Network Automation Toolkit

Migrating platform service provisioning from shell scripts to Ansible: LXC bootstrap, nginx vhost templating, Netgate Unbound DNS sync, and TLS cert distribution.

ansible run target

roles in scope

manual steps remaining

Goal

A single Ansible run that takes a service name, upstream IP/port, and protocol, then produces:

✓LXC container with the right base image and resources

✓nginx vhost on the reverse proxy with wildcard cert wired in

○Netgate Unbound host override pointing the service hostname at the proxy

○Cloudflare DNS record if the service is public-facing

○Test confirming the service responds with a 200 over HTTPS

Current status

Working through the Netgate DNS role: read existing Unbound host overrides via the pfSense REST API, merge the new record, PATCH or POST the delta, then apply the resolver. The shell script version already works; the Ansible role wraps the same read-merge-push pattern.

# pfSense Unbound. safe merge pattern

GET /api/v2/services/dns_resolver/host_overrides # read existing

merge(existing, new) # safe combine

PATCH or POST host_override # write delta

POST /api/v2/services/dns_resolver/apply # reload Unbound

Reproducibility

The platform is large enough that any change risks breaking something else. A playbook run either succeeds cleanly or fails loudly. not silently.

Skill progression

Everyone past mid-level is expected to read and write Ansible / Terraform / similar. This is the natural place to build that fluency on real infrastructure.

A writeup will follow once the first end-to-end run works.

Stack

AnsiblePythonBashCloudflare APIJinja2

← Previous

Splunk

BGP Mesh with Private ASNs