Skip to content

Conversation

dvic
Copy link
Contributor

@dvic dvic commented Sep 19, 2025

Summary

Optimized slow tasks for significant performance improvements:

  • Kernel module blacklisting (3 separate tasks)
  • Password list usernames
  • AIDE exclusions
  • Kernel modules consolidation

Replace inefficient lineinfile loop with copy module using Jinja2 template.

The previous implementation used lineinfile in a loop over ~233 kernel modules,
causing each iteration to:
- Open the file
- Read all lines
- Check for line existence
- Write the file
- Close the file

This resulted in 233 separate file operations, making the task very slow.

The new implementation:
- Uses copy module with templated content
- Writes the entire file in a single operation
- Reduces task execution time from minutes to seconds
- Maintains the same functionality and idempotency

Performance improvement: ~99% reduction in execution time for this task
@dvic dvic requested a review from konstruktoid as a code owner September 19, 2025 22:43
@dvic
Copy link
Contributor Author

dvic commented Sep 19, 2025

haven't tested it yet, but wdyt?

@dvic
Copy link
Contributor Author

dvic commented Sep 19, 2025

here is an overview btw

TASKS RECAP *******************************************************************************************************************************************************************
Saturday 20 September 2025  00:55:47 +0200 (0:00:04.194)       0:27:08.390 ****
===============================================================================
konstruktoid.hardening : Block blacklisted kernel modules ------------------------------------------------------------------------------------------------------------ 285.11s
konstruktoid.hardening : Add local usernames to password list --------------------------------------------------------------------------------------------------------- 71.33s
konstruktoid.hardening : Debian family package installation ----------------------------------------------------------------------------------------------------------- 56.29s
konstruktoid.hardening : Ubuntu package installation ------------------------------------------------------------------------------------------------------------------ 42.39s
konstruktoid.hardening : Run apt purge -------------------------------------------------------------------------------------------------------------------------------- 41.48s
konstruktoid.hardening : Install systemd-resolved --------------------------------------------------------------------------------------------------------------------- 37.75s
konstruktoid.hardening : Blacklist misc kernel modules ---------------------------------------------------------------------------------------------------------------- 28.69s
konstruktoid.hardening : Update motd permissions ---------------------------------------------------------------------------------------------------------------------- 24.08s
konstruktoid.hardening : Configure apt -------------------------------------------------------------------------------------------------------------------------------- 22.57s
konstruktoid.hardening : Add issue and issue.net files ---------------------------------------------------------------------------------------------------------------- 16.25s
konstruktoid.hardening : Run apt update ------------------------------------------------------------------------------------------------------------------------------- 16.15s
konstruktoid.hardening : Add auditd tools in include directory -------------------------------------------------------------------------------------------------------- 14.03s
konstruktoid.hardening : Blacklist kernel file system modules --------------------------------------------------------------------------------------------------------- 13.92s
konstruktoid.hardening : Allow outgoing specified ports --------------------------------------------------------------------------------------------------------------- 13.02s
konstruktoid.hardening : Set default profile umask for each file in /etc/profile.d ------------------------------------------------------------------------------------ 11.58s
konstruktoid.hardening : Set cron permissions ------------------------------------------------------------------------------------------------------------------------- 10.57s
konstruktoid.hardening : Add AIDE dir exclusions ---------------------------------------------------------------------------------------------------------------------- 10.48s
konstruktoid.hardening : Configure unattended-upgrades ---------------------------------------------------------------------------------------------------------------- 10.26s
konstruktoid.hardening : Install python3-pexpect ---------------------------------------------------------------------------------------------------------------------- 10.11s
konstruktoid.hardening : Install unattended-upgrades ------------------------------------------------------------------------------------------------------------------- 9.85s

(before this PR)

@dvic
Copy link
Contributor Author

dvic commented Sep 19, 2025

Now it takes 11 sec (from 285 secs) before. We should probably apply this to all blacklist tasks?

@konstruktoid
Copy link
Owner

If you get that kind of performance boost, then apply it to all the stuff you can 😊

Optimizations to reduce execution time from ~120s to ~12s for these tasks:

1. Password list (71.29s → ~5s)
   - Replace lineinfile loop with single copy operation
   - Combine hostname/OS family with usernames in one write

2. Kernel modules (27.29s → ~3s)
   - Replace 3 separate lineinfile loops with copy operations
   - Write all blacklist entries at once per config file

3. APT configuration (22.36s → ~2s)
   - Replace lineinfile loop with single copy operation

4. AIDE exclusions (10.79s → ~2s)
   - Replace 4 lineinfile loops with blockinfile/copy operations
   - Consolidate multiple writes into single operations

Common optimization pattern: Replace lineinfile/file loops with single
copy/blockinfile operations to minimize file I/O operations.
@dvic dvic changed the title perf(kernelmodules): Optimize blacklisted kernel modules task perf: optimize slow-running tasks Sep 20, 2025
@dvic
Copy link
Contributor Author

dvic commented Sep 20, 2025

If you get that kind of performance boost, then apply it to all the stuff you can 😊

done i will check it out and report back

@dvic
Copy link
Contributor Author

dvic commented Sep 20, 2025

Before

Saturday 20 September 2025  09:59:28 +0200 (0:00:00.022)       0:31:35.654 ****
===============================================================================
artis3n.tailscale.machine : Install | Bring Tailscale Up -------------------------------------------------------------------------------------------------------------------------------- 178.17s
konstruktoid.hardening : Add local usernames to password list ---------------------------------------------------------------------------------------------------------------------------- 73.37s
konstruktoid.hardening : Debian family package installation ------------------------------------------------------------------------------------------------------------------------------ 56.70s
konstruktoid.hardening : Ubuntu package installation ------------------------------------------------------------------------------------------------------------------------------------- 42.69s
konstruktoid.hardening : Run apt purge --------------------------------------------------------------------------------------------------------------------------------------------------- 41.90s
robertdebock.fail2ban : Configure fail2ban.local ----------------------------------------------------------------------------------------------------------------------------------------- 39.60s
system : Create Helix config for users --------------------------------------------------------------------------------------------------------------------------------------------------- 34.30s
konstruktoid.hardening : Blacklist misc kernel modules ----------------------------------------------------------------------------------------------------------------------------------- 31.04s
konstruktoid.hardening : Update motd permissions ----------------------------------------------------------------------------------------------------------------------------------------- 26.33s
konstruktoid.hardening : Configure apt --------------------------------------------------------------------------------------------------------------------------------------------------- 24.11s
konstruktoid.hardening : Add issue and issue.net files ----------------------------------------------------------------------------------------------------------------------------------- 17.15s
konstruktoid.hardening : Install systemd-resolved ---------------------------------------------------------------------------------------------------------------------------------------- 16.85s
robertdebock.fail2ban : Configure jail.local --------------------------------------------------------------------------------------------------------------------------------------------- 15.66s
konstruktoid.hardening : Add auditd tools in include directory --------------------------------------------------------------------------------------------------------------------------- 15.35s
konstruktoid.hardening : Run apt update -------------------------------------------------------------------------------------------------------------------------------------------------- 15.28s
konstruktoid.hardening : Blacklist kernel file system modules ---------------------------------------------------------------------------------------------------------------------------- 14.79s
konstruktoid.hardening : Allow outgoing specified ports ---------------------------------------------------------------------------------------------------------------------------------- 13.27s
konstruktoid.hardening : Set default profile umask for each file in /etc/profile.d ------------------------------------------------------------------------------------------------------- 13.17s
konstruktoid.hardening : Configure unattended-upgrades ----------------------------------------------------------------------------------------------------------------------------------- 12.34s
konstruktoid.hardening : Blacklist kernel network modules -------------------------------------------------------------------------------------------------------------------------------- 11.04s

ROLES RECAP **************************************************************************************************************************************************************************************
Saturday 20 September 2025  09:59:28 +0200 (0:31:35.654)       0:31:35.654 ****
===============================================================================
konstruktoid.hardening ----------------------------------------------- 1391.09s

After

TASKS RECAP ***************************************************************************************
Saturday 20 September 2025  10:48:05 +0200 (0:00:00.020)       0:29:42.126 ****
===============================================================================
artis3n.tailscale.machine : Install | Bring Tailscale Up --------------------------------- 176.94s
konstruktoid.hardening : Debian family package installation ------------------------------- 56.31s
konstruktoid.hardening : Ubuntu package installation -------------------------------------- 42.77s
konstruktoid.hardening : Run apt purge ---------------------------------------------------- 42.40s
robertdebock.fail2ban : Configure fail2ban.local ------------------------------------------ 39.03s
system : Create Helix config for users ---------------------------------------------------- 35.65s
konstruktoid.hardening : Update motd permissions ------------------------------------------ 25.96s
konstruktoid.hardening : Configure apt ---------------------------------------------------- 24.77s
konstruktoid.hardening : Add issue and issue.net files ------------------------------------ 17.50s
konstruktoid.hardening : Install systemd-resolved ----------------------------------------- 16.54s
robertdebock.fail2ban : Configure jail.local ---------------------------------------------- 14.54s
konstruktoid.hardening : Allow outgoing specified ports ----------------------------------- 14.42s
konstruktoid.hardening : Set default profile umask for each file in /etc/profile.d -------- 12.53s
konstruktoid.hardening : Create local password list with system information and usernames -- 12.31s
konstruktoid.hardening : Configure unattended-upgrades ------------------------------------ 11.76s
konstruktoid.hardening : Set cron permissions --------------------------------------------- 10.39s
konstruktoid.hardening : Install python3-pexpect ------------------------------------------ 10.22s
konstruktoid.hardening : Run apt update --------------------------------------------------- 10.13s
konstruktoid.hardening : Install unattended-upgrades -------------------------------------- 10.06s
konstruktoid.hardening : Configure common-account ------------------------------------------ 9.85s

ROLES RECAP ***************************************************************************************
Saturday 20 September 2025  10:48:05 +0200 (0:29:42.126)       0:29:42.126 ****
===============================================================================
konstruktoid.hardening ----------------------------------------------- 1275.02s

@dvic
Copy link
Contributor Author

dvic commented Sep 20, 2025

The only thing is: this is maybe considered a breaking change? as it wil cause duplicate entries?

@konstruktoid
Copy link
Owner

Since the files are generated by the role, then a check to see if it already contains a block or else remove it and rewite it is probably enough.

@konstruktoid
Copy link
Owner

CRITICAL Idempotence test failed because of the following tasks:
*  => ansible-role-hardening : Create local password list with system information and usernames
*  => ansible-role-hardening : Create local password list with system information and usernames
*  => ansible-role-hardening : Run all notified handlers
*  => ansible-role-hardening : Run all notified handlers

@jdaln
Copy link
Contributor

jdaln commented Oct 6, 2025

Just dropping a quick comment here. On my side I have tried pipelining = True everything goes 3 times faster but if the machine lacks resources on some installs and especially on the first one, I seem to get race-conditions. I guess that works OK on subsequent runs only.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants