Ansible Cheatsheet

Inventory

INI Format

[web]
web1.example.com
web2.example.com

[db]
db1 ansible_host=10.0.1.5

[prod:children]
web
db

[prod:vars]
ansible_user=deploy

YAML Format

all:
  children:
    web:
      hosts:
        web1.example.com:
      vars:
        ansible_user: deploy

Ad-Hoc & CLI

ansible all -m ping
ansible web -m command -a "uptime"
ansible web -m ansible.builtin.apt \
  -a "name=nginx state=present" --become
ansible db1 -m setup                 # gather facts

ansible-playbook -i inv.yml site.yml
ansible-playbook site.yml --check --diff   # dry run
ansible-playbook site.yml --limit web --tags deploy
ansible-playbook site.yml --ask-become-pass

Playbook Skeleton

---
- name: Configure web
  hosts: web
  become: true
  vars:
    app_port: 8080
  tasks:
    - name: Install nginx
      ansible.builtin.apt:
        name: nginx
        state: present
      notify: Restart nginx
  handlers:
    - name: Restart nginx
      ansible.builtin.service:
        name: nginx
        state: restarted

Common Modules

Variables, Facts, Loops

# conditional on a fact
when: ansible_facts['os_family'] == "Debian"

# loop
loop: "{{ dev_users }}"

# register + use output
- command: whoami
  register: who
- debug: msg="{{ who.stdout }}"

Jinja2 Template

listen {{ app_port }};
{% for b in backends %}
server {{ b }};
{% endfor %}

Roles & Galaxy

roles/webserver/
  tasks/main.yml
  handlers/main.yml
  templates/
  defaults/main.yml
  vars/main.yml

ansible-galaxy init roles/webserver
ansible-galaxy collection install community.general
ansible-galaxy install -r requirements.yml

ansible-vault

ansible-vault encrypt vault.yml
ansible-vault edit vault.yml
ansible-vault view vault.yml
ansible-vault rekey vault.yml
ansible-playbook site.yml --ask-vault-pass
ansible-playbook site.yml --vault-password-file ~/.vp