Ansible Cheat Sheet: Inventory, Playbooks, Roles & Ad-hoc Commands

[webservers]
web1.example.com ansible_user=ubuntu
web2.example.com ansible_user=ubuntu

[dbservers]
db1.example.com ansible_user=postgres
db2.example.com ansible_user=postgres

[production:children]
webservers
dbservers

[production:vars]
ansible_python_interpreter=/usr/bin/python3
environment=production

all:
  children:
    webservers:
      hosts:
        web1.example.com:
          ansible_user: ubuntu
        web2.example.com:
          ansible_user: ubuntu
    dbservers:
      hosts:
        db1.example.com:
          ansible_user: postgres
  vars:
    ansible_python_interpreter: /usr/bin/python3
    environment: production

# Use AWS EC2 dynamic inventory
ansible-playbook site.yml -i ec2.py

# Use a custom script
ansible-playbook site.yml -i inventory script.py --list-hosts

---
- name: Basic setup
  hosts: webservers
  become: yes                # Run as root
  vars:
    app_dir: /opt/myapp

  tasks:
    - name: Install nginx
      apt:
        name: nginx
        state: present
        update_cache: yes

    - name: Copy config file
      copy:
        src: nginx.conf
        dest: /etc/nginx/nginx.conf
      notify: Restart nginx

    - name: Start nginx
      service:
        name: nginx
        state: started
        enabled: yes

  handlers:
    - name: Restart nginx
      service:
        name: nginx
        state: restarted

roles/
└── webserver/
    ├── defaults/
    │   └── main.yml          # Default variables (lowest priority)
    ├── files/
    │   └── nginx.conf        # Files to copy
    ├── handlers/
    │   └── main.yml          # Handlers
    ├── meta/
    │   └── main.yml          # Role dependencies
    ├── tasks/
    │   └── main.yml          # Main tasks
    ├── templates/
    │   └── nginx.conf.j2     # Jinja2 templates
    └── vars/
        └── main.yml          # Higher-priority variables

---
- name: Deploy web application
  block:
    - name: Create application directory
      file:
        path: "{{ app_dir }}"
        state: directory
        owner: "{{ app_user }}"
        mode: '0755'

    - name: Clone repository
      git:
        repo: "{{ app_repo }}"
        dest: "{{ app_dir }}"
        version: "{{ app_branch }}"
        force: yes

    - name: Install dependencies
      pip:
        requirements: "{{ app_dir }}/requirements.txt"
        virtualenv: "{{ app_dir }}/venv"

    - name: Start application
      systemd:
        name: "{{ app_service }}"
        state: started
        enabled: yes
        daemon_reload: yes
      register: app_started

  rescue:
    - name: Rollback notification
      debug:
        msg: "Application deployment failed. Rolling back."

---
- name: Production deployment
  hosts: production
  become: yes

  roles:
    - role: common           # Standard roles
    - role: webserver
      vars:
        app_dir: /opt/myapp
        app_service: myapp
    - role: database
      when: "'dbservers' in group_names"

- name: Start service based on OS
  service:
    name: "{{ service_name }}"
    state: started
  when: ansible_os_family == "Debian"

- name: Create user if not exists
  user:
    name: deploy
    state: present
    shell: /bin/bash
  when: "'dbservers' in group_names"

- name: Check if file exists
  stat:
    path: /etc/app.conf
  register: config_file

- name: Copy config only if missing
  copy:
    src: app.conf
    dest: /etc/app.conf
  when: not config_file.stat.exists

# Simple loop
- name: Install packages
  apt:
    name: "{{ item }}"
    state: present
  loop:
    - nginx
    - git
    - curl

# Loop with index
- name: Create users
  user:
    name: "{{ item.user }}"
    uid: "{{ item.uid }}"
    shell: /bin/bash
  loop:
    - { user: alice, uid: 1001 }
    - { user: bob, uid: 1002 }
    - { user: carol, uid: 1003 }

# Loop over dict
- name: Set facts
  set_fact:
    "{{ item.key }}": "{{ item.value }}"
  loop:
    - { key: env, value: production }
    - { key: tier, value: backend }

- name: Deploy application
  block:
    - name: Pull latest code
      git:
        repo: "{{ app_repo }}"
        dest: "{{ app_dir }}"
        version: "{{ app_version }}"
    - name: Run migrations
      command: "{{ app_dir }}/migrate.sh"
      changed_when: true
  rescue:
    - name: Notify on failure
      debug:
        msg: "Deployment failed — check logs"
    - name: Run rollback script
      command: "{{ app_dir }}/rollback.sh"

# Create an encrypted file
ansible-vault encrypt secrets.yml

# Edit an encrypted file
ansible-vault edit secrets.yml

# Create a new encrypted file
ansible-vault create secrets.yml

# Decrypt to view
ansible-vault decrypt secrets.yml

# Change password
ansible-vault rekey secrets.yml

# Encrypt a string (for CLI use)
ansible-vault encrypt_string "mypassword" --name "db_password"

# Run playbook with vault password
ansible-playbook site.yml --ask-vault-pass

# Use a password file
ansible-playbook site.yml --vault-password-file ~/.vault_pass

# secrets.yml (encrypted)
---
db_host: prod-db.example.com
db_user: appuser
db_password: !vault |
  $ANSIBLE_VAULT;1.1;AES256
  616263646566...  # encrypted value

# playbook.yml
- name: Deploy application
  hosts: dbservers
  vars_files:
    - secrets.yml           # Decrypted automatically

  tasks:
    - name: Configure database connection
      template:
        src: db.conf.j2
        dest: /etc/app/db.conf

ansible-playbook site.yml --check      # Show what would change
ansible-playbook site.yml --check --diff   # Show diffs

tasks:
  - name: Install dependencies
    apt:
      name: "{{ item }}"
    loop:
      - nginx
      - git
    tags:
      - setup
      - web

  - name: Deploy app
    git:
      repo: "{{ app_repo }}"
      dest: "{{ app_dir }}"
    tags:
      - deploy

ansible-playbook site.yml --tags setup        # Run only setup tasks
ansible-playbook site.yml --skip-tags deploy  # Skip deploy tasks

- name: Deploy to web servers one by one
  command: /opt/deploy.sh
  hosts: webservers
  serial: 1                    # Run on one host at a time

- name: Notify localhost
  debug:
    msg: "Deployment complete on {{ inventory_hostname }}"
  delegate_to: localhost

- name: Wait for web server to be ready
  wait_for:
    host: "{{ item }}"
    port: 80
    delay: 5
    timeout: 30
  loop: "{{ groups['webservers'] }}"

- name: Set fact with filters
  set_fact:
    app_version_clean: "{{ app_version | trim | upper }}"
    config_dict: "{{ config_json | from_json }}"
    filtered_list: "{{ items_list | selectattr('active') | list }}"
    joined: "{{ domains | join(', ') }}"