r/ansible

Hi everybody,

I'm have created two playbooks for my Proxmox nodes:
- Bootstrap = NAG removal, Add repos, create 2 users, setup SSH
- Proxmox_play = Setting up the whole system to my desires

The Bootstrap has to be done with elevated privileges (root: become=true). I'm passing through the root password as a vault encrypted file.

Now, for the Proxmox_play, I read that one should use a different user to perform all remaining tasks. I'm just talking about a home-lab, nothing exposed to the WWW.

1. Do I really need to use a different user to execute all the remaining tasks, what are the implications if I don't do that?
2. How can I tell Ansible that it should use user X with passwd Y to execute all tasks on hosts: 1, 2, 3, 4, 5, 6, etc...?

Additionally, I'm currently storing the encrypted files in a separate directory where all my ansible related stuff resides....NOT directly within the roles, though!
What is the recommendation of the community where to store these files best? (I'm not using GitHub at the moment...is something pending to learn/setup).

Thank you in advance for the recommendations.

Hi all,

I'm in a doubt here what would be best practice to use. Both solutions work for me, though. Nevertheless, I'm learning and would like to satisfy my curiosity on this one.

I'm modifying the root crontab to run an rclone script every 4 minutes on my Mac.
With Ansible, I've created a play that used the ansible.builtin.cron and the results are exactly as any example is showing:

0 11 * * 1-5   <the jobs>

Boring and for some, not very obvious.

I also did the same this, but using ansible.builtin.blockinfile to make it look like this:

# Mins  Hours   Days    Months  WkDay
#=====================================
## rclone-sync - This job will run every Monday to Friday at 11 am
  0     11      *       *       1-5   <the jobs>

I know, if both ways work, choose to your liking. What would be the choice of the community and are there any pro's or con's on both methods?

Thank you for your comments in advance.

Hi all!

I've used Ansible many years ago to manage VMs and other cloud infra, stopped using it but recently rediscoverd Ansible to manage my local system.

Turned my past knowledge in a set of reusable Ansible roles with a simple CLI wrapper.

Do you mange your system in the same way? :)
Curious to hear your experiences and insights!

Has anyone install the self service portal alongside their AAP 2.6 instance? I understand that I will need a separate server for this, but the deployment seems...odd? I'm following the instructions here - https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.7/install-proc_self_service_install_kvm

When a task depends on another how do you decide if you should use a handler or checking if the register was changed? Handlers run at the end unless you force them. Are there are other things you think about?

Hello,

I’m very new to Reddit so this might not follow normal conventions of writing (idk I lurk every once and a while but I never post lmao). I joined a group and somehow the infrastructure is quite complex and not very documented so it’s been a lot of breaking things so I’ve been wanting to start learning ansible to automate them so if I accidentally bonk something too hard, I’ll be fine. The thing is it’s such a weird set up, but it’s secure so I can’t complain lol.

I’ve looked a little bit on this subreddit and saw lots of people recommend watching someone named geerling and their ansible stuff, and I do plan to but I had 2 other questions.

1: other than geerling, is there any other recommendations on learning ansible? I’ve been wanting to but I have already been so intimidated by it so I just kinda push it off, so I just want to have a second source to learn if I can’t understand geerling off the jump.

2: I don’t understand how I could actually do the backup itself. I do understand the basics of ansible, like how it fundamentally works (not how to make a playbook or anything like that yet) but with how everything is now I don’t see a way to make a backup ig. We have a machine at 10.8.0.17 that will run the ansible backup and put it on a hard drive that we can access if need be. We have 6 other machines that I’ll need to back up, each of them have a main user and then either a “containers”, “bots”, or “<service name>” kinda user. Most services run under those users and not the main one but you need to sudo machinectl shell containers@ or whatever the syntax is (I forgot off the top of my head). Those users however only have access to their home directory so if there is a backup script it’ll need to be run as that user because they’re running the service, I’ll then need to go to the main user, then to root and then move the backup to the main user to the scp to the ansible server. However I don’t think ansible deals with passwords and instead works with keys so it wouldn’t be able to go into the containers user or into root to move it around.

I saw another thing saying make an ansible user and then only let it have access to their backup scripts but I thought it wouldn’t work since it isn’t the one running the services so I’m kinda at a loss on how it would actually work.

Does anyone have any ideas on how to get around this or should I look at something else to do some of these backups?

Also this is all done through Alma Linux 9.8, this is basically my second to third month of actually doing live infra work so I don’t understand the super in-depth stuff but I’m feeling solid about ground level stuff so if I’m missing something very obvious, I probably just haven’t learned it yet lol.

Edit: i probably should’ve also said but didn’t think I needed to. This is a college security club and I’m the infrastructure officer. Idk if it’s needed to say it but one of the people Ik who is a common Reddit user said I should probably mention it.

Hey everyone,

I’m an IT System Engineer and I’m just starting to learn Ansible.

I’m hoping to get comfortable with it and eventually use it as part of my daily work. My plan is to first test and learn everything in my homelab before using Ansible in a production environment at my company.

For those of you who already work with Ansible, do you have any tips or tricks for getting started?

What should I focus on first? Are there any common beginner mistakes I should avoid? Also, are there any best practices you wish you had learned from the beginning?

I’d appreciate any advice, resources, or recommendations from people who use Ansible in real production environments.

I've been thinking about how automation changes once an application becomes more complex than a single server.

With tools like Ansible, you can automate a lot of the repetitive work around configuring machines, deploying services and keeping environments consistent.

But there is still a difference between knowing what you intended to configure and knowing what is actually happening inside the running application.

For example, an application might have an API, PostgreSQL, Redis, object storage and several containers. An automation playbook can configure the environment correctly, but the application can still end up with a broken service connection, incorrect environment variable or unhealthy process.

I've been exploring this problem while working with IQX.DEV. where the AI agent is designed to work with both the application and its running environment.

Instead of only looking at source code or configuration, the agent can inspect things such as container logs, running processes, ports, endpoints and service connections.

That creates an interesting workflow:

Configuration → deployment → runtime observation → diagnosis → correction

rather than treating deployment as the final step.

I'm curious where people using Ansible think AI agents could actually be useful.

Would you trust an agent to inspect an environment and recommend changes to an Ansible playbook?

Would you allow it to execute a playbook automatically after identifying a problem?

Or is it better to keep the agent completely separate from infrastructure automation and let it only provide recommendations?

I think the interesting challenge isn't giving an AI agent more control. It's deciding what information and permissions it actually needs to be useful without creating another source of infrastructure problems.

Has anyone discovered a way to install the security center license during the package installation? Looking to create a way to automate the installation of the server without having to manually enter the license file.

On-Premises

In role vars main.yml file I create a variable using info from ansible_facts["interfaces"].

The playbook has tasks to add and remove some net interfaces. After those tasks can I refresh the role vars so when I reference the variable it has the values of the new net interfaces?

Is there another place I can set these variables that will work? I don't want to duplicate it in vars: in every task because lots of them use this variable.

Do you enable become on a playbook level or on a task level? I tend to enable it on a playbook level but I'm thinking it might be better to enable only for tasks that require it, which is most to be fair.