "$IFILE" ]; then
    echo "Inventory file $IFILE  not found"
    exit 1
fi
# Processing Templates
for ESH in  *.esh; do
    esh -o ${ESH%.*} $ESH
done
# Reading inventory in variable INV
INV=`cat $IFILE|tr '\n' ' '`
echo "Press RETURN for running efs2 with the following inventory"; echo
echo "$INV"; echo
echo "Ctrl-C to abort"
read n
# Running efs2
efs2 --user=$USR --port=$SSHPORT -i $KEYFILE $INV

Run it with runefs2.sh Inventory

Improvements are very welcome, of course :-)