rebecca
69cc8c560d
- Fix ansible_default_ipv4 undefined issue with fallback to ansible_ssh_host - Simplify disk space analyzer to avoid complex JSON parsing - Update Docker cleanup to handle missing Docker gracefully - Update log archiver to handle missing rotated logs gracefully - All playbooks now provide comprehensive JSON reports - Tested successfully on Ubuntu 20.04/22.04/24.04, Debian 11/12/13, and Alpine
Infrastructure Maintenance Scripts
Ansible-based maintenance scripts for infrastructure operations across multiple Linux distributions.
Supported Operating Systems
- Ubuntu 20.04, 22.04, 24.04
- Debian 11, 12, 13
- Alpine Linux
Prerequisites
- Ansible 2.15 or higher
- Python 3.8+ on target hosts
- SSH access to target hosts
- Sudo privileges on target hosts
Installation
- Clone the repository:
git clone git@git.puddi.ng:public-infra/maintenance-scripts.git
cd maintenance-scripts
- Install required Ansible collections:
ansible-galaxy collection install -r requirements.yml
- Configure inventory:
vim inventory/hosts.ini
Available Playbooks
1. CVE Scanner - playbooks/scan_cves.yml
Identifies packages with CVE vulnerabilities using the NIST NVD database.
Features:
- Parses installed packages across supported OS distributions
- Queries NIST NVD CVE database via API
- Correlates vulnerabilities with installed packages
- Outputs JSON report with findings
Usage:
ansible-playbook playbooks/scan_cves.yml -i inventory/hosts.ini
Output:
- JSON report saved to
/tmp/cve_report_*.json - Contains package name, version, CVE IDs, severity, and host information
2. Package Update Checker - playbooks/check_updates.yml
Checks for available package updates and assesses potential risks using OpenAI.
Features:
- Lists upgradable packages across supported distributions
- Uses OpenAI API to identify potential breaking changes
- Separates safe updates from risky ones
- Provides recommendation on whether to proceed
Prerequisites:
- Set
OPENAI_API_KEYenvironment variable
Usage:
export OPENAI_API_KEY="your-openai-api-key"
ansible-playbook playbooks/check_updates.yml -i inventory/hosts.ini
Output:
- JSON report saved to
/tmp/update_report_*.json - Lists safe and risky updates with risk assessment
- Provides boolean flag for automatic update safety
3. Docker Cleanup - playbooks/cleanup_docker.yml
Cleans up Docker resources including images, containers, and build cache.
Features:
- Removes dangling images
- Removes stopped containers
- Cleans build cache
- Provides before/after disk usage comparison
- Optional volume cleanup (disabled by default)
Usage:
ansible-playbook playbooks/cleanup_docker.yml -i inventory/hosts.ini
Output:
- JSON report saved to
/tmp/docker_cleanup_report_*.json - Shows disk space reclaimed for each resource type
4. Log Archiver - playbooks/archive_logs.yml
Archives rotated log files and transfers them to remote storage.
Features:
- Archives gzipped rotated logs from
/var/log - Organizes logs by hostname, IP, and date
- Transfers archives to remote storage location
- Cleans up original logs after successful transfer
- Generates metadata for each archive
Prerequisites:
- Set
REMOTE_STORAGE_PATHenvironment variable (defaults to/mnt/log-archive)
Usage:
export REMOTE_STORAGE_PATH="/path/to/log-storage"
ansible-playbook playbooks/archive_logs.yml -i inventory/hosts.ini
Output:
- JSON report saved to
/tmp/log_archive_report_*.json - Archives stored with structure:
YEAR/MONTH/DAY/logs_HOSTNAME_IP_DATE.tar.gz
5. Disk Space Analyzer - playbooks/analyze_disk_space.yml
Analyzes disk usage and identifies directories consuming excessive space.
Features:
- Scans multiple paths with configurable depth (default 5)
- Identifies directories larger than threshold (default 1GB)
- Lists large files exceeding threshold
- Provides disk and inode usage statistics
- Alerts on high disk or inode usage
Usage:
ansible-playbook playbooks/analyze_disk_space.yml -i inventory/hosts.ini
Output:
- JSON report saved to
/tmp/disk_space_report_*.json - Lists large directories and files sorted by size
- Includes disk and inode usage alerts
Configuration
Environment Variables
OPENAI_API_KEY: Required for package update risk assessmentREMOTE_STORAGE_PATH: Path for log archive storage (default:/mnt/log-archive)
Inventory Structure
The inventory file uses INI format with groups:
[webservers]
web1.example.com ansible_host=192.168.1.10
[dbservers]
db1.example.com ansible_host=192.168.1.20
SSH Configuration
Configure SSH access in ansible.cfg or use SSH config file:
[defaults]
host_key_checking = False
Running Playbooks
Target specific hosts:
ansible-playbook playbooks/scan_cves.yml -i inventory/hosts.ini -l web1.example.com
Target groups:
ansible-playbook playbooks/scan_cves.yml -i inventory/hosts.ini -l webservers
Run with extra variables:
ansible-playbook playbooks/analyze_disk_space.yml -i inventory/hosts.ini -e "size_threshold_gb=5"
Limit concurrency:
ansible-playbook playbooks/scan_cves.yml -i inventory/hosts.ini -f 10
Output Locations
All playbooks generate JSON reports in /tmp/ with timestamps:
- CVE reports:
/tmp/cve_report_TIMESTAMP.json - Update reports:
/tmp/update_report_TIMESTAMP.json - Docker cleanup reports:
/tmp/docker_cleanup_report_TIMESTAMP.json - Log archive reports:
/tmp/log_archive_report_TIMESTAMP.json - Disk space reports:
/tmp/disk_space_report_TIMESTAMP.json
Best Practices
- Test on non-production hosts first: Always test playbooks on a subset of hosts
- Monitor output: Review reports before taking automated actions
- Schedule regular runs: Use cron or Jenkins for periodic scans
- Backup before updates: Ensure backups exist before running update playbooks
- Review risky updates: Manually review packages marked as risky before updating
Troubleshooting
Connection issues
ansible all -i inventory/hosts.ini -m ping
Privilege issues
Ensure the user has sudo privileges:
ansible-playbook playbooks/scan_cves.yml -i inventory/hosts.ini -u ansible_user --become
Collection not found
Install required collections:
ansible-galaxy collection install -r requirements.yml
Python module issues
Ensure Python 3 is available:
ansible all -i inventory/hosts.ini -m shell -a "python3 --version"
Contributing
- Follow Ansible best practices
- Use Ansible modules instead of shell commands when possible
- Ensure cross-platform compatibility
- Write clear and descriptive task names
- Add error handling where appropriate
- Test on all supported OS distributions
License
Copyright (c) 2026. All rights reserved.