--- name: ansible-2df1c3604020 description: Expert Ansible automation assistance covering playbooks, roles, inventory, idempotent modules, and Ansible Vault. Use when automating server configuration, application deployment, and infrastructure orchestration. --- # Ansible Ansible is an agentless automation engine for configuration management, infrastructure provisioning, and multi-tier application deployment via declarative YAML playbooks. ## When to Use - **Agentless Infrastructure Configuration**: Automating multi-node server setup over SSH without installing client daemons. - **Application Deployment & Provisioning**: Deploying microservices, security patches, and system packages idempotently. - **Security Hardening & Compliance**: Enforcing CIS benchmarks, firewall rules, and SSH hardening across fleet servers. - **Orchestration & Rolling Updates**: Coordinating zero-downtime rolling upgrades across clustered backend nodes. ## Quick Start ```yaml # playbook.yml - name: Configure Webservers hosts: web become: true tasks: - name: Install Nginx ansible.builtin.apt: name: nginx state: present - name: Start Service ansible.builtin.service: name: nginx state: started ``` ## Core Concepts ### Idempotent Playbook Structure with Handlers Configuring web servers with automated restart triggers: ```yaml --- # playbooks/deploy_web.yml - name: Configure and Harden Nginx Web Nodes hosts: webservers become: true vars: nginx_port: 80 app_root: /var/www/production tasks: - name: Install Nginx web server ansible.builtin.apt: name: nginx state: present update_cache: true - name: Deploy hardened Nginx configuration ansible.builtin.template: src: templates/nginx.conf.j2 dest: /etc/nginx/nginx.conf owner: root group: root mode: "0644" notify: Reload Nginx Service - name: Ensure Nginx is enabled and running ansible.builtin.service: name: nginx state: started enabled: true handlers: - name: Reload Nginx Service ansible.builtin.service: name: nginx state: reloaded ``` ### Dynamic Inventory & Host Grouping Targeting cloud infrastructure dynamically: ```ini # inventory/hosts.ini [webservers] web-01.infra.internal ansible_host=10.0.1.10 web-02.infra.internal ansible_host=10.0.1.11 [database] db-primary.infra.internal ansible_host=10.0.2.20 [production:children] webservers database [production:vars] ansible_user=deploy ansible_ssh_private_key_file=~/.ssh/prod_deploy.pem ansible_python_interpreter=/usr/bin/python3 ``` ### Ansible Vault for Secret Protection Encrypting credentials and sensitive environment variables: ```bash # Encrypt sensitive variables file ansible-vault create vars/vault_secrets.yml # Execute playbook passing vault password file ansible-playbook -i inventory/hosts.ini playbooks/deploy_web.yml --vault-password-file ~/.vault_pass ``` ## Common Patterns ### Idempotent Nginx Configuration and Service Handler **Problem**: Applying configuration changes repeatedly without restarting services unless template files changed. **Solution**: Use notification handlers triggered by templated tasks: ```yaml --- - name: Configure Web Servers hosts: webservers become: true tasks: - name: Ensure Nginx is installed ansible.builtin.apt: name: nginx state: present update_cache: true - name: Deploy Nginx site configuration ansible.builtin.template: src: templates/site.conf.j2 dest: /etc/nginx/sites-available/default mode: "0644" notify: Reload Nginx handlers: - name: Reload Nginx ansible.builtin.service: name: nginx state: reloaded ``` ## Best Practices **Do**: - Always use fully qualified collection names (FQCN), e.g. `ansible.builtin.template`, `community.docker.docker_container`. - Verify idempotency by running playbooks twice in CI; the second run must report `changed=0`. - Store credentials, certificates, and passwords in `ansible-vault` or retrieve from HashiCorp Vault. - Test roles and playbooks using Molecule and testinfra in automated CI pipelines. **Don't**: - Use `ansible.builtin.shell` or `command` when a dedicated idempotent Ansible module exists. - Commit unencrypted vault passwords or plain text secrets to version control. - Perform large inventory operations without `--forks` tuned for network concurrency. ## Troubleshooting | Error | Cause | Solution | | :------------------------------------------------------------------------ | :---------------------------------------------------------------- | :-------------------------------------------------------------------------- | | `Permission denied (publickey)` | SSH key missing, incorrect user, or host key verification failed. | Specify private key via `--private-key` or set `ansible_user` in inventory. | | `FAILED! => {"changed": false, "msg": "Destination ... is not writable"}` | Task requires root escalation but `become: true` is missing. | Add `become: true` at playbook or task level. | | `Syntax Error while loading YAML` | Tab characters or improper indentation in YAML playbook. | Ensure consistent 2-space indentation and run `ansible-lint playbook.yml`. | ## References - [Ansible Documentation](https://docs.ansible.com/) --- Source attribution: G1Joshi Original project: https://github.com/G1Joshi/Agent-Skills/blob/6a74cf03a8a86dc7d993ead3091b41123dbd0181/skills/devops/ansible/SKILL.md License: MIT License information: https://opensource.org/license/mit Original upstream instructions; downloaded from Mega AI Hub. ## Upstream license notice MIT License Copyright (c) 2026 G1Joshi Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. # Mega AI Hub resource metadata Creator / publisher: G1Joshi Original project: https://github.com/G1Joshi/Agent-Skills/blob/6a74cf03a8a86dc7d993ead3091b41123dbd0181/skills/devops/ansible/SKILL.md Attribution basis: Source repository record Fields of work: Development & Engineering, Operations Roles: Backend Developer, DevOps / SRE, Operations Manager Specialties: DevOps Tools: Ansible Country applicability: Country not specified Classification basis: Source catalog labels Instruction SHA-256: 46edbf1afd370b6a24a370f713d9ea483c4ad74f524d23492e03eb174e484284