AnsibleOpsLab

Production-grade Ansible automation for Linux VM operations, application deployment,
Java JAR lifecycle, patching, security hardening, Docker, and day-2 infrastructure.

---

Overview

AnsibleOpsLab is a structured, portfolio-quality Ansible automation repository built around realistic Linux VM operations. Every playbook maps to a real operational task performed by DevOps, SRE, and platform engineers in production-like environments.

This is not a collection of disconnected examples. The repository is organised by operational domain, follows consistent naming conventions, enforces safe defaults on destructive tasks, and documents every folder, file, and variable.

Designed for:

• DevOps and SRE engineers building practical automation skills
• Principal and staff engineers demonstrating automation ownership
• Backend engineers moving into infrastructure automation
• Portfolio projects showcasing infrastructure engineering depth

---

Prerequisites

Requirement	Minimum Version	Notes
Ansible	2.14	pip3 install ansible
Python	3.8	Required on controller and managed hosts
Target OS	Ubuntu 20.04 / 22.04	Also tested on RHEL/CentOS 8/9
SSH	Key-based	Password auth supported but not recommended

Install required Galaxy collections:

ansible-galaxy collection install -r requirements.yml

---

Quick Start

# 1. Clone the repository
git clone https://github.com/youruser/AnsibleOpsLab.git
cd AnsibleOpsLab

# 2. Install Ansible and dependencies
pip3 install ansible
ansible-galaxy collection install -r requirements.yml

# 3. Verify connectivity against localhost
ansible-playbook -i 00_inventory/inventory_local.ini \
  01_connectivity_basics/01_ping_all_hosts.yml

# 4. Run a VM health check
ansible-playbook -i 00_inventory/inventory_local.ini \
  10_vm_health_checks/08_generate_vm_health_report.yml

Expected result: pong from localhost, then a health report written to /tmp/ansible_reports/.

---

Repository Structure

AnsibleOpsLab/
│
├── README.md                        Project documentation (this file)
├── SPEC.MD                          Project specification and coding standards
├── ansible.cfg                      Ansible runtime configuration
├── requirements.yml                 Galaxy collection requirements
├── LICENSE                          MIT License
│
├── 00_inventory/                    Inventory examples: local, dev, prod
│   ├── inventory_local.ini          Localhost testing — no SSH required
│   ├── inventory_dev.ini            Development environment
│   ├── inventory_prod.ini           Production-like layout (sample values only)
│   ├── group_vars_demo.yml          Variables applied to all hosts
│   └── host_vars_demo.yml           Per-host variable override template
│
├── 01_connectivity_basics/          Ping, SSH validation, facts, Python checks
├── 02_linux_file_ops/               Create, copy, delete, chmod, chown, symlinks
├── 03_package_management/           Install, update, upgrade, remove packages
├── 04_service_management/           systemd start, stop, restart, enable, status
├── 05_user_group_access/            Users, groups, SSH key deployment
├── 06_python_script_execution/      Copy and execute Python scripts via Ansible
├── 07_shell_command_execution/      Shell and command module patterns
├── 08_templates_config/             Jinja2 template rendering and group/host vars
├── 09_handlers_tags_conditions/     Handlers, tags, when/failed_when/changed_when
├── 10_vm_health_checks/             Disk, memory, CPU, uptime, ports, processes
├── 11_vm_maintenance/               Cleanup, log rotation, large file search, reboot
├── 12_patch_management/             Security and full package updates, reboot, report
├── 13_application_operations/       App start/stop/restart, health, logs, cache
├── 14_java_jar_deployment/          Full JAR deployment: backup, deploy, validate
├── 15_rollback_recovery/            Config and JAR rollback workflows
├── 16_backup_restore/               Directory and config backup/restore
├── 17_log_management/               Collect, search, archive, delete logs
├── 18_monitoring_observability/     Filebeat and Prometheus Node Exporter setup
├── 19_security_hardening/           SSH, sysctl, file permissions, audit, report
├── 20_firewall_networking/          UFW/firewalld, DNS, connectivity checks
├── 21_docker_operations/            Docker install, containers, cleanup
├── 22_kubernetes_preparation/       K8s node prerequisites: swap, modules, sysctl
├── 23_database_operations/          MySQL service check, backup, restore
├── 24_batch_job_operations/         Batch job start, status, stop, logs, recovery
├── 25_certificates_ssl/             Cert expiry check, deploy, install, report
├── 26_cron_scheduling/              Create, remove, disable, list cron jobs
├── 27_reporting_audit/              Inventory, patch, service, security reports
├── 28_roles_examples/               Playbooks that call reusable roles
├── 29_real_world_scenarios/         End-to-end operational workflows
│
├── roles/                           10 reusable Ansible roles
│   ├── common/                      Baseline packages, timezone, users
│   ├── app_deploy/                  Application deployment workflow
│   ├── java_service/                Java JAR service management
│   ├── docker/                      Docker Engine installation
│   ├── monitoring/                  Monitoring agent setup
│   ├── security/                    Security hardening
│   ├── patching/                    Package update workflow
│   ├── backup/                      Backup and restore
│   ├── certificate/                 SSL certificate management
│   └── reporting/                   Operational report generation
│
├── scripts/                         Helper scripts used by playbooks
│   ├── hellopython.py               Python connectivity test script
│   └── lucky.py                     CLI argument demo script
│
├── templates/                       Jinja2 templates (.j2)
│   ├── app_config.conf.j2           Application configuration template
│   ├── nginx_vhost.conf.j2          Nginx virtual host template
│   └── systemd_service.j2           systemd service unit template
│
├── files/                           Static files for ansible.builtin.copy
├── docs/                            10 operational guides
└── tests/                           Localhost test playbooks

---

Domain Coverage

#	Folder	Domain	Playbooks
00	00_inventory	Inventory examples	—
01	01_connectivity_basics	Ping, SSH, facts, Python	5
02	02_linux_file_ops	Files and directories	8
03	03_package_management	Packages	6
04	04_service_management	systemd services	8
05	05_user_group_access	Users, groups, SSH keys	6
06	06_python_script_execution	Python integration	6
07	07_shell_command_execution	Shell and command patterns	5
08	08_templates_config	Jinja2 and variables	6
09	09_handlers_tags_conditions	Control flow	6
10	10_vm_health_checks	Disk, CPU, memory, uptime	8
11	11_vm_maintenance	Cleanup, rotation, reboot	8
12	12_patch_management	Security and full patching	8
13	13_application_operations	App lifecycle management	10
14	14_java_jar_deployment	JAR deployment lifecycle	8
15	15_rollback_recovery	Rollback and recovery	6
16	16_backup_restore	Backup and restore	6
17	17_log_management	Log collection and archiving	6
18	18_monitoring_observability	Filebeat, Node Exporter	6
19	19_security_hardening	SSH, sysctl, audit	8
20	20_firewall_networking	UFW, firewalld, DNS	5
21	21_docker_operations	Docker and containers	6
22	22_kubernetes_preparation	K8s node prerequisites	5
23	23_database_operations	MySQL backup and restore	5
24	24_batch_job_operations	Batch job management	5
25	25_certificates_ssl	SSL cert lifecycle	5
26	26_cron_scheduling	Cron job management	4
27	27_reporting_audit	Operational reports	5
28	28_roles_examples	Role-based playbooks	4
29	29_real_world_scenarios	End-to-end workflows	8
		Total	~170

---

Running Playbooks

Against localhost (development and testing)

ansible-playbook -i 00_inventory/inventory_local.ini \
  FOLDER/PLAYBOOK.yml

Against remote VMs

ansible-playbook -i 00_inventory/inventory_dev.ini \
  FOLDER/PLAYBOOK.yml

Common options

# Dry run — show what would change without applying
ansible-playbook ... --check --diff

# Override a variable
ansible-playbook ... -e service_name=nginx

# Target a single host
ansible-playbook ... --limit app01

# Run only tasks with a specific tag
ansible-playbook ... --tags install

Confirming destructive tasks

Playbooks that reboot, delete files, stop services, or close firewall ports require an explicit confirmation variable. This prevents accidental runs.

# Example: reboot a VM
ansible-playbook -i 00_inventory/inventory_dev.ini \
  11_vm_maintenance/06_reboot_vm.yml -e confirm_reboot=true

# Example: clean up old logs
ansible-playbook -i 00_inventory/inventory_dev.ini \
  11_vm_maintenance/02_cleanup_old_logs.yml -e confirm_log_cleanup=true

---

Real-World Scenario Examples

The 29_real_world_scenarios/ folder contains complete end-to-end workflows.

Bootstrap a fresh VM:

ansible-playbook -i 00_inventory/inventory_dev.ini \
  29_real_world_scenarios/01_full_vm_bootstrap.yml

Full Java JAR deployment (with rollback capability):

ansible-playbook -i 00_inventory/inventory_dev.ini \
  29_real_world_scenarios/02_full_app_deployment.yml \
  -e confirm_deploy=true

Patch, reboot, and validate (rolling across a group):

ansible-playbook -i 00_inventory/inventory_dev.ini \
  29_real_world_scenarios/03_full_patch_and_reboot.yml \
  -e confirm_patch=true -e confirm_reboot=true

Full day-2 operations cycle:

ansible-playbook -i 00_inventory/inventory_dev.ini \
  29_real_world_scenarios/08_full_day2_operations_workflow.yml

---

Roles

Ten reusable roles are included under roles/. Each role follows the standard Ansible role structure with tasks/, handlers/, defaults/, vars/, and a README.md documenting all variables.

Role	Purpose
common	Baseline packages, timezone, directory layout, users
app_deploy	Application deployment — artefact copy, service start
java_service	Java JAR service management and validation
docker	Docker Engine installation and container operations
monitoring	Filebeat and Prometheus Node Exporter setup
security	sysctl hardening, SSH configuration, file permissions
patching	Package update, reboot decision, post-patch validation
backup	Archive creation and restore from tar.gz
certificate	SSL certificate deployment, expiry checks
reporting	Operational report generation across all domains

Using a role in a playbook:

- hosts: all
  become: true
  roles:
    - role: common
      vars:
        common_packages:
          - curl
          - vim
          - htop

See 28_roles_examples/ for working examples and docs/08_roles_guide.md for the full role documentation.

---

Playbook Standards

All playbooks in this repository follow these conventions.

Naming:

NN_descriptive_action.yml

Structure:

---
- name: Clear, descriptive play name
  hosts: all
  become: false        # only true where privilege escalation is required
  gather_facts: true

  vars:
    variable_name: default_value

  tasks:
    - name: Meaningful task description
      ansible.builtin.module:
        parameter: value
      register: result
      changed_when: false   # on read-only shell/command tasks

    - name: Display result
      ansible.builtin.debug:
        var: result.stdout_lines

Key rules:

• All playbook names are lowercase with underscores and a two-digit prefix
• Shell commands that do not modify state include changed_when: false
• Destructive operations require a confirm_*: false guard variable
• No real credentials, IP addresses, or certificate keys are committed
• Variables always have safe defaults

---

Documentation

All documentation is in the docs/ folder.

File	Contents
01_getting_started.md	Installation and first run
02_inventory_guide.md	Inventory file structure and variables
03_running_playbooks.md	CLI options, tags, dry runs, confirmation variables
04_vm_operations.md	Health checks, maintenance, and patching workflows
05_application_operations.md	Application lifecycle and JAR deployment
06_patch_management.md	Step-by-step patching workflow
07_security_hardening.md	Security playbooks and warnings
08_roles_guide.md	Role structure, variables, and development guide
09_troubleshooting.md	SSH, Python, sudo, and YAML error resolution
10_interview_notes.md	Ansible concepts mapped to this repository

---

Safety Policy

Risk Level	Mechanism
Destructive tasks (reboot, delete, close ports)	confirm_*: false variable guard
Sensitive commands (database passwords)	no_log: true on tasks
Configuration changes (SSH hardening)	Documented warnings in playbook header
Credentials	Never committed — use Ansible Vault
Real hostnames or IPs	Never committed — sample values only

---

Implementation Phases

Phase	Focus	Target
Phase 1 — Foundation	Connectivity, files, packages, services, health checks	50 playbooks
Phase 2 — Operations	Patching, backup, logs, monitoring, security, Docker	100 playbooks
Phase 3 — Showcase	JAR deployment, certificates, reporting, roles, scenarios	150+ playbooks

---

Roadmap

• Add Molecule tests for all roles
• Add GitHub Actions CI for YAML lint and syntax check
• Add Ansible Vault usage examples with sample encrypted variables
• Expand database operations to cover PostgreSQL
• Add Windows Server playbook examples
• Add AWX/Tower job template documentation

---

License

Distributed under the MIT License.

---