Ansible Automation | GeekAnarchy

Why Ansible?

Ansible is a configuration management and automation tool that requires no agents on target machines. It connects over SSH (Linux/Unix) or WinRM (Windows), executes modules, and reports results. This agentless architecture means you can automate a new server by adding it to an inventory file -- no software installation, no daemon running, no certificate management.

For an IT professional managing a mixed Windows/Linux environment with Active Directory, Hyper-V, and cloud instances, Ansible provides a single automation layer across everything. Write a playbook once, run it against any number of targets.

Installation and Setup

Ansible runs from a control node -- any machine with Python 3.8+. Install it with pip or your package manager:

pip install ansible

After installation, create an inventory file (hosts) listing your managed nodes:

[webservers] web1.example.com web2.example.com [dbservers] db1.example.com [all:vars] ansible_user=admin

Test connectivity with ansible all -m ping. If your targets use SSH keys, configure ~/.ssh/config for user and key paths. For Windows targets, configure WinRM with SSL on port 5986 and use the ansible.windows collection.

Playbook Fundamentals

Playbooks are YAML files that define the desired state of your systems. Each playbook contains one or more plays, and each play targets a group of hosts with a set of tasks.

A basic playbook structure:

--- - name: Configure web servers hosts: webservers become: true tasks: - name: Install nginx apt: name: nginx state: present - name: Start and enable nginx service: name: nginx state: started enabled: true

The become: true directive elevates to root for tasks that need it. Each task is idempotent -- running it multiple times produces the same result without side effects. If nginx is already installed and running, Ansible reports "ok" rather than reinstalling.

Key Ansible Concepts

Modules are the building blocks of Ansible. Each module performs a specific action: installing packages, managing services, creating files, configuring network devices, etc. Over 2,700 modules are available covering Linux, Windows, cloud platforms, and networking equipment. Use ansible-doc module_name to read the documentation for any module.

Variables allow you to parameterize playbooks. Define them in inventory files, group_vars, host_vars, or pass them on the command line with -e "var=value". Variable precedence determines which value wins when the same variable is defined in multiple places.

Handlers are tasks that run only when notified by another task. The most common use case is restarting a service after its configuration file changes:

tasks: - name: Update nginx config template: src: nginx.conf.j2 dest: /etc/nginx/nginx.conf notify: restart nginx handlers: - name: restart nginx service: name: nginx state: restarted

Roles organize playbooks into reusable components. A role has a standard directory structure: tasks/, templates/, files/, handlers/, vars/, and defaults/. Ansible Galaxy hosts thousands of community roles that you can use directly or customize.

Windows Automation with Ansible

Ansible manages Windows targets just as effectively as Linux. The requirements are straightforward:

Windows 7/Server 2008 R2 or later
PowerShell 5.1 or later (PowerShell Core 7+ also works)
WinRM configured with SSL on port 5986
The ansible.windows and community.windows collections installed

Configure WinRM with a simple PowerShell script:

Enable-PSRemoting -Force Set-Item wsman:\localhost\client\trustedhosts * New-SelfSignedCertificate -DnsName "$(hostname)" -CertStoreLocation cert:\LocalMachine\My # Configure WinRM to use the certificate

Once configured, use Windows-specific modules like win_feature, win_service, win_reg_stat, win_domain, and win_domain_computer to manage Active Directory, roles, features, and registry settings.

Practical Use Cases

Here are real scenarios where Ansible saves significant time and eliminates manual errors:

Server provisioning -- Spin up a new VM from your hypervisor, add it to inventory, and run a playbook that installs all required packages, configures services, and joins it to the domain
Security hardening -- Apply CIS benchmark configurations across all Linux servers with a single playbook run
Patch management -- Schedule playbook runs that apply security updates to Windows and Linux servers in maintenance windows, with pre-flight checks and rollback capability
Network device configuration -- Use Ansible's network modules to push consistent configurations to switches and routers, with change tracking and rollback
Compliance reporting -- Run audit playbooks that check for configuration drift and generate reports showing which systems deviate from the baseline

Best Practices

Version control all playbooks, roles, and inventories in Git
Use --check mode to preview changes before applying them
Use --diff to see exactly what will change in configuration files
Keep playbooks idempotent -- they should produce the same result when run repeatedly
Use roles for anything you plan to reuse across multiple projects
Store secrets in Ansible Vault, never in plain text
Test playbooks against a staging environment before running in production
Document your inventory structure and variable definitions for your team