The Linux System Roles are a set of Ansible Roles, also available as an Ansible Collection, used to manage and configure common GNU/Linux operating system components. Conceptually, the intent is to provide for the operating system components an automation “API” that is consistent across multiple major and minor releases. The roles are available in Ansible Galaxy at linux-system-roles. If you would prefer to use a collection instead of individual roles, see fedora.linux_system_roles collection
Benefits of System Roles
Consistent and abstract
A major objective is that a role will provide a consistent user interface to provide settings to a given subsystem that is abstract from any particular implementation. For example, assigning an IP Address to a network interface should be a generic concept separate from any particular implementations such as init networking scripts, NetworkManager, or systemd-networkd.
Another part of the consistency is a set of Good Practices which role users and developers follow in order to maintain a consistent behavior and interface for all of the roles.
Utilize the subsystems’ native libraries
Whenever possible, the modules for this effort will take advantage of the native libraries and interfaces provided by the distribution, rather than calling upon CLI commands. Example libraries include dbus, libnm, and similar interfaces which provide robust and strictly defined inputs.
Designed in conjunction with subsystem maintainers
Each role handles subsystem best practices, corner cases, new features. In many cases, the role for a particular subsystem is designed by the maintainer of that subsystem. For example, the network system role was designed by the team that maintains NetworkManager and nmstate.
Hides RHEL major and minor version differences
You can use the same inventory and playbook to manage a mix of multiple different RHEL major and minor versions. Many subsystems have major version differences, and some have minor version differences (e.g. fapolicyd). The role hides and manages those differences for you.
Can manage a list of settings
Most roles can take a list of settings, so no need for looping in the playbook. You can define the list of settings in the inventory, the role takes care of applying those settings idempotently. In most cases, the playbook is just a list of roles to invoke - no further logic is needed.
Aids in upgrade
After you upgrade your managed node to the next major version of the OS, you can keep using the same playbook and inventory to manage that node. Fewer changes, fewer errors, less QE.
Extensively tested
The roles collectively have over 600 integration tests, many unit tests, which
are included with the roles, and tested across many different OS and Ansible
versions, as well as multiple versions of ansible-lint and ansible-test. The
integration tests are Ansible playbooks, and are a great resource for learning
how to use the roles, in addition to the examples.
Roles are composable
Internally, some roles which provide a network service use the certificate role for the TLS cert/key, the firewall role for managing the firewall ports, and the selinux role for managing port policy, so the user does not have to manage these separately. Externally, users can chain multiple roles in a single playbook for complete end-to-end scenarios - for example, combining the certificate, firewall, and cockpit roles to deploy the RHEL web console with trusted certificates in one run.
Other features
- Consistent API/naming across multiple roles - For example, a variable with a
_certsuffix means the same thing in all roles. - Can manage immutable systems (ostree).
- Works with explicit fact gathering - each role knows how to gather facts
needed by the role. You can use the roles with
ANSIBLE_GATHERING=explicit. - Handles lifecycle management beyond initial setup - roles support ongoing operations such as encryption key rotation, certificate renewal, snapshot revert, and configuration updates, not just first-time provisioning.
- Handle reboot orchestration - several roles detect when changes require a reboot and can handle the reboot sequence automatically, or report the need if not permitted.
Supported distributions
- Fedora
- Red Hat Enterprise Linux (RHEL 6+)
- CentOS and CentOS Stream
- openSUSE and SUSE Linux Enterprise (SLE SP6+)
Note:
- Some components are not available on EL6, and some are available only on EL8+/Fedora.
- Support for SUSE and openSUSE is in progress and currently limited to a subset of roles.
- Refer to the documentation of each role to verify compatibility across distributions.
Supported roles
| Role Name | Description | Role Docs | Ansible Galaxy | GitHub Repository |
|---|---|---|---|---|
| ad_integration | Active Directory join | Docs | Galaxy | linux-system-roles/ad_integration |
| aide | Advanced Intrusion Detection Environment (file integrity monitoring) | Docs | Galaxy | linux-system-roles/aide |
| auditd | Linux audit daemon | Docs | Galaxy | linux-system-roles/auditd |
| bootloader | Boot loader configuration | Docs | Galaxy | linux-system-roles/bootloader |
| certificate | Certificate management | Docs | Galaxy | linux-system-roles/certificate |
| cockpit | Cockpit web console | Docs | Galaxy | linux-system-roles/cockpit |
| crypto_policies | Crypto policies | Docs | Galaxy | linux-system-roles/crypto_policies |
| fapolicyd | File access policy daemon | Docs | Galaxy | linux-system-roles/fapolicyd |
| firewall | Firewall configuration | Docs | Galaxy | linux-system-roles/firewall |
| gfs2 | GFS2 clustered file system | Docs | Galaxy | linux-system-roles/gfs2 |
| ha_cluster | Cluster HA (Pacemaker/Corosync) | Docs | Galaxy | linux-system-roles/ha_cluster |
| hpc | High performance computing | Docs | Galaxy | linux-system-roles/hpc |
| journald | Systemd journald | Docs | Galaxy | linux-system-roles/journald |
| kernel_settings | Kernel settings (sysctl, sysfs, etc.) | Docs | Galaxy | linux-system-roles/kernel_settings |
| keylime_server | Keylime remote attestation server | Docs | Galaxy | linux-system-roles/keylime_server |
| kdump | Kernel crash dump | Docs | Galaxy | linux-system-roles/kdump |
| logging | System logging (rsyslog) | Docs | Galaxy | linux-system-roles/logging |
| metrics | Metrics collection - PCP, Grafana, Valkey, Elasticsearch, and more | Docs | Galaxy | linux-system-roles/metrics |
| mssql | Microsoft SQL Server | Docs | Galaxy | linux-system-roles/mssql |
| nbde_client | Network-bound disk encryption client | Docs | Galaxy | linux-system-roles/nbde_client |
| nbde_server | Network-bound disk encryption server | Docs | Galaxy | linux-system-roles/nbde_server |
| network | Network configuration - NetworkManager, nmstate, ifcfg | Docs | Galaxy | linux-system-roles/network |
| pam_pwd | PAM password quality and configuration | Docs | Galaxy | linux-system-roles/pam_pwd |
| podman | Podman containers - Quadlets, Kube specs, Secrets, registries, storage, credentials | Docs | Galaxy | linux-system-roles/podman |
| postfix | Postfix email server | Docs | Galaxy | linux-system-roles/postfix |
| postgresql | PostgreSQL | Docs | Galaxy | linux-system-roles/postgresql |
| rhc | Red Hat Subscription Management and Insights | Docs | Galaxy | linux-system-roles/rhc |
| selinux | SELinux configuration | Docs | Galaxy | linux-system-roles/selinux |
| snapshot | LVM snapshot management | Docs | Galaxy | linux-system-roles/snapshot |
| ssh | SSH client | Docs | Galaxy | linux-system-roles/ssh |
| sshd | SSH server | Docs | Galaxy | willshersystems/ansible-sshd |
| storage | Storage management - LVM, RAID, LUKS, pools, volumes, and more | Docs | Galaxy | linux-system-roles/storage |
| sudo | Sudo configuration - manage sudoers file | Docs | Galaxy | linux-system-roles/sudo |
| systemd | Systemd unit management - system and user units | Docs | Galaxy | linux-system-roles/systemd |
| timesync | Time synchronization - chrony, ntp | Docs | Galaxy | linux-system-roles/timesync |
| tlog | Terminal logging and session recording | Docs | Galaxy | linux-system-roles/tlog |
| trustee_client | Trustee client | Docs | Galaxy | linux-system-roles/trustee_client |
| trustee_server | Trustee server | Docs | Galaxy | linux-system-roles/trustee_server |
| vpn | VPN (IPSec with Libreswan) | Docs | Galaxy | linux-system-roles/vpn |
Collection
If you would prefer to use a collection instead of individual roles, see Linux System Roles Collection
Submit an Issue
If the issue is specific to a role, file an issue at the role repository - for example, network issues
If the issue is not specific to a role e.g. a general question, or a request to add a new role, use General issues
Demos
Roles on the roadmap
- Kerberos authentication
- tuned (power management)