Ansible Comprehensive Guide

README.md

Ansible Comprehensive Guide

Project Structure

.
├── ansible.cfg
├── hosts.yml
├── site.yml
├── roles/
│   └── webserver/
│       ├── tasks/
│       │   └── main.yml
│       ├── handlers/
│       │   └── main.yml
│       ├── templates/
│       │   └── vhost.conf.j2
│       └── vars/
│           └── main.yml
└── docs/
    └── ...

Resources

• https://zenn.dev/y_mrok/books/ansible-no-module-no-tsukaikata/viewer/introduction

ansible.cfg

[defaults]
inventory = hosts.yml
roles_path = roles
remote_user = ansible
host_key_checking = False
retry_files_enabled = False
forks = 10
stdout_callback = yaml
bin_ansible_callbacks = True

boilerplate.sh

#!/bin/bash
set -euo pipefail

PROJECT_DIR="${HOME}/ansible"
PYTHON_BIN="python3"
VENV_DIR=".venv"

function log() { 
  printf '\n[%s] %s\n' "$(date +'%F %T')" "$*" >&2; 
}

function cmd_exists() {
  if ! command -v "$1" >/dev/null 2>&1; then
    return 1
  fi
}

function detect_os() {
  if [[ -r /etc/os-release ]]; then
    # shellcheck source=/dev/null
    . /etc/os-release
    OS_ID="${ID:-unknown}"
    OS_LIKE="${ID_LIKE:-}"
  else
    OS_ID="unknown"
    OS_LIKE=""
  fi
}

function which_pkg_mgr() {
  if cmd_exists dnf; then
    PKG_MGR="dnf"
  elif cmd_exists yum; then
    PKG_MGR="yum"
  elif cmd_exists apt-get; then
    PKG_MGR="apt"
  elif cmd_exists apt-get; then
    PKG_MGR="apt-get"
  elif cmd_exists zypper; then
    PKG_MGR="zypper"
  else
    log "ERROR: Could not find a supported package manager (dnf/yum/apt-get/zypper)."
    exit 1
  fi
}

function install_prereq_packages() {
  local packages=()

  case "$PKG_MGR" in
    apt-get)
      packages=(python3 python3-venv python3-pip git sshpass)
      log "Update apt cache..."
      sudo apt-get update -y
      log "Install system packages: ${packages[*]}"
      sudo apt-get install -y "${packages[@]}"
      ;;
    dnf|yum)
      packages=(python3 python3-pip git sshpass)
      log "Install system packages: ${packages[*]}"
      sudo "$PKG_MGR" install -y "${packages[@]}"
      ;;
    *)
      log "ERROR: Unsupported package manager: $PKG_MGR"
      exit 1
      ;;
  esac
}

hosts.yml

---
all:
  hosts:
    node1:
      ansible_host: <hostname>
      ansible_user: ansible
      ansible_ssh_private_key_file: ./.ssh/private_key
      ansible_python_interpreter: /usr/bin/python3

run-playbook.sh

#!/bin/bash

ansible-playbook -i hosts.yml site.yml

run.sh

#!/bin/bash

#ansible all -m ping
#ansible all -m copy -a "src=./file dest=/tmp/file" --become
#ansible webservers -m yum -a "name=httpd state=present" --become

ansible-navigator run task1.yml -i hosts.yml -m stdout

site.yml

- hosts: webservers
  roles:
    - webserver

task1.yml

---
- name: Run tasks
  hosts: all
  gather_facts: no

  tasks:
  
    - name: Configure httpd_can_network_connect
      ansible.posix.seboolean:
        name: httpd_can_network_connect
        state: yes
      become: yes

    - name: Allow HTTP
      ansible.posix.firewalld:
        service: http
        state: enabled
        permanent: yes
        immediate: yes
      become: yes
      
    - name: Add keypair
      ansible.posix.authorized_key:
        user: ec2-user
        state: present
        key: "{{ lookup('file', './my_keypair.pub') }}"
      become: yes

web_servers.yml

---
- name: Configure web servers
  hosts: webservers
  become: yes
  vars:
    http_port: 80

  tasks:
  
    - name: Ensure httpd is installed
      ansible.builtin.package:
        name: httpd
        state: present

    - name: Ensure httpd is enabled and running
      ansible.builtin.service:
        name: httpd
        state: started
        enabled: yes

    - name: Allow HTTP through firewalld
      ansible.posix.firewalld:
        service: http
        state: enabled
        permanent: true
        immediate: true
      notify: reload firewalld

    - name: Enable SELinux httpd_can_network_connect
      ansible.posix.seboolean:
        name: httpd_can_network_connect
        state: true
        persistent: true

  handlers:
  
    - name: reload firewalld
      ansible.builtin.service:
        name: firewalld
        state: reloaded