Ansible setup and Directory structure for local mechine

• For Devops Engineer

ansible-lab/
├── docker-compose.yml
├── Dockerfile.control
├── Dockerfile.managed
├── ansible/
│   ├── inventory/
│   │   ├── hosts.ini
│   │   └── group_vars/
│   │       └── managed_nodes.yml
│   ├── playbooks/
│   │   ├── site.yml
│   │   ├── webserver.yml
│   │   └── monitoring.yml
│   ├── roles/
│   │   ├── common/
│   │   ├── webserver/
│   │   └── monitoring/
│   ├── ansible.cfg
│   └── ssh_keys/
└── scripts/
    ├── init-ssh.sh
    └── verify-connectivity.sh

Start this setup using this command step by step

# 1. Initialize SSH keys
chmod +x scripts/init-ssh.sh
./scripts/init-ssh.sh

# 2. Start the lab
docker-compose up -d

# 3. Verify connectivity
chmod +x scripts/verify-connectivity.sh
./scripts/verify-connectivity.sh


## DOCKER COMMON Operations:
------------------------------------------------------------
# 4. Enter control node
docker-compose exec control bash

#optional:
# Stop everything
docker-compose down

# Stop but keep volumes (data persists)
docker-compose down -v

# Rebuild images (if you changed Dockerfile)
docker-compose up -d --build

# Restart a specific service
docker-compose restart managed-node-1

# View logs for one service
docker-compose logs control

# Shell into a container
docker-compose exec control bash
docker-compose exec managed-node-1 bash

# Run one-off command
docker-compose exec control ansible all -i inventory/hosts.ini -m ping

# Validate YAML syntax:
docker-compose config

------------------------------------------------------------


# Inside control node:
# List inventory
ansible-inventory -i inventory/hosts.ini --list

# List all hosts
ansible all --list-hosts

# Ping all nodes
ansible all -i inventory/hosts.ini -m ping
ansible all -m ping # inventory define ansible.cfg

# Ping specific group
ansible webservers -m ping

#Install the Dependencies
ansible-galaxy install -r requirements.yml
----------------------------------------------------
#optioanl
#Install to project roles folder:
ansible-galaxy install -r requirements.yml -p ./roles

#Create role structure:
ansible-galaxy init my_custom_role
----------------------------------------------------------
#Check playbook without running:
ansible-playbook site.yml --check

# Run playbook
ansible-playbook playbooks/site.yml


##Run only specific tags:
/#--------------------------------------------------------#/
# Only install packages
ansible-playbook site.yml --tags install

# Only configure
ansible-playbook site.yml --tags configure

# Only on web servers
ansible-playbook site.yml --limit webservers

# Run common role only
ansible-playbook site.yml --tags update,packages
/*----------------------------------------------------------*/

# Ad-hoc command
ansible managed_nodes -i inventory/hosts.ini -m setup -a "filter=ansible_os_family"

# Check logs
tail -f /tmp/ansible.log

Verbose Mode

• Most important debugging tool

# Level 1 - Basic extra info
ansible-playbook site.yml -v

# Level 2 - More details
ansible-playbook site.yml -vv

# Level 3 - Full connection details
ansible-playbook site.yml -vvv

# Level 4 - Maximum debug info
ansible-playbook site.yml -vvvv

Part 2 - Check Mode (Dry Run)

• Test without making any changes:

# Check what will change
ansible-playbook site.yml --check

# Check with diff to see file changes
ansible-playbook site.yml --check --diff

Running module and Ad-hoc command

# Check service exists
ansible webservers -m command -a "systemctl list-units --type=service"

# Check service status manually
ansible webservers -m command -a "systemctl status nginx"

# Check service logs
ansible webservers -m command -a "journalctl -u nginx -n 50"

# Run command on all hosts
ansible all -m command -a "uptime"

# Run command on group
ansible webservers -m command -a "nginx -v"

# Check disk space
ansible all -m command -a "df -h"

# Check running services
ansible all -m command -a "systemctl list-units --state=running"

Gather facts

# Get all facts about host
ansible web1 -m setup

# Get specific fact
ansible web1 -m setup -a "filter=ansible_os_family"

# Get network facts
ansible web1 -m setup -a "filter=ansible_default_ipv4"

# Get memory facts
ansible web1 -m setup -a "filter=ansible_memtotal_mb"

Quick Troubleshooting Checklist

When Ansible fails - check these in order

------------------------------------------

1. Can you SSH manually?
   ssh -i ~/.ssh/id_rsa ubuntu@server_ip

2. Is inventory correct?
   ansible-inventory --list

3. Can ansible ping hosts?
   ansible all -m ping

4. Are permissions correct?
   become: yes in playbook?
   sudo working on server?

5. Are variables defined?
   ansible-playbook site.yml --check
   Look for undefined variable errors

6. Is syntax correct?
   ansible-playbook site.yml --syntax-check

7. Run with verbose mode
   ansible-playbook site.yml -vvv

8. Check log file
   grep "FAILED" ansible.log

9. Run step by step
   ansible-playbook site.yml --step

10. Check service on server
    ansible all -m command -a "systemctl status nginx"

Practice Scenarios

# 1. Test handlers (restart services)
ansible-playbook playbooks/webserver.yml --tags "handlers"

# 2. Gather facts from specific host
ansible managed-node-1 -i inventory/hosts.ini -m setup

# 3. Run command with become
ansible webservers -i inventory/hosts.ini -m command -a "systemctl status nginx" -b

# 4. Test conditional execution
ansible managed_nodes -i inventory/hosts.ini -m debug -a "msg='Node type'" -e "node_type=production"

# 5. Validate playbook syntax
ansible-playbook playbooks/site.yml --syntax-check

# 6. Dry-run (check mode)
ansible-playbook playbooks/site.yml --check

# 7. Run with increased verbosity
ansible-playbook playbooks/site.yml -vvv

Vault Section

#1. Create directory
mkdir -p inventory/group_vars/vault/

#2. create vault file ( unencrypted first)
cat > inventory/group_vars/vault/vault.yml << 'EOF'
---
ansible_ssh_password: ansible@123
EOF

# create file to encrypt vault.yml
echo " pass_@123" > .pass.txt

#3. Encrypt the file
ansible-vault encrypt inventory/group_vars/vault/vault.yml --vault-password-file ~/.pass.txt

#4. Verify encryption
cat inventory/vault/vault.yml

#5. View encrypted content (verify it worked)
ansible-vault view inventory/group_vars/vault/vault.yml
# Enter vault password when prompted

## Quick test - with password prompt
ansible -i inventory_vault.yml managed_nodes -m ping --ask-vault-pass
# Enter vault password when prompted

#Production use - with password file
# Create password file
echo "MyVaultPass123" > ~/.vault_password
chmod 600 ~/.vault_password

# Run without prompting
ansible-playbook -i inventory_vault.yml playbook.yml \
  --vault-password-file ~/.vault_password

#EDIT PASSWORD
ansible-vault edit inventory/grop_vars/vault/vault.yml
# Opens in editor, decrypts, re-encrypts on save