Roles, Vault & Rolling Deploys

Roles

roles/nginx/
  tasks/main.yml
  handlers/main.yml
  templates/nginx.conf.j2
  defaults/main.yml    # default variable values, overridable per-host/group

# site.yml
- hosts: webservers
  roles:
    - nginx

# Or pull a community-maintained role instead of writing it yourself:
# ansible-galaxy install geerlingguy.nginx

Ansible Vault — Secrets

ansible-vault create secrets.yml     # create an encrypted variables file
ansible-vault edit secrets.yml       # edit it (decrypts, opens editor, re-encrypts)
ansible-playbook site.yml --ask-vault-pass

# secrets.yml can now be safely committed to version control —
# it's encrypted at rest, decrypted only at runtime with the vault password

Rolling Deploys with serial

- hosts: webservers
  serial: "25%"   # apply to 25% of hosts at a time, not all simultaneously —
                  # catches a bad change before it hits the entire fleet
  tasks:
    - name: Deploy new release
      # ...

# Without `serial`, Ansible applies each task to ALL targeted hosts
# roughly in parallel (up to the `forks` limit) — a broken change could
# hit every host nearly at once.

Agentless Architecture

Ansible connects over standard SSH and runs Python-based modules remotely — no persistent agent daemon to install, maintain, or keep updated on every managed host, unlike older agent-based configuration management tools. The trade-off: Ansible enforces state at explicit run time (push-based), not continuously in the background the way a locally-running agent daemon could.