Ansible Lab Guide | Nkydigitech

📚 Curriculum

What You'll Learn

A structured learning path from Ansible fundamentals to production-grade infrastructure automation.

Module 01

Ansible Fundamentals

Understand the control node, managed nodes, SSH authentication, and the agentless architecture that makes Ansible unique.

Control NodeSSHInventory

Module 02

Playbooks & Variables

Write declarative YAML playbooks, use Jinja2 templating for dynamic values, and manage variables across playbooks, files, and inventory.

YAMLJinja2Variables

Module 03

Roles & Project Structure

Organise playbooks into reusable roles with dedicated tasks, handlers, templates, and variable directories following best practices.

RolesHandlersTemplates

Module 04

Ansible Vault & Security

Encrypt sensitive credentials using Ansible Vault with AES-256. Learn the golden rule: never commit plain text passwords to version control.

VaultAES-256Security

Module 05

Galaxy & Dynamic Inventory

Leverage Ansible Galaxy for community roles and configure dynamic inventory for cloud environments where servers scale automatically.

GalaxyAWSDynamic Inventory

Bonus

Idempotency Deep Dive

Understand why "desired state" thinking is the superpower that separates Ansible from bash scripts. Run playbooks 100 times safely.

IdempotencyBest Practices

🧪 Hands-on Labs

Real-World Exercises

Work through these lab exercises in GitHub Codespaces or any Linux environment. Each lab builds on the last.

🖥

Lab 1 — Your First Playbook

Install and manage Nginx on a local host

Beginner

Objective: Write a playbook that installs Nginx, ensures it's running, and demonstrates idempotency by running it twice.

yaml

---
- name: Install and start Nginx
  hosts: localhost
  become: yes
  tasks:
    - name: Install nginx
      apt:
        name: nginx
        state: present
    - name: Start nginx service
      service:
        name: nginx
        state: started
        enabled: yes

Steps

Create a file called webserver.yml and paste the playbook above

Run: ansible-playbook webserver.yml — note changed=1

Run it again — what does changed=0 tell you? That's idempotency!

📁

Lab 2 — Multi-Role Project

Build a webserver + mysql + app role structure

Intermediate

Objective: Create a full project with three separate roles — webserver (Nginx), mysql (database), and app (deployment) — each with its own tasks directory.

bash

# Create the role structure
mkdir -p roles/{webserver,mysql,app}/tasks
mkdir -p roles/mysql/vars

# Create the main playbook
touch playbook.yml inventory.ini

# Verify structure
tree roles/

Steps

Create the directory structure using the commands above

Write tasks in each role's main.yml

Reference all three roles in your playbook.yml

Run the playbook and verify all tasks complete successfully

🔐

Lab 3 — Ansible Vault

Encrypt database credentials with AES-256

Intermediate

Objective: Create a secrets file with database credentials, encrypt it with Ansible Vault, and configure your MySQL role to load it securely using include_vars.

bash

# Create secrets file
cat > roles/mysql/vars/secrets.yml << EOF
db_name: appdb
db_user: appuser
db_password: SuperSecret123!
EOF

# Encrypt it
ansible-vault encrypt roles/mysql/vars/secrets.yml

# Run playbook with vault
ansible-playbook -i inventory.ini playbook.yml \
  --ask-vault-pass

Steps

Create secrets.yml with plain text credentials

Run ansible-vault encrypt on the file

Add include_vars: vars/secrets.yml to your MySQL tasks

Run with --ask-vault-pass and confirm it works

🌐

Lab 4 — Ansible Galaxy

Use community roles for production-grade setup

Advanced

Objective: Create a requirements.yml file, install a Galaxy role from Jeff Geerling, and use it in your playbook instead of your custom Nginx role.

yaml

# requirements.yml
roles:
  - name: geerlingguy.nginx
  - name: geerlingguy.mysql

bash

# Install all roles at once
ansible-galaxy install -r requirements.yml

Steps

Create requirements.yml with the roles above

Install with ansible-galaxy install -r requirements.yml

Update your playbook to reference the Galaxy roles

Compare the Galaxy role with your custom one — what extra features does it have?

📋 Cheatsheet

Quick Reference

The most important Ansible commands you'll use every day.

▶ Running Playbooks

ansible-playbook playbook.yml

Run a playbook against inventory

ansible-playbook playbook.yml --check

Dry run — no changes made

ansible-playbook playbook.yml -v

Verbose output for debugging

ansible-playbook playbook.yml --ask-vault-pass

Run with encrypted vault files

🔐 Ansible Vault

ansible-vault encrypt file.yml

Encrypt a file

ansible-vault decrypt file.yml

Decrypt a file (use carefully!)

ansible-vault edit file.yml

Edit an encrypted file safely

ansible-vault view file.yml

View encrypted content

🌐 Ansible Galaxy

ansible-galaxy install role.name

Install a single role

ansible-galaxy install -r requirements.yml

Install all roles from file

ansible-galaxy list

List installed roles

ansible-galaxy init my_role

Scaffold a new role structure

🗃 Inventory & Hosts

ansible all -i inventory.ini -m ping

Ping all hosts

ansible-inventory --list

List all inventory hosts

ansible webservers -m command -a "uptime"

Run ad-hoc command on group

ansible all -m setup

Gather facts from all hosts

💡 Key Concepts

Core Concepts Explained

🔄

Idempotency

Running the same playbook multiple times produces the same result. Ansible checks "what should the state be?" not "what should I do?" — changed=0 is the goal.

📦

Roles

Reusable units of automation. Each role owns a specific part of your infrastructure — webserver, database, app — with its own tasks, vars, handlers and templates.

🗂

Inventory

The list of servers Ansible manages. Can be static (.ini files) for fixed infrastructure or dynamic (cloud APIs) for auto-scaling environments.

📝

Playbooks

YAML files that declare the desired state of your infrastructure. They define which tasks run on which hosts — the heart of all Ansible automation.

🔔

Handlers

Tasks that only run when notified by another task. Perfect for restarting services only when a config file actually changed — not on every run.

🔐

Ansible Vault

AES-256 encryption for sensitive data. Passwords, API keys, and tokens are encrypted at rest — the golden rule: never commit plain text secrets to Git.

🌐

Ansible Galaxy

The public marketplace for Ansible roles. Like npm for Node.js — download battle-tested roles for Nginx, MySQL, Docker instead of writing them from scratch.

⚙

Modules

The building blocks of Ansible tasks. apt, yum, service, copy, file, template — each module handles one specific operation on the managed node.

Master Ansible.
Automate Everything.

What You'll Learn

Real-World Exercises

Quick Reference

Core Concepts Explained

Meet Your Teacher

Master Ansible. Automate Everything.

What You'll Learn

Real-World Exercises

Quick Reference

Core Concepts Explained

Meet Your Teacher

Master Ansible.
Automate Everything.