automation

name	automation
description	Infrastructure automation and configuration management using Ansible, Terraform, and CI/CD pipelines
license	MIT
compatibility	opencode
metadata	{"audience":"devops-engineers","category":"systems-administration"}

What I do

• Write Ansible playbooks and roles
• Create Terraform infrastructure code
• Design CI/CD pipelines
• Implement GitOps workflows
• Automate deployment processes
• Manage configuration drift
• Create self-service infrastructure
• Implement policy as code
• Automate testing and validation
• Orchestrate multi-cloud deployments

When to use me

When automating infrastructure provisioning, configuring systems, or building CI/CD pipelines for deployments.

Core Concepts

• Infrastructure as Code (IaC)
• Configuration management
• CI/CD pipeline design
• GitOps workflows
• Terraform and Ansible fundamentals
• Secret management
• Pipeline parallelization
• Blue-green and canary deployments
• Feature flags
• Infrastructure testing

Code Examples

Ansible Playbooks

# site.yml - Main playbook
---
- name: Common system configuration
  hosts: all
  become: true
  gather_facts: true
  vars:
    common_packages:
      - vim
      - curl
      - wget
      - htop
      - net-tools
      - git
      - unzip
    ntp_servers:
      - 0.pool.ntp.org
      - 1.pool.ntp.org
  pre_tasks:
    - name: Check connection
      ping:
    - name: Display facts
      debug:
        msg: "Host {{ ansible_fqdn }} has {{ ansible_memory_mb.real.total }}MB RAM"
  roles:
    - role: common
    - role: 
      
  
       
      
         
         

# roles/common/tasks/main.yml
---
- name: Install common packages
  apt:
    name: "{{ common_packages }}"
    state: present
    update_cache: yes
    cache_valid_time: 3600
  notify: Check services

- name: Configure NTP
  template:
    src: ntp.conf.j2
    dest: /etc/ntp.conf
    mode: 0644
    validate: ntpq -p -c config %s
  notify: Restart NTP

- name: Configure timezone
  community.general.timezone:
    name: "{{ timezone | default('UTC') }}"

- name: Setup sysctl parameters
  sysctl:
    name: "{{ item.name }}"
     
     
     
  
      
       
      
       
      
       

     
  
     
     
     

# roles/security/tasks/main.yml
---
- name: Configure firewall
  ufw:
    state: enabled
    policy: deny

- name: Allow SSH
  ufw:
    rule: allow
    to_port: "{{ ssh_port | default('22') }}"
    proto: tcp

- name: Allow HTTP/HTTPS
  ufw:
    rule: allow
    name: www-full

- name: Install fail2ban
  apt:
    name: fail2ban
    state: present

- name: Configure fail2ban
  template:
    src: fail2ban.local.j2
    dest: /etc/fail2ban/jail.local
    mode: 0644
  notify: Restart fail2ban

- name:    
  
     
     
     
     
    

     
  
     
     
     
     

Terraform Configuration

# main.tf - Infrastructure provisioning
terraform {
  required_version = ">= 1.5.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
    random = {
      source  = "hashicorp/random"
      version = "~> 3.5"
    }
  }
  
  backend "s3" {
    bucket = "terraform-state-bucket"
    key    = "prod/terraform.tfstate"
    region = "us-east-1"
    encrypt = true
    dynamodb_table = "terraform-lock"
  }
}

# Variables
variable "environment" {
  type    = string
  default = "production"
}

variable "instance_type" {
  type    = string
  default = "t3.medium"
}

variable "desired_capacity" {
  type    = number
  default = 3
}

# Provider
provider "aws" {
  region = var.region
  default_tags {
    Environment = var.environment
    ManagedBy   = "Terraform"
    Project     = "web-application"
  }
}

# Data sources
data "aws_ami" "amazon_linux" {
  most_recent = true
  owners      = ["amazon"]
  
  filter {
    name   = "name"
    values = ["amzn2-ami-hvm-*-x86_64-gp2"]
  }
}

data "aws_vpc" "default" {
  default = true
}

# Resources
resource "aws_security_group" "web" {
  name        = "${var.environment}-web-sg"
  description = "Security group for web servers"
  vpc_id      = data.aws_vpc.default.id
  
  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
  
  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
  
  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/16"]
  }
  
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_launch_template" "web" {
  name_prefix   = "${var.environment}-web-"
  image_id      = data.aws_ami.amazon_linux.id
  instance_type = var.instance_type
  
  vpc_security_group_ids = [aws_security_group.web.id]
  
  iam_instance_profile {
    name = aws_iam_instance_profile.web.name
  }
  
  tag_specifications {
    resource_type = "instance"
    tags = {
      Name        = "${var.environment}-web"
      Environment = var.environment
    }
  }
  
  tag_specifications {
    resource_type = "volume"
    tags = {
      Environment = var.environment
    }
  }
}

resource "aws_autoscaling_group" "web" {
  name                = "${var.environment}-web-asg"
  vpc_zone_identifier = ["subnet-abc123", "subnet-def456"]
  target_group_arns   = [aws_lb_target_group.web.arn]
  
  launch_template {
    id      = aws_launch_template.web.id
    version = "$Latest"
  }
  
  min_size         = var.desired_capacity
  max_size         = var.desired_capacity * 3
  desired_capacity = var.desired_capacity
  
  health_check_type         = "ELB"
  health_check_grace_period = 300
  
  lifecycle {
    create_before_destroy = true
    ignore_changes        = [desired_capacity]
  }
  
  tag {
    key                 = "Name"
    value                = "${var.environment}-web"
    propagate_at_launch = true
  }
}

# Outputs
output "alb_dns_name" {
  description = "DNS name of the load balancer"
  value       = aws_lb.web.dns_name
}

CI/CD Pipeline

# .github/workflows/deploy.yml
name: CI/CD Pipeline

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

env:
  AWS_REGION: us-east-1
  ECR_REPOSITORY: app-repository
  ECS_SERVICE: app-service
  ECS_CLUSTER: app-cluster

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'
      
      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements.txt
      
      - name: Run linters
        run: |
          pip install ruff flake8
          ruff check .
          flake8 .
      
      - name: Run 
               
         
         
        
           

  
     
     
    
         
    
        
      
          
         
        
             
             
             
      
           
         
         
      
               
         
        
             
             
         
  
     
     
     
    
        
         
      
          
         
        
             
             
             
      
          
         
        
           
             
             
           

  
     
     
     
    
        
         
      
          
         
        
             
             
             
      
           
         
        
           
             
             
           
           
           
           

Ansible Vault for Secrets

#!/bin/bash
# vault_management.sh

# Create encrypted vault file
ansible-vault create group_vars/all/vault.yml

# View vault contents
ansible-vault view group_vars/all/vault.yml

# Edit vault
ansible-vault edit group_vars/all/vault.yml

# Decrypt for editing
ansible-vault decrypt group_vars/all/vault.yml --output=vault-decrypted.yml

# Encrypt after editing
ansible-vault encrypt vault-decrypted.yml --output=group_vars/all/vault.yml
rm vault-decrypted.yml

# Run playbook with vault
ansible-playbook site.yml --ask-vault-pass

# Using vault password file
echo "my_secure_password" > ~/.vault_pass
chmod 600 ~/.vault_pass
ansible-playbook site.yml --vault-password-file ~/.vault_pass

Best Practices

• Use version control for all infrastructure code
• Implement state management for Terraform
• Use modules to promote reuse
• Implement proper secret management (Vault, SSM)
• Design pipelines with proper approval gates
• Use immutable infrastructure patterns
• Implement proper testing (unit, integration, e2e)
• Use feature flags for controlled rollouts
• Maintain documentation alongside code
• Implement proper rollback mechanisms