Today, I released iptables-ng, a cookbook to maintain iptables rules on different machines using chef.

But why another cookbook? There are two fairly often used around

• iptables from Opscode
• simple_iptables from Dan Crosta

Well, I wanted a tool which can do all the following:

• Configure iptables rules in a consistent and nice way for all distributions
• Be configured by using LWRPs only
• Be configured by using node attributes only
• Respect the way the currently used distribution stores their rules
• Provide a good-to-read and good-to-maintain way of deploying complex iptables rulesets
• Provide a way of specifying the order of the iptables rules, in case needed
• Only run iptables-restore once during a chef run, and only if something was actually changed
• Support both, ipv6 as well as ipv4
• Be able to assemble iptables rules from different recipes (and even cookbooks), so you can set your iptables rule where you actually configure the service

By default, the connections between the chef-client and the chef-server are not secured. This is a short post on howto encrypt and verify your connections.

As of chef-11 (unlike chef-10), SSL is enabled by default. But (naturally, as Opscode cannot create trusted certificates for your domain) the certificates are not verified. This essentially means that the connection is not secure at all.

Unless you only use chef in a trusted network, you should invest some time in securing your clients connections.

One thing that was annoying me for a long time, was that, using Capistrano deployment, you cannot spawn a new vanilla virtual machine, and bring it to a fully up-and-running state with just one Chef command.

make deploy_revision compatible with Capistrano, so deployments can happen with Capistrano, until we’ve decided to fully migrate to Chef, or to stick with the push deployment

On our rails and worker servers at flinc, we recently migrated the ruby version management from rvm to chruby.

Besides the usual arguments against rvm, like preferring unpatched cd commands, there was another reason:

The fnichol’s chef rvm cookbook has some issues.