Automatiser avec Ansible — Infrastructure as Code pour débutants

Ansible est l'outil d'automatisation le plus accessible : pas d'agent à installer sur les serveurs, juste SSH et Python.

Installation

# Sur votre machine de contrôle
pip install ansible

# Vérifier
ansible --version

Concepts fondamentaux

Inventory         ← Quels serveurs ?
    ↓
Playbook          ← Quoi faire ?
    ↓
Tasks             ← Actions spécifiques
    ↓
Modules           ← Outils (apt, copy, service, ...)
    ↓
Handlers          ← Réactions aux changements
    ↓
Roles             ← Organisation réutilisable

Inventory

# inventory/production
[webservers]
web1.neotoad.fr ansible_user=ubuntu
web2.neotoad.fr ansible_user=ubuntu

[databases]
db1.neotoad.fr ansible_user=ubuntu

[all:vars]
ansible_python_interpreter=/usr/bin/python3
ansible_ssh_private_key_file=~/.ssh/id_ed25519

Premier Playbook — Sécuriser un serveur

# playbooks/secure-server.yml
---
- name: Sécurisation initiale du serveur
  hosts: webservers
  become: yes  # sudo
  
  vars:
    admin_user: neotoad
    ssh_port: 2222
    packages_to_install:
      - ufw
      - fail2ban
      - unattended-upgrades
      - git
      - curl

  tasks:
    - name: Mettre à jour les paquets
      apt:
        update_cache: yes
        upgrade: dist
        cache_valid_time: 3600

    - name: Installer les paquets essentiels
      apt:
        name: "{{ packages_to_install }}"
        state: present

    - name: Créer l'utilisateur admin
      user:
        name: "{{ admin_user }}"
        groups: sudo
        shell: /bin/bash
        state: present

    - name: Copier la clé SSH
      authorized_key:
        user: "{{ admin_user }}"
        key: "{{ lookup('file', '~/.ssh/id_ed25519.pub') }}"

    - name: Configurer SSH
      lineinfile:
        path: /etc/ssh/sshd_config
        regexp: "{{ item.regexp }}"
        line: "{{ item.line }}"
      loop:
        - { regexp: '^#?PasswordAuthentication', line: 'PasswordAuthentication no' }
        - { regexp: '^#?PermitRootLogin', line: 'PermitRootLogin no' }
        - { regexp: '^#?Port', line: 'Port {{ ssh_port }}' }
      notify: Restart SSH

    - name: Configurer UFW - politique par défaut
      ufw:
        state: enabled
        policy: deny
        direction: incoming

    - name: Configurer UFW - autoriser SSH
      ufw:
        rule: allow
        port: "{{ ssh_port }}"
        proto: tcp

    - name: Configurer UFW - autoriser HTTP/HTTPS
      ufw:
        rule: allow
        port: "{{ item }}"
      loop: ['80', '443']

    - name: Activer Fail2ban
      service:
        name: fail2ban
        state: started
        enabled: yes

  handlers:
    - name: Restart SSH
      service:
        name: sshd
        state: restarted

Playbook de déploiement Laravel

# playbooks/deploy-laravel.yml
---
- name: Déploiement de l'application
  hosts: webservers
  become: yes
  
  vars:
    app_path: /var/www/neotoad
    repo_url: git@github.com:neotoad/neotoad.git
    branch: main
    php_version: "8.3"

  tasks:
    - name: Créer le répertoire de l'application
      file:
        path: "{{ app_path }}"
        state: directory
        owner: www-data
        group: www-data
        mode: '0755'

    - name: Cloner / mettre à jour le dépôt
      git:
        repo: "{{ repo_url }}"
        dest: "{{ app_path }}"
        version: "{{ branch }}"
        force: yes
      become_user: www-data

    - name: Installer les dépendances Composer
      composer:
        command: install
        working_dir: "{{ app_path }}"
        no_dev: yes
        optimize_autoloader: yes
      become_user: www-data

    - name: Copier le fichier .env
      template:
        src: templates/.env.j2
        dest: "{{ app_path }}/.env"
        owner: www-data
        mode: '0600'

    - name: Exécuter les migrations
      command: php artisan migrate --force
      args:
        chdir: "{{ app_path }}"
      become_user: www-data

    - name: Optimiser Laravel
      command: "{{ item }}"
      args:
        chdir: "{{ app_path }}"
      loop:
        - php artisan config:cache
        - php artisan route:cache
        - php artisan view:cache
      become_user: www-data

    - name: Redémarrer PHP-FPM
      service:
        name: "php{{ php_version }}-fpm"
        state: restarted

Exécution

# Tester sans appliquer (dry-run)
ansible-playbook -i inventory/production playbooks/secure-server.yml --check

# Appliquer
ansible-playbook -i inventory/production playbooks/secure-server.yml

# Sur un seul serveur
ansible-playbook -i inventory/production playbooks/deploy-laravel.yml \
    --limit web1.neotoad.fr

# Avec des variables en ligne
ansible-playbook -i inventory/production playbooks/deploy-laravel.yml \
    -e "branch=develop"

Roles — Organisation avancée

# Créer la structure d'un role
ansible-galaxy role init roles/nginx

roles/nginx/
├── tasks/
│   └── main.yml
├── handlers/
│   └── main.yml
├── templates/
│   └── nginx.conf.j2
├── files/
├── vars/
│   └── main.yml
└── defaults/
    └── main.yml

Ansible est le meilleur investissement pour quiconque gère plus de 3 serveurs.