# lineinfile, insert, and idempotency **URL:** \ **Category:** Ansible Project\ **Created:** [November 21, 2014, 5:10pm UTC](https://forum.ansible.com/t/lineinfile-insert-and-idempotency/16848 "2014-11-21T17:10:26Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![John\_Oliver](https://avatars.discourse-cdn.com/v4/letter/j/97f17d/32.png) [@John\_Oliver](https://forum.ansible.com/u/John_Oliver)\ **Post date:** [November 21, 2014, 5:10pm UTC](https://forum.ansible.com/t/lineinfile-insert-and-idempotency/16848/1 "2014-11-21T17:10:26Z")
I have several lineinfile statements to insert iptables rules into /etc/sysconfig/iptables I’m using positional like insertbefore to get them in the order I want, and it works just fine on the first run. But subsequent runs are not idempotent… if I insert B before Y, and then C before Y, and then D before Y; then run the playbook over, it seems to see that the line before Y is D, and adds B again, then C, then D. Is there a way to use positional but tell ansible that if it sees a line matching a regexp anywhere in the file to not execute? Or is there another module that might be more appropriate for this? I mean, I could use a shell directive to check the config file or output of iptables for a line matching a regexp, and if no match then insert my line, and then iptables-save, but that just isn’t as neat as using the lineinfile module 🙂 ---
**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\ **Post date:** [November 21, 2014, 5:14pm UTC](https://forum.ansible.com/t/lineinfile-insert-and-idempotency/16848/2 "2014-11-21T17:14:15Z")
I would recommend switching to the the template module and managing the whole file with it. ---
**Author:** ![John\_Oliver](https://avatars.discourse-cdn.com/v4/letter/j/97f17d/32.png) [@John\_Oliver](https://forum.ansible.com/u/John_Oliver)\ **Post date:** [November 21, 2014, 5:46pm UTC](https://forum.ansible.com/t/lineinfile-insert-and-idempotency/16848/3 "2014-11-21T17:46:59Z")
Problem with that is uncertainty over what the file might initially contain. And because different roles might be assigned to different hosts, therefore the files might be similar, but not the same, on all… rules inserted in the ‘common’ role would be there for all, but only the http server would allow 80 and 443, the postgres module would allow access to 5432, etc. ---
**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\ **Post date:** [November 21, 2014, 6:04pm UTC](https://forum.ansible.com/t/lineinfile-insert-and-idempotency/16848/4 "2014-11-21T18:04:18Z")
you can manage all that with the template module ---
**Author:** ![John\_Oliver](https://avatars.discourse-cdn.com/v4/letter/j/97f17d/32.png) [@John\_Oliver](https://forum.ansible.com/u/John_Oliver)\ **Post date:** [November 24, 2014, 10:55pm UTC](https://forum.ansible.com/t/lineinfile-insert-and-idempotency/16848/5 "2014-11-24T22:55:18Z")
Erm, how? It seems to me that template is the exact opposite of what I want to do. A template is for when the vast majority of a file is known beforehand and you want to insert variables into boilerplate. ---
**Author:** ![Tomasz\_Kontusz](https://avatars.discourse-cdn.com/v4/letter/t/bc79bd/32.png) [@Tomasz\_Kontusz](https://forum.ansible.com/u/Tomasz_Kontusz)\ **Post date:** [November 25, 2014, 7:02am UTC](https://forum.ansible.com/t/lineinfile-insert-and-idempotency/16848/6 "2014-11-25T07:02:25Z")
If all parts of the file come from Ansible, you can make roles store facts on the target, and then use template to render those facts. If you can’t do that, maybe that config supports some kind of conf.d include? Then you’d only manage the include line with lineinfile. John Oliver [jnojr1@gmail.com](mailto:jnojr1@gmail.com) napisał: