Server Configuration Automation with Ansible: Writing Playbooks

Q: How do I manage secrets with Ansible Vault?

You can encrypt variable files with ansible-vault encrypt. Encrypted files can be safely committed to Git. When running playbooks, use --ask-vault-pass to be prompted for the password.

Installing the same packages on dozens of servers, distributing configuration files, and restarting services takes hours when done manually via SSH, with high error risk. Ansible uses an agentless architecture to configure your servers over SSH with YAML-based playbooks. This guide covers inventory management, playbook writing, role structure, and idempotent automation practices.

Ansible Basics

Ansible's biggest advantage is that it requires no agent installation on target servers. SSH connectivity and Python are sufficient. You run playbooks from your control machine (laptop or CI runner).

Concept	Description	Example
Inventory	List of servers to manage	hosts.yml
Playbook	YAML definition of tasks to perform	setup-web.yml
Task	A single operation step	apt install nginx
Role	Reusable task package	roles/nginx/

Inventory Management

The inventory file defines which servers Ansible connects to. By grouping servers, you can apply different playbooks to different groups.

inventory/hosts.yml

all:
  children:
    webservers:
      hosts:
        web-01:
          ansible_host: 10.0.1.10
        web-02:
          ansible_host: 10.0.1.11
    databases:
      hosts:
        db-01:
          ansible_host: 10.0.2.10
  vars:
    ansible_user: deploy
    ansible_ssh_private_key_file: ~/.ssh/deploy_key

Writing Playbooks

A playbook is an ordered list of tasks to run on servers. Each task uses an Ansible module and should be idempotent - running the same playbook multiple times should produce the same result.

setup-web.yml

---
- name: Configure web servers
  hosts: webservers
  become: true
  tasks:
    - name: Install Nginx
      apt:
        name: nginx
        state: present
        update_cache: true

    - name: Copy Nginx configuration
      template:
        src: templates/nginx.conf.j2
        dest: /etc/nginx/sites-available/default
      notify: Restart Nginx

    - name: Allow HTTP/HTTPS in UFW
      ufw:
        rule: allow
        port: "{{ item }}"
      loop:
        - "80"
        - "443"

  handlers:
    - name: Restart Nginx
      service:
        name: nginx
        state: restarted

💡 Tip: Handlers only run when the task that triggers them makes a change. If the Nginx configuration hasn't changed, the service won't be restarted. This is a key part of idempotent behavior.

For infrastructure provisioning, check our Terraform IaC guide. For CI/CD integration, see our GitHub Actions guide. For SSH security, read our SSH Hardening guide. The Ansible documentation and Ansible Galaxy are valuable additional resources.

Frequently Asked Questions

What is the difference between Ansible and Terraform?

Terraform is for infrastructure creation (servers, networks, DNS), while Ansible is for configuring existing servers (package installation, file distribution, service management). Creating servers with Terraform and configuring them with Ansible is a common approach.

What does idempotent mean?

It means running the same playbook multiple times produces the same result. If Nginx is already installed, it won't be reinstalled; if a file is already correct, it won't be copied again. This lets you safely re-run playbooks.

What is Ansible Galaxy?

Ansible Galaxy is a platform for sharing community-created roles. You can find ready-made roles for common setups like Nginx, Docker, and PostgreSQL and use them in your own playbooks.

How do I manage secrets with Ansible Vault?

You can encrypt variable files with ansible-vault encrypt. Encrypted files can be safely committed to Git. When running playbooks, use --ask-vault-pass to be prompted for the password.

Conclusion

By automating server configuration with Ansible, you gain consistency, speed, and repeatability. Group your servers with inventory, define configuration with playbooks, and create reusable structures with roles. Manage secrets securely with Ansible Vault.

Automate Your Server Configuration

Set up your Ansible automation quickly with Hosted Cloud servers.

Explore Cloud Server Plans →