One format
A normalized action plan: per host, actions each with a validate guard and a run command. Everything runs through it.
RHEL 9 fleet tooling · over SSH
linux-apply
One executor for the whole toolkit. Turn any tool's plan into actions and run them over SSH, re-validating each one against live state first.
$ git clone https://github.com/vikozs/linux-apply
linux-apply run --from patch --tool-plan patch_plan.json -H hosts.txt -u sa.vko --ask-ssh-pass web01.zav-mb.loc applied 1, skipped 0, failed 0 db01.zav-mb.loc applied 0, skipped 1, failed 0 Results: apply_results.json Applied: 1 skipped (not needed): 1 failed: 0
How it works
01
plan in
a discover tool's plan
02
adapt
normalize to an action plan
03
run
execute, re-validating each action
What it does
Re-validates live
Every action carries a guard. run executes an action only when the host confirms the change is still needed, so a stale plan skips what no longer applies.
Three adapters wired
patch turns updates into guarded dnf runs, users into lock/expire, firewall into per-rule firewalld changes. Same guard pattern for each.
Safe by construction
Adapters shell-quote every value from a plan, never lock root, and never drop your SSH access.
Output
Plans in, results out
A normalized action plan you can inspect, and a results file recording each action's outcome:
action_plan.jsonapply_results.jsonappliedskipped (not needed)failed
Safety
GUARDED
Every action re-validates on the host before it runs. Adapters quote plan values, never lock root, and never drop SSH access.
The rest of the family