Host *
  User ansible
  Port 22
  IdentityFile /path/ssh/private_key
  LogLevel INFO
  Compression yes
  ForwardAgent yes
  ForwardX11 yes

Host bastion
   User username
   Hostname bastion.example.com

Host private-server-*.example.com
   ProxyJump bastion

ansible_user: vagrant
ansible_ssh_common_args: -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ProxyCommand="ssh -p 22 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -W %h:%p -q vagrant@bastion"

ungrouped:
  hosts:
    mail.example.com:
dbservers:
  hosts:
    foo.example.com:
    bar.example.com:
webservers:
  hosts:
    www[01:50:2].example.com:
    webserver01:
      ansible_host: 192.0.2.140
      http_port: 80
    webserver02:
      ansible_host: 192.0.2.150
      http_port: 443
  vars:
    ansible_user: my_server_user
    ntp_server: ntp.atlanta.example.com
east:
  hosts:
    foo.example.com:
    one.example.com:
    two.example.com:
west:
  hosts:
    bar.example.com:
    three.example.com:
prod:
  children:
    east:
test:
  children:
    west:

ungrouped:
  hosts:
    localhost:
      host: 127.0.0.1
      ansible_connection: local
      ansible_python_interpreter: /usr/bin/env python3

- name: Update OS of servers
  hosts: webservers
  become: true
  gather_facts: false

  tasks:
    - name: Collects facts
      ansible.builtin.setup:
        fact_path: /custom/facts/path/
        gather_subset: !all,min

- hosts: 127.0.0.1
  connection: local

- name:
    ansible.builtin.command:
      cmd: hostname
    delegate_to: remote_host

- hosts: app_servers
  tasks:
    - name: gather facts from db servers
      setup:
      delegate_to: "{{ item }}"
      delegate_facts: True
      loop: "{{ groups['dbservers'] }}"

- name: Local action
  local_action:
    module: ansible.builtin.command
    cmd: hostname

- name: Send summary mail
  local_action:
    module: community.general.mail
    subject: "Summary Mail"
    to: "{{ mail_recipient }}"
    body: "{{ mail_body }}"
  run_once: True

- hosts: localhost
  gather_facts: no

  tasks:
    - name: Apply tags to only this task (include_role)
      include_role:
        name: example
        apply:
          tags:
            - install
      tags:
        - install

    - debug:
        msg: "include_role completed"
      tags:
        - install

    - name: Apply tags to tasks inside the role (import_role)
      import_role:
        name: example
      tags:
        - install

tasks:
  - name: Test my module
    gigix.demo.mymodule:
      number: 11

  roles:
  - gigix.demo.myrole

tasks:
  - name: Test my module
    mymodule:
      number: 11

  roles:
  - myrole

id: "{{ (openstack_networks | default({})).id | default(omit) }}"

id: "{{ omit if openstack_networks.id is not defined else openstack_networks.id }}"

- name: Touch files with an optional mode
  ansible.builtin.file:
    dest: "{{ item.path }}"
    state: touch
    mode: "{{ item.mode | default(omit) }}"
  loop:
    - path: /tmp/foo
    - path: /tmp/bar
    - path: /tmp/baz
      mode: "0444"

demo_variable: "{{ undef(hint='Please provide a demo variable') }}"

loop_control:
  extended: true

- name: Fail if return code is not 0
  ansible.builtin.fail:
    msg: "The command ({{ item.cmd }}) did not have a 0 return code"
  when: item.rc != 0
  loop: "{{ echo.results }}"

- name: Place the result of the current item in the variable
  ansible.builtin.shell: echo "{{ item }}"
  loop:
    - one
    - two
  register: echo
  changed_when: echo.stdout != "one"

- name: Retry a task until a certain condition is met
  ansible.builtin.shell: /usr/bin/foo
  register: result
  until: result.stdout.find("all systems go") != -1
  retries: 5
  delay: 10

- name: Show all the hosts matching the pattern, ie all but the group www
  ansible.builtin.debug:
    msg: "{{ item }}"
  loop: "{{ query('inventory_hostnames', 'all:!www') }}"

- name: Create servers
  digital_ocean:
    name: "{{ item.name }}"
    state: present
  loop:
    - name: server1
      disks: 3gb
      ram: 15Gb
      network:
        nic01: 100Gb
        nic02: 10Gb
        ...
  loop_control:
    label: "{{ item.name }}"

- name: Create servers, pause 3s before creating next
  community.digitalocean.digital_ocean:
    name: "{{ item }}"
    state: present
  loop:
    - server1
    - server2
  loop_control:
    pause: 3

loop: "{{ query('inventory_hostnames', 'all') }}"
loop: "{{ lookup('inventory_hostnames', 'all', wantlist=True) }}"

when: inventory_hostname != 'hostname_to_exclude'

- name: Register a variable, ignore errors and continue
  ansible.builtin.command: /bin/false
  register: result
  ignore_errors: true

- name: Run only if the task that registered the "result" variable fails
  ansible.builtin.command: /bin/something
  when: result is failed

- name: Run only if the task that registered the "result" variable succeeds
  ansible.builtin.command: /bin/something_else
  when: result is succeeded

- name: Run only if the task that registered the "result" variable is skipped
  ansible.builtin.command: /bin/still/something_else
  when: result is skipped

- name: Run only if the task that registered the "result" variable changed something.
  ansible.builtin.command: /bin/still/something_else
  when: result is changed

- include_tasks: other_tasks.yml
  when: x is not defined

- name: Fail if "bar" is undefined
  ansible.builtin.fail: msg="Bailing out. This play requires 'bar'"
  when: bar is undefined

- name: Shut down CentOS 6 and Debian 7 systems
  ansible.builtin.command: /sbin/shutdown -t now
  when: (ansible_facts['distribution'] == "CentOS" and ansible_facts['distribution_major_version'] == "6") or
        (ansible_facts['distribution'] == "Debian" and ansible_facts['distribution_major_version'] == "7")

- name: Get the CPU temperature
  set_fact:
    temperature: "{{ ansible_facts['cpu_temperature'] }}"

- name: Restart the system if the temperature is too high
  when: temperature | float > 90
  shell: "reboot"

- name: Run with items greater than 5
  ansible.builtin.command: echo {{ item }}
  loop: [ 0, 2, 4, 6, 8, 10 ]
  when: item > 5

ignore_errors: true
ignore_unreachable: true

- name: Check if a file exists in temp and fail task if it does
  ansible.builtin.command: ls /tmp/this_should_not_be_here
  register: result
  failed_when:
    - result.rc == 0 or result.rc >= 10
    - '"No such" not in result.stdout'

- name: example of many failed_when conditions with OR
  ansible.builtin.shell: "./myBinary"
  register: ret
  failed_when: >
    ("No such file or directory" in ret.stdout) or
    (ret.stderr != '') or
    (ret.rc == 10)

- name: Report 'changed' when the return code is not equal to 2
  ansible.builtin.shell: /usr/bin/billybass --mode="take me to the river"
  register: bass_result
  changed_when: "bass_result.rc != 2"

- name: This will never report 'changed' status
  ansible.builtin.shell: wall 'beep'
  changed_when: False

- name: Combine multiple conditions to override 'changed' result
  ansible.builtin.command: /bin/fake_command
  register: result
  ignore_errors: True
  changed_when:
    - '"ERROR" in result.stderr'
    - result.rc == 2

- name: Run this command and ignore the result
  ansible.builtin.shell: /usr/bin/somecommand || /bin/true

- hosts: somehosts
  any_errors_fatal: true
  roles:
    - myrole

- hosts: somehosts
  tasks:
    - block:
        - include_tasks: mytasks.yml
      any_errors_fatal: true

- name: This task will always make changes to the system
  ansible.builtin.command: /something/to/run --even-in-check-mode
  check_mode: false

- name: This task will never make changes to the system
  ansible.builtin.lineinfile:
    line: "important config"
    dest: /path/to/myconfig.conf
    state: present
  check_mode: true
  register: changes_to_important_config

- name: This task will be skipped in check mode
  ansible.builtin.git:
    repo: ssh://[email protected]/mylogin/hello.git
    dest: /home/mylogin/hello
  when: not ansible_check_mode

- name: This task will ignore errors in check mode
  ansible.builtin.git:
    repo: ssh://[email protected]/mylogin/hello.git
    dest: /home/mylogin/hello
  ignore_errors: "{{ ansible_check_mode }}"

- name: This task will not report a diff when the file changes
  ansible.builtin.template:
    src: secret.conf.j2
    dest: /etc/secret.conf
    owner: root
    group: root
    mode: '0600'
  diff: false

- name: Attempt and graceful roll back demo
  block:
    - name: Print a message
      ansible.builtin.debug:
        msg: 'I execute normally'

    - name: Force a failure
      ansible.builtin.command: /bin/false

    - name: Never print this
      ansible.builtin.debug:
        msg: 'I never execute, due to the above task failing, :-('
  rescue:
    - name: Print when errors
      ansible.builtin.debug:
        msg: 'I caught an error'

    - name: Force a failure in middle of recovery! >:-)
      ansible.builtin.command: /bin/false

    - name: Never print this
      ansible.builtin.debug:
        msg: 'I also never execute :-('
  always:
    - name: Always do this
      ansible.builtin.debug:
        msg: "This always executes"

- name: without timeout (check every 2 seconds if the task has finished with a timeout set to 10s)
  ansible.builtin.command:
    cmd: sleep 2
  async: 10
  poll: 2
  changed_when: false

- name: With timeout (check every 1 second to a timeout set to 1 sec)
  ansible.builtin.command:
    cmd: sleep 2
  async: 1
  poll: 1
  changed_when: false

- name: Show extracted list of keys from a list of dictionaries
  ansible.builtin.debug:
    msg: "{{ chains | map('extract', chains_config) | map(attribute='configs') | flatten | map(attribute='type') | flatten | unique }}"
  vars:
    chains: [1, 2]
    chains_config:
        1:
            foo: bar
            configs:
                - type: routed
                  version: 0.1
                - type: bridged
                  version: 0.2
        2:
            foo: baz
            configs:
                - type: routed
                  version: 1.0
                - type: bridged
                  version: 1.1

- name: Enable a list of Windows features, by name
  ansible.builtin.set_fact:
    win_feature_list: "{{ namestuff | reject('equalto', omit) | list }}"
  vars:
    namestuff:
      - "{{ (fs_installed_smb_v1 | default(False)) | ternary(omit, 'FS-SMB1') }}"
      - "foo"
      - "bar"

- name: Output mount facts grouped by device name
  ansible.builtin.debug:
    var: ansible_facts.mounts | community.general.groupby_as_dict('device')

- name: Output mount facts grouped by mount point
  ansible.builtin.debug:
    var: ansible_facts.mounts | community.general.groupby_as_dict('mount')

- name: Async (no wait)
  ansible.builtin.command:
    cmd: sleep 10
  async: 20
  poll: 0
  register: _full_async
  changed_when: false

- name: Wait full async task
  ansible.builtin.async_status:
    jid: "{{ _full_async.ansible_job_id }}"
  register: _async_result
  until: _async_result.finished
  retries: 10
  delay: 10

- name: Create MySQL client config (Debian os family)
  copy:
    dest: "/root/.my.cnf"
    content: |
      [client]
      user=root
      password={{ root_password }}
    mode: 0400

- name: Insert/Update "Match User" configuration block in /etc/ssh/sshd_config prepending and appending a new line
  ansible.builtin.blockinfile:
    path: /etc/ssh/sshd_config
    append_newline: true
    prepend_newline: true
    block: |
      Match User ansible-agent
      PasswordAuthentication no

- name: Insert/Update configuration using a local file and validate it
  ansible.builtin.blockinfile:
    block: "{{ lookup('ansible.builtin.file', './local/sshd_config') }}"
    path: /etc/ssh/sshd_config
    backup: yes
    validate: /usr/sbin/sshd -T -f %s

- name: Declare interface ib0
  register: ib0
  template:
    src=files/ifcfg-ib0.j2
    dest=/etc/sysconfig/network/ifcfg-ib0
    owner=root
    group=root
    mode=0644
  with_items:
    - { ip: 192.168.1.{{ ansible_eth0.ipv4.address.split(".")[-1] }}' }
  notify: UP interface ib0

- name: Synchronization using rsync protocol (push)
  ansible.posix.synchronize:
    src: some/relative/path/
    dest: rsync://somehost.com/path/

- name: Synchronization using rsync protocol (pull)
  ansible.posix.synchronize:
    mode: pull
    src: rsync://somehost.com/path/
    dest: /some/absolute/path/

- name:  Synchronization using rsync protocol on delegate host (push)
  ansible.posix.synchronize:
    src: /some/absolute/path/
    dest: rsync://somehost.com/path/
  delegate_to: delegate.host

- name: Synchronization using rsync protocol on delegate host (pull)
  ansible.posix.synchronize:
    mode: pull
    src: rsync://somehost.com/path/
    dest: /some/absolute/path/
  delegate_to: delegate.host

- name: Merge all file vars found
  ansible.builtin.include_vars: "{{ item }}"
  loop:
    # - default.yml # use main.yml instead (this is the default file)
    - "{{ ansible_os_family }}.yml"
    - "{{ ansible_distribution }}.yml"
    - "{{ ansible_distribution }}{{ ansible_distribution_version }}.yml"
  when:
    - ([path, item] | path_join) in query("ansible.builtin.fileglob", "{}/*.yml".format(path))
  vars:
    path: "{{ [role_path, 'vars'] | path_join }}"

- name: Include vars with first_found
  ansible.builtin.include_vars: "{{ lookup('ansible.builtin.first_found', params) }}"
  vars:
    params:
      files:
        - "{{ ansible_distribution }}{{ ansible_distribution_version }}.yml"
        - "{{ ansible_distribution }}.yml"
        - "{{ ansible_os_family }}.yml"
        - default.yml
      paths:
        - "{{ [role_path, 'vars'] | path_join }}"

- name: Merge all file vars found
  ansible.builtin.include_vars: "{{ item }}"
  loop:
    - "{{ ansible_distribution }}/main.yml"
    - "{{ ansible_distribution }}/{{ ansible_distribution_major_version }}/main.yml"
    - "{{ ansible_distribution }}/{{ ansible_distribution_major_version }}/{{ ansible_distribution_version }}.yml"
  when:
    - ([path, item] | path_join) in query("community.general.filetree", path) | selectattr("state", "in", "file") | map(attribute="src") | list
  vars:
    path: "{{ [role_path, 'vars'] | path_join }}"

- name: Merge all file vars found
  ansible.builtin.include_vars: "{{ item }}"
  loop:
    - "{{ ansible_distribution }}/main.yml"
    - "{{ ansible_distribution }}/{{ ansible_distribution_major_version }}/main.yml"
    - "{{ ansible_distribution }}/{{ ansible_distribution_major_version }}/{{ ansible_distribution_version }}.yml"
    - "{{ role_path }}/defaults/main.yml"
  when:
    - item.startswith('/') | ternary(item, [path, item] | path_join) in query("community.general.filetree", item.startswith('/') | ternary(item | dirname, path)) | selectattr("state", "in", "file") | map(attribute="src") | list
  vars:
    path: "{{ [role_path, 'vars'] | path_join }}"

- name: Set authorized key taken from file
  ansible.posix.authorized_key:
    user: charlie
    state: present
    key: "{{ lookup('file', '/home/charlie/.ssh/id_rsa.pub') }}"
    key_options: 'no-port-forwarding,from="10.0.1.1"'

- name: Case insensitive password string match
  ansible.builtin.expect:
    command: passwd username
    responses:
      (?i)password: "MySekretPa$$word"
  # you don't want to show passwords in your logs
  no_log: true

- name: Ensure PAM Displays Last Logon/Access Notification - Check integrity of
    authselect current profile
  ansible.builtin.command:
    cmd: authselect check
  register: result_authselect_check_cmd
  changed_when: false
  failed_when: false

- name: Ensure PAM Displays Last Logon/Access Notification - Informative message
    based on the authselect integrity check result
  ansible.builtin.assert:
    that:
    - result_authselect_check_cmd.rc == 0
    fail_msg:
    - authselect integrity check failed. Remediation aborted!
    - This remediation could not be applied because an authselect profile was
      not selected or the selected profile is not intact.
    - It is not recommended to manually edit the PAM files when authselect tool
      is available.
    - In cases where the default authselect profile does not cover a specific
      demand, a custom authselect profile is recommended.
    success_msg:
    - authselect integrity check passed

- name: Group_by playbook
  hosts: all
  tasks:
    - name: Create a group of all hosts by operating system
      ansible.builtin.group_by:
        key: "{{ ansible_distribution }}-{{ ansible_distribution_version }}"

- name: CentOS-6.2
  hosts: CentOS-6.2
  tasks:
    - name: Ping all CentOS 6.2 hosts
      ansible.builtin.ping:

- name: CentOS-6.3
  hosts: CentOS-6.3
  tasks:
    - name: Ping all CentOS 6.3 hosts
      ansible.builtin.ping:

molecule init scenario
molecule init scenario --verifier-name ansible --driver-name vagrant

---
dependency:
  name: galaxy
driver:
  name: vagrant
platforms:
  - name: instance
    box: generic/ubuntu2204
    memory: 512
    cpus: 1
provisioner:
  name: ansible
verifier:
  name: ansible
lint: |
  yaml-lint