{"id":26364962,"url":"https://github.com/kaalpanikh/configuration-management","last_synced_at":"2026-04-11T11:03:52.542Z","repository":{"id":276258450,"uuid":"928688292","full_name":"kaalpanikh/configuration-management","owner":"kaalpanikh","description":"Ansible-driven configuration management for secure web servers on AWS using Nginx and Let's Encrypt.","archived":false,"fork":false,"pushed_at":"2025-02-08T09:07:41.000Z","size":28,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-07-19T21:29:00.687Z","etag":null,"topics":["ansible","automation","aws","configuration-management","devops","nginx","ssl"],"latest_commit_sha":null,"homepage":"https://ansible.nikhilmishra.live","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/kaalpanikh.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2025-02-07T03:54:41.000Z","updated_at":"2025-02-08T09:07:44.000Z","dependencies_parsed_at":null,"dependency_job_id":"9b079051-648a-467e-95bb-3a5a21bb8959","html_url":"https://github.com/kaalpanikh/configuration-management","commit_stats":null,"previous_names":["kaalpanikh/configuration-management"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/kaalpanikh/configuration-management","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kaalpanikh%2Fconfiguration-management","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kaalpanikh%2Fconfiguration-management/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kaalpanikh%2Fconfiguration-management/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kaalpanikh%2Fconfiguration-management/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/kaalpanikh","download_url":"https://codeload.github.com/kaalpanikh/configuration-management/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kaalpanikh%2Fconfiguration-management/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":31677819,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-11T08:18:19.405Z","status":"ssl_error","status_checked_at":"2026-04-11T08:17:08.892Z","response_time":54,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ansible","automation","aws","configuration-management","devops","nginx","ssl"],"created_at":"2025-03-16T19:28:50.332Z","updated_at":"2026-04-11T11:03:52.526Z","avatar_url":"https://github.com/kaalpanikh.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Ansible Configuration Management Project\n\nThis project demonstrates how to use Ansible for server configuration management, specifically setting up a web server with Nginx and SSL. It follows the project requirements from [roadmap.sh's Configuration Management Project](https://roadmap.sh/projects/configuration-management).\n\n## Project Overview\n\nWe use Ansible to configure two AWS EC2 instances:\n1. **Control Node**: Amazon Linux 2023 instance that runs Ansible\n2. **Target Node**: Ubuntu instance that hosts our website\n\nThe project automates the following:\n- Basic server setup and security\n- Nginx web server installation and configuration\n- SSL certificate setup using Let's Encrypt\n- Website deployment from a Git repository\n\n## Project Result\n\n![SSL Proof](images/ssl-proof.png)\n\nSuccessfully set up a secure website with:\n- HTTPS encryption using Let's Encrypt SSL\n- Automatic HTTP to HTTPS redirection\n- Modern security headers\n- Automated certificate renewal\n\nThe website is securely accessible at https://ansible.nikhilmishra.live\n\n## Learning Resources\n\nFor a deep dive into this project:\n- Check out [LEARNING_GUIDE.md](LEARNING_GUIDE.md) for a comprehensive understanding of:\n  * Complete project implementation details\n  * Technical concepts and best practices\n  * Real-world applications and scaling\n  * Maintenance and troubleshooting\n  * Advanced topics and improvements\n\n## Prerequisites\n\n1. **AWS Account** with two EC2 instances:\n   - Control Node: Amazon Linux 2023\n   - Target Node: Ubuntu\n\n2. **SSH Keys** for both instances:\n   - Control Node: `~/.ssh/my_first_key`\n   - Target Node: `~/.ssh/roadmapsh-ansible-key.pem`\n\n3. **Domain Name** pointing to the target node's IP address\n   - Our example uses: ansible.nikhilmishra.live\n\n## Server Migration Guide\n\nThis project supports easy server migration scenarios. Here's how to handle different migration cases:\n\n### Target Node Migration with Control Node IP Update\n\nWhen you need to:\n- Deploy to a new target server\n- Update control node's IP (same server, new IP)\n- Use a new domain name\n\nFollow these steps:\n\n1. **Update Configuration Files**:\n   ```bash\n   # 1. inventory.ini - Update IPs\n   [aws_servers]\n   aws_instance ansible_host=\u003cNEW_TARGET_IP\u003e ...\n   control_node ansible_host=\u003cNEW_CONTROL_IP\u003e ...\n\n   # 2. roles/nginx/tasks/main.yml - Update domain\n   certbot --nginx -d \u003cNEW_DOMAIN\u003e ...\n\n   # 3. roles/nginx/templates/default-site.conf.j2\n   server_name \u003cNEW_DOMAIN\u003e;\n   ```\n\n2. **DNS Configuration**:\n   - Update A record for new domain → new target IP\n   - Wait for DNS propagation\n\n3. **Deploy**:\n   ```bash\n   # Copy files to control node\n   ./copy_to_control.sh\n\n   # SSH and run playbook\n   ssh -i ~/.ssh/my_first_key ec2-user@\u003cNEW_CONTROL_IP\u003e\n   cd ~/ansible-project\n   ansible-playbook setup.yml -i inventory.ini\n   ```\n\nThis approach demonstrates the power of Infrastructure as Code (IaC):\n- Configurations are reusable\n- Deployments are consistent\n- Migration is streamlined\n- No manual server setup needed\n\n## Project Structure\n\n```\nconfiguration-management/\n├── inventory.ini           # Defines our servers\n├── setup.yml              # Main playbook\n├── requirements.txt       # Python dependencies\n└── roles/\n    ├── base/             # Basic server setup\n    │   ├── tasks/\n    │   └── handlers/\n    ├── nginx/            # Nginx web server\n    │   ├── tasks/\n    │   ├── handlers/\n    │   └── templates/\n    ├── app/              # Website deployment\n    │   ├── tasks/\n    │   └── defaults/\n    └── ssh/              # SSH configuration\n        ├── tasks/\n        └── handlers/\n```\n\n## Role Descriptions\n\n1. **Base Role**\n   - Updates system packages\n   - Installs essential tools\n   - Sets up security (UFW/firewalld, fail2ban)\n   - Installs certbot for SSL\n\n2. **Nginx Role**\n   - Installs and configures Nginx\n   - Sets up server blocks\n   - Configures SSL with Let's Encrypt\n   - Adds security headers\n\n3. **App Role**\n   - Creates web directory\n   - Deploys website from Git\n   - Sets proper permissions\n\n4. **SSH Role**\n   - Configures SSH security\n   - Manages SSH keys\n   - Sets up proper permissions\n\n## Getting Started\n\n1. **Clone the Repository**\n   ```bash\n   git clone https://github.com/kaalpanikh/configuration-management.git\n   cd configuration-management\n   ```\n\n2. **Update Inventory**\n   - Edit `inventory.ini` with your EC2 instances' details\n   - Update SSH key paths\n\n3. **Copy Files to Control Node**\n   ```bash\n   ./copy_to_control.sh\n   ```\n\n4. **Run the Playbook**\n   ```bash\n   cd ~/ansible-project\n   ansible-playbook setup.yml -i inventory.ini\n   ```\n\n## What the Playbook Does\n\n1. **Basic Setup** (base role)\n   - Updates system packages\n   - Installs security tools\n   - Configures firewall rules\n   - Sets up fail2ban for security\n\n2. **Web Server** (nginx role)\n   - Installs Nginx\n   - Creates server configuration\n   - Obtains SSL certificate\n   - Sets up automatic SSL renewal\n\n3. **Website Deployment** (app role)\n   - Clones website from Git\n   - Sets proper permissions\n   - Configures web root\n\n4. **SSH Security** (ssh role)\n   - Configures SSH daemon\n   - Sets up key-based authentication\n   - Applies security best practices\n\n## Security Features\n\n1. **Firewall Configuration**\n   - UFW on Ubuntu\n   - Only ports 22 (SSH), 80 (HTTP), and 443 (HTTPS) are open\n\n2. **SSL/TLS**\n   - Automatic SSL certificate from Let's Encrypt\n   - HTTP to HTTPS redirection\n   - Modern SSL security settings\n\n3. **Server Hardening**\n   - fail2ban for brute force protection\n   - Secure SSH configuration\n   - Security headers in Nginx\n\n## Maintenance\n\n- SSL certificates automatically renew via cron job\n- System packages can be updated by re-running the playbook\n- Website updates by pushing to the Git repository\n\n## Troubleshooting\n\n1. **SSH Connection Issues**\n   - Verify security group rules\n   - Check SSH key permissions (should be 600)\n   - Ensure proper key paths in inventory\n\n2. **SSL Certificate Issues**\n   - Verify domain DNS settings\n   - Check nginx configuration\n   - Review certbot logs\n\n3. **Website Not Loading**\n   - Check nginx status\n   - Verify website files in /var/www/html\n   - Check nginx error logs\n\n## Contributing\n\nFeel free to submit issues and enhancement requests!\n\n## License\n\nThis project is licensed under the MIT License - see the LICENSE file for details.","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkaalpanikh%2Fconfiguration-management","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fkaalpanikh%2Fconfiguration-management","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkaalpanikh%2Fconfiguration-management/lists"}