Variables, Facts, and Jinja2 Templates

1. 1

   Split hosts into environments

   Groups can contain groups with :children. Now web1 is in web and dev; web2 is in web and prod, and each picks up its environment's variables.

   [dev]
   web1
   
   [prod]
   web2
   
   [web:children]
   dev
   prod
   
   [web:vars]
   ansible_connection=community.docker.docker

2. 2

   Defaults for everyone, overrides for prod

   Group files are named after the group. Prod gets two upstream app servers and a stricter body size; dev inherits the defaults.

   env: dev
   listen_port: 80
   client_max_body_size: 10m
   upstreams:
     - 127.0.0.1:8080
   admin_users: []

3. 3

   Prod overrides

   Only the values that differ. Everything else still comes from all.yml.

   env: prod
   client_max_body_size: 2m
   upstreams:
     - 10.20.10.21:8080
     - 10.20.10.22:8080
   admin_users:
     - amira
     - raj

4. 4

   Turn the config into a template

   A loop renders one server line per upstream; facts size the worker count; a comment header warns humans not to hand-edit. ansible_managed is a built-in string for exactly that.

   # {{ ansible_managed }}  (env: {{ env }})
   upstream shoplite_app {
   {% for u in upstreams %}
       server {{ u }};
   {% endfor %}
   }
   
   server {
       listen {{ listen_port }} default_server;
       client_max_body_size {{ client_max_body_size }};
       location /healthz { return 200 "ok {{ inventory_hostname }}\n"; }
       location / {
           proxy_pass http://shoplite_app;
           proxy_set_header Host $host;
       }
   }

5. 5

   Use the template, a loop, a condition, and register

   template replaces copy. loop creates one user per list item. when skips the task entirely when the list is empty (dev). register saves a task's result into a variable, and debug prints it, which is the usual way to inspect what a module returned.

   - name: Configure ShopLite web servers
     hosts: web
     become: true
   
     tasks:
       - name: Install nginx
         ansible.builtin.apt: { name: nginx, state: present, update_cache: true, cache_valid_time: 3600 }
   
       - name: Render the ShopLite site
         ansible.builtin.template:
           src: templates/shoplite.conf.j2
           dest: /etc/nginx/sites-available/default
           mode: "0644"
         notify: Reload nginx
   
       - name: Create admin users
         ansible.builtin.user:
           name: "{{ item }}"
           groups: sudo
           append: true
           shell: /bin/bash
         loop: "{{ admin_users }}"
         when: admin_users | length > 0
   
       - name: Check nginx version
         ansible.builtin.command: nginx -v
         register: nginx_version
         changed_when: false
   
       - name: Show what we're running
         ansible.builtin.debug:
           msg: "{{ inventory_hostname }} ({{ env }}, {{ ansible_facts.processor_vcpus }} vCPU) → {{ nginx_version.stderr }}"
   
       - name: Ensure nginx is running
         ansible.builtin.service: { name: nginx, state: started }
   
     handlers:
       - name: Reload nginx
         ansible.builtin.service: { name: nginx, state: reloaded }

6. 6

   Run it and compare the two environments

   Same playbook, different results per group. ansible-inventory --host shows the final merged variables for a host, which is the fastest way to debug 'why does prod have this value?'.

   terminalcopy cmd

   $ ansible-playbook site.yml --diff

   ansible-inventory --host web2 | grep -A3 upstreams

   docker exec web2 grep server /etc/nginx/sites-available/default

   ── expected output ──

   TASK [Create admin users] ***

   skipping: [web1] => (item=...)

   changed: [web2] => (item=amira)

   changed: [web2] => (item=raj)

    

   TASK [Show what we're running] ***

   ok: [web1] => { "msg": "web1 (dev, 4 vCPU) → nginx version: nginx/1.24.0 (Ubuntu)" }

   ok: [web2] => { "msg": "web2 (prod, 4 vCPU) → nginx version: nginx/1.24.0 (Ubuntu)" }

   ...

   "upstreams": [

   "10.20.10.21:8080",

   "10.20.10.22:8080"

   server 10.20.10.21:8080;

   server 10.20.10.22:8080;

Make each change, run the command, and read the error before revealing the diagnosis. Recognising these messages on sight is what makes you fast on a real team. Undo the change afterwards.