Ansibleでサーバー構築を自動化する：インベントリ・Playbook・ロールの基本と実践

sudo apt install -y pipx
pipx install --include-deps ansible
pipx ensurepath        # ~/.local/bin をPATHに追加。シェルを開き直す
ansible --version

# 管理対象へ鍵を配布し、鍵だけで入れてsudoできることを確認
ssh-keygen -t ed25519 -f ~/.ssh/ansible -C "ansible control"
ssh-copy-id -i ~/.ssh/ansible.pub [email protected]
ssh -i ~/.ssh/ansible [email protected] 'sudo -n true && echo sudo OK'

[web]
web01 ansible_host=192.168.10.11
web02 ansible_host=192.168.10.12

[db]
db01 ansible_host=192.168.10.21

[homelab:children]
web
db

[homelab:vars]
ansible_user=admin
ansible_ssh_private_key_file=~/.ssh/ansible

[defaults]
inventory = ./inventory.ini
interpreter_python = auto_silent
forks = 10

[privilege_escalation]
become_method = sudo

$ ansible all -m ansible.builtin.ping
web01 | SUCCESS => {
    "changed": false,
    "ping": "pong"
}
（web02、db01も同様）

$ ansible all -a "uptime"
$ ansible web -m ansible.builtin.apt -a "name=nginx state=present" --become
$ ansible db01 -m ansible.builtin.setup -a "filter=ansible_memtotal_mb"

- name: Web servers
  hosts: web
  become: true
  vars:
    server_name: app.home.internal
  tasks:
    - name: Install nginx
      ansible.builtin.apt:
        name: nginx
        state: present
        update_cache: true
        cache_valid_time: 3600

    - name: Deploy site config
      ansible.builtin.template:
        src: templates/site.conf.j2
        dest: /etc/nginx/sites-available/{{ server_name }}.conf
        mode: "0644"
      notify: Reload nginx

    - name: Enable site
      ansible.builtin.file:
        src: /etc/nginx/sites-available/{{ server_name }}.conf
        dest: /etc/nginx/sites-enabled/{{ server_name }}.conf
        state: link
      notify: Reload nginx

    - name: Ensure nginx is running
      ansible.builtin.service:
        name: nginx
        state: started
        enabled: true

  handlers:
    - name: Reload nginx
      ansible.builtin.service:
        name: nginx
        state: reloaded

server {
    listen 80;
    server_name {{ server_name }};
    root /var/www/{{ server_name }};
{% if enable_gzip | default(true) %}
    gzip on;
{% endif %}
}

$ ansible-galaxy role init roles/hardening
roles/hardening/
├── defaults/main.yml   # 利用側に上書きさせたい既定値（優先度が最も低い）
├── files/              # copy モジュール用の静的ファイル
├── handlers/main.yml
├── meta/main.yml       # 依存ロールとメタ情報
├── tasks/main.yml
├── templates/          # template モジュール用の .j2
└── vars/main.yml       # ロール内で固定したい値（優先度が高い）

- name: Baseline for all hosts
  hosts: homelab
  become: true
  serial: 1            # 1台ずつ適用。締め出し事故を1台で止める
  roles:
    - role: hardening
      vars:
        admin_users: [ryoma]

# 暗号化ファイルを作る（エディタが開く）
ansible-vault create --vault-id homelab@prompt group_vars/all/vault.yml

# 1つの値だけ暗号化して、平文のYAMLに貼り付ける
ansible-vault encrypt_string --vault-id homelab@prompt 'S3cret!' --name 'vault_db_password'

# パスワードファイルで実行（ファイルは chmod 600 にして .gitignore へ）
ansible-playbook site.yml --vault-id homelab@~/.vault_pass_homelab

- name: Install packages
  ansible.builtin.apt:
    name: [ufw, fail2ban, unattended-upgrades]
    state: present
    update_cache: true

- name: Create admin users with sudo
  ansible.builtin.user:
    name: "{{ item }}"
    groups: sudo
    append: true
    shell: /bin/bash
  loop: "{{ admin_users }}"
  when: ansible_facts['distribution'] == 'Ubuntu'

- name: Harden sshd via drop-in
  ansible.builtin.copy:
    dest: /etc/ssh/sshd_config.d/50-hardening.conf
    content: |
      PasswordAuthentication no
      PermitRootLogin no
      KbdInteractiveAuthentication no
      MaxAuthTries 3
    mode: "0600"
    validate: sshd -t -f %s
  notify: Restart sshd

- name: Allow SSH (rate limited) before enabling ufw
  community.general.ufw:
    rule: limit
    port: "22"
    proto: tcp

- name: Enable ufw with default deny
  community.general.ufw:
    state: enabled
    policy: deny

- name: Enable fail2ban
  ansible.builtin.service:
    name: fail2ban
    state: started
    enabled: true

- name: Restart sshd
  ansible.builtin.service:
    name: ssh
    state: restarted

$ ansible-playbook site.yml --check --diff --limit web01
TASK [hardening : Harden sshd via drop-in] ****************************
--- before
+++ after: /home/me/.ansible/tmp/ansible-local-1234/tmpab12cd/source
@@ -0,0 +1,4 @@
+PasswordAuthentication no
+PermitRootLogin no
+KbdInteractiveAuthentication no
+MaxAuthTries 3
changed: [web01]
（中略）
PLAY RECAP ************************************************************
web01 : ok=8  changed=4  unreachable=0  failed=0  skipped=0  rescued=0  ignored=0

$ ansible-playbook site.yml --limit web01
$ ansible-playbook site.yml --limit web01     # 2回目
PLAY RECAP ************************************************************
web01 : ok=8  changed=0  unreachable=0  failed=0  skipped=0  rescued=0  ignored=0

$ ssh -o PreferredAuthentications=password [email protected]
[email protected]: Permission denied (publickey).   # パスワード認証が閉じた