テーマ： automation
-
Tale MCP: deployment endpoint and organization scope
Tale exposes a deployment-specific MCP endpoint for knowledge and automations, using bearer API keys and organization scoping. This reference summarizes its documented connection and permission boundaries.
-
FreeBSD の rc.conf、sysrc、service：有効化、起動、起動時に動くものの確認
FreeBSD のサービスは rc.conf の変数で宣言的に有効化する。変数は /etc/rc.conf または /etc/rc.conf.d のサービス別ファイルに置く。sysrc と service <name> enable はどちらも変数を書くだけで、rc.conf 自体は直接何かを実行するものではなく、/etc/rc.d の rc スクリプトが読む変数を設定する。sysrc はスクリプトから変数を安全に編集し、service は対応する rc.d スクリプトを起動・停止して状態を報告する。
-
Why an unattended script fails silently on macOS: TCC permissions for files, Accessibility and Automation
macOS mediates access to files outside an app's container, keyboard/screen control, and cross-app Apple Events through TCC, keyed to the code identity of the calling binary rather than the Unix user — so root does not bypass it, and a rebuilt unsigned or ad-hoc-signed tool starts the grant process over.
-
Setting locale, timezone and reconfiguring packages non-interactively on Debian and Ubuntu
localectl, timedatectl and update-locale change locale and timezone without a text-mode dialog, and dpkg-reconfigure -f noninteractive re-runs a package's debconf-driven setup the same way a script would run the original install, both usable in provisioning scripts with no terminal attached.
-
Ansible ad-hoc commands and check mode for a safe first run against a fleet
An ad-hoc `ansible` command runs one module against one or more hosts without a playbook, and combining it with `--check --diff` and a narrow `--limit` lets an agent see what a change would do to a fleet before it does it.
-
Automating z/OS through z/OSMF: the jobs, datasets, and files REST APIs
z/OSMF exposes z/OS jobs, datasets, and z/OS UNIX files as ordinary HTTPS/REST resources, which makes it the most agent-friendly interface to the system; requests need the X-CSRF-ZOSMF-HEADER custom header (state-changing ones are rejected without it), and responses use standard HTTP status codes rather than 3270 message text.
-
cron の代わりに systemd タイマーを使う：OnCalendar、Persistent=、RandomizedDelaySec
systemd の .timer ユニットを oneshot 型の .service と組み合わせると、crontab のエントリを置き換え、停止中に逃した実行の補完と、複数ホスト間でのランダムな時刻のずらしを加えられる。この手法では、この組を作成・検証・有効化し、Persistent= と RandomizedDelaySec= の実際の動作を説明する。
-
Using SMIT as a command generator instead of a menu system
smit/smitty menus ultimately run ordinary AIX commands, and the tool is built to show you which ones: the output window displays the constructed command statement, and smit.log/smit.script capture every command and its exact flags with timestamps. Reading smit.script after a menu-driven task is a fast way to learn the equivalent non-interactive command.
-
Updating FreeBSD: freebsd-update for the base system, pkg upgrade for packages, and pkg audit for known vulnerabilities
FreeBSD splits patching into two independent tools: freebsd-update fetch/install for the base system (with upgrade -r for a major release change), and pkg upgrade for installed packages. pkgbase — installing the base system itself as pkg(8) packages — is documented as experimental on FreeBSD 14 and a technology preview for FreeBSD 15.0, not yet the default path.
-
Running Linux administrative commands non-interactively for unattended agents
Interactive defaults — a pager, a confirmation prompt, a locale that reformats numbers, a sudo password prompt with no terminal to answer it — are the most common reasons an unattended agent session hangs or misparses output on Linux. This article lists the flags and environment variables that turn each one off.
-
launchd domains: choosing a LaunchAgent or LaunchDaemon and loading it with launchctl
LaunchAgents and LaunchDaemons live in different directories, run in different launchd domains, and are managed with the modern bootstrap/bootout/enable/kickstart/print subcommands rather than the deprecated load/unload pair. This methodology covers picking the right domain, writing a minimal plist, and checking status.
-
Storing secrets for unattended scripts: systemd credentials, DPAPI, macOS keychain — and what not to do
Each OS has a mechanism to hand a script a secret without an environment variable or command-line argument that any co-resident process or log can read: systemd's LoadCredential=, Windows DPAPI via Export-Clixml or SecretManagement, and the macOS keychain via security find-generic-password.
-
Detecting the operating system from a script: uname, os-release, sw_vers, oslevel and a fallback order
A portable script needs a reliable way to branch on operating system and version before running an OS-specific command from any of the other articles in this series. This methodology gives a fallback order — from the most specific, most reliable source down to a last-resort guess — for POSIX shells and PowerShell.
-
SSH known_hosts and host key verification for automation: ssh-keyscan plus an out-of-band check
Automation that connects over SSH still needs to verify the server's host key; ssh-keyscan alone only harvests a key without proving it is genuine. StrictHostKeyChecking=accept-new, HashKnownHosts and SSHFP records each address a different part of doing this safely without an interactive prompt.
-
Administering SUSE Linux with zypper: refresh, patch versus update versus dup, and non-interactive runs
zypper separates refreshing repository metadata, installing official patches, updating individual packages and a full distribution upgrade into four distinct commands. Knowing which one to use, how to run zypper unattended, how to find processes still using deleted files after an update, and how to lock a package version keeps an agent from breaking a SUSE host.
-
The PF firewall on FreeBSD: testing pf.conf with pfctl -n before loading it, and a scheduled rollback against SSH lockout
pf.conf rules are organized around a default pass/block policy, optional anchors for attaching sub-rulesets, and are loaded with pfctl -f only after pfctl -nf has parsed them without loading. Because a mistaken rule set can cut off the very SSH session used to apply it, scheduling an unattended revert with at(1) before loading new rules is a common safety pattern (not a PF feature) for testing changes on a remote FreeBSD host.
-
Running apt and dpkg non-interactively on Debian and Ubuntu without hanging on prompts
A scripted apt-get or dpkg run can stall on a debconf prompt, a modified-conffile question or a held dpkg lock. Setting DEBIAN_FRONTEND, the right confold/confdef options and preseeding debconf answers first turns an install into a command that either finishes or fails loudly.
-
Running Homebrew non-interactively on a build agent: NONINTERACTIVE, env vars and Brewfile
Homebrew's installer, its auto-update and analytics behaviour, and formula versions can all be controlled without a prompt for use on a CI runner, and a Brewfile makes the installed set reproducible across runners.
-
Kickstart ファイルで RHEL の無人インストールを構築する
Kickstart ファイルは、一行のコマンドと %pre・%post のスクリプトを組み合わせ、対話的な確認なしに RHEL、Rocky Linux、AlmaLinux のインストールを進める。この手順では、使用前の検証、起動時の指定、認証なしで配布されることの多いファイルに秘密を入れない方法を扱う。
-
DebianとUbuntuでセキュリティ更新を自動適用するためにunattended-upgradesを設定する
unattended-upgradesは、20auto-upgrades（実行の有無と頻度）と50unattended-upgrades（対象の配布元と再起動の有無）の2つのファイルを使い、タイマーでパッケージ更新を適用する。本番環境で有効にする前に--dry-run --debugでテストすると、予期しない再起動や途中までしか適用されない更新を避けられる。
機械可読： JSON