Linux Server Playbooks

One playbook for every distribution

Installing PHP 8.4 takes different repositories and package names on Debian, on Ubuntu 22.04 and on Rocky Linux. A playbook detects the distribution, its version and the package manager installed on each server, and chooses the commands itself.

You choose the playbook and its options, such as the PHP version and extensions. You do not need to know whether a server uses apt or dnf.

Preflight checks before any change

Every run starts with a preflight on each server. It confirms the server is reachable, the account can act as root, the playbook supports the distribution and version, and, for anything that installs software, that at least 1 GB of disk space is free.

A server that fails a check is left unchanged and the reason is recorded on the run, so an install never stops halfway through because of a problem that could have been found first.

Root or sudo accounts

The platform does not assume it connects as root. It detects whether the account is root, has passwordless sudo, or needs a sudo password, and uses whichever applies. A stored sudo password is encrypted and passed to sudo on standard input, never on the command line.

If an account cannot become root, the preflight says so and explains what to change.

Safe to run repeatedly

Each step checks the current state before it acts. A package that is already installed is reported as installed, and a running service is left alone, so running a playbook again confirms the server is in the state you expect.

The output separates what was already correct, what changed and, in a dry run, what would change.

Dry runs and automatic retries

Every playbook supports a dry run, which performs the same checks and reports what it would do without changing anything.

During a real run, temporary failures such as an unresponsive package mirror or a package lock held by unattended upgrades are retried automatically. Any other failure stops the step and shows the package manager’s output alongside the reason.

Available playbooks

Restart Services. Restarts the services you choose, testing each one’s configuration first.

Update Packages. Applies all updates or security updates only, without replacing configuration files that have been modified.

Clean Disk Space. Removes downloaded package files, trims the journal and old rotated logs to limits you set, and can remove unused packages and untagged Docker images. It never touches /home, /var/www, /srv, /opt, databases or Docker volumes.

Advanced Security: Fail2Ban & Firewall Hardening. Installs Fail2Ban for SSH, turns on ufw or firewalld with the ports you choose, and applies safer SSH settings, putting everything back if a check fails.

Runtimes and services. Install Docker with the Compose plugin, Node.js 22 or 24 with global packages, PHP 8.2 to 8.5 with extensions and PHP-FPM, Python 3 with Gunicorn and uv, Poetry or Pipenv, Nginx, MariaDB, Redis and Composer, and a Prometheus, Node Exporter and Grafana stack in containers.

Web and certificates. Put an Nginx reverse proxy with a Let’s Encrypt certificate in front of an app, API or container, turn on renewal that reloads nginx afterwards, and check renewal with a dry run.

CI runners. Install the tools CI jobs expect and prepare GitHub Actions or GitLab runners, ready for you to register.

Each playbook lists the distributions and minimum versions it supports.

Frequently asked questions

Which Linux distributions do playbooks support?

Ubuntu 22.04 and later, Debian 12 and later, and RHEL-compatible 8 and later: AlmaLinux, Rocky Linux, RHEL, CentOS Stream and Oracle Linux. Most playbooks also support Amazon Linux 2023. The maintenance playbooks and some installs still accept older releases such as Ubuntu 20.04, Debian 11 and Amazon Linux 2, which are past the end of standard support. Each playbook lists exactly what it accepts.

Does the platform need to connect as root?

No. It works with root, with an account that has passwordless sudo, or with an account whose sudo password you store with its credential. The platform detects which applies when it checks the server.

What does a dry run do?

It connects, runs the preflight and walks through each step, reporting what is already in place and what would change. Nothing is installed, restarted or removed.

Will a playbook reboot my server?

No. If updates need a reboot to take effect, such as a new kernel, the run tells you. Rebooting is left to you.

Do I need to install an agent?

No. Playbooks run over the SSH connection configured for the server, and nothing is left running on the server afterwards.

Related features