Ansible

pip install ansible

sudo apt update
sudo apt install ansible

sudo yum install ansible

ansible --version

ansible all -m ping

ansible webservers -m ping

ansible all -m shell -a 'uptime'

ansible-playbook playbook.yml

ansible-playbook -i inventory.ini playbook.yml

ansible-playbook playbook.yml --tags "configuration,packages"

ansible-playbook playbook.yml --skip-tags "testing"

ansible-playbook playbook.yml --syntax-check

ansible-playbook playbook.yml --check

ansible-playbook playbook.yml -v
ansible-playbook playbook.yml -vv
ansible-playbook playbook.yml -vvv
ansible-playbook playbook.yml -vvvv

ansible-playbook playbook.yml --limit "host1,host2"

ansible-playbook playbook.yml --step

ansible-playbook playbook.yml --start-at-task="task name"

1. ANSIBLE_CONFIG environment variable
2. ansible.cfg in current directory
3. ~/.ansible.cfg in home directory
4. /etc/ansible/ansible.cfg

[defaults]
inventory = ./inventory
remote_user = ansible
host_key_checking = False
retry_files_enabled = False

[privilege_escalation]
become = True
become_method = sudo
become_user = root
become_ask_pass = False

export ANSIBLE_CONFIG=/path/to/ansible.cfg

ansible-config dump

ansible-config list

# inventory.ini
[webservers]
web1.example.com
web2.example.com

[databases]
db1.example.com
db2.example.com

[production:children]
webservers
databases

[webservers:vars]
http_port=80

# inventory.yml
all:
  children:
    webservers:
      hosts:
        web1.example.com:
        web2.example.com:
      vars:
        http_port: 80
    databases:
      hosts:
        db1.example.com:
        db2.example.com:

ansible all --list-hosts

ansible webservers --list-hosts

ansible-inventory --host hostname

ansible-inventory --graph

ansible-playbook -i ec2.py playbook.yml

---
- name: Configure web servers
  hosts: webservers
  become: yes
  vars:
    http_port: 80

  tasks:
    - name: Install Apache
      apt:
        name: apache2
        state: present

    - name: Start Apache service
      service:
        name: apache2
        state: started
        enabled: yes

---
- name: Configure web servers
  hosts: webservers
  tasks:
    - name: Task 1
      ...

- name: Configure database servers
  hosts: databases
  tasks:
    - name: Task 2
      ...

tasks:
  - name: Include common tasks
    include_tasks: common-tasks.yml

tasks:
  - name: Import common tasks
    import_tasks: common-tasks.yml

- name: Include variables
  include_vars: vars.yml

- name: Install package
  apt:
    name: nginx
    state: present
    update_cache: yes

- name: Remove package
  apt:
    name: nginx
    state: absent

- name: Install multiple packages
  apt:
    name:
      - nginx
      - git
      - vim
    state: present

- name: Install package
  yum:
    name: httpd
    state: present

- name: Install specific version
  yum:
    name: httpd-2.4.6
    state: present

- name: Install package (OS agnostic)
  package:
    name: htop
    state: present

- name: Start and enable service
  service:
    name: nginx
    state: started
    enabled: yes

- name: Restart service
  service:
    name: nginx
    state: restarted

- name: Stop service
  service:
    name: nginx
    state: stopped

- name: Copy file
  copy:
    src: /local/path/file.txt
    dest: /remote/path/file.txt
    owner: root
    group: root
    mode: '0644'

- name: Copy with inline content
  copy:
    content: "Hello World"
    dest: /tmp/hello.txt

- name: Create directory
  file:
    path: /opt/myapp
    state: directory
    mode: '0755'

- name: Create symlink
  file:
    src: /path/to/source
    dest: /path/to/link
    state: link

- name: Delete file
  file:
    path: /tmp/file.txt
    state: absent

- name: Touch file
  file:
    path: /tmp/file.txt
    state: touch

- name: Template a configuration file
  template:
    src: nginx.conf.j2
    dest: /etc/nginx/nginx.conf
    owner: root
    group: root
    mode: '0644'
  notify: restart nginx

- name: Add line to file
  lineinfile:
    path: /etc/hosts
    line: '192.168.1.100 myserver.example.com'

- name: Replace or add line
  lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^PermitRootLogin'
    line: 'PermitRootLogin no'

- name: Create user
  user:
    name: johndoe
    state: present
    shell: /bin/bash
    groups: sudo
    append: yes

- name: Remove user
  user:
    name: johndoe
    state: absent
    remove: yes

- name: Create group
  group:
    name: developers
    state: present

- name: Clone repository
  git:
    repo: https://github.com/user/repo.git
    dest: /opt/myapp
    version: main

- name: Pull latest changes
  git:
    repo: https://github.com/user/repo.git
    dest: /opt/myapp
    update: yes

- name: Run shell command
  shell: echo "Hello" > /tmp/hello.txt
  args:
    creates: /tmp/hello.txt

- name: Run command
  command: ls -la /tmp
  args:
    chdir: /home/user

Note: command module does not support piping, redirection, or shell variables. Use shell module for those.

- name: Print variable
  debug:
    var: ansible_hostname

- name: Print message
  debug:
    msg: "The hostname is {{ ansible_hostname }}"

- name: Assert condition
  assert:
    that:
      - ansible_os_family == "Debian"
      - ansible_distribution_version >= "20.04"
    fail_msg: "This playbook requires Ubuntu 20.04 or later"

- name: Make HTTP request
  uri:
    url: https://api.example.com/health
    method: GET
    status_code: 200

- name: Wait for port to be available
  wait_for:
    port: 80
    delay: 10
    timeout: 300

vars:
  http_port: 80
  app_name: myapp

- name: Install {{ app_name }}
  apt:
    name: "{{ app_name }}"
    state: present

- name: Gather facts
  hosts: all
  gather_facts: yes

Common facts: - ansible_hostname - ansible_os_family - ansible_distribution - ansible_distribution_version - ansible_architecture - ansible_default_ipv4.address

- name: Play without facts
  hosts: all
  gather_facts: no

- name: Set fact
  set_fact:
    my_var: "{{ ansible_hostname }}_backup"

- name: Get disk usage
  shell: df -h /
  register: disk_usage

- name: Print disk usage
  debug:
    var: disk_usage.stdout

1. Role defaults
2. Inventory variables
3. Playbook variables
4. Host facts
5. Registered variables
6. Set facts
7. Role and include variables
8. Block variables
9. Task variables
10. Extra variables (command line -e)

ansible-playbook playbook.yml -e "http_port=8080"
ansible-playbook playbook.yml -e "@vars.yml"

- name: Install Apache on Debian
  apt:
    name: apache2
    state: present
  when: ansible_os_family == "Debian"

- name: Install Apache on RedHat
  yum:
    name: httpd
    state: present
  when: ansible_os_family == "RedHat"

- name: Task with AND conditions
  debug:
    msg: "Condition met"
  when:
    - ansible_os_family == "Debian"
    - ansible_distribution_version >= "20.04"

- name: Task with OR conditions
  debug:
    msg: "Condition met"
  when: ansible_os_family == "Debian" or ansible_os_family == "RedHat"

- name: Install packages
  apt:
    name: "{{ item }}"
    state: present
  loop:
    - nginx
    - git
    - vim

- name: Create users
  user:
    name: "{{ item.key }}"
    state: present
    groups: "{{ item.value.groups }}"
  loop: "{{ users | dict2items }}"
  vars:
    users:
      alice:
        groups: sudo
      bob:
        groups: developers

- name: Print items with index
  debug:
    msg: "Item {{ item.0 }}: {{ item.1 }}"
  loop: "{{ packages | zip(range(packages | length)) | list }}"

- name: Retry until success
  shell: /usr/bin/check-service.sh
  register: result
  until: result.rc == 0
  retries: 5
  delay: 10

tasks:
  - name: Update nginx config
    template:
      src: nginx.conf.j2
      dest: /etc/nginx/nginx.conf
    notify: restart nginx

handlers:
  - name: restart nginx
    service:
      name: nginx
      state: restarted

tasks:
  - name: Update config
    template:
      src: config.j2
      dest: /etc/app/config
    notify:
      - restart app
      - clear cache

handlers:
  - name: restart app
    service:
      name: myapp
      state: restarted

  - name: clear cache
    file:
      path: /var/cache/myapp
      state: absent

- name: Force handlers to run now
  meta: flush_handlers

roles/
  common/
    tasks/
      main.yml
    handlers/
      main.yml
    templates/
      config.j2
    files/
      script.sh
    vars/
      main.yml
    defaults/
      main.yml
    meta/
      main.yml

- name: Configure web servers
  hosts: webservers
  roles:
    - common
    - nginx
    - php

- name: Configure web servers
  hosts: webservers
  roles:
    - role: nginx
      vars:
        http_port: 8080
        server_name: example.com

ansible-galaxy install geerlingguy.nginx

ansible-galaxy list

ansible-galaxy init myrole

# requirements.yml
- src: geerlingguy.nginx
- src: geerlingguy.php

# Install
ansible-galaxy install -r requirements.yml

ansible-vault create secrets.yml

ansible-vault encrypt vars.yml

ansible-vault edit secrets.yml

ansible-vault decrypt secrets.yml

ansible-vault view secrets.yml

ansible-vault rekey secrets.yml

ansible-playbook playbook.yml --ask-vault-pass

ansible-playbook playbook.yml --vault-password-file ~/.vault_pass

ansible-vault encrypt_string 'secretpassword' --name 'db_password'

Output can be used directly in playbooks: yaml db_password: !vault | $ANSIBLE_VAULT;1.1;AES256 ...

- name: Install packages
  apt:
    name: nginx
    state: present
  tags:
    - packages
    - nginx

- name: Configure nginx
  template:
    src: nginx.conf.j2
    dest: /etc/nginx/nginx.conf
  tags:
    - configuration
    - nginx

- name: Configure web servers
  hosts: webservers
  tags: webserver
  roles:
    - role: nginx
      tags: nginx

ansible-playbook playbook.yml --tags "configuration"
ansible-playbook playbook.yml --tags "nginx,php"

ansible-playbook playbook.yml --skip-tags "testing"

ansible-playbook playbook.yml --list-tags

• always - Always run, even with --tags
• never - Never run unless explicitly specified
• tagged - Run all tagged tasks
• untagged - Run all untagged tasks
• all - Run everything (default)

- name: Always run this
  debug:
    msg: "This always runs"
  tags: always

# Good
- name: Install and configure nginx web server
  ...

# Bad
- name: Install stuff
  ...

Tasks should be safe to run multiple times without changing the result beyond the initial run.

# Idempotent
- name: Ensure nginx is installed
  apt:
    name: nginx
    state: present

# Not idempotent
- name: Append to file
  shell: echo "line" >> /etc/config

• Store playbooks, roles, and inventory in Git
• Use meaningful commit messages
• Review changes before applying
• Tag releases

• Break complex playbooks into reusable roles
• Keep roles focused on single responsibility
• Use role dependencies when needed
• Share common roles across projects

# Syntax check
ansible-playbook playbook.yml --syntax-check

# Dry run
ansible-playbook playbook.yml --check

# Run on test hosts first
ansible-playbook playbook.yml --limit "test-servers"

# On entire play
- name: System configuration
  hosts: all
  become: yes
  tasks: ...

# On specific task
- name: Install package
  apt:
    name: nginx
  become: yes

• Add comments explaining complex logic
• Document required variables
• Include README for roles
• Provide example inventory files

ansible all -m ping

ansible-playbook playbook.yml -v     # Level 1
ansible-playbook playbook.yml -vv    # Level 2
ansible-playbook playbook.yml -vvv   # Level 3
ansible-playbook playbook.yml -vvvv  # Level 4 (connection debug)

- name: Show all variables
  debug:
    var: hostvars[inventory_hostname]

- name: Show specific variable
  debug:
    var: ansible_os_family

ansible hostname -m setup

ansible-playbook playbook.yml --limit "hostname"

# ansible.cfg
[defaults]
stdout_callback = yaml
# or
stdout_callback = debug