Ansible is so simple yet so elegant.

Righteous!

If the open source release is adequate then you can just continue using it… Or fork for your needs.

I like to require access to 22 via IP whitelist and all services on SSL behind a reverse proxy. Doesn’t leave much surface to attack.

You can always set watchtower to blindly pull for you. If it’s going to be broken anyways, might as well automate the process.