Skip to content

Ansible Configuration Management

Status: Working reference assembled from BarnesBears setup sessions through October 2026. Validate inventory, versions, and role code on the live controller.

Controller

Item Value
Hostname ansible.barnesbears.xyz
Operating system Ubuntu Server 24.04.4 LTS (last observed)
Ansible ansible-core 2.21.2 (last observed)
Inventory /etc/ansible/hosts
Playbooks and roles /etc/ansible/
Web orchestration Semaphore UI

The controller uses Git to track its Ansible configuration. The specific remote repository and Semaphore storage/credential details should be verified before documenting them.

Inventory organization

Groups used during setup included:

Group Purpose
ubuntu, debian, arch OS-specific targeting
proxmox_vms Proxmox guest systems; original inventory used proxmox-vms
postfix SMTP relay configuration
zabbix_agent2 Zabbix Agent 2
chrony Time synchronization
Domain controllers ad-1, ad-2 (exact group name should be checked)

Group naming

Earlier inventory groups used hyphens (for example zabbix-agent2). Ansible warned about invalid characters, and these were subsequently renamed. Verify the actual inventory using ansible-inventory --graph; don't copy the historical group names blindly.

Hosts previously added or managed include traefik-1, prox-5, nextcloud, ad-2, ansible, and other infrastructure systems.

Roles

Role Responsibility
sshd SSH daemon hardening; template 10-ansible-sshd.conf.j2
proxmox_guest_agent Install/manage QEMU guest agent
postfix_relay Configure outbound SMTP via Brevo
zabbix_agent2 Agent installation, monitoring configuration, optional specialized checks
chrony Consistent NTP/time sources

SSH configuration

The sshd role deploys an SSH drop-in, validates syntax before reload, and uses handlers to avoid unnecessary restarts. Keep an existing console/session open when changing SSH settings.

Postfix relay

The relay role uses Brevo SMTP. Historical sender conventions include admin@barnesbears.xyz for generic hosts and proxmox@barnesbears.xyz for Proxmox. Credentials are stored with Ansible Vault; never commit decrypted secrets.

Zabbix Agent 2

The role detects target operating-system details rather than assuming every host is Ubuntu 24.04. It includes Traefik-specific checks and recovery configuration and Mobility Print queue monitoring on applicable hosts.

Chrony

The intended hierarchy prefers ad-1 as time source and ad-2 as fallback. Verify the live role variables and each host's active sources.

Inspect the current controller

ansible --version
ansible-config dump | grep '^DEFAULT_HOST_LIST'
ansible-inventory --graph
ansible-inventory --list > /tmp/barnesbears-inventory.json
cd /etc/ansible && git status --short

Review the inventory JSON before sharing it externally; it can include sensitive variables.

Safe playbook workflow

  1. Pull the latest reviewed Ansible repository changes.
  2. Confirm the inventory and intended host group.
  3. Validate playbook syntax.
  4. Run --check --diff when modules support it, ideally with --limit on a test host.
  5. Apply to a limited set of hosts.
  6. Confirm service health and Zabbix state.
  7. Roll out to the remaining group and commit the tested configuration.

Example, replacing the playbook and host group with real values:

cd /etc/ansible
ansible-playbook --syntax-check site.yml
ansible-playbook site.yml --check --diff --limit traefik-1
ansible-playbook site.yml --limit traefik-1

site.yml is illustrative, not a verified filename. Be aware that check mode is not a guarantee of safety or complete simulation.

Semaphore UI

Semaphore provides browser-based playbook execution. Check that its project references the current Git repository, inventory, SSH credentials, environment variables, and Vault secrets. Review execution output and permissions before allowing unattended runs.

Recovery

Restore the controller VM or rebuild Ansible and its dependencies; recover the Git repository, inventory, Vault password/key, SSH deployment credentials, and Semaphore configuration from protected backups. Revalidate connectivity and run a limited check-mode test before applying changes broadly.