Lucas Savva m1cr0man

So, to get something like /etc/rc.local you can use the custom SMF import facility. (See the source for more information about how this actually works.)

/opt is mounted out of zones/opt by default. You can create a directory /opt/custom/smf and populate it with SMF manifests. Any manifests you put in there will be imported by SmartOS when it boots. Below is an example SMF manifest that simply starts /opt/custom/bin/postboot, a self-explanatory shell script that you can use like /etc/rc.local.

Note that it would likely be better to customise and respin your own images, as putting a bunch of platform state in the zones pool undoes some of the benefits of the ramdisk platform architecture that SmartOS has.

Working with ansible-vault

I've been using a lot of Ansible lately and while almost everything has been great, finding a clean way to implement ansible-vault wasn't immediately apparent.

What I decided on was the following: put your secret information into a vars file, reference that vars file from your task, and encrypt the whole vars file using ansible-vault encrypt.

Let's use an example: You're writing an Ansible role and want to encrypt the spoiler for the movie Aliens.

The following keys, when placed in the customer_metadata section of the VM definition JSON will effect the specified behaviour:

smartos key	corresponds to cloudinit key	effect
`hostname`	`local-hostname`
`root_authorized_keys`	`public-keys`	copies to /root/.ssh and default user ~/.ssh (e.g., ubuntu)
`user-script`	`user-script`	Executed each boot
`user-data`	`legacy-user-data`
`cloud-init:user-data`	`user-data`	Evaluated by cloud-init once at VM creation only
`iptables_disable`	`iptables_disable`	?

	from time import sleep
	from tornado.httpserver import HTTPServer
	from tornado.ioloop import IOLoop
	from tornado.web import Application, asynchronous, RequestHandler
	from multiprocessing.pool import ThreadPool

	_workers = ThreadPool(10)

	def run_background(func, callback, args=(), kwds={}):
	def _callback(result):

	import os
	import asyncio
	import sys

	from asyncio.streams import StreamWriter, FlowControlMixin

	reader, writer = None, None

	@asyncio.coroutine
	def stdio(loop=None):

	import gssapi
	from ldap3 import Connection, SASL_AVAILABLE_MECHANISMS
	from ldap3.protocol.sasl.digestMd5 import sasl_digest_md5
	from ldap3.protocol.sasl.external import sasl_external
	from ldap3.protocol.sasl.sasl import send_sasl_negotiation, abort_sasl_negotiation

	SASL_AVAILABLE_MECHANISMS.append('GSSAPI')


	def sasl_gssapi(connection, controls):

	#!/bin/bash

	bootstrapper_dialog() {
	DIALOG_RESULT=$(dialog --clear --stdout --backtitle "Arch bootstrapper" --no-shadow "$@" 2>/dev/null)
	}

	#################
	#### Welcome ####
	#################
	bootstrapper_dialog --title "Welcome" --msgbox "Welcome to Kenny's Arch Linux bootstrapper.\n" 6 60

	[Match]
	Name=host*

	[Network]
	DHCP=yes

	"""
	Playing with python's single dispatch.
	See: https://hynek.me/articles/serialization/

	See also PEP 443: https://www.python.org/dev/peps/pep-0443/

	"""
	from datetime import datetime
	from functools import singledispatch

	# /etc/fail2ban/filter.d/traefik-auth.conf
	[Definition]
	failregex = ^<HOST> \- \S+ \[\] \"(GET\|POST\|HEAD) .+\" 401 .+$