Extra vars (--extra-vars on command line)
Task vars
Block vars
Role vars
Inventory host vars
Inventory group vars
Role defaults

# playbook-level vars
vars:
    app_name: "futuretechzone"
    app_port: 3000
    db_name: "production_db"

# vars_files — separate variable files
vars_files:
    - vars/common.yml
    - vars/{{ ansible_os_family }}.yml  # Load OS-specific vars

# group_vars/webservers.yml — applies to all servers in 'webservers' group
nginx_worker_processes: auto
nginx_worker_connections: 1024
app_log_level: info

# group_vars/all.yml — applies to ALL servers
ntp_servers:
    - 0.pool.ntp.org
    - 1.pool.ntp.org
timezone: Asia/Kolkata

# host_vars/web-01.example.com.yml — host-specific variables
nginx_port: 443
ssl_enabled: true
server_id: 1

# templates/nginx-site.conf.j2

server {
    listen {{ nginx_port | default(80) }};
    server_name {{ server_name }};

    {% if ssl_enabled %}
    listen 443 ssl;
    ssl_certificate /etc/ssl/certs/{{ server_name }}.crt;
    ssl_certificate_key /etc/ssl/private/{{ server_name }}.key;
    {% endif %}

    location / {
        proxy_pass http://localhost:{{ app_port }};
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        {% if enable_cache | default(false) %}
        proxy_cache_valid 200 1m;
        {% endif %}
    }

    location /static/ {
        root /var/www/{{ app_name }};
        expires 1y;
        add_header Cache-Control "public, immutable";
    }

    access_log /var/log/nginx/{{ app_name }}_access.log;
    error_log  /var/log/nginx/{{ app_name }}_error.log;
}

tasks:
    - name: Create app directory
      file:
        path: /var/www/{{ app_name }}
        state: directory

    - name: Set config variable
      set_fact:
        config_file: "/etc/{{ app_name }}/config.yml"

    - name: Show all server facts
      debug:
        msg: |
            OS: {{ ansible_distribution }} {{ ansible_distribution_version }}
            CPU Cores: {{ ansible_processor_vcpus }}
            Memory: {{ ansible_memtotal_mb }}MB
            IP: {{ ansible_default_ipv4.address }}

roles/
└── nginx/
    ├── tasks/
    │   ├── main.yml        # Main tasks file
    │   ├── install.yml     # Installation tasks
    │   └── configure.yml   # Configuration tasks
    ├── handlers/
    │   └── main.yml        # Handlers (notify triggers)
    ├── templates/
    │   └── nginx.conf.j2   # Jinja2 configuration templates
    ├── files/
    │   └── ssl-params.conf # Static files to copy
    ├── vars/
    │   └── main.yml        # Role-specific variables
    ├── defaults/
    │   └── main.yml        # Default variable values (lowest priority)
    ├── meta/
    │   └── main.yml        # Role metadata and dependencies
    └── README.md

# roles/nginx/defaults/main.yml
nginx_port: 80
nginx_user: www-data
nginx_worker_processes: auto
nginx_worker_connections: 1024

# roles/nginx/tasks/main.yml
---
- name: Include installation tasks
  import_tasks: install.yml

- name: Include configuration tasks
  import_tasks: configure.yml

# roles/nginx/tasks/install.yml
---
- name: Install Nginx
  apt:
    name: nginx
    state: present
    update_cache: yes

- name: Ensure Nginx service is enabled
  service:
    name: nginx
    enabled: yes

# site.yml — main playbook using roles
---
- name: Configure Web Servers
  hosts: webservers
  become: true
  roles:
    - common           # Applied first (security, NTP, etc.)
    - nginx            # Install and configure Nginx
    - nodejs           # Install Node.js runtime
    - app              # Deploy the application

- name: Configure Database Servers
  hosts: databases
  become: true
  roles:
    - common
    - postgresql
    - pgbouncer

# Install a role from Ansible Galaxy
ansible-galaxy install geerlingguy.nginx
ansible-galaxy install geerlingguy.docker
ansible-galaxy install geerlingguy.postgresql

# Install from requirements file
# requirements.yml
roles:
    - name: geerlingguy.nginx
      version: "3.2.0"
    - name: geerlingguy.docker
      version: "6.1.0"

ansible-galaxy install -r requirements.yml

# Use installed role in playbook
- hosts: webservers
  roles:
    - geerlingguy.nginx

# deploy-app.yml — Deploy Node.js application
---
- name: Deploy FutureTechZone Application
  hosts: webservers
  become: true

  vars:
    app_name: futuretechzone
    app_dir: /var/www/{{ app_name }}
    app_user: deploy
    node_version: "20"
    git_repo: "https://github.com/myorg/futuretechzone.git"
    git_branch: "main"
    pm2_app_name: "{{ app_name }}"

  pre_tasks:
    - name: Ensure deployment user exists
      user:
        name: "{{ app_user }}"
        shell: /bin/bash
        create_home: yes

    - name: Ensure app directory exists
      file:
        path: "{{ app_dir }}"
        state: directory
        owner: "{{ app_user }}"
        recurse: yes

  tasks:
    - name: Clone or update application repository
      git:
        repo: "{{ git_repo }}"
        dest: "{{ app_dir }}"
        version: "{{ git_branch }}"
        force: yes
      become_user: "{{ app_user }}"
      notify: Restart Application

    - name: Create environment file
      template:
        src: templates/env.j2
        dest: "{{ app_dir }}/.env"
        owner: "{{ app_user }}"
        mode: "0600"
      notify: Restart Application

    - name: Install Node.js dependencies
      npm:
        path: "{{ app_dir }}"
        state: present
        production: yes
      become_user: "{{ app_user }}"

    - name: Build application
      shell: npm run build
      args:
        chdir: "{{ app_dir }}"
      become_user: "{{ app_user }}"

    - name: Run database migrations
      shell: npm run migrate
      args:
        chdir: "{{ app_dir }}"
      become_user: "{{ app_user }}"
      run_once: true    # Only run on first server

    - name: Check if PM2 app is running
      command: pm2 show {{ pm2_app_name }}
      register: pm2_status
      ignore_errors: yes
      changed_when: false
      become_user: "{{ app_user }}"

    - name: Start application with PM2 (if not running)
      shell: pm2 start ecosystem.config.js --env production
      args:
        chdir: "{{ app_dir }}"
      become_user: "{{ app_user }}"
      when: pm2_status.rc != 0

    - name: Save PM2 configuration
      shell: pm2 save
      become_user: "{{ app_user }}"
      changed_when: false

  handlers:
    - name: Restart Application
      shell: pm2 reload {{ pm2_app_name }}
      become_user: "{{ app_user }}"

  post_tasks:
    - name: Verify application is responding
      uri:
        url: "http://localhost:{{ app_port }}/health"
        status_code: 200
      retries: 5
      delay: 10

# Deploy with custom variables
ansible-playbook deploy-app.yml \
    -i inventory.yml \
    --extra-vars "git_branch=release/2.0 app_port=3001" \
    --limit production-web \
    -v

Terraform:
→ Create cloud infrastructure (EC2 instances, RDS, VPC, S3)
→ "Give me 5 Ubuntu servers on AWS"

Ansible:
→ Configure the infrastructure Terraform created
→ "Install Docker, Node.js, and deploy the app on those 5 servers"

Together:
1. Terraform creates the servers
2. Ansible configures them
3. CI/CD pipeline runs both automatically

# Good Ansible practices:

# 1. Use descriptive task names
- name: Install Nginx web server (not just "install nginx")
  apt:
    name: nginx
    state: present

# 2. Always use modules instead of shell when possible
# BAD:
- name: Install nginx
  shell: apt-get install -y nginx

# GOOD:
- name: Install nginx
  apt:
    name: nginx
    state: present

# 3. Use become: true at play level, not task level
- hosts: webservers
  become: true    # All tasks run as root

# 4. Use handlers for service restarts
# BAD — restarts after every change even if not needed:
- name: Copy config
  copy:
    src: nginx.conf
    dest: /etc/nginx/nginx.conf
- name: Restart Nginx
  service:
    name: nginx
    state: restarted

# GOOD — only restarts if config changed:
- name: Copy config
  copy:
    src: nginx.conf
    dest: /etc/nginx/nginx.conf
  notify: Restart Nginx

handlers:
    - name: Restart Nginx
      service:
        name: nginx
        state: restarted

# 5. Use vault for secrets
ansible-vault encrypt_string 'mySecretPassword' --name db_password
# Result: db_password: !vault | $ANSIBLE_VAULT;1.1;AES256 ...