Ansible Cheatsheet

Software-Testing, das sich bezahlt macht: Ein Feldbericht aus drei Codebasen

Evidenzbasierte Testing-Praxis aus Produktions-Codebasen — property-basierte Invarianten, gezielte Fehlerinjektion, Contract-Tests, benchmark-verifizierte Performance und Qualitäts-Gates, die durchgesetzt werden, nicht nur versprochen.

A purpose-built Ansible skeleton designed for AI agent workflow — declarative infrastructure management where agents understand the conventions before making changes.

Service Management

- name: Start service
  ansible.builtin.service:
    name: nginx
    state: started
    enabled: yes

- name: Restart service
  ansible.builtin.service:
    name: nginx
    state: restarted

- name: Check service status
  ansible.builtin.service:
    name: nginx
    state: started
  check_mode: yes

System Administration

- name: Create user
  ansible.builtin.user:
    name: deploy
    shell: /bin/bash
    system: yes
    generate_ssh_key: yes

- name: Add SSH key
  ansible.posix.authorized_key:
    user: deploy
    key: "{{ lookup('file',('~/.ssh/id_rsa.pub')) }}"
    state: present

- name: Setup cron job
  ansible.builtin.cron:
    name: "Daily backup"
    minute: "0"
    hour: "2"
    job: "/usr/local/bin/backup.sh"

Variables

# Define in playbook
vars:
  app_name: myapp
  app_version: 1.0.0
  servers:
    - server1
    - server2

# Define in external file (group_vars/all.yml)
app_name: myapp
app_port: 8080

# Use with Jinja2
- name: Print variable
  ansible.builtin.debug:
    msg: "App: {{ app_name }} on {{ ansible_fqdn }}"

# Loop over list
- name: Create multiple users
  ansible.builtin.user:
    name: "{{ item }}"
    shell: /bin/bash
  loop:
    - user1
    - user2
    - user3

# Loop with dictionary
- name: Configure services
  ansible.builtin.service:
    name: "{{ item.key }}"
    state: "{{ item.value }}"
  loop:
    - { key: "nginx", value: "started" }
    - { key: "mysql", value: "started" }

Conditionals

- name: Install nginx on Debian/Ubuntu
  ansible.builtin.apt:
    name: nginx
    state: present
  when: ansible_os_family == "Debian"

- name: Install nginx on RHEL/CentOS
  ansible.builtin.yum:
    name: nginx
    state: present
  when: ansible_os_family == "RedHat"

# Multiple conditions
- name: Configure for production
  ansible.builtin.copy:
    src: prod.conf
    dest: /etc/app/config.conf
  when:
    - environment == "production"
    - ansible_fqdn is match("^prod.*")

# Check if file exists
- name: Check if config exists
  ansible.builtin.stat:
    path: /etc/app/config.conf
  register: config_file

- name: Create config if missing
  ansible.builtin.copy:
    src: default.conf
    dest: /etc/app/config.conf
  when: not config_file.stat.exists

Handlers

# Define handlers section
handlers:
  - name: Restart nginx
    ansible.builtin.service:
      name: nginx
      state: restarted

  - name: Reload systemd
    ansible.builtin.systemd:
      daemon_reload: yes

# Notify handler from task
- name: Update nginx config
  ansible.builtin.copy:
    src: nginx.conf
    dest: /etc/nginx/nginx.conf
  notify: Restart nginx

# Force handler to run
- name: Always notify
  ansible.builtin.debug:
    msg: "Triggering handler"
  notify: Restart nginx
  changed_when: true

Loops

# Simple loop
- name: Install packages
  ansible.builtin.apt:
    name: "{{ item }}"
    state: present
  loop:
    - nginx
    - python3-pip
    - git

# Loop with index
- name: Configure interfaces
  ansible.builtin.copy:
    content: "Interface {{ item.0 }}: {{ item.1 }}"
    dest: "/etc/interfaces/{{ item.0 }}"
  loop:
    - [0, "192.168.1.1"]
    - [1, "192.168.1.2"]

# Until loop
- name: Wait for service to be ready
  ansible.builtin.uri:
    url: "http://localhost:8080/health"
    status_code: 200
  register: result
  until: result.status == 200
  retries: 10
  delay: 5

# Dictionary loop
- name: Create users with specific properties
  ansible.builtin.user:
    name: "{{ item.key }}"
    shell: "{{ item.value.shell }}"
  loop: "{{ users | dict2items }}"
  vars:
    users:
      deploy:
        shell: /bin/bash
      backup:
        shell: /bin/bash

Error Handling

# Ignore errors
- name: Run command that may fail
  ansible.builtin.command: /tmp/dangerous-command
  ignore_errors: yes

# Rescue block (try/catch)
- name: Attempt deployment
  block:
    - name: Deploy application
      ansible.builtin.get_url:
        url: "{{ app_url }}"
        dest: /var/www/app.tar.gz
  rescue:
    - name: Deployment failed, cleanup
      ansible.builtin.file:
        path: /var/www/app.tar.gz
        state: absent
    - name: Notify failure
      ansible.builtin.debug:
        msg: "Deployment failed, performing rollback"
  always:
    - name: Always run cleanup
      ansible.builtin.debug:
        msg: "Cleanup completed"

# Failed_when condition
- name: Check service status
  ansible.builtin.command: systemctl status nginx
  register: service_status
  changed_when: false
  failed_when: "'active (running)' not in service_status.stdout"

Jinja2 Templates

# Variables in template
{{ app_name }}
{{ app_port }}
{{ ansible_default_ipv4.address }}

# Conditionals
{% if environment == "production" %}
server_name: {{ prod_domain }}
{% else %}
server_name: {{ dev_domain }}
{% endif %}

# Loops
{% for user in allowed_users %}
allow {{ user }};
{% endfor %}

# Filters
{{ nginx_config | to_nice_json }}
{{ list_of_items | join(', ') }}
{{ '  some text  ' | trim }}
{{ 'HELLO' | lower }}
{{ array | unique | list }}

Useful Filters

- name: Show memory usage
  ansible.builtin.debug:
    msg: "{{ ansible_memtotal_mb }} MB total, {{ ansible_memfree_mb }} MB free"

- name: Create list from string
  ansible.builtin.set_fact:
    packages_list: "{{ packages_string | split(',') }}"

- name: Get unique values
  ansible.builtin.set_fact:
    unique_users: "{{ users | unique | list }}"

- name: Check if item in list
  ansible.builtin.debug:
    msg: "Package installed"
  when: package_name in installed_packages

- name: Parse YAML string
  ansible.builtin.set_fact:
    config: "{{ config_string | from_yaml }}"

Best Practices

1. Use YAML format for inventory (easier to read and maintain)
2. Become (sudo) only when needed, with become: yes
3. Idempotence - tasks should be safe to run multiple times
4. Separate sensitive data using Ansible Vault
5. Use handlers for service restarts (only restart when changed)
6. Validate with --check and --diff before applying
7. Structure with roles for larger projects
8. Document playbooks with comments and descriptions
9. Version control all playbooks and configurations
10. Test in staging before production

Resources & Related Platforms

• tobias-weiss.org - More cheat sheets, articles and store products
• graphwiz.ai - AI, knowledge graphs and agentic development
• courses.graphwiz.ai - Interactive practice exams and study guides
• ki-kompetenz-training.org - EU AI Act compliant AI literacy training

Related Cheat Sheets

• Terraform Cheat Sheet - IaC alternative
• Systemd Cheat Sheet - Service management