We're (very boring I know) just putting it all in a git repository with a Makefile which deploys it, plus some basic orchestration to run 'make diff' across the cluster and see what's out of sync, and 'make install' across hosts to deploy it into pl ace.
It's clunky, but simple, repeatable, and easily (vsfo) understood.
As for the bigger things, software etc - we have scripts that generate Debian packages which we store in our own private repo. You just install `fastmail-server` and the dependency management updates everything. There's a daily cronjob which checks if there are updated security packages or thing we failed to correctly deploy and emails us as well.
It's amazing what you can build on top of the OS provided tools with not too much complexity if you don't overthink it.
It's clunky, but simple, repeatable, and easily (vsfo) understood.
As for the bigger things, software etc - we have scripts that generate Debian packages which we store in our own private repo. You just install `fastmail-server` and the dependency management updates everything. There's a daily cronjob which checks if there are updated security packages or thing we failed to correctly deploy and emails us as well.
It's amazing what you can build on top of the OS provided tools with not too much complexity if you don't overthink it.