update-conf

Update an existing ansible.cfg with targeted changes. Always shows a diff and waits for confirmation before writing.

Required Inputs

1. path to ansible.cfg — Resolved from discovery if not provided
2. change_description — What to change (e.g., "enable fact caching with redis", "set forks to 20", "add vault_identity_list for dev and prod")

Behavior

Step 1 — Discovery

Locate the ansible.cfg via discovery (references/discovery.md).

Step 2 — Load Existing Config

Read the full ansible.cfg content.

Step 2a — Secret Scan (before any output)

Before displaying any content or diff, scan every line for credential-like values:

• Match lines where the key contains password, secret, token, key, pass, credential, or vault_password_file
• Skip lines where the value is already a vault reference ({{ vault_* }}), empty, or None
• For any remaining matches, redact the value in all output: password = ***REDACTED***
• Emit a warning at the top of the diff block:

  ⚠ Warning: N line(s) with credential-like values were redacted from this display.
    Review the file directly before applying changes.

• Never output actual credential values in diffs, summaries, or confirmations.

Step 3 — Apply Change

Apply the requested change:

• Preserve all existing sections, keys, and comments
• Add inline justification comments for security-sensitive settings:
• host_key_checking = False → must have a comment explaining why
• vault_password_file → add chmod reminder comment
• Use correct INI format: key = value with spaces around =
• If a requested section doesn't exist, create it at the appropriate location
• If removing a key: remove only that line (and its comment block if it's clearly paired)
• Prefer collections_path in newly generated examples while preserving existing intent in older files

Step 4 — Show Unified Diff

--- ansible.cfg (original)
+++ ansible.cfg (proposed)
@@ -8,6 +8,9 @@
 forks                 = 10
 timeout               = 30
+
+# Fact caching: redis (shared across controller nodes; configure auth via REDIS_URL or vault)
+fact_caching          = redis
+fact_caching_connection = redis://:{{ vault_redis_password }}@cache.internal:6379/0
+fact_caching_timeout  = 86400

Then ask: "Apply this change? (yes/no)"

Step 5 — Write on Confirmation

• If yes: write the updated ansible.cfg.
• If no: ask what to change and loop back.

Step 6 — Final Output

echo "Updated: $(realpath ansible.cfg)"

Suggest next step:

Next step: Validate with `ansible --version` to confirm the config is loaded
           or run /ansible-designer:review-conf to check for remaining issues.

Change Types Supported

Safety Rules

• Never remove entire sections unless explicitly requested.
• Never change host_key_checking = True to False without adding a justification comment.
• If adding vault_password_file, add a comment reminding about chmod 600.
• If the user requests forks > 100, warn: "Each fork uses ~100MB RAM — ensure the controller has sufficient memory."
• Preserve the existing indentation/alignment style (spaces around =).
• Never display actual credential values — apply the Step 2a secret scan before any output. Redact before showing.
• When modifying security-sensitive settings (host_key_checking, become, transport, vault_password_file, callback or stdout plugins), always add an inline comment explaining the security implication of the change.