🧑‍🏫 Ansible Vault, Tags, Error Handling & Final Project

---

🔐 1. Ansible Vault — Secure Sensitive Data

✅ What is Ansible Vault?

Ansible Vault lets you encrypt secrets like passwords, API tokens, and keys — so they don’t appear in plain text in your playbooks or variables.

---

🔸 Create an Encrypted File

ansible-vault create secrets.yml

Enter your secret content:

db_password: SuperSecure123

---

🔸 Use Encrypted Vars in Playbook

vars_files:
  - secrets.yml

tasks:
  - name: Show password
    debug:
      msg: "Password is {{ db_password }}"

---

🔸 Commands

Command	Description
ansible-vault edit file.yml	Edit encrypted file
ansible-vault view file.yml	View contents
ansible-vault encrypt file.yml	Encrypt existing file
ansible-vault decrypt file.yml	Decrypt a file

---

🔒 Run Playbook with Vault

If using a password file:

ansible-playbook play.yml --vault-password-file pass.txt

---

🏷️ 2. Tags — Run Specific Parts of a Playbook

✅ Use Case:

Run only selected tasks instead of the full playbook.

---

🔸 Example:

tasks:
  - name: Install Apache
    yum:
      name: httpd
      state: present
    tags: apache

  - name: Install MariaDB
    yum:
      name: mariadb-server
      state: present
    tags: db

---

🔸 Run with Tag

ansible-playbook setup.yml --tags apache

Skip a tag:

ansible-playbook setup.yml --skip-tags db

---

🛑 3. Error Handling in Ansible

By default, if a task fails, Ansible stops execution.

---

🔸 Ignore Task Failure

- name: Try to stop nginx
  service:
    name: nginx
    state: stopped
  ignore_errors: true

---

🔸 Block / Rescue / Always (like try/catch/finally)

tasks:
  - block:
      - name: Install app
        command: /usr/bin/install_app
    rescue:
      - name: Send failure notification
        debug:
          msg: "Installation failed!"
    always:
      - name: Always cleanup temp files
        file:
          path: /tmp/install.log
          state: absent

---

🧪 4. Final Project — Combine All Concepts

🧩 Goal:

Build a real-world multi-role, dynamic, secure automation with:

• Apache and MariaDB roles
• Encrypted DB password
• Custom homepage with template
• Use tags and error handling

---

📁 Directory Structure:

project/
├── inventory
├── vault_pass.txt
├── secrets.yml (encrypted)
├── site.yml
├── roles/
│   ├── apache/
│   │   ├── tasks/main.yml
│   │   └── templates/index.html.j2
│   └── mariadb/
│       ├── tasks/main.yml
│       └── templates/my.cnf.j2

---

🔸 secrets.yml (Encrypted)

db_root_password: MyS3cr3t!

---

🔸 site.yml

- name: Web Role
  hosts: web
  become: true
  roles:
    - apache

- name: DB Role
  hosts: db
  become: true
  vars_files:
    - secrets.yml
  roles:
    - mariadb

---

🔸 roles/apache/tasks/main.yml

- name: Install Apache
  yum:
    name: httpd
    state: present
  tags: apache

- name: Deploy homepage
  template:
    src: index.html.j2
    dest: /var/www/html/index.html
  notify: Restart Apache

handlers:
  - name: Restart Apache
    service:
      name: httpd
      state: restarted

---

🔸 roles/mariadb/tasks/main.yml

- block:
    - name: Install MariaDB
      yum:
        name: mariadb-server
        state: present

    - name: Configure DB
      template:
        src: my.cnf.j2
        dest: /etc/my.cnf

    - name: Set root password
      mysql_user:
        name: root
        password: "{{ db_root_password }}"
        login_unix_socket: /var/lib/mysql/mysql.sock

  rescue:
    - name: Log DB setup failure
      debug:
        msg: "MariaDB setup failed!"

---

✅ Summary (End of Course)

Topic	Mastered
Vault	✅
Tags	✅
Error Handling	✅
Roles, Templates, Variables	✅
Project Use Case	✅

---