Ansible

ansible-playbook site.yml --check --diff --limit staging
ansible-playbook site.yml --check --diff --tags nginx

# inventory/prod.ini
[web]
web-[01:04].example.internal

[db]
db-01.example.internal ansible_host=10.0.5.11

[prod:children]
web
db

[prod:vars]
ansible_user=ops
ansible_python_interpreter=/usr/bin/python3

# inventory/prod.yml — the YAML form, better for nested group vars
all:
  children:
    web:
      hosts:
        web-01.example.internal:
        web-02.example.internal:
      vars:
        nginx_workers: 4

ansible-inventory -i inventory/prod.yml --graph
ansible-inventory -i inventory/prod.yml --host web-01.example.internal
ansible all -i inventory/prod.yml -m ping --limit web

- name: Configure web tier
  hosts: web
  become: true
  gather_facts: true
  serial: "25%"                 # rolling, a quarter of the group at a time
  max_fail_percentage: 0
  vars:
    nginx_version: "1.27.*"

  pre_tasks:
    - name: Drain from the load balancer
      ansible.builtin.uri:
        url: "http://lb.internal/drain/{{ inventory_hostname }}"
        method: POST
      delegate_to: localhost

  roles:
    - role: nginx
      tags: [nginx]

  tasks:
    - name: Deploy configuration
      ansible.builtin.template:
        src: nginx.conf.j2
        dest: /etc/nginx/nginx.conf
        owner: root
        mode: "0644"
        validate: nginx -t -c %s      # never install a config that fails its own check
      notify: reload nginx

  handlers:
    - name: reload nginx
      ansible.builtin.service:
        name: nginx
        state: reloaded

- name: Package present
  ansible.builtin.package:
    name: "nginx={{ nginx_version }}"
    state: present

- name: Line in a config file
  ansible.builtin.lineinfile:
    path: /etc/security/limits.conf
    regexp: '^\*\s+nofile'
    line: '*    nofile 65535'

- name: Run a migration exactly once
  ansible.builtin.command: /opt/app/bin/migrate
  args:
    creates: /var/lib/app/.migrated        # skip if this exists

- name: Shell with an explicit change test
  ansible.builtin.shell: /usr/local/bin/sync-data
  register: sync
  changed_when: "'updated' in sync.stdout"
  failed_when: sync.rc not in [0, 2]

# nginx.conf.j2
worker_processes {{ ansible_processor_vcpus }};
upstream app {
{% for host in groups['app'] %}
    server {{ hostvars[host]['ansible_default_ipv4']['address'] }}:8080;
{% endfor %}
}

ansible web-01 -m setup | jq '.ansible_facts | keys'
ansible web-01 -m setup -a 'filter=ansible_mounts'
ansible-playbook site.yml -e '{"debug_facts": true}' --tags facts

- name: What is this value, actually
  ansible.builtin.debug:
    var: nginx_workers
    verbosity: 1              # only with -v

ansible-vault create group_vars/prod/secrets.yml
ansible-vault edit group_vars/prod/secrets.yml
ansible-vault encrypt_string 's3cret' --name db_password
ansible-playbook site.yml --vault-password-file ~/.vault-pass

# ansible.cfg
[defaults]
inventory = inventory/prod.yml
forks = 25
host_key_checking = True
stdout_callback = yaml
callbacks_enabled = profile_tasks

[ssh_connection]
pipelining = True
ssh_args = -o ControlMaster=auto -o ControlPersist=60s

# Reachability across the fleet
ansible all -m ping -o | grep -v SUCCESS

# Which hosts are running which OS version
ansible all -m setup -a 'filter=ansible_distribution_version' -o | sed 's/ | SUCCESS.*"ansible_distribution_version": "/ /;s/".*//'

# Check a package version everywhere
ansible web -m command -a 'nginx -v' -o

# Run a playbook against one host and show only changes
ansible-playbook site.yml --limit web-01 --diff | grep -E '^changed|^--- |^\+\+\+ '

# Tasks sorted by duration (needs profile_tasks)
ansible-playbook site.yml 2>&1 | grep -E '^[a-z_]+ -+ [0-9.]+s' | sort -k3 -rn | head

# Find every task that uses shell or command
grep -rnE 'ansible\.builtin\.(shell|command)|^\s+(shell|command):' roles/ | grep -v creates

# Which variables a group resolves to
ansible-inventory --host web-01.example.internal | jq 'keys'

# Encrypt an existing plaintext vars file in place
ansible-vault encrypt group_vars/prod/secrets.yml

# Confirm no secrets are readable in the repository
grep -rLn '\$ANSIBLE_VAULT' group_vars/*/secrets.yml

# Apply a single role without a playbook file
ansible web -m include_role -a 'name=nginx' --become

# Restart a service in batches of two with a pause
ansible-playbook restart.yml --forks 2 -e 'pause_seconds=10'