Ansible cheat sheet

Ansible automates servers over SSH with no agent. Commands take an inventory (list of hosts) with -i. Always test with --check --diff first.

Click any command to copy it.

Ad-hoc commands

Command	What it does
`ansible all -i inventory.ini -m ping`	Test connectivity and Python on all hosts.
`ansible web -i inventory.ini -a "uptime"`	Run a command on the web group.
`ansible web -i inventory.ini -b -m apt -a "name=nginx state=present update_cache=yes"`	Install a package with sudo (become).
`ansible web -i inventory.ini -b -m service -a "name=nginx state=restarted"`	Restart a service.
`ansible all -i inventory.ini -m setup -a 'filter=ansible_distribution*'`	Show OS facts.
`ansible all -i inventory.ini -m copy -a 'src=file dest=/tmp/file'`	Copy a file to every host.

Command	What it does
`ansible-playbook -i inventory.ini site.yml`	Run a playbook.
`ansible-playbook -i inventory.ini site.yml --check --diff`	Dry run showing what would change.
`ansible-playbook site.yml --limit web1`	Run only on one host or group.
`ansible-playbook site.yml --tags nginx`	Run only tasks with a tag.
`ansible-playbook site.yml -e "version=1.2.3"`	Pass an extra variable.
`ansible-playbook site.yml --syntax-check`	Check the playbook for syntax errors.
`ansible-playbook site.yml --list-tasks`	List tasks without running them.
`ansible-playbook site.yml -vvv`	Very verbose output for debugging.
`ansible-playbook site.yml --start-at-task 'Task name'`	Resume from a specific task.

Command	What it does
`ansible-inventory -i inventory.ini --list`	Show the parsed inventory as JSON.
`ansible all -i inventory.ini --list-hosts`	List the hosts that would be targeted.
`[web] web1 ansible_host=203.0.113.10 web2 ansible_host=203.0.113.11 [web:vars] ansible_user=deploy`	Example inventory.ini file.
`ansible-config dump --only-changed`	Show settings that differ from the defaults.

Command	What it does
`ansible-vault create secrets.yml`	Create an encrypted file.
`ansible-vault edit secrets.yml`	Edit an encrypted file.
`ansible-vault encrypt vars.yml`	Encrypt an existing file.
`ansible-vault decrypt vars.yml`	Destructive: Decrypt a file in place, leaving secrets in plain text on disk.
`ansible-vault view secrets.yml`	Show the contents without saving them.
`ansible-playbook site.yml --ask-vault-pass`	Prompt for the vault password when running.

Command	What it does
`ansible-galaxy init myrole`	Create a role skeleton.
`ansible-galaxy install geerlingguy.nginx`	Install a role.
`ansible-galaxy collection install community.general`	Install a collection.
`ansible-doc apt`	Show documentation for a module.
`ansible-doc -l \| grep docker`	Search the list of modules.

Command	What it does
`--- - name: Configure web servers hosts: web become: true tasks: - name: Install nginx ansible.builtin.apt: name: nginx state: present update_cache: true - name: Ensure nginx is running ansible.builtin.service: name: nginx state: started enabled: true`	A minimal playbook that installs and starts nginx.

What does --check do?

It simulates the run and reports what would change without changing anything. Combine it with --diff to see file differences.

How do I stop Ansible from asking about SSH host keys?

Add each host to known_hosts first. Disabling host key checking works but removes protection against impersonation.