I see you have a good amount of time in this script. I do appreciate the efforts.

I just see that writing large scripts like this is a waste of time when we have cool tech like Ansible that could do this far easier. Plus Ansible is idempotence!

Scripts like this take time to create, debug and read to those that are seeing it the first time, or the 100th. This is one reason imho why Ansible (Puppet, Chef) were created. Yaml synax is easy, just need a good editor that shows the spaces. I use Atom and sometimes Notepad++

For example, here is a Nginx role with php that I randomly found: https://github.com/geerlingguy/ansible-role-nginx

I don't understand why people keep saying Ansible is idempotent. Ansible is not somehow magically idempotent, nor is Bash "always not idempotent". You can write bad, non-idempotent code in Ansible too and good, idempotent code in Bash too.

Sure, if you are using some of Ansible's modules that are developed specifically to be idempotent, then yes, but there are plenty of "shell" module examples out there that aren't remotely idempotent

For a specific ansible role for nginx, suggest to look at

https://github.com/nginxinc/ansible-role-nginx

it is complete free, open source, not difficult to use, does not require any additional tools on the target host.

On the control (source) host you just need ansible and target hosts need python3.

And from there you can use this role to push nginx install on 10 or 100 target hosts (with same single command). The hosts do not have to run the same OS (they can run a mix Debian-based, or -redhat based Linuxes, and a FreeBSD.. I think (although did not try that) ).

This role automatically setups and download the appropriate versions of nginx binaries, and allows pretty flexible config of nginx itself, from load balancers to reverse proxies, to plain-jane web servers...

Any passwords that may need to be transmitted to target hosts (eg for cert files), are normally encrypted in crypto-secure ansible vault. So they get transferred with SSH over to the host, without being ever bein stored plain on the source/controller host.

With regards to

> Most automation scripts are used to sell additional products like Ansible so this script avoids that.

I think most open source software, nginx including, can be though of as 'promoting' something or somebody. Just like any other endeavor that meant to be publicly consumed.

One of the benefit of using Ansible is that when something blows up in the middle, it can restart from there than do it all over again.

Also Ansible Tower (AWX for opensource version) can have user access control and keep a history of past execution whether they succeeded or not.

And there are bunch of community written recipes for many tasks.

While writing everything in yaml may or may not make you feel good but at least it's more readable than a complicated bash script.

A gold-plated wrench is undoubtedly better than a regular wrench. It will never rust and it's even more resistant to acids and alkoli than chrome plating. If you embed diamond dust in the surface, it's even better because now it's grippy and the grip will never wear out.

And yet, not everyone needs a diamong-encrusted gold-plated wrench. There is a place in the world for a regular simple wrench.

The existence of one does not invalidate the existence of everything else.

Yes, bash scripts have their places like running a repeating task on a machine but deploying an environment on multiple machines is exactly what Ansible is intended for.

False analogy. Ansible is the regular wrench here, scripting everything again in bash is the needle in the haystack solution.

Correct me if I'm wrong, but isn't Ansible's only dependency Python, which is already installed on 99% of linux distros? It may drag some extra python packages but those can be contained in a virtualenv to avoid bloating the OS installation.

There is room for DIY scripts but it's mostly in development and perhaps early testing. In production the most important thing would be ease of maintenance. DIY scripts just create technical debt down the line, unless your whole setup is so simple that you can completely replace Ansible or similar with a DIY script.