Configure long-lived servers from code

How to do it

Use a tool such as Ansible, cloud-init, Salt or NixOS. Write every step so that a second run makes no changes. Run the code in check mode on a schedule, so a hand-made change shows up as drift. Give people no shell rights for lasting changes, and route every change through the code.

Example

# Ansible: the same steps every time, and a second run changes nothing
- hosts: shop
  become: true
  tasks:
    - name: Install the web server
      ansible.builtin.apt: { name: nginx, state: present }
    - name: Install the site settings
      ansible.builtin.template: { src: shop.conf.j2, dest: /etc/nginx/conf.d/shop.conf, mode: '0644' }
      notify: reload nginx
  handlers:
    - name: reload nginx
      ansible.builtin.service: { name: nginx, state: reloaded }

ansible-playbook site.yml --check --diff   # expect: changed=0

How to check

Run the code twice in a row. The second run reports 0 changed. The scheduled check run reports no differences.