itamae VS judo

I maintain two projects that I use daily for both work and personal stuff, that have attracted a modest, but appreciable amount of contributions. In both cases, the codebases are relatively small (500-1k sloc), and laser-focused on doing exactly one thing well.

I'm very grateful for every contribution, no matter how small - people have found bugs, fixed real problems, done cleanups. The hardest part is telling someone that a feature/idea does not have a place in this project. I think the general emphasis on minimalism tends to help here - I've never had to deal with any drama.

In terms of workload, again - the minimalist design and extremely clear goals have helped so much. I got trapped by that once before - I volunteered to build an internal automation tool (that saved someone else from doing like 1h/d of work), but literally couldn't spare 1h/mo to maintain it; the cause of the maintenance burden was an influx of changes in the APIs of the external services it integrated. So now I'm much more careful about volunteering to maintain integrations with external tools; in case of these two projects, the targets are SSH and ZFS - both have extremely stable interfaces.

In both cases it was absolutely worth it to publish and (very lightly) promote the projects; since these are "devops" tools that theoretically have unlimited potential for causing great harm, having any response at all helped reassure me that the code I'm running against production infrastructure has fewer unknown bugs. https://i.pinimg.com/474x/2f/e0/87/2fe08785e8eb112cada6da789...

The projects: <https://github.com/rollcat/judo>; <https://github.com/rollcat/zfs-autosnap>.

"This simple tool solves X at my org" is probably the most underrated type of project. There's not enough room to overcomplicate something that isn't a core part of the business, it must be practical to maintain, simple&stupid enough so that onboarding is not a hurdle, etc.

I encourage everyone to share your "splunk in 1kloc of Python" projects! Some of my own:

- https://github.com/rollcat/judo is Ansible without Python or YAML

- https://github.com/rollcat/zfs-autosnap manages rolling ZFS snapshots

I've written a minimalist replacement for Ansible. It started as a weekend hack, and I'm still using it daily after 7 years. Perhaps it's not technically impressive, but so wasn't the original UNIX, which served as a direct inspiration: how much work can you do with the simplest design and the least amount of code?

https://github.com/rollcat/judo

Ansible and YAML were my primary (de)motivators to create Judo (https://github.com/rollcat/judo). This combo is extremely frustrating: for every line in a (hypothetical) shell script that would do one thing, I needed 3-5 (sometimes many more) lines of YAML. Most people on the team who were just getting started with Ansible, would often do half of their work just shelling out. I would usually push to do things "the Ansible way", but even I had to acknowledge the mental overhead of translating back & forth. I think what finally pushed me over the edge was when we started venturing into compose & k8s, and had to mix & juggle YAML+Jinja in two entirely different contexts, each with its own quirks, bugs, gotchas and brain damage.

I figured I just need a layer of glue to run shell scripts across a bunch of remote hosts (hence Judo), and otherwise resort to other tooling (like Terraform, AWS CLI, k8s CLI, etc) for problems that don't map to SSH.

You're right, once an adversary gains physical access (or even remote access as your main login account), all bets are off. This is the area where the traditional UNIX security model has failed to adapt at all: you need a password to install a random game from apt (a vetted and trusted source), but you don't need a password to install a cryptolocker, or exfiltrate personal data.

However I like having a password (or some other form of confirmation), just so that I can stop to think for a second, whether what I'm about to do is a good idea.

What's annoying is that I effectively need two different policies on workstations and on servers, since I still want to be able to escalate privileges from maintenance scripts[1].

[1]: https://github.com/rollcat/judo/issues/9

Hi! I'm the author of judo - it seems like our projects share a lot in common, all the way down to implementation language and license ;) feel free to borrow some inspiration or solutions (e.g. master mode for SSH connections might be useful).

I wrote judo[1] because I was frustrated with Ansible. I wanted a very basic tool that could do 80% of the work in 1% of the code. It has one or two bugs, but I've been using it for personal and work stuff since 2016 and I'm not looking back.

[1]: https://github.com/rollcat/judo