Getting started¶

Prerequisites¶

Install Ansible collections declared in requirements.yml:

ansible-galaxy collection install -r requirements.yml

Vault password file¶

Sensitive variables are encrypted with Ansible Vault. The repo expects a local password file at .ansible_vault_pass (relative to the repo root).

echo "your-vault-password" > .ansible_vault_pass
chmod 600 .ansible_vault_pass

The file is git-ignored. Never commit it. Without it, playbooks that reference vault variables will fail.

SSH user configuration¶

Do not hardcode your username in the repository. Configure your local SSH client instead:

# ~/.ssh/config
Host bk-db-01 bkdk-web-01 bkse-web-01 bknl-web-01 elcom-web-01 kddk-web-01 elome-db-01 kd-db-01 tools-server-01 analytics-e01
  User pt
  IdentityFile ~/.ssh/id_ed25519

Alternatively, set an environment variable for a one-off run:

export ANSIBLE_REMOTE_USER=pt

Zero Trust hosts (Cloudflare tunnel)¶

Servers with zt_lockdown_enabled: true are only reachable via Cloudflare Access. SSH through them requires the cloudflared proxy:

# ~/.ssh/config
Host *.subscribed.build
  User pt
  IdentityFile ~/.ssh/id_ed25519
  ProxyCommand cloudflared access ssh --hostname %h

Or use the equivalent Ansible host variable:

# inventories/prod/host_vars/<host>/main.yml
ansible_host: sshbksedb.subscribed.dk
ansible_ssh_common_args: '-o ProxyCommand="cloudflared access ssh --hostname %h"'

Verify connectivity¶

Ping all hosts in the default (stage) inventory:

make ping

Ping production hosts:

make ENV=prod ping

Or directly:

ansible -i inventories/prod/hosts.yml all -m ping

Run your first playbook¶

Run the web playbook against a single staging host in check (dry-run) mode:

ansible-playbook -i inventories/stage/hosts.yml web.yml --limit web-01 --check

Apply it for real:

ansible-playbook -i inventories/stage/hosts.yml web.yml --limit web-01

See Playbooks for the full list and New server for the first-time setup workflow.