web design

Card Size Gallery

Mon, 03 Aug 2026 20:22:31 +0300

List of products is often shown as images on a grid. This pattern is called "cards".

Card Size Gallery allows you to test what different card formats look like.

Try Card Size Gallery - right in your browser.

Clanker warning: I created this AI-assisted.

Kokoro TTS - Voice Comparison

Wed, 08 Jul 2026 17:10:54 +0300

Free, open weight models can generate speech. On your local machine.

Listen to voice samples of all Kokoro TTS voices on the web.

Optionally, install Kokoro with Podman.

Listen and Compare Voices in Your Browser

Search and filter by gender and language. The demo text is currently only in English.

Kokoro is a free text-to-speech engine, architected by Li, Han, Raghavan, Mischler and Mesgarani; and trained by @rzvnzn. I just created the samples and the page to filter them. Their default flagship voice is af_heart (English, female), but there are many other interesting voices.

Listen Kokoro samples now.

Run Kokoro with Podman

These commands assume you already have Podman installed. Podman runs containers like Docker. It's safer than Docker, as it does not require root (or the infamous root-equivalent docker group).

Let's download and run Brauns ready-made Kokoro container:

$ podman run -p 8880:8880 ghcr.io/remsky/kokoro-fastapi-cpu

Web user interface: http://localhost:8880/web/

API, usable with Python requests http://localhost:8880/v1

cdu - Jump up to project directory

Mon, 06 Jul 2026 11:58:45 +0300

You're five levels deep in your git repo. You would like to get to the top level. 'cdu'.

An up only directory jumper for zsh and bash. Nicely complements other directory jumpers, like zoxide, autojump or fasd.

Usage example

$ pwd
/home/tero/code/revincom/doc/design/subsystems/nav/fallbacks/sun
$ cdu
/home/tero/code/revincom
Found .git

If you have really deep repos, such as monorepos, cdu can help you even more.

Deep in a Django project, cdu jumps to manage.py level first. The next cdu will take you to repo root.

A new 'cdu', change dir up

I have used a longer bash version for years. This is a rewrite to support both zsh and bash. It's also shorter. Prettier and more features, but less tested than the old one.

Save the source code to a dir where it runs (e.g. /usr/local/bin/changedirup). Make runnable (chmod ugo+rx /usr/local/bin/changedirup). Add to your .bashrc and .zshrc: 'alias cdu="source changedirup"'. Log out and back.

And now you can jump up with 'cdu'.

Source code, GPL

#!/bin/bash
# changedirup - cd up to project top dir, 'alias cdu="source changedirup"'
# To persist it, add the alias to .zshrc or .bashrc

# Single usage also works with 'source cdu' or '. cdu'
# Can be run again to go to even higher project dir. 
# cdu works with zsh and bash. Shebang #! is just for syntax highlight.
# SPDX-License-Identifier: GPL-3.0-or-later
# SPDX-FileCopyrightText: Copyright 2020-2026 Tero Karvinen https://TeroKarvinen.com

CDU_PWD_WAS="$(pwd)"
cd ..
while true; do
 for f in .git Makefile .profile .bashrc README.md requirements.txt go.mod manage.py hosts.ini .project project.godot Dockerfile Cargo.toml index.theme config.toml default.gpr DICOMDIR ansible.cfg site.yml Vagrantfile package.json pyproject.toml zowe.yaml pom.xml build.gradle Gemfile composer.json docker-compose.yml compose.yaml .cobaltstrike.beacon_keys flake.nix .zshrc .ssh .sliver .sliver-client .msf4 havoc_default.yaotl .projectile .svn .hg .fossil .jj .editorconfig _darcs .bzr Cargo.lock .bash_profile
 do
 if [ -e "$f" ]; then
 echo "Found $f"
 pwd
 break 2
 fi
 done

 if [ "$(pwd)" = "/" ]; then
 cd "$CDU_PWD_WAS"
 echo "No project files found above. Working directory unchanged."
 pwd
 break
 fi

 cd .. || break # prevent infinite loop in the rare case cd fails for permissions
done

ppp Personal Project Portfolio

Thu, 02 Jul 2026 11:52:15 +0300

Arrange your ideas into a skill tree.

Pick little wins on your way to big goals
Ship something at every step
Turn ambition into output

Open ppp in your browser. Free, no login.

Talk nerd to me

Single 50 kB HTML file with no dependencies. Use online or 100% offline. Your data stays yours: JSON export and import. Fully usable with keyboard-only - or mouse-only with keyboard just for typing names. A vibe-coded GUI editor for a directed acyclic graph with project-specific attributes: costs, deliverables, soft benefits. Public beta.

Gain a bird's-eye view with ppp. I hope you have more ideas than time to do them. Use ppp to decide which path to pick next. Once you're committed, use calendar.txt and todo.txt for day-to-day and hour-to-hour.

Try ppp

Try ppp. Free web access, no login required. Optionally save the 50 kB HTML file for 100% offline use. Looking forward to your comments.

Apache installed with Ansible - quick notes

Thu, 09 Apr 2026 16:10:04 +0300

Install Apache 2 web server automatically. Serves a web site on the front page of http://localhost. Pages can be edited as a normal user - without root or sudo.

Simplified Ansible role. An example of package-file-server pattern. Just notes, no tutorial.

Using these short notes require a working Ansible configuration - Hello Ansible.

Package-file-service pattern

Daemons, like Apache2 web server, are somewhat similar. They are configured with package-file-service pattern. Install the daemon, change configuration by editing files, start it.

package - sudo apt-get install apache2
files - sudoedit /etc/apache2/...
service - sudo systemctl restart apache2

Changes to configuration files only take effect after you kick the daemon. Thus, file in tasks/main.yml notify the handler "restart apache2".

tree of roles/apache2/

roles/apache2/ # All files related to "apache2" role
├── files/ # Master copies of files
│   └── example.com.conf
├── handlers/ # restarting services
│   └── main.yml
└── tasks/ # most ansible code
└── main.yml

tasks/main.yml

- apt:
 name: apache2
 state: present

- copy:
 dest: "/etc/apache2/sites-available/example.com.conf"
 src: "example.com.conf"
 owner: "root"
 group: "root"
 mode: "0644"
 notify: restart apache2

- file:
 src: /etc/apache2/sites-available/example.com.conf
 dest: /etc/apache2/sites-enabled/example.com.conf
 owner: root
 group: root
 state: link
 notify: restart apache2

handlers/main.yml

- name: restart apache2
 systemd:
 name: apache2
 state: restarted

files/example.com.conf

# Managed file, changes will be overwritten

<VirtualHost *:80>
 ServerName example.com
 DocumentRoot /home/tero/publicsite/

 <Directory /home/tero/publicsite/>
 require all granted
 </Directory>
</VirtualHost>

Adminstrivia

Apache httpd logo is a trademark of The Apache Software Foundation.

Passwordless Sudo with Ansible

Thu, 02 Apr 2026 16:44:50 +0300

Sudo without password, automatically. Short example role for ansible.

The role

creates a new user in "sudoless" group
adds a sudoers.d/ NOPASSWD rule for the group

Prerequisites

Applying this example file requires you to have Ansible working.

Tero's rule #1 for IaC: Manual before auto.

So it's a good idea to try creating passwordless sudo manually first.

Draft: This article has commands written from memory. It has not gone trough quality assuarance and testing yet.

Tree

$ tree -F
./
├── ansible.cfg
├── hosts.ini
├── roles/
│   ├── antero/
│   │   └── tasks/
│   │   └── main.yml
│   └── world/
│   └── tasks/
│   └── main.yml
└── site.yml

Role - antero

cat roles/antero/tasks/main.yml

- group:
 name: "sudoless"
 state: present
- user:
 name: "antero"
 state: present
 groups: ["sudoless", "sudo", "adm"]
- authorized_key:
 user: "antero"
 key: "ssh-ed25519 U2VlIHlvdSBhdCBUZXJvS2FydmluZW4uY29tIQ== tero@example.com"
- copy:
 dest: "/etc/sudoers.d/sudoless"
 content: "%sudoless ALL = (ALL) NOPASSWD: ALL\n"
 owner: "root"
 group: "root"
 mode: "0644"

First run - chicken or egg?

For the first run, you don't yet have sudo without password.

Let's make ansible try for sudo rights. Add "become: true" in the correct block in site.yml:

- hosts: all
 become: true
 roles:
 - world
 - antero

$ ansible-playbook site.yml

Now it should complain that sudo needs password. Ansible asks this with -K aka --ask-become-password.

$ ansible-playbook site.yml --ask-become-password

Tips

When you got it to work manually, you have your example. Copy it to automation!

Copy paste paths.
Copy files or file contents.
Use 'stat' to check for modes (permissions). Do not guess octal permissions, you have to understand them to avoid privesc worries.

Some IaC programs only reliably understand octal modes (numbers), and only as strings. I would also recommend explicit leading zero meaning no special permissions (no setgid...). So "0644", in quotes. Maybe it has improved over the years? Who knows.

Sudo without password

Thu, 02 Apr 2026 16:04:03 +0300

Ansible needs root on the slave. One way is to allow 'sudo' without password.

Summary for gurus (the rest of us can read the article):

$ cat /etc/sudoers.d/sudoless
%sudoless ALL = (ALL) NOPASSWD: ALL

Draft: This article has commands written from memory. It has not gone trough quality assuarance and testing yet.

This short tutorial assumes you know the basics of Linux command line and have installed openssh-server.

Create the new user

Let's create a user and add it to "sudoless" group that we'll set up later. We'll call him antero, a neologism from "Ansible" and "Tero", yours truly.

Always use only good passwords. Never use bad passwords, even for a moment. Practice doing it right, don't practice doing it wrong.

$ sudo adduser antero
$ sudo groupadd sudoless
$ sudo adduser antero sudoless

Broken sudo insurance

Open a new window, ssh to target machine as needed. Then open a root shell using sudo.

If we break sudo, this might be a way to fix it. Otherwise, broken sudo prevents us from using sudo to fix the broken files.

$ sudo -i # just while fiddling with sudoers

We don't wont to work in the root shell (where the prompt is a hash "#").

So leave the root shell window behind and go back to the normal window.

New sudoers rule

Let's create a sudoers rule that allows members of "sudoless" group use 'sudo' without password.

Visudo runs our default $EDITOR. But has some checks for obvious errors.

As usual, we'll use .d/ dirs if available. And luckily, sudoers has /etc/sudoers.d/.

$ sudo visudo /etc/sudoers.d/sudoless

Add our oneliner there

%sudoless ALL = (ALL) NOPASSWD: ALL

What does the sudoers line mean?

Token	Meaning
%sudoless	Percent "%" means group
ALL	All computers
=	Literal equals "=", a separator
(ALL)	Runas: may become any user, including root
NOPASSWD	Tag: don't prompt for password
:	Literal colon ":", a separator
ALL	All commands permitted

So it's something like:

%group COMPUTERS: (RUNAS) TAG: COMMANDS.

Test

not tested == not done

New groups are effective only after logout-login. So if you're logged in as "antero", log out and back.

If you have recently given 'sudo' commands as "antero", sudo will remember your credentials for a while. Use 'sudo -k' to forget them.

$ ssh antero@localhost
$ sudo -k
$ sudo echo "See you at TeroKarvinen.com"
See you at TeroKarvinen.com

No password asked? Great! You now have passwordless sudo. You could use it with Ansible.

Adminstrivia

Sudo logo my Mark Stillman 2019, received under CC-BY-4.0.

DORA & Threat Lead Penetration Testing with Marko

Tue, 31 Mar 2026 14:54:33 +0300

Banks are now required to do red teaming exercises. Marko Buuri (Bank of Finland) showed us how TIBER-FI helps to create threat intel based red teaming exercises.

Marko's visit was part of my Penetration Testing course. You can join my list to get invitations to similar events.

Synopsis

Cybersecurity red team testing has evolved from underground art to regulated operations in the European financial sector. This lecture explores the requirement for advanced threat-led penetration testing in EU's DORA regulation, and practical guidance on how those projects are organized and delivered according to the TIBER-EU guidance across Europe.

Slides

Buuri 2026: DORA and TLPT testing - Lecture for Haaga-Helia on 31 March 2026 (pdf, 2 MB)

Slides taster

You can download the whole deck.

Bio

Marko Buuri is cyber security adviser in the Bank of Finland (Suomen Pankki). He has over 20 years of in-house and consulting cyber experience. Since 2020 he's been involved in implementing and operating TIBER-FI red team testing framework for the financial sector in Finland.

SSH public key - Login without password

Thu, 26 Mar 2026 14:50:58 +0200

SSH is the leading solution for securily logging into servers.

Many products use SSH in the background: git, rsync, ansible...

Public key authentication is quite convenient. You don't need to type your password for every 'git push' or 'ansible-playbook'. Use correctly, it can also make your server more secure.

This example is written for Debian 13-trixie.

Draft: This article has commands written from memory. It has not gone trough quality assuarance and testing yet.

Install SSH

Install the OpenSSH-server package

$ sudo apt-get update
$ sudo apt-get -y install ssh

Make SSH daemon start on boot (enable) and also start it now (--now)

$ sudo systemctl enable --now ssh

Test SSH

Normally, you would say user@host, such as tero@example.com. Here, we can leave out username, as it's the same on both machines.

$ ssh localhost

With 'w', you can see yourself logged in twice: once on the desktop, once trough ssh.

remote$ exit

Generate a keypair

$ ssh-keygen # enter enter enter to accept the defaults

If you already have a keypair, don't overwrite it. The public key ($HOME/.ssh/id_*.pub) is literally public, you can use the same public key in all hosts. The public key ends with ".pub".

If you need the public key for VPS (virtual private server) provider, you can see and copy-paste your keys with 'head $HOME/.ssh/id*.pub'.

Copy it to hosts where you can already log in.

$ ssh-copy-id localhost

Once you've entered your password for the last time, ssh-copy-id adds your public key into .ssh/authorized_keys on the remote machine. Now your key is authorized for logins.

Your public key is used automatically

$ ssh localhost

Did you log in without giving your password?

Well done, you've now automated login with SSH public keys.

Troubleshooting

Here are some helpfull troubleshooting commands.

Client side:

$ ssh -v localhost

Server side:

$ sudo journalctl --follow
$ sudo systemctl status ssh

Hello Ansible

Thu, 26 Mar 2026 14:39:42 +0200

Write infrastructure-as-code, control multiple machines easily.

In this Ansible tutorial, we create a single file in /tmp/.

In this whole tutorial, we'll create only 4 folders and 4 short files. But I'll show you how to build it step by step, so you can understand and adapt the process.

Draft: This article has commands written from memory. It has not gone trough quality assuarance and testing yet.

Background

Ansible is a configuration management tool. You write your infrastructure as code (IaC). You describe the end state, and ansible only makes changes if they are needed.

Ansible works trough SSH. Thus, the slave computers only need SSH daemon and Python installed.

This tutorial is tested with Debian 13-Trixie. You can probably adapt it to other Linuxes, like Kali or Ubuntu. We'll use ssh daemon on the same host for testing, so the master and the slave are the same computer here.

Test SSH account (without Ansible)

Ansible works trough SSH. Let's first test that we can use SSH without Ansbile.

It's advertised as "agentless", and indeed there is no slave daemon for ansible. It still needs SSH daemon and Python on slave machine. Ansible (the command) is only needed on master side. Master computer is also known as "controller" in Ansible lingo.

It's a good idea to set up passwordless SSH authentication for the account used with ansible. Check out Karvinen 2026: SSH public key - Login without password.

$ ssh localhost
remote$ exit

Install Ansible

Ansible is convenintly in Debian repositories.

$ sudo apt-get update
$ sudo apt-get install ansible micro bash-completion tree

Only ansible is really needed. Extras make it easier to work: - micro (text editor) - bash-completion (tab fills current word) - tree (show a tree of files and folders)

Test SSH with Ansible

Let's make a folder for our Ansible configuration.

$ cd
$ mkdir ansible/
$ cd ansible/

Let's write a list of hosts we'll be controlling. Create "hosts.ini", and add "localhost" there.

$ micro hosts.ini
$ cat hosts.ini
localhost

Later, we can add more hosts. One line per host. The hosts can be grouped, so we can have hosts in "web" category and five in "db".

Now we can make Ansible run a command on all hosts.

$ ansible all -a 'uptime' -i hosts.ini
...
localhost | CHANGED | rc=0 >>
15:24:39 up 14 days, 20:36, 2 users, load average: 0.55, 0.44, 0.47

We're just testing ansible here. If we just wanted to run command on remote machine, we could have 'ssh localhost "uptime"'.

Did you see the uptime? Great, Ansible can now use SSH to one host.

<a name="pythonversion"

Convenience: Stop whining about Python version

Why does Ansible have to whine about Python version? Oh, it could change - who could have guessed...

$ ansible all -a 'uptime' -i hosts.ini
[WARNING]: Host 'localhost' is using the discovered Python interpreter at '/usr/bin/python3.13', but future installation of another Python interpreter could cause a different interpreter to be discovered. See https://docs.ansible.com/ansible-core/2.19/reference_appendices/interpreter_discovery.html for more information.
localhost | CHANGED | rc=0 >>
15:29:24 up 14 days, 20:41, 2 users, load average: 0.27, 0.29, 0.39

Let's tell it to use the obvious Python command. We can add variables to host groups in inventory. This one we'll add to all.

$ micro hosts.ini
$ cat hosts.ini
localhost
[all:vars]
ansible_python_interpreter=/usr/bin/python3

So our only host "localhost" at the top, and variables for all hosts at the bottom.

Let's try again:

ansible$ ansible all -a 'uptime' -i hosts.ini
localhost | CHANGED | rc=0 >>
15:31:18 up 14 days, 20:43, 2 users, load average: 0.18, 0.27, 0.37

We can see that the Python version warning is gone.

Convenience: Just use my hosts.ini

Don't want to write "-i hosts.ini" for each 'ansible' and 'ansible-playbook' command?

You can add hosts.ini to ansible.cfg, so you don't need to add it to each command line.

$ micro ansible.cfg
$ cat ansible.cfg
[defaults]
inventory = hosts.ini

Now we don't need to add "-i hosts.ini" to every 'ansible' and 'ansbile-playbook' commands.

$ ansible all -a "uptime"
localhost | CHANGED | rc=0 >>
15:22:18 up 14 days, 20:34, 2 users, load average: 0.35, 0.37, 0.46

Site.yml - what computers get which roles

Site.yml lists wich groups of computers get which configuration (roles).

We want all computers to get the role "hello". We have not written the role yet.

$ micro site.yml
$ cat site.yml
- hosts: all
roles:
- hello

Let's run our new playbook, site.yml

$ ansible-playbook site.yml
[ERROR]: the role 'hello' was not found in /home/tero/code/terokarvinen-com/ansible/roles/:...
Origin: /home/tero/code/terokarvinen-com/ansible/site.yml:3:7
1 - hosts: all
2 roles:
3 - hello
^ column 7

Great, an error message! Most error messages bring us two letters: good news and bad news.

Good news: ansible-playbook has read our file, site.yml. It's even quoting some text from it.
Bad news: the role "hello" does not exist. Well, we have not written it yet.

First role - create a file

Role is one configured thing, for example nginx, apache2, postgresql...

But first, we'll create a "hello" role. It will create a file in /tmp/, on the slave computer. It's so simple it doesn't even need sudo.

Roles are in roles/ folder. There could be roles/nginx/, roles/postgresql/... But here, we'll have roles/hello/.

Each role folder will have standard subfolders. We'll just have tasks/. Often, we'll also see handlers/ for kicking daemons. The entry point, the code that get's run automatically, is in main.yml.

$ mkdir -p roles/hello/tasks/
$ micro roles/hello/tasks/main.yml
$ cat roles/hello/tasks/main.yml
- copy:
dest: /tmp/hello-ansible
content: "See you at TeroKarvinen.com!\n"

Let's run our playbook. Site.yml calls roles/hello/, tasks/main.yml is run automatically:

$ ansible-playbook site.yml
PLAY [all]
TASK [Gathering Facts]
ok: [localhost]
TASK [hello : copy]
changed: [localhost]
PLAY RECAP
localhost : ok=2 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0

Hey, it has "changed=1". So it claims to have changed the file on the slave.

Let's verify using a different tool.

$ ssh localhost 'cat /tmp/hello-ansible'
See you at TeroKarvinen.com!

Did you see the file on slave? Great, your first "Hello, Ansible world" has run.

Convenience: Show me what you do

Default is pretty terse:

TASK [hello : copy]
changed: [localhost]

A popular solution would be giving each task a name that repeats the code: "Copy our hello world text to the file /tmp/hello". To me, this would be similar to this C code: "i++; // increment the value of i by one". It would make sense to name a block of tasks in ansible, but this is not supported yet.

Luckily, we can make ansible print what it does. Add display_args_to_stdout:

$ micro ansible.cfg
$ cat ansible.cfg
[defaults]
inventory = hosts.ini
display_args_to_stdout = true

Now, let's run our playbook again:

$ ansible-playbook site.yml
...
TASK [hello : copy dest=/tmp/hello-ansible, content=See you at TeroKarvinen.com!
]
ok: [localhost]

Now we can see what it does:

- old: "hello : copy"
- new: "hello : copy dest=/tmp/hello-ansible, content=See you at TeroKarvinen.com!"

End result

This is what we have in the end

$ tree -F
./
├── ansible.cfg # generic configuration
├── hosts.ini # list of slave computers
├── roles/
│   └── hello/
│   └── tasks/
│   └── main.yml # code for "hello" role"
└── site.yml # which roles run on which slave
4 directories, 4 files
$ head -1000 ansible.cfg hosts.ini site.yml roles/hello/tasks/main.yml
==> ansible.cfg <== # generic configuration
[defaults]
inventory = hosts.ini
display_args_to_stdout = true
==> hosts.ini <== # list of slave computers
localhost
[all:vars]
ansible_python_interpreter=/usr/bin/python3
==> site.yml <== # which roles run on which slave
- hosts: all
roles:
- hello
==> roles/hello/tasks/main.yml <== # code for "hello" role
- copy:
dest: /tmp/hello-ansible
content: "See you at TeroKarvinen.com!\n"

And to run it all, we just run the playbook:

$ ansible-playbook site.yml
...
localhost : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0

Troubleshooting Ansible

No trouble? No troubleshooting needed. Go enjoy your ansible!

No inventory

$ ansible all -a "uptime"
[WARNING]: No inventory was parsed, only implicit localhost is available
[WARNING]: provided hosts list is empty, only localhost is available. Note that the implicit localhost does not match 'all'
$

See: Convenience: Just use my hosts.ini

Ansible does not detect hosts inventory hosts.ini automatically. Use a command line flag for that:

$ ansible all -a "uptime" -i hosts.ini
...
localhost | CHANGED | rc=0 >>
15:17:49 up 14 days, 20:29, 2 users, load average: 0.25, 0.41, 0.51

You can add hosts.ini to ansible.cfg, so you don't need to add it to each command line.

$ micro ansible.cfg
$ cat ansible.cfg
[defaults]
inventory = hosts.ini

Now we don't need to add "-i hosts.ini" to every 'ansible' and 'ansbile-playbook' commands.

$ ansible all -a "uptime"
...
localhost | CHANGED | rc=0 >>
15:22:18 up 14 days, 20:34, 2 users, load average: 0.35, 0.37, 0.46

Discovered Python interpreter

$ ansible all -a 'uptime' -i hosts.ini
[WARNING]: Host 'localhost' is using the discovered Python interpreter at '/usr/bin/python3.13', but future installation of another Python interpreter could cause a different interpreter to be discovered. See https://docs.ansible.com/ansible-core/2.19/reference_appendices/interpreter_discovery.html for more information.

See Convenience: Stop whining about Python version.

Indent is two spaces: Tabs are usually invalid in YAML

[ERROR]: YAML parsing failed: Tabs are usually invalid in YAML.

Yes, my brain hurts, too. Why can't YAML use tabs like normal people?

You must indent with spaces. Each indent is two spaces. The error message will show where the mistake is:

[ERROR]: YAML parsing failed: Tabs are usually invalid in YAML.
Origin: ...ansible/site.yml:3:1
1 - hosts: all
2 roles:
3 - hello
^ column 1

Indent ignores the dash: conflicting action statements

[ERROR]: conflicting action statements: copy, dest Origin: ...ansible/roles/hello/tasks/main.yml:1:3

1 - copy: ^ column 3

$ cat roles/hello/tasks/main.yml
- copy:
dest: /tmp/hello-ansible # WRONG - too little indent
content: "Blah" # WRONG - too little indent

We want to have "copy", which has two children, "dest" and "content".

Correct:

- copy: # no indent, dash is first char on line
dest: /tmp/hello-ansible # four spaces on the left, two spaces from "c" in copy
content: "See you at TeroKarvinen.com!\n" # four spaces on the left, two from "c"

"But it looks like four" - I know, I know. It's two from the start of the word above, ignoring the dash.

Sudo needed

After a wait: "Task failed: Module failed: Failed to lock apt for exclusive operation: Failed to lock directory" and other error messages.

Ansible needs sudo on the slave to do administration. It does not complain when creating files on /tmp/, because anyone can create files there. But as soon as you start doing any normal sysop things, you will need sudo.

Add "become: true". That means becoming the sudo user on slave machine.

$ cat site.yml
- hosts: all
become: true
roles:
- apt
- sshd
# ...

Now it will probably complain it does not know your sudo password.

$ ansible-playbook site.yml --ask-become-pass

Now it asks your sudo password before running the commands.

If you get tired of typing your sudo password, there are many ways around it, with different levels of security. For example, you can create an ansible specific user with passwordless sudo. Or use ansible vault. Or pass. Or even read sudo password from file, which sounds less than secure.

web design

Card Size Gallery

Kokoro TTS - Voice Comparison

Listen and Compare Voices in Your Browser

Run Kokoro with Podman

See also

cdu - Jump up to project directory

Usage example

A new 'cdu', change dir up

Source code, GPL

ppp Personal Project Portfolio

Talk nerd to me

Try ppp

Apache installed with Ansible - quick notes

Package-file-service pattern

tree of roles/apache2/

tasks/main.yml

handlers/main.yml

files/example.com.conf

Adminstrivia

Passwordless Sudo with Ansible

Prerequisites

Tree

Role - antero

First run - chicken or egg?

Tips

Sudo without password

Create the new user

Broken sudo insurance

New sudoers rule

Test

Adminstrivia

DORA & Threat Lead Penetration Testing with Marko

Synopsis

Slides

Links

Slides taster

Bio

SSH public key - Login without password

Install SSH

Test SSH

Automatic login with SSH public key

Troubleshooting

Hello Ansible

Background

Test SSH account (without Ansible)

Install Ansible

Test SSH with Ansible

Convenience: Stop whining about Python version

Convenience: Just use my hosts.ini

Site.yml - what computers get which roles

First role - create a file

Convenience: Show me what you do

End result

Troubleshooting Ansible

No inventory

Discovered Python interpreter

Indent is two spaces: Tabs are usually invalid in YAML

Indent ignores the dash: conflicting action statements

Sudo needed