Ansible inventory, modules, handlers and roles

Why and what

Ansible runs tasks against an inventory, commonly over SSH. Modules implement operations such as package installation and file management. Idempotence means rerunning desired-state tasks should not keep making unnecessary changes. A shell command is not automatically idempotent.

Inventory

[web]
academy1 ansible_host=203.0.113.10 ansible_user=ec2-user

Use your real instance address, trusted host keys and a securely managed key path. Do not disable host-key checking globally to bypass setup. Limit the inventory to authorized lab hosts.

Playbook

- name: Configure academy web server
  hosts: web
  become: true
  tasks:
    - name: Install nginx
      ansible.builtin.package:
        name: nginx
        state: present
    - name: Create site directory
      ansible.builtin.file:
        path: /var/www/academy
        state: directory
        mode: '0755'
    - name: Install a static page
      ansible.builtin.copy:
        content: '<h1>Configured by Ansible</h1>'
        dest: /var/www/academy/index.html
        mode: '0644'
    - name: Enable nginx
      ansible.builtin.service:
        name: nginx
        state: started
        enabled: true

This creates content but still needs a reviewed Nginx server block pointing at that directory. Add a template task and notify a reload handler only after successful config validation. Distribution package metadata may need updating first; package modules abstract names only when those names match.

Run and inspect

ansible -i inventory.ini web -m ping
ansible-playbook -i inventory.ini web.yml --check --diff
ansible-playbook -i inventory.ini web.yml
ansible-playbook -i inventory.ini web.yml

Ansible ping checks management connectivity and Python execution, not ICMP. Check mode is a preview and not all tasks fully support it. The second real run should show no unnecessary changes for the demonstrated tasks.

Roles and secrets

Organize reusable tasks, handlers, templates and defaults into roles. Store secrets through an appropriate external manager or Ansible Vault; encrypted source still needs key handling. Use no_log on sensitive tasks, but do not treat it as protection against an untrusted operator with host access.

Assignment

Parameterize server_name and root, then manage one Ubuntu and one AL2023 host with explicit OS-specific differences. Demonstrate a config test catching an invalid directive before reload.

Official reference

Ansible getting started

Interview and revision check

What does a second playbook run teach you?

It reveals whether desired-state tasks are idempotent and whether unnecessary changes/restarts occur.