Skip to content
>_devvkit
$devvkit learn --librarie ansible-guide

Ansible Guide

[automation][devops][configuration-management][iac]
Automation & CI/CD
Install
sudo apt install ansible
brew install ansible
pip install ansible
# or: pipx install ansible
# Windows: WSL or pip in WSL

Ansible uses SSH (no agents!) and YAML playbooks to automate servers. A playbook is a list of plays, each targeting a host group with tasks. Modules (package, copy, service, template, command, file) handle the actual work idempotently.

Inventory files define your hosts and groups. The `ansible` command runs ad-hoc tasks: `ansible all -m ping`, `ansible webservers -a "uptime"`. For repeatable automation, use playbooks: `ansible-playbook deploy.yml -i inventory.ini`.

Ansible Galaxy is the community hub for roles. Use `ansible-galaxy install geerlingguy.nginx` to get battle-tested roles. Ansible Vault encrypts secrets. AWX / Ansible Tower provides a GUI dashboard for enterprise. Alternatives: Puppet, Chef, SaltStack.

Ad-Hoc

Ad-hoc ping— Test connectivity.
ansible all -i inventory.ini -m ping
ansible webservers -m ping                   # Group from inventory
ansible all -m command -a "uptime"           # Run any command
ansible all -m shell -a "free -h && df -h"   # Chained commands
Ad-hoc package— Install/remove packages.
ansible all -m apt -a "name=nginx state=latest" --become
ansible all -m apt -a "name=nginx state=absent" --become
ansible all -m service -a "name=nginx state=started enabled=yes" --become

Playbooks

Basic playbook— Install and configure nginx.
---
- name: Setup web server
  hosts: webservers
  become: yes
  vars:
    nginx_port: 8080

  tasks:
    - name: Install nginx
      apt:
        name: nginx
        state: latest

    - name: Copy config
      template:
        src: nginx.conf.j2
        dest: /etc/nginx/nginx.conf
      notify: restart nginx

    - name: Start service
      service:
        name: nginx
        state: started
        enabled: yes

  handlers:
    - name: restart nginx
      service:
        name: nginx
        state: restarted
Handlers— Notify on config change.
# Handlers run once at the end if notified
handlers:
  - name: restart nginx
    service: name=nginx state=restarted

  - name: reload haproxy
    service: name=haproxy state=reloaded

# In tasks:
- name: Update nginx config
  template: src=nginx.conf.j2 dest=/etc/nginx/nginx.conf
  notify: restart nginx
Dry-run and check— Test before applying.
ansible-playbook deploy.yml --check        # Dry run
ansible-playbook deploy.yml --diff          # Show file changes
ansible-playbook deploy.yml --check --diff  # Both
ansible-playbook deploy.yml --step          # Confirm each task
ansible-playbook deploy.yml --syntax-check  # validate syntax

Inventory

Inventory file— Host groups.
# inventory.ini
[webservers]
web1.example.com ansible_user=admin
web2.example.com

[databases]
db1.example.com ansible_user=admin

[all:vars]
ansible_python_interpreter=/usr/bin/python3

# Dynamic inventory: from cloud API
# ansible-inventory --list -i aws_ec2.yml

Roles

Ansible Galaxy role— Reusable role.
# Install a role:
ansible-galaxy install geerlingguy.nginx

# Use in playbook:
- name: Apply nginx role
  hosts: webservers
  roles:
    - role: geerlingguy.nginx
      vars:
        nginx_worker_processes: 4

# Create your own:
ansible-galaxy role init myrole
# roles/myrole/tasks/main.yml
# roles/myrole/templates/...
Roles directory structure— Standard layout.
# myrole/
# ├── defaults/main.yml      # Default variables
# ├── vars/main.yml          # Override variables
# ├── tasks/main.yml         # Tasks (required)
# ├── handlers/main.yml      # Handlers
# ├── templates/             # Jinja2 templates
# ├── files/                 # Static files
# ├── meta/main.yml          # Dependencies
# └── README.md

Vault

Ansible Vault— Encrypt secrets.
ansible-vault encrypt secrets.yml      # Encrypt file
ansible-vault decrypt secrets.yml      # Decrypt
ansible-vault edit secrets.yml         # Edit encrypted file
ansible-vault create secrets.yml       # Create encrypted
ansible-vault view secrets.yml         # View without editing

# Run playbook with vault:
ansible-playbook deploy.yml --ask-vault-pass
ansible-playbook deploy.yml --vault-password-file ~/.vault_pass