Ansible Setup Guide

1. Edit the Hosts File
   First, we have to edit the hosts file to add all of the servers you want to control.

2. Organize Inventory and Playbooks
   I created an inventory folder where I placed the hosts file and another folder named playbooks where all my playbooks are stored.

3. Prepare for Key Authentication
   If you are like me, I didn’t have key authentication set up on any of the machines I wanted to control, so the first task I wanted to achieve using Ansible was this.
   However, it’s not as simple as it sounds. First, you need to ensure you can SSH into each machine using your password and the root user. This is the username I used in my hosts file initially.
   Eventually, during this process, we will:

   • Create the serveradmin user on all machines.
   • Set up key authentication for that user.
   • Update our hosts file with the new user.

4. Test Connectivity
   Test if we can connect to all the machines using the Ansible ping command:

   ansible all -m ping -i hosts --ask-pass

   • Use the --ask-pass option since we don’t have key authentication set up yet.
   • If everything goes well, you should see a list of your hosts with the ping results. Even if it fails, you can troubleshoot using the logs.

5. Create a Secrets File
   Create a secrets.yml file to store the desired password for the serveradmin user:

   ansible-vault create secrets.yml

   Inside the file, include:

   serveradmin_password: "{{ 'desired_password' | password_hash('sha512') }}"

   Save this file in the playbooks folder.

6. Create a Playbook to Add the serveradmin User
   Once everything is ready, create your first playbook to add the serveradmin user.

   • If you want to exclude a specific host (e.g., pve-homelab), include this condition:

     when: inventory_hostname != "pve-homelab"

   • Run the playbook using:

     ansible-playbook -i ./inventory/hosts ./playbooks/<playbook_name>.yml --ask-pass

7. Change the User’s Shell
   The serveradmin user may use a shell that doesn’t have access to the .ssh directory.

   • To fix this, create a change-shell.yml playbook to update the shell.
   • Run the playbook using the same command as above, replacing the playbook name:

     ansible-playbook -i ./inventory/hosts ./playbooks/change-shell.yml --ask-pass

8. Set Up SSH Keys for the serveradmin User
   Use the setup-ssh-serveradmin.yml playbook to copy the SSH key to all hosts.
   Once done:

   • Update the hosts file to use the serveradmin user for all hosts.
   • Test connectivity again:

     ansible all -m ping -i hosts

     This time, omit the --ask-pass option. It should work without errors.

9. (Optional) Disable Password Authentication
   For added security, disable password authentication for SSH on all hosts using the pass-auth-disable.yml playbook.

Note for Personal Self

If you want to be able to directly send commands to Ansible to a new machine that you added in the hosts file, you need to:

1. Go to the WSL machine and run:

   cat ~/.ssh/id_rsa.pub

2. Copy the output.

3. On the machine that you want to control:

   • Change directory to ~/.ssh

   • Open the authorized_keys file with:

     nano authorized_keys

   • Paste the contents of your id_rsa.pub

4. After that, you should be able to run Ansible commands to the machine, granted that you configured the username in the hosts file.

Limits on which the playbooks run

1. Limit groups

   • If you want to run a playbook only to an specific group of hosts run:

     ansible-playbook -i hosts playbook.yml --limit group

2. Exclude hosts

   • If you want to run a playbook but want to exclude a single (*or multiple) host run:

     ansible-playbook -i hosts playbook.yml --limit '!host'

   • *If you want to exclude multiple hosts just add it spaced by comas following the same '!' syntax inside the quotes