71 lines
2.3 KiB
Plaintext
71 lines
2.3 KiB
Plaintext
== ansible repository/structure ==
|
|
|
|
files - files and templates for use in playbooks/tasks
|
|
- subdirs for specific tasks/dirs highly recommended
|
|
|
|
inventory - where the inventory and additional vars is stored
|
|
- All files in this directory in ini format
|
|
- added together for total inventory
|
|
group_vars:
|
|
- per group variables set here in a file per group
|
|
host_vars:
|
|
- per host variables set here in a file per host
|
|
|
|
library - library of custom local ansible modules
|
|
|
|
playbooks - collections of plays we want to run on systems
|
|
|
|
groups: groups of hosts configured from one playbook.
|
|
|
|
hosts: playbooks for single hosts.
|
|
|
|
manual: playbooks that are only run manually by an admin as needed.
|
|
|
|
tasks - snippets of tasks that should be included in plays
|
|
|
|
roles - specific roles to be use in playbooks.
|
|
Each role has it's own files/templates/vars
|
|
|
|
filter_plugins - Jinja filters
|
|
|
|
master.yml - This is the master playbook, consisting of all
|
|
current group and host playbooks. Note that the
|
|
daily cron doesn't run this, it runs even over
|
|
playbooks that are not yet included in master.
|
|
This playbook is usefull for making changes over
|
|
multiple groups/hosts usually with -t (tag).
|
|
|
|
== Paths ==
|
|
|
|
public path for everything is:
|
|
|
|
/srv/web/infra/ansible
|
|
|
|
private path - which is sysadmin-main accessible only is:
|
|
|
|
/srv/private/ansible
|
|
|
|
In general to run any ansible playbook you will want to run:
|
|
|
|
sudo -i ansible-playbook /path/to/playbook.yml
|
|
|
|
== Scheduled check-diff ==
|
|
|
|
Every night a cron job runs over all playbooks under playbooks/{groups}{hosts}
|
|
with the ansible --check --diff options. A report from this is sent to
|
|
sysadmin-logs. In the ideal state this report would be empty.
|
|
|
|
== Idempotency ==
|
|
|
|
All playbooks should be idempotent. Ie, if run once they should bring the
|
|
machine(s) to the desired state, and if run again N times after that they should
|
|
make 0 changes (because the machine(s) are in the desired state).
|
|
Please make sure your playbooks are idempotent.
|
|
|
|
== Can be run anytime ==
|
|
|
|
When a playbook or change is checked into ansible you should assume
|
|
that it could be run at ANY TIME. Always make sure the checked in state
|
|
is the desired state. Always test changes when they land so they don't
|
|
surprise you later.
|