Server Automation dengan Ansible
Mengotomasi konfigurasi server dengan Ansible: inventory, playbook, module, role, template, handler, dan vault.
Ansible mengotomasi konfigurasi server tanpa agent. Ia terhubung lewat SSH, menjalankan module, dan memastikan kondisi akhir sesuai playbook.
Konsep utama
| Konsep | Arti |
|---|---|
| Inventory | Daftar host yang dikelola |
| Playbook | Kumpulan play dan task |
| Task | Satu aksi (install paket, copy file) |
| Module | Implementasi aksi |
| Role | Kumpulan task/template/variable reusable |
| Handler | Task yang dipicu perubahan |
| Variable | Nilai konfigurasi |
| Vault | Enkripsi rahasia |
Instalasi
apt install -y ansible
ansible --versionInventory
inventory.ini:
[web]
app-1 ansible_host=10.10.10.11
app-2 ansible_host=10.10.10.12
[db]
db-1 ansible_host=10.10.10.20
[all:vars]
ansible_user=deploy
ansible_ssh_private_key_file=~/.ssh/id_ed25519Uji koneksi:
ansible all -i inventory.ini -m pingAd-hoc command
ansible web -i inventory.ini -m apt -a "name=nginx state=present" --become
ansible all -i inventory.ini -m command -a "uptime"Ad-hoc cocok untuk tugas cepat, bukan konfigurasi permanen.
Playbook pertama
site.yml:
- name: Konfigurasi web server
hosts: web
become: true
vars:
app_dir: /srv/app
app_port: 3000
tasks:
- name: Update cache apt
apt:
update_cache: true
cache_valid_time: 3600
- name: Install paket dasar
apt:
name:
- nginx
- curl
- ufw
state: present
- name: Izinkan SSH dan HTTP
ufw:
rule: allow
port: "{{ item }}"
proto: tcp
loop:
- "22"
- "80"
- "443"
- name: Aktifkan UFW
ufw:
state: enabled
- name: Buat direktori aplikasi
file:
path: "{{ app_dir }}"
state: directory
owner: deploy
group: deploy
mode: "0755"
- name: Copy konfigurasi Nginx
template:
src: templates/app.conf.j2
dest: /etc/nginx/conf.d/app.conf
mode: "0644"
notify: Reload nginx
handlers:
- name: Reload nginx
service:
name: nginx
state: reloadedJalankan:
ansible-playbook -i inventory.ini site.yml --check
ansible-playbook -i inventory.ini site.yml--check melakukan dry run.
Idempotensi
Playbook harus aman dijalankan berulang. Module Ansible umumnya idempotent:
apttidak install ulang jika sudah ada.filememastikan kondisi.templatehanya berubah jika isi berbeda.- Handler hanya jalan jika ada perubahan.
Hindari command/shell tanpa creates atau changed_when karena selalu dianggap berubah.
- name: Cek file konfigurasi
stat:
path: /etc/app/config.yml
register: config_file
- name: Generate config jika belum ada
template:
src: config.yml.j2
dest: /etc/app/config.yml
when: not config_file.stat.existsRole
Struktur role:
roles/
└─ nginx/
├─ tasks/main.yml
├─ handlers/main.yml
├─ templates/app.conf.j2
├─ defaults/main.yml
└─ vars/main.ymlPemakaian:
- hosts: web
become: true
roles:
- nginx
- appRole membuat playbook modular dan reusable.
Template Jinja2
templates/app.conf.j2:
server {
listen 80;
server_name {{ server_name }};
location / {
proxy_pass http://127.0.0.1:{{ app_port }};
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
}
}Variable di defaults/main.yml:
server_name: app.example.com
app_port: 3000Ansible Vault
Enkripsi rahasia:
ansible-vault create group_vars/all/vault.yml
ansible-vault edit group_vars/all/vault.yml
ansible-vault encrypt secrets.yml
ansible-vault decrypt secrets.ymlJalankan playbook:
ansible-playbook -i inventory.ini site.yml --ask-vault-passAtau gunakan vault password file dengan permission ketat.
Jangan simpan vault password di repository
Simpan password vault di tempat aman (password manager/CI secret). Tanpa password, file vault tidak bisa dibuka.
Deployment aplikasi
- name: Deploy aplikasi
hosts: web
become: true
vars:
image_tag: "{{ lookup('env', 'IMAGE_TAG') }}"
tasks:
- name: Pull image
command: "docker compose pull"
args:
chdir: /srv/app
- name: Jalankan Compose
command: "docker compose up -d"
args:
chdir: /srv/app
- name: Health check
uri:
url: http://127.0.0.1:3000/health
status_code: 200
retries: 10
delay: 3Praktik: hardening dasar dengan Ansible
- Buat inventory.
- Update paket.
- Buat user deploy.
- Pasang SSH key.
- Nonaktifkan login root/password.
- Aktifkan UFW.
- Pasang Fail2ban.
- Jalankan
--check, lalu apply. - Verifikasi dengan login SSH baru.
Ringkasan
- Ansible mengotomasi konfigurasi lewat SSH tanpa agent.
- Inventory, playbook, role, dan template membuat konfigurasi terstruktur.
- Idempotensi memastikan playbook aman diulang.
- Vault melindungi rahasia.
Selanjutnya
Masuk ke orkestrasi di Kubernetes Fundamentals.