Why
#I run a handful of my own servers, and some of them host things other people rely on. That makes “I’ll just fix it by hand” a bad habit to keep.
Each machine had been set up a little differently over the years. Answering simple questions, like which ones update themselves or where the logs go, meant logging in and looking around. A careless change in the wrong place could also take down something that wasn’t mine to break.
What I changed
#Everything now lives in Ansible, split into small roles for users, SSH, updates, logging and metrics. Secrets are encrypted in the repository and never written down in plain text.
The playbooks refuse to run without a host limit, so a change can only ever touch the machines I name. Every change gets a dry run with a diff first, and only then the real apply. The roles also check their own work, because writing a config file doesn’t mean the service actually picked it up.
New software versions show up as notifications instead of being installed automatically in the middle of the night.
Where it ended up
#Every machine is described in one repository, and rebuilding one is a single run. Logs and basic health signals, such as whether a reboot is pending, end up in one place. Mistakes still happen, but they stay small because the tooling won’t let them spread. I’d rather have the playbook stop me than rely on remembering to be careful.