Ansible
Ansible: a first setup, important settings, verification, and recovery considerations.
Working directory: ~/homelab/ops/config-mgmt. Follow the common setup workflow first. This is a setup note based on the linked documentation, not a copy of my live configuration or a runtime verification of this full stack.
Start here
Ansible runs from a control machine and configures hosts through modules, commonly over SSH. This is not a long-running Compose service. Follow the official installation and inventory tutorial using one disposable VM. Verify SSH host keys before accepting a new host.
Settings and data
Keep an inventory, playbooks, and roles in a private configuration repository. Put example placeholders in public documentation. Use a limited login account and explicit privilege escalation where required. Encrypt sensitive variables with a supported secret mechanism; an encrypted file still needs a separately protected unlock credential.
Check it
Begin with the documented ping module, which checks Ansible connectivity rather than ICMP. Write a small playbook that creates a harmless directory. Run it twice: the second run should report no change if the desired state already exists.
When something fails
Use --check on supported tasks before applying changes, but do not treat check mode as a complete simulation. Some modules cannot predict every effect. Use --diff only when output cannot reveal secrets. Syntax errors, SSH failures, and missing privilege permissions are different layers; test one host before changing a whole inventory.