Declarative Fleet Management: GitOps for Bare Linux Nodes with Ansible Pull

GitOps has become the gold standard for declarative infrastructure. In container-heavy ecosystems, tools like ArgoCD and Flux monitor Git repositories and continuously reconcile Kubernetes cluster state. However, running a complete Kubernetes control plane merely to manage a fleet of 5 to 50 Linux VPS instances introduces overwhelming overhead.

You do not need Kubernetes to practice true GitOps. By combining Git repositories, GPG cryptographic commit signing, and periodic 'ansible-pull' daemons managed by systemd timers, standalone Linux VPS instances become autonomous, self-converging nodes that pull and enforce their own target state without an open inbound SSH port.

The Inverted Push-to-Pull Paradigm

Traditional configuration management operates on a push model: an operator or CI runner initiates SSH connections into dozens of servers. This creates severe security issues:

• Inbound SSH Exposure: Every server must accept incoming connections from CI runners or bastion hosts.
• Blast Radius: Compromising the central push runner grants immediate root access to the entire fleet.
• Offline Nodes: Servers that are temporarily offline miss push updates and suffer configuration drift.

In the 'ansible-pull' architecture, the flow is completely inverted:

Systemd Timer and Service Configuration

To establish autonomous convergence, create a systemd service unit and timer:

# /etc/systemd/system/ansible-pull.service
[Unit]
Description=Autonomous GitOps Convergence via Ansible Pull
After=network-online.target
Wants=network-online.target

[Service]
Type=oneshot
User=root
ExecStart=/usr/bin/ansible-pull     --url https://github.com/netbay-org/fleet-infra.git     --checkout main     --directory /var/lib/ansible/local     --verify-commit     local.yml
StandardOutput=journal
StandardError=journal

Pair it with a timer that activates every 10 minutes with randomized jitter to prevent thundering herd requests on your Git host:

# /etc/systemd/system/ansible-pull.timer
[Unit]
Description=Trigger periodic Ansible Pull GitOps convergence

[Timer]
OnBootSec=2min
OnUnitActiveSec=10min
RandomizedDelaySec=60s

[Install]
WantedBy=timers.target

Sample Idempotent Playbook

The repository's 'local.yml' playbook ensures configuration state is maintained:

# local.yml
- hosts: localhost
  connection: local
  tasks:
    - name: Ensure security packages are installed
      apt:
        name:
          - ufw
          - fail2ban
          - unattended-upgrades
        state: present
        update_cache: yes
        cache_valid_time: 3600

    - name: Enforce locked down SSH daemon configuration
      copy:
        dest: /etc/ssh/sshd_config.d/99-hardened.conf
        content: |
          PermitRootLogin prohibit-password
          PasswordAuthentication no
          X11Forwarding no
          MaxAuthTries 3
        mode: '0600'
      notify: Restart SSH

  handlers:
    - name: Restart SSH
      service:
        name: ssh
        state: restarted

Expand

Video Reference on Ansible Infrastructure Automation

Watch this comprehensive walkthrough on automating infrastructure configurations with Ansible:

With 'ansible-pull', you obtain all the benefits of declarative GitOps—versioned history, reviewable PRs, and automatic drift remediation—without the overhead of heavy cluster control planes.

Deploy fast, independent Linux VPS nodes on Netbay Cloud Infrastructure and manage them declaratively at netbayhosts.in.