Skip to content

Subscribed Ansible – Documentation¶

Ansible-based server configuration management for Subscribed web and database infrastructure (Ubuntu).

Guide	Description
Getting started	Prerequisites, SSH setup, first run
Playbooks	All playbooks and when to run them
New server	End-to-end guide: bootstrap → configure → lockdown
SSH management	Operator keys, adding users, extra deployment users
Inventory & variables	How inventories, host_vars, and group_vars work
Vault – secrets management	View, edit, create, and rekey encrypted files
Firewall	UFW rules (Ansible-managed) and Hetzner firewall (manual)
Cloudflare Zero Trust	Tunnels, Access applications, lockdown mode
Database access from a GUI client	Connect Sequel Ace and friends to a database through the Cloudflare tunnel
Sandbox – local testing	Test playbooks locally with Docker
Backup verification	Automated proof that the S3 backups can be restored, and the DR runbook
Roles reference	What each role does and its key variables

Repository layout¶

subscribed-ansible/
├── ansible.cfg               # Default config (stage inventory, vault file, etc.)
├── Makefile                  # Shorthand for common playbook commands
├── requirements.yml          # Ansible collection dependencies
│
├── inventories/
│   ├── prod/                 # Production hosts and variables
│   ├── stage/                # Staging hosts and variables
│   └── tool-server/          # Tool servers (own inventory, not a prod group)
│
├── group_vars/all/           # Variables shared across all hosts
│   ├── common.yml            # Timezone, SSH, firewall defaults, users
│   ├── allowlist.yml         # IP allowlists (office, Plecto, Supermetrics, …)
│   ├── cronjobs.yml          # Cron job definitions
│   └── deployment.yml        # Deployment user definition
│
├── roles/                    # All Ansible roles (see roles.md)
├── cronjobs/                 # Cron shell scripts deployed to servers
├── keys/                     # SSH public keys for operator users
├── sandbox/                  # Local Docker test environment
└── docs/                     # This documentation

Environments¶

Environment	Inventory	Default?
`stage`	`inventories/stage/hosts.yml`	Yes (`ansible.cfg`)
`prod`	`inventories/prod/hosts.yml`	No – pass `-i inventories/prod/hosts.yml` or `ENV=prod`
`tool-server`	`inventories/tool-server/hosts.yml`	No – `make tool ENV=tool-server`