Configuration management for standardised system delivery

Consumers order a system from the service catalogue and expect it fully configured, policy-compliant and identical in every environment. In a public-sector estate of that size that means many system classes, binding security and operations requirements, and an unbroken record of which state was rolled out when. Manual work does not scale there, and it does not hold up in an audit.

We moved the configuration into versioned building blocks: Ansible roles and Puppet modules per system class, written idempotently, reviewable in Git and rolled out through pipelines. That turns a delivery into a repeatable standard change rather than a one-off build. The target state is described as code, any drift from it surfaces, and which state runs where is evidenced rather than reconstructed.

A system class can be delivered reproducibly rather than set up one at a time, and the consumer gets a defined service instead of a hand-built one-off. For us it is the reference that shows our infrastructure work holds up under public-sector requirements.