Blocks that change what is inside a file, line by line, without replacing the whole file.

Comment Out Lines

Comments out the lines of a file that match a pattern.

Generates: a files promise.

Settings

Setting Required Description
File path Yes An absolute path.
Line pattern Yes A regular expression the whole line must match, e.g. Listen 8.*
Comment marker Yes Put in front of each matching line. Default: #.

Example

The policy it generates, for example:

# Comment out port 8080
files:
  "/etc/nginx/nginx.conf"
    edit_line => default:comment_lines_matching("listen 8080.*", "#");

Ensure Lines in File

Appends lines that are missing from a file, leaving the rest of it alone.

Generates: a files promise.

Settings

Setting Required Description
File path Yes An absolute path.
Lines Yes One line per line; each is appended at the end of the file unless it’s already there, exactly as written.
If the file is missing Yes One of: Create it, Leave it missing. Default: Create it.

Example

The policy it generates, for example:

# Add the app to hosts
files:
  "/etc/hosts"
    create => "true",
    edit_line => default:append_if_no_lines("10.0.0.5 db.local");

Remove Matching Lines

Deletes every line of a file that matches a pattern.

Generates: a files promise.

Settings

Setting Required Description
File path Yes An absolute path.
Line pattern Yes A regular expression the whole line must match, e.g. PermitRootLogin.* (not a substring search).

Example

The policy it generates, for example:

# Remove passwordless sudo
files:
  "/etc/sudoers" edit_line => default:delete_lines_matching(".*NOPASSWD.*");

Replace Text in File

Replaces every match of a pattern in a file, like sed.

Generates: a files promise.

Settings

Setting Required Description
File path Yes An absolute path.
Find Yes A regular expression, e.g. example.com. The replacement mustn’t match it again, or the agent reports the edit as not convergent.
Replace with No Empty removes the matched text.

Example

The policy it generates, for example:

# Use the demo domain
files:
  "/etc/nginx/nginx.conf"
    edit_line => default:regex_replace("example\.com", "demo.local");

Set Config Values

Sets keys in a config file: updates, uncomments or adds each line.

Generates: a files promise.

Settings

Setting Required Description
File path Yes An absolute path, e.g. /etc/ssh/sshd_config or /etc/sysctl.conf.
File format Yes One of: Key value, key=value. Default: Key value.
Settings Yes One per line: the key, then its value after a space or =, e.g. PermitRootLogin no. Other lines are left alone.

Example

The policy it generates, for example:

# Harden SSH
vars:
  "harden_ssh_settings[PermitRootLogin]" string => "no";
  "harden_ssh_settings[MaxAuthTries]" string => "3";

files:
  "/etc/ssh/sshd_config"
    edit_line => default:set_line_based(
      "security:main.harden_ssh_settings", " ", "\s+", ".*", "\s*#\s*"
    );