Ansible: Roles, Variables and Vault

As playbooks grow, move tasks into roles.

ansible-galaxy init roles/nginx

roles/nginx/
  tasks/main.yml
  handlers/main.yml
  templates/site.conf.j2
  defaults/main.yml

tasks/main.yml:

- name: Install nginx
  ansible.builtin.apt: { name: nginx, state: present }
- name: Render site config
  ansible.builtin.template:
    src: site.conf.j2
    dest: /etc/nginx/conf.d/site.conf
  notify: Reload nginx

handlers/main.yml reloads nginx only when the template changed:

- name: Reload nginx
  ansible.builtin.service: { name: nginx, state: reloaded }

Secrets go in Vault:

ansible-vault create group_vars/prod/vault.yml
ansible-playbook site.yml -i inventory.ini --ask-vault-pass

Prefix vault variables with vault_ and reference them from a plain file, so searches still show where they are used. Pin collections in requirements.yml, and lint with ansible-lint.