{"id":13766585,"url":"https://github.com/CentOS/ansible-infra-playbooks","last_synced_at":"2025-05-10T22:31:14.249Z","repository":{"id":41990191,"uuid":"165660726","full_name":"CentOS/ansible-infra-playbooks","owner":"CentOS","description":null,"archived":false,"fork":false,"pushed_at":"2024-11-18T16:05:27.000Z","size":266,"stargazers_count":63,"open_issues_count":2,"forks_count":21,"subscribers_count":14,"default_branch":"master","last_synced_at":"2025-02-25T00:37:02.105Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Jinja","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/CentOS.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-01-14T12:50:04.000Z","updated_at":"2025-02-13T10:03:06.000Z","dependencies_parsed_at":"2024-02-08T11:28:00.874Z","dependency_job_id":"55b8a7a4-85d4-43ae-96a2-2a72384216d3","html_url":"https://github.com/CentOS/ansible-infra-playbooks","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CentOS%2Fansible-infra-playbooks","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CentOS%2Fansible-infra-playbooks/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CentOS%2Fansible-infra-playbooks/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CentOS%2Fansible-infra-playbooks/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/CentOS","download_url":"https://codeload.github.com/CentOS/ansible-infra-playbooks/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":253492529,"owners_count":21916959,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-03T16:00:57.798Z","updated_at":"2025-05-10T22:31:13.644Z","avatar_url":"https://github.com/CentOS.png","language":"Jinja","funding_links":[],"categories":["Automation"],"sub_categories":["Ansible"],"readme":"# CentOS.org Ansible Infra playbooks\n\nJust a placeholder for the Ansible playbooks used in the CentOS Infrastructure.\nMainly divided into :\n\n * playbooks only including role (and so applied based on group membership)\n * ad-hoc tasks playbooks, called on demand when needed\n\n## Contributing to Ansible infra (playbooks or roles)\nWhen you want to contribute to playbooks or roles, you should always open a merge request (PR) against `staging` branch and not `master` branch.\nOne reviewer from the correct org will then get notification and will discuss/review your PR and eventually guide you.\nIdeally just look at the common way roles are organised, to reuse other roles and convention.\nAlways have default variables for *Everything*, with safe default values (of course never the ones deployed for staging/prod)\nWhen proposing a change in the behaviour, always make that change a opt-in, that defaults to \"no\" (safest) so that only that change would be applied on other nodes *if* variable used to include that task would be turned on. Of course we can have on real needs a default to `True` if we know that such change would need to be replicated by default on all nodes controlled by Ansible and using that role.\n\n##  Naming convention\n### Roles (regular playbooks used at regular interval)\nThe playbooks that will be played for roles will start with `role-\u003crole_name\u003e`\nA all-in-one roles-all.yml will just include all the role-\u003crole_name\u003e.yml when we want to just ensure the whole infra is configured the way it should.\nEach playbook for a role target a group called `hostgroup-role-\u003crole_name\u003e`. \n\nThere a small exceptions where some role-\u003crole_name\u003e playbooks will be small variants of a role, so also with other tasks to call specific tasks for an existing role (so when for example a vhost for httpd is a variant of the httpd role)\n\n#### \"pre-flight\" check\nFor each playbook configuring a role, there is an option (in case of) to end the play if we have to.\nBasically touching /etc/no-ansible on a managed node would ensure that the playbook is ended. That permits to have (in emergency for example) someone having a look at a node and ensuring that ansible doesn't modify the node at the same time. After each role configuration, a file is also created (monitored by Zabbix) to ensure that nodes are always configured as they have to\n\n\n### Deploy (on demand/triggered)\nDeploy playbooks (can combine also other playbooks) can be named `deploy-\u003cfunction\u003e`\n\n\n### Ad-Hoc tasks (on demand/triggered)\nSimple ad-hoc playbooks can just be named/start with `adhoc-\u003cfunction\u003e`.\nThose specific playbooks can need some tasks/vars/handlers, so for those special ones (as each role has it own set) we'll include those in the same repository, but it's up to the process deploying those for the ansible-host role to setup correctly the needed symlinks for the normal hierarchy.\n\n## Complete needed structure (needed on ansible mgmt node)\nThe \"on-disk\" ansible directory should then look like this :\n\n```\n.\n├── ansible.cfg\n├── files -\u003e playbooks/files\n├── handlers -\u003e playbooks/handlers\n├── filestore\n├── inventory\n├── pkistore\n├── playbooks\n│   ├── files\n│   ├── handlers\n│   ├── requirements.yml\n│   └── vars\n│   └── templates\n├── roles\n│   ├── \u003crole-name\u003e\n└── templates -\u003e playbooks/templates\n└── vars -\u003e playbooks/vars\n\n```\n\n## Ansible roles setup\nAll roles will be deployed for a list of individual git repositories, each one being its own role.\nA requirements.yml file will be used to declare which roles (and from where to get them) and so downloaded on the ansible host through ansible-galaxy\n\n## Inventory and encrypted files\nInventory is itself a different git repository, git-crypted and that will be checked-out on the ansible host\nSame for the two following git (crypted) repositories:\n * pkistore (holding some PKI key/certs)\n * filestore (holding some other files/secrets that aren't templates but that should be crypted/non public, so not in roles either)\n\n## License\nMIT (see [LICENSE file](LICENSE) )\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FCentOS%2Fansible-infra-playbooks","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FCentOS%2Fansible-infra-playbooks","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FCentOS%2Fansible-infra-playbooks/lists"}