Generate Ansible Playbooks for Infrastructure Automation

This skill provides expertise in creating Ansible playbooks, with deep knowledge of infrastructure automation, configuration management, and DevOps best practices, producing well-structured, secure, maintainable playbooks that follow Ansible conventions. Core principles cover playbook structure (consistent 2-space YAML indentation, clear task names and descriptions, proper variable scoping via group_vars/host_vars/defaults, standard directory structure, handlers for service restarts, and tags for selective task execution) and idempotency/safety (idempotent tasks by default, check_mode-compatible tasks, proper error handling with failed_when and ignore_errors, pre-change validation tasks, and --diff-friendly modules where possible).

Best practices cover security (Ansible Vault for sensitive data, least-privilege principles, input validation, no_log: true for sensitive operations, and preferring modules over raw shell/command) and performance (serial for rolling updates, async for long-running tasks, delegate_to for host-specific operations, and gather_facts: false when facts aren't needed). Playbook templates demonstrate a basic web server setup (package installation, application user creation, templated config deployment with handlers for start/reload) and a database configuration playbook with pre-task variable validation via assert before installing and configuring PostgreSQL.

Advanced patterns include rolling deployment (serial: "25%" with max_fail_percentage: 0, removing a server from the load balancer before deploying, health-checking after deployment, then re-adding it) and conditional execution with block/rescue for graceful error handling (e.g. configuring a firewall with a rescue block that logs failure). Configuration management covers variable precedence (group_vars/all.yml for global defaults, environment-specific group_vars, host_vars for host-specific overrides, and --extra-vars for runtime overrides), inventory organization (grouped hosts with host-specific and group-level variables, and nested group hierarchies like production:children), and error handling strategies (block/rescue/always for complex error handling, post-deployment health checks, rollback procedures for critical changes, custom failed_when conditions, and failure notification handlers). Testing and validation covers syntax checking (ansible-playbook --syntax-check), linting (ansible-lint, yamllint), and dry-run testing (ansible-playbook --check --diff).

Use this skill when writing or reviewing Ansible playbooks that need proper idempotency, security (Vault, no_log), rolling deployment safety, and structured error handling. It is well suited to infrastructure-as-code work targeting multiple hosts/environments via inventory groups. It is not meant for other configuration management tools (Puppet, Chef, Salt), or for a single manual server change with no repeatable automation need.

Input: the infrastructure task to automate - service configuration, application deployment, or database setup - and the target inventory.

Output: a complete, idempotent Ansible playbook with proper variable scoping, handlers, error handling, and (where applicable) rolling deployment logic. Example basic web server task:

tasks:
  - name: Install nginx
    package:
      name: nginx
      state: present
    notify: start nginx

handlers:
  - name: start nginx
    service:
      name: nginx
      state: started

Works with the Ansible toolchain directly - inventory files, group_vars/host_vars, Ansible Vault, and validation tools (ansible-lint, yamllint, --syntax-check).

DevOps and infrastructure engineers writing or reviewing Ansible playbooks, and teams that need idempotent, secure, rolling-deployment-safe automation across multi-host inventories.