Ansible Server Repository

This repository manages server instances and roles using a unified configuration.

Quick start

• Define server aliases and host mapping in inventory/group_vars/all.yml.
• Add instances to inventory/instance_vars/instances.yml with server: <alias> and reference passwords as {{ mysql_passwords['user__domain'] }}.
• Store MySQL passwords in the vaulted file inventory/hosts/group_vars/all/mysql_passwords.yml using the key pattern username__domain.

Run

• All hosts: ansible-playbook -i inventory/hosts create_instances.yml --check --diff
• With Vault prompt: --ask-vault-pass or with file: --vault-password-file .vault_pass.txt
• Limit to one host: -l sv01.server.ktrion.de

Key files

• create_instances.yml filters instances per host by resolved alias.
• inventory/group_vars/all.yml holds aliases and FQDN mappings.
• inventory/instance_vars/instances.yml is the single source of instances.
• inventory/hosts/group_vars/all/mysql_passwords.yml contains vaulted MySQL passwords.
• inventory/hosts/group_vars/all/mail_passwords.yml contains vaulted Mail/IMAP passwords.

Mail passwords (mail_local)

• Add password hashes to inventory/hosts/group_vars/all/mail_passwords.yml using keys:
  • <username>__<domainname>__system
  • <username>__<domainname>__mail
• Hash generation:
  • System hash: openssl passwd -6
  • Dovecot hash: doveadm pw -s SHA512-CRYPT
• Edit via Vault: ansible-vault edit inventory/hosts/group_vars/all/mail_passwords.yml
• Script to set a mail password (Vault required):
  • scripts/set_mail_password.sh <username> <domain> [password]
  • Optional: FILE=inventory/hosts/group_vars/all/mail_passwords.yml

Contributing

• Keep playbooks idempotent and use FQCN modules (ansible.builtin.*).
• Validate with --check --diff; lint with ansible-lint and yamllint if available.