CloudEngine CE OS supports multiple connections. This page offers details on how each connection works in Ansible and how to use it.
CloudEngine CE OS is part of the `community.network <https://galaxy.ansible.com/community/network>`_ collection and supports multiple connections. This page offers details on how each connection works in Ansible and how to use it.
For legacy playbooks, Ansible still supports ``ansible_connection=local`` on all CloudEngine modules. We recommend modernizing to use ``ansible_connection=netconf`` or ``ansible_connection=network_cli`` as soon as possible.
The ``ansible_connection: local`` has been deprecated. Please use ``ansible_connection: ansible.netcommon.netconf`` or ``ansible_connection=ansible.netcommon.network_cli`` instead.
Using CLI in Ansible
Using CLI in Ansible
====================
====================
@ -47,8 +49,8 @@ Example CLI inventory ``[ce:vars]``
@ -58,15 +60,15 @@ Example CLI inventory ``[ce:vars]``
- If you are accessing your host directly (not through a bastion/jump host) you can remove the ``ansible_ssh_common_args`` configuration.
- If you are accessing your host directly (not through a bastion/jump host) you can remove the ``ansible_ssh_common_args`` configuration.
- If you are accessing your host through a bastion/jump host, you cannot include your SSH password in the ``ProxyCommand`` directive. To prevent secrets from leaking out (for example in ``ps`` output), SSH does not support providing passwords via environment variables.
- If you are accessing your host through a bastion/jump host, you cannot include your SSH password in the ``ProxyCommand`` directive. To prevent secrets from leaking out (for example in ``ps`` output), SSH does not support providing passwords via environment variables.
@ -80,16 +82,16 @@ Before you can use NETCONF to connect to a switch, you must:
- install the ``ncclient`` python package on your control node(s) with ``pip install ncclient``
- install the ``ncclient`` python package on your control node(s) with ``pip install ncclient``
- enable NETCONF on the CloudEngine OS device(s)
- enable NETCONF on the CloudEngine OS device(s)
To enable NETCONF on a new switch via Ansible, use the ``ce_config`` module via the CLI connection. Set up your platform-level variables just like in the CLI example above, then run a playbook task like this:
To enable NETCONF on a new switch using Ansible, use the ``community.network.ce_config`` module with the CLI connection. Set up your platform-level variables just like in the CLI example above, then run a playbook task like this:
CNOS supports Enable Mode (Privilege Escalation). This page offers details on how to use Enable Mode on CNOS in Ansible.
CNOS is part of the `community.network <https://galaxy.ansible.com/community/network>`_ collection and supports Enable Mode (Privilege Escalation). This page offers details on how to use Enable Mode on CNOS in Ansible.
For legacy playbooks, CNOS still supports ``ansible_connection: local``. We recommend modernizing to use ``ansible_connection: network_cli`` as soon as possible.
The ``ansible_connection: local`` has been deprecated. Please use ``ansible_connection: ansible.netcommon.network_cli`` instead.
@ -46,8 +47,8 @@ Example CLI ``group_vars/cnos.yml``
..code-block:: yaml
..code-block:: yaml
ansible_connection: network_cli
ansible_connection: ansible.netcommon.network_cli
ansible_network_os: cnos
ansible_network_os: community.network.cnos
ansible_user: myuser
ansible_user: myuser
ansible_password: !vault...
ansible_password: !vault...
ansible_become: yes
ansible_become: yes
@ -60,15 +61,15 @@ Example CLI ``group_vars/cnos.yml``
- If you are accessing your host directly (not through a bastion/jump host) you can remove the ``ansible_ssh_common_args`` configuration.
- If you are accessing your host directly (not through a bastion/jump host) you can remove the ``ansible_ssh_common_args`` configuration.
- If you are accessing your host through a bastion/jump host, you cannot include your SSH password in the ``ProxyCommand`` directive. To prevent secrets from leaking out (for example in ``ps`` output), SSH does not support providing passwords via environment variables.
- If you are accessing your host through a bastion/jump host, you cannot include your SSH password in the ``ProxyCommand`` directive. To prevent secrets from leaking out (for example in ``ps`` output), SSH does not support providing passwords via environment variables.
OS10 supports Enable Mode (Privilege Escalation). This page offers details on how to use Enable Mode on OS10 in Ansible.
The `dellemc.os10 <https://galaxy.ansible.com/dellemc_networking/os10>`_ collection supports Enable Mode (Privilege Escalation). This page offers details on how to use Enable Mode on OS10 in Ansible.
For legacy playbooks, OS10 still supports ``ansible_connection: local``. We recommend modernizing to use ``ansible_connection: network_cli`` as soon as possible.
The ``ansible_connection: local`` has been deprecated. Please use ``ansible_connection: ansible.netcommon.network_cli`` instead.
@ -46,8 +48,8 @@ Example CLI ``group_vars/dellos10.yml``
..code-block:: yaml
..code-block:: yaml
ansible_connection: network_cli
ansible_connection: ansible.netcommon.network_cli
ansible_network_os: dellos10
ansible_network_os: dellemc.os10.os10
ansible_user: myuser
ansible_user: myuser
ansible_password: !vault...
ansible_password: !vault...
ansible_become: yes
ansible_become: yes
@ -60,16 +62,16 @@ Example CLI ``group_vars/dellos10.yml``
- If you are accessing your host directly (not through a bastion/jump host) you can remove the ``ansible_ssh_common_args`` configuration.
- If you are accessing your host directly (not through a bastion/jump host) you can remove the ``ansible_ssh_common_args`` configuration.
- If you are accessing your host through a bastion/jump host, you cannot include your SSH password in the ``ProxyCommand`` directive. To prevent secrets from leaking out (for example in ``ps`` output), SSH does not support providing passwords via environment variables.
- If you are accessing your host through a bastion/jump host, you cannot include your SSH password in the ``ProxyCommand`` directive. To prevent secrets from leaking out (for example in ``ps`` output), SSH does not support providing passwords via environment variables.
OS6 supports Enable Mode (Privilege Escalation). This page offers details on how to use Enable Mode on OS6 in Ansible.
The `dellemc.os6 <https://github.com/ansible-collections/dellemc.os6>`_ collection supports Enable Mode (Privilege Escalation). This page offers details on how to use Enable Mode on OS6 in Ansible.
For legacy playbooks, OS6 still supports ``ansible_connection: local``. We recommend modernizing to use ``ansible_connection: network_cli`` as soon as possible.
The ``ansible_connection: local`` has been deprecated. Please use ``ansible_connection: ansible.netcommon.network_cli`` instead.
@ -46,8 +47,8 @@ Example CLI ``group_vars/dellos6.yml``
..code-block:: yaml
..code-block:: yaml
ansible_connection: network_cli
ansible_connection: ansible.netcommon.network_cli
ansible_network_os: dellos6
ansible_network_os: dellemc.os6.os6
ansible_user: myuser
ansible_user: myuser
ansible_password: !vault...
ansible_password: !vault...
ansible_become: yes
ansible_become: yes
@ -60,16 +61,16 @@ Example CLI ``group_vars/dellos6.yml``
- If you are accessing your host directly (not through a bastion/jump host) you can remove the ``ansible_ssh_common_args`` configuration.
- If you are accessing your host directly (not through a bastion/jump host) you can remove the ``ansible_ssh_common_args`` configuration.
- If you are accessing your host through a bastion/jump host, you cannot include your SSH password in the ``ProxyCommand`` directive. To prevent secrets from leaking out (for example in ``ps`` output), SSH does not support providing passwords via environment variables.
- If you are accessing your host through a bastion/jump host, you cannot include your SSH password in the ``ProxyCommand`` directive. To prevent secrets from leaking out (for example in ``ps`` output), SSH does not support providing passwords via environment variables.
OS9 supports Enable Mode (Privilege Escalation). This page offers details on how to use Enable Mode on OS9 in Ansible.
The `dellemc.os9 <https://github.com/ansible-collections/dellemc.os9>`_ collection supports Enable Mode (Privilege Escalation). This page offers details on how to use Enable Mode on OS9 in Ansible.
For legacy playbooks, OS9 still supports ``ansible_connection: local``. We recommend modernizing to use ``ansible_connection: network_cli`` as soon as possible.
The ``ansible_connection: local`` has been deprecated. Please use ``ansible_connection: ansible.netcommon.network_cli`` instead.
@ -46,8 +47,8 @@ Example CLI ``group_vars/dellos9.yml``
..code-block:: yaml
..code-block:: yaml
ansible_connection: network_cli
ansible_connection: ansible.netcommon.network_cli
ansible_network_os: dellos9
ansible_network_os: dellemc.os9.os9
ansible_user: myuser
ansible_user: myuser
ansible_password: !vault...
ansible_password: !vault...
ansible_become: yes
ansible_become: yes
@ -60,16 +61,16 @@ Example CLI ``group_vars/dellos9.yml``
- If you are accessing your host directly (not through a bastion/jump host) you can remove the ``ansible_ssh_common_args`` configuration.
- If you are accessing your host directly (not through a bastion/jump host) you can remove the ``ansible_ssh_common_args`` configuration.
- If you are accessing your host through a bastion/jump host, you cannot include your SSH password in the ``ProxyCommand`` directive. To prevent secrets from leaking out (for example in ``ps`` output), SSH does not support providing passwords via environment variables.
- If you are accessing your host through a bastion/jump host, you cannot include your SSH password in the ``ProxyCommand`` directive. To prevent secrets from leaking out (for example in ``ps`` output), SSH does not support providing passwords via environment variables.
ENOS supports Enable Mode (Privilege Escalation). This page offers details on how to use Enable Mode on ENOS in Ansible.
ENOS is part of the `community.network <https://galaxy.ansible.com/community/network>`_ collection and supports Enable Mode (Privilege Escalation). This page offers details on how to use Enable Mode on ENOS in Ansible.
For legacy playbooks, ENOS still supports ``ansible_connection: local``. We recommend modernizing to use ``ansible_connection: network_cli`` as soon as possible.
The ``ansible_connection: local`` has been deprecated. Please use ``ansible_connection: ansible.netcommon.network_cli`` instead.
@ -48,8 +49,8 @@ Example CLI ``group_vars/enos.yml``
..code-block:: yaml
..code-block:: yaml
ansible_connection: network_cli
ansible_connection: ansible.netcommon.network_cli
ansible_network_os: enos
ansible_network_os: community.network.enos
ansible_user: myuser
ansible_user: myuser
ansible_password: !vault...
ansible_password: !vault...
ansible_become: yes
ansible_become: yes
@ -62,15 +63,15 @@ Example CLI ``group_vars/enos.yml``
- If you are accessing your host directly (not through a bastion/jump host) you can remove the ``ansible_ssh_common_args`` configuration.
- If you are accessing your host directly (not through a bastion/jump host) you can remove the ``ansible_ssh_common_args`` configuration.
- If you are accessing your host through a bastion/jump host, you cannot include your SSH password in the ``ProxyCommand`` directive. To prevent secrets from leaking out (for example in ``ps`` output), SSH does not support providing passwords via environment variables.
- If you are accessing your host through a bastion/jump host, you cannot include your SSH password in the ``ProxyCommand`` directive. To prevent secrets from leaking out (for example in ``ps`` output), SSH does not support providing passwords via environment variables.
Extreme ERIC_ECCLI Ansible modules only supports CLI connections today. This page offers details on how to use ``network_cli`` on ERIC_ECCLI in Ansible.
Extreme ERIC_ECCLI is part of the `community.network <https://galaxy.ansible.com/community/network>`_ collection and only supports CLI connections today. This page offers details on how to use ``ansible.netcommon.network_cli`` on ERIC_ECCLI in Ansible.
@ -55,15 +56,15 @@ Example CLI ``group_vars/eric_eccli.yml``
- If you are accessing your host directly (not through a bastion/jump host) you can remove the ``ansible_ssh_common_args`` configuration.
- If you are accessing your host directly (not through a bastion/jump host) you can remove the ``ansible_ssh_common_args`` configuration.
- If you are accessing your host through a bastion/jump host, you cannot include your SSH password in the ``ProxyCommand`` directive. To prevent secrets from leaking out (for example in ``ps`` output), SSH does not support providing passwords via environment variables.
- If you are accessing your host through a bastion/jump host, you cannot include your SSH password in the ``ProxyCommand`` directive. To prevent secrets from leaking out (for example in ``ps`` output), SSH does not support providing passwords via environment variables.
Example CLI Task
Example CLI task
----------------
----------------
..code-block:: yaml
..code-block:: yaml
- name: run show version on remote devices (eric_eccli)
- name: run show version on remote devices (eric_eccli)
Extreme EXOS Ansible modules support multiple connections. This page offers details on how each connection works in Ansible and how to use it.
Extreme EXOS is part of the `community.network <https://galaxy.ansible.com/community/network>`_ collection and supports multiple connections. This page offers details on how each connection works in Ansible and how to use it.
EXOS does not support ``ansible_connection: local``. You must use ``ansible_connection: network_cli`` or ``ansible_connection: httpapi``
EXOS does not support ``ansible_connection: local``. You must use ``ansible_connection: ansible.netcommon.network_cli`` or ``ansible_connection: ansible.netcommon.httpapi``.
Using CLI in Ansible
Using CLI in Ansible
====================
====================
@ -45,8 +47,8 @@ Example CLI ``group_vars/exos.yml``
@ -56,15 +58,15 @@ Example CLI ``group_vars/exos.yml``
- If you are accessing your host directly (not through a bastion/jump host) you can remove the ``ansible_ssh_common_args`` configuration.
- If you are accessing your host directly (not through a bastion/jump host) you can remove the ``ansible_ssh_common_args`` configuration.
- If you are accessing your host through a bastion/jump host, you cannot include your SSH password in the ``ProxyCommand`` directive. To prevent secrets from leaking out (for example in ``ps`` output), SSH does not support providing passwords via environment variables.
- If you are accessing your host through a bastion/jump host, you cannot include your SSH password in the ``ProxyCommand`` directive. To prevent secrets from leaking out (for example in ``ps`` output), SSH does not support providing passwords via environment variables.
ICX supports Enable Mode (Privilege Escalation). This page offers details on how to use Enable Mode on ICX in Ansible.
ICX is part of the `community.network <https://galaxy.ansible.com/community/network>`_ collection supports Enable Mode (Privilege Escalation). This page offers details on how to use Enable Mode on ICX in Ansible.
|enable_mode| supported: use ``ansible_become: yes`` with
|enable_mode| supported: use ``ansible_become: yes`` with
``ansible_become_method: enable`` and ``ansible_become_password:``
``ansible_become_method: enable`` and ``ansible_become_password:``
@ -44,8 +45,8 @@ Example CLI ``group_vars/icx.yml``
..code-block:: yaml
..code-block:: yaml
ansible_connection: network_cli
ansible_connection: ansible.netcommon.network_cli
ansible_network_os: icx
ansible_network_os: community.network.icx
ansible_user: myuser
ansible_user: myuser
ansible_password: !vault...
ansible_password: !vault...
ansible_become: yes
ansible_become: yes
@ -58,16 +59,16 @@ Example CLI ``group_vars/icx.yml``
- If you are accessing your host directly (not through a bastion/jump host) you can remove the ``ansible_ssh_common_args`` configuration.
- If you are accessing your host directly (not through a bastion/jump host) you can remove the ``ansible_ssh_common_args`` configuration.
- If you are accessing your host through a bastion/jump host, you cannot include your SSH password in the ``ProxyCommand`` directive. To prevent secrets from leaking out (for example in ``ps`` output), SSH does not support providing passwords via environment variables.
- If you are accessing your host through a bastion/jump host, you cannot include your SSH password in the ``ProxyCommand`` directive. To prevent secrets from leaking out (for example in ``ps`` output), SSH does not support providing passwords via environment variables.
IronWare supports Enable Mode (Privilege Escalation). This page offers details on how to use Enable Mode on IronWare in Ansible.
IronWare is part of the `community.network <https://galaxy.ansible.com/community/network>`_ collection and supports Enable Mode (Privilege Escalation). This page offers details on how to use Enable Mode on IronWare in Ansible.
For legacy playbooks, IronWare still supports ``ansible_connection: local``. We recommend modernizing to use ``ansible_connection: network_cli`` as soon as possible.
The ``ansible_connection: local`` has been deprecated. Please use ``ansible_connection: ansible.netcommon.network_cli`` instead.
Using CLI in Ansible
Using CLI in Ansible
====================
====================
@ -47,8 +48,8 @@ Example CLI ``group_vars/mlx.yml``
..code-block:: yaml
..code-block:: yaml
ansible_connection: network_cli
ansible_connection: ansible.netcommon.network_cli
ansible_network_os: ironware
ansible_network_os: community.network.ironware
ansible_user: myuser
ansible_user: myuser
ansible_password: !vault...
ansible_password: !vault...
ansible_become: yes
ansible_become: yes
@ -61,16 +62,16 @@ Example CLI ``group_vars/mlx.yml``
- If you are accessing your host directly (not through a bastion/jump host) you can remove the ``ansible_ssh_common_args`` configuration.
- If you are accessing your host directly (not through a bastion/jump host) you can remove the ``ansible_ssh_common_args`` configuration.
- If you are accessing your host through a bastion/jump host, you cannot include your SSH password in the ``ProxyCommand`` directive. To prevent secrets from leaking out (for example in ``ps`` output), SSH does not support providing passwords via environment variables.
- If you are accessing your host through a bastion/jump host, you cannot include your SSH password in the ``ProxyCommand`` directive. To prevent secrets from leaking out (for example in ``ps`` output), SSH does not support providing passwords via environment variables.
Pluribus NETVISOR Ansible modules only support CLI connections today. ``httpapi`` modules may be added in future.
Pluribus NETVISOR Ansible is part of the `community.network <https://galaxy.ansible.com/community/network>`_ collection and only supports CLI connections today. ``httpapi`` modules may be added in future.
This page offers details on how to use ``network_cli`` on NETVISOR in Ansible.
This page offers details on how to use ``ansible.netcommon.network_cli`` on NETVISOR in Ansible.
@ -56,18 +57,18 @@ Example CLI ``group_vars/netvisor.yml``
- If you are accessing your host directly (not through a bastion/jump host) you can remove the ``ansible_ssh_common_args`` configuration.
- If you are accessing your host directly (not through a bastion/jump host) you can remove the ``ansible_ssh_common_args`` configuration.
- If you are accessing your host through a bastion/jump host, you cannot include your SSH password in the ``ProxyCommand`` directive. To prevent secrets from leaking out (for example in ``ps`` output), SSH does not support providing passwords via environment variables.
- If you are accessing your host through a bastion/jump host, you cannot include your SSH password in the ``ProxyCommand`` directive. To prevent secrets from leaking out (for example in ``ps`` output), SSH does not support providing passwords via environment variables.
Extreme NOS Ansible modules only support CLI connections today. ``httpapi`` modules may be added in future.
Extreme NOS is part of the `community.network <https://galaxy.ansible.com/community/network>`_ collection and only supports CLI connections today. ``httpapi`` modules may be added in future.
This page offers details on how to use ``network_cli`` on NOS in Ansible.
This page offers details on how to use ``ansible.netcommon.network_cli`` on NOS in Ansible.
@ -56,16 +57,16 @@ Example CLI ``group_vars/nos.yml``
- If you are accessing your host directly (not through a bastion/jump host) you can remove the ``ansible_ssh_common_args`` configuration.
- If you are accessing your host directly (not through a bastion/jump host) you can remove the ``ansible_ssh_common_args`` configuration.
- If you are accessing your host through a bastion/jump host, you cannot include your SSH password in the ``ProxyCommand`` directive. To prevent secrets from leaking out (for example in ``ps`` output), SSH does not support providing passwords via environment variables.
- If you are accessing your host through a bastion/jump host, you cannot include your SSH password in the ``ProxyCommand`` directive. To prevent secrets from leaking out (for example in ``ps`` output), SSH does not support providing passwords via environment variables.
RouterOS is part of the `community.network <https://galaxy.ansible.com/community/network>`_ collection and only supports CLI connections today. ``httpapi`` modules may be added in future.
This page offers details on how to use ``ansible.netcommon.network_cli`` on RouterOS in Ansible.
RouterOS does not support ``ansible_connection: local``. You must use ``ansible_connection: network_cli``.
RouterOS does not support ``ansible_connection: local``. You must use ``ansible_connection: ansible.netcommon.network_cli``.
Using CLI in Ansible
Using CLI in Ansible
====================
====================
@ -43,8 +47,8 @@ Example CLI ``group_vars/routeros.yml``
..code-block:: yaml
..code-block:: yaml
ansible_connection: network_cli
ansible_connection: ansible.netcommon.network_cli
ansible_network_os: routeros
ansible_network_os: community.network.routeros
ansible_user: myuser
ansible_user: myuser
ansible_password: !vault...
ansible_password: !vault...
ansible_become: yes
ansible_become: yes
@ -58,16 +62,16 @@ Example CLI ``group_vars/routeros.yml``
- If you are accessing your host through a bastion/jump host, you cannot include your SSH password in the ``ProxyCommand`` directive. To prevent secrets from leaking out (for example in ``ps`` output), SSH does not support providing passwords via environment variables.
- If you are accessing your host through a bastion/jump host, you cannot include your SSH password in the ``ProxyCommand`` directive. To prevent secrets from leaking out (for example in ``ps`` output), SSH does not support providing passwords via environment variables.
- If you are getting timeout errors you may want to add ``+cet1024w`` suffix to your username which will disable console colors, enable "dumb" mode, tell RouterOS not to try detecting terminal capabilities and set terminal width to 1024 columns. See article `Console login process <https://wiki.mikrotik.com/wiki/Manual:Console_login_process>`_ in MikroTik wiki for more information.
- If you are getting timeout errors you may want to add ``+cet1024w`` suffix to your username which will disable console colors, enable "dumb" mode, tell RouterOS not to try detecting terminal capabilities and set terminal width to 1024 columns. See article `Console login process <https://wiki.mikrotik.com/wiki/Manual:Console_login_process>`_ in MikroTik wiki for more information.
Extreme SLX-OS Ansible modules only support CLI connections today. ``httpapi`` modules may be added in future.
Extreme SLX-OS is part of the `community.network <https://galaxy.ansible.com/community/network>`_ collection and only supports CLI connections today. ``httpapi`` modules may be added in future.
This page offers details on how to use ``network_cli`` on SLX-OS in Ansible.
This page offers details on how to use ``ansible.netcommon.network_cli`` on SLX-OS in Ansible.
@ -57,16 +58,16 @@ Example CLI ``group_vars/slxos.yml``
- If you are accessing your host directly (not through a bastion/jump host) you can remove the ``ansible_ssh_common_args`` configuration.
- If you are accessing your host directly (not through a bastion/jump host) you can remove the ``ansible_ssh_common_args`` configuration.
- If you are accessing your host through a bastion/jump host, you cannot include your SSH password in the ``ProxyCommand`` directive. To prevent secrets from leaking out (for example in ``ps`` output), SSH does not support providing passwords via environment variables.
- If you are accessing your host through a bastion/jump host, you cannot include your SSH password in the ``ProxyCommand`` directive. To prevent secrets from leaking out (for example in ``ps`` output), SSH does not support providing passwords via environment variables.
Extreme VOSS Ansible modules only support CLI connections today. This page offers details on how to
Extreme VOSS is part of the `community.network <https://galaxy.ansible.com/community/network>`_ collection and only supports CLI connections today. This page offers details on how to
use ``network_cli`` on VOSS in Ansible.
use ``ansible.netcommon.network_cli`` on VOSS in Ansible.
VOSS does not support ``ansible_connection: local``. You must use ``ansible_connection: network_cli``.
VOSS does not support ``ansible_connection: local``. You must use ``ansible_connection: ansible.netcommon.network_cli``.
Using CLI in Ansible
Using CLI in Ansible
====================
====================
@ -47,8 +48,8 @@ Example CLI ``group_vars/voss.yml``
..code-block:: yaml
..code-block:: yaml
ansible_connection: network_cli
ansible_connection: ansible.netcommon.network_cli
ansible_network_os: voss
ansible_network_os: community.network.voss
ansible_user: myuser
ansible_user: myuser
ansible_become: yes
ansible_become: yes
ansible_become_method: enable
ansible_become_method: enable
@ -60,15 +61,15 @@ Example CLI ``group_vars/voss.yml``
- If you are accessing your host directly (not through a bastion/jump host) you can remove the ``ansible_ssh_common_args`` configuration.
- If you are accessing your host directly (not through a bastion/jump host) you can remove the ``ansible_ssh_common_args`` configuration.
- If you are accessing your host through a bastion/jump host, you cannot include your SSH password in the ``ProxyCommand`` directive. To prevent secrets from leaking out (for example in ``ps`` output), SSH does not support providing passwords via environment variables.
- If you are accessing your host through a bastion/jump host, you cannot include your SSH password in the ``ProxyCommand`` directive. To prevent secrets from leaking out (for example in ``ps`` output), SSH does not support providing passwords via environment variables.