Ansible

Ansible is an agentless automation tool for configuration management, application deployment, and orchestration. It uses SSH to connect to managed nodes and executes tasks defined in YAML playbooks.

Installation

bash
# Install Ansible via pip
pip install ansible

# Verify installation
ansible --version

Inventory Management

ini
# inventory/production.ini — Production inventory with groups
[webservers]
web1.example.com ansible_host=10.0.1.10
web2.example.com ansible_host=10.0.1.11

[databases]
db1.example.com ansible_host=10.0.2.10

[all:vars]
ansible_user=deploy
ansible_ssh_private_key_file=~/.ssh/deploy_key
ansible_python_interpreter=/usr/bin/python3

yaml
# inventory/dynamic_aws.yml — Dynamic AWS EC2 inventory plugin
plugin: amazon.aws.aws_ec2
regions:
  - us-east-1
  - us-west-2
keyed_groups:
  - key: tags.Environment
    prefix: env
  - key: instance_type
    prefix: type
filters:
  tag:Managed: ansible
compose:
  ansible_host: private_ip_address

Playbooks

yaml
# playbooks/webserver.yml — Configure Nginx web servers
---
- name: Configure web servers
  hosts: webservers
  become: true
  vars:
    nginx_port: 80
    app_root: /var/www/app

  pre_tasks:
    - name: Update apt cache
      apt:
        update_cache: true
        cache_valid_time: 3600

  tasks:
    - name: Install Nginx
      apt:
        name: nginx
        state: present

    - name: Deploy Nginx configuration
      template:
        src: templates/nginx.conf.j2
        dest: /etc/nginx/sites-available/default
        owner: root
        group: root
        mode: "0644"
      notify: Restart Nginx

    - name: Ensure app directory exists
      file:
        path: "{{ app_root }}"
        state: directory
        owner: www-data
        group: www-data
        mode: "0755"

    - name: Deploy application files
      synchronize:
        src: files/app/
        dest: "{{ app_root }}/"
      notify: Restart Nginx

    - name: Ensure Nginx is running
      service:
        name: nginx
        state: started
        enabled: true

  handlers:
    - name: Restart Nginx
      service:
        name: nginx
        state: restarted

yaml
# playbooks/deploy-app.yml — Rolling deployment with serial execution
---
- name: Deploy application
  hosts: webservers
  become: true
  serial: 2
  max_fail_percentage: 25

  pre_tasks:
    - name: Remove from load balancer
      uri:
        url: "http://lb.example.com/api/deregister/{{ inventory_hostname }}"
        method: POST

  roles:
    - role: app-deploy
      vars:
        app_version: "{{ deploy_version | default('latest') }}"

  post_tasks:
    - name: Health check
      uri:
        url: "http://{{ inventory_hostname }}:{{ app_port }}/health"
        status_code: 200
      retries: 5
      delay: 10

    - name: Re-register with load balancer
      uri:
        url: "http://lb.example.com/api/register/{{ inventory_hostname }}"
        method: POST

Roles

yaml
# roles/common/tasks/main.yml — Common server baseline role
---
- name: Set timezone
  timezone:
    name: "{{ server_timezone | default('UTC') }}"

- name: Install common packages
  apt:
    name:
      - curl
      - wget
      - vim
      - htop
      - unzip
      - jq
      - fail2ban
    state: present

- name: Configure SSH hardening
  template:
    src: sshd_config.j2
    dest: /etc/ssh/sshd_config
    validate: sshd -t -f %s
  notify: Restart SSH

- name: Configure firewall rules
  ufw:
    rule: allow
    port: "{{ item }}"
    proto: tcp
  loop: "{{ allowed_ports | default(['22']) }}"

- name: Enable UFW
  ufw:
    state: enabled
    policy: deny

yaml
# roles/common/defaults/main.yml — Default variables for common role
---
server_timezone: UTC
allowed_ports:
  - "22"
  - "80"
  - "443"
ntp_servers:
  - 0.pool.ntp.org
  - 1.pool.ntp.org

Ansible Vault

bash
# Create encrypted variables file
ansible-vault create group_vars/production/vault.yml

# Encrypt existing file
ansible-vault encrypt secrets.yml

# Edit encrypted file
ansible-vault edit group_vars/production/vault.yml

# Run playbook with vault password
ansible-playbook site.yml --ask-vault-pass

# Use password file (for CI/CD)
ansible-playbook site.yml --vault-password-file ~/.vault_pass

yaml
# group_vars/production/vault.yml — Encrypted production secrets
---
vault_db_password: supersecretpassword
vault_api_key: abc123def456
vault_ssl_cert: |
  -----BEGIN CERTIFICATE-----
  ...
  -----END CERTIFICATE-----

yaml
# group_vars/production/vars.yml — Reference vault variables with prefix
---
db_password: "{{ vault_db_password }}"
api_key: "{{ vault_api_key }}"

Configuration

ini
# ansible.cfg — Project-level Ansible configuration
[defaults]
inventory = inventory/
roles_path = roles/
retry_files_enabled = false
host_key_checking = false
stdout_callback = yaml
forks = 20
timeout = 30

[privilege_escalation]
become = true
become_method = sudo
become_ask_pass = false

[ssh_connection]
pipelining = true
ssh_args = -o ControlMaster=auto -o ControlPersist=60s

Common Commands

bash
# Run playbook against specific inventory
ansible-playbook -i inventory/production.ini playbooks/webserver.yml

# Limit to specific hosts
ansible-playbook playbooks/deploy.yml --limit web1.example.com

# Dry run (check mode)
ansible-playbook playbooks/deploy.yml --check --diff

# Run ad-hoc commands
ansible webservers -m shell -a "uptime"
ansible all -m ping

# List hosts in a group
ansible-inventory --list --yaml

# Run with extra variables
ansible-playbook deploy.yml -e "deploy_version=2.1.0 env=production"

# Tags for selective execution
ansible-playbook site.yml --tags "configuration,packages"
ansible-playbook site.yml --skip-tags "slow_tasks"

Jinja2 Templates

nginx
# templates/nginx.conf.j2 — Nginx virtual host template
server {
    listen {{ nginx_port }};
    server_name {{ ansible_fqdn }};
    root {{ app_root }};

    {% if ssl_enabled | default(false) %}
    listen 443 ssl;
    ssl_certificate {{ ssl_cert_path }};
    ssl_certificate_key {{ ssl_key_path }};
    {% endif %}

    location / {
        proxy_pass http://127.0.0.1:{{ app_port }};
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }

    access_log /var/log/nginx/{{ inventory_hostname }}_access.log;
    error_log /var/log/nginx/{{ inventory_hostname }}_error.log;
}

Conditionals and Loops

yaml
# playbooks/conditional-tasks.yml — Tasks with conditionals and loops
---
- name: Conditional and loop examples
  hosts: all
  become: true
  tasks:
    - name: Install packages based on OS family
      apt:
        name: "{{ item }}"
        state: present
      loop: "{{ debian_packages }}"
      when: ansible_os_family == "Debian"

    - name: Create users from list
      user:
        name: "{{ item.name }}"
        groups: "{{ item.groups | join(',') }}"
        shell: "{{ item.shell | default('/bin/bash') }}"
        state: present
      loop: "{{ users }}"
      no_log: true

    - name: Wait for service readiness
      uri:
        url: "http://localhost:{{ app_port }}/health"
      register: health
      until: health.status == 200
      retries: 10
      delay: 5