12 Configuration Management Tasks You Should Automate with Ansible (Production-Ready Guide)

the best automation is the one that doesn’t wake you up at 3AM

Configuration drift is one of the fastest ways to lose control of your infrastructure.

Servers slowly fall out of sync due to:

• manual fixes
• hot patches
• inconsistent deployments

Over time, this leads to:

• “works on one server but not another”
• painful debugging
• security gaps

This is exactly what Ansible solves but only if used correctly.

In this guide we’ll go beyond the basics and show high-impact, production-safe tasks you should automate, with actual patterns that won’t break your systems.

1. Safe & Controlled Package Updates

Blind upgrades break systems. Smart updates prevent incidents.

Update packages safely, not blindly.

---
- name: Safe package updates (Debian/Ubuntu)
  hosts: all
  become: yes

  vars:
    allowed_packages:
      - curl
      - vim
      - git

  tasks:
    - name: Update apt cache
      apt:
        update_cache: yes
        cache_valid_time: 3600

    - name: Upgrade only approved packages
      apt:
        name: "{{ allowed_packages }}"
        state: latest

Instead of upgrading everything:

• you reduce risk of breaking dependencies
• you control what changes in production
• you can test updates before rollout

In production, combine this with staging environments and maintenance windows.

2. Centralized User & Access Management

Manually managing users across servers is a security risk.

---
- name: Manage users securely
  hosts: all
  become: yes

  vars:
    users:
      - name: devops
        groups: sudo
        ssh_key: "ssh-rsa AAAA..."
      - name: deploy
        groups: www-data
        ssh_key: "ssh-rsa BBBB..."

  tasks:
    - name: Ensure users exist
      user:
        name: "{{ item.name }}"
        groups: "{{ item.groups }}"
        append: yes
        state: present
      loop: "{{ users }}"

    - name: Add SSH keys
      authorized_key:
        user: "{{ item.name }}"
        key: "{{ item.ssh_key }}"
      loop: "{{ users }}"

• consistent access across all servers
• safe onboarding/offboarding
• eliminates “forgotten accounts”

3. Safe SSH Hardening (Without Lockouts)

SSH hardening is critical but if it’s done wrong, it locks you out.

---
- name: Harden SSH safely
  hosts: all
  become: yes

  tasks:
    - name: Ensure SSH config is valid before applying
      command: sshd -t
      changed_when: false

    - name: Disable root login
      lineinfile:
        path: /etc/ssh/sshd_config
        regexp: '^PermitRootLogin'
        line: 'PermitRootLogin no'

    - name: Disable password authentication
      lineinfile:
        path: /etc/ssh/sshd_config
        regexp: '^PasswordAuthentication'
        line: 'PasswordAuthentication no'

    - name: Restart SSH safely
      service:
        name: ssh
        state: restarted

• prevents brute-force attacks
• enforces key-based access

Always ensure:

• SSH keys are already deployed
• and that you test on one server first.

4. Configuration Management with Templates

Hardcoding configs leads to inconsistencies.

---
- name: Deploy nginx config safely
  hosts: webservers
  become: yes

  vars:
    server_name: example.com

  tasks:
    - name: Deploy config
      template:
        src: nginx.conf.j2
        dest: /etc/nginx/nginx.conf
        validate: "nginx -t -c %s"
      notify: restart nginx

  handlers:
    - name: restart nginx
      service:
        name: nginx
        state: restarted

• prevents broken configs
• ensures consistency across environments
• validation avoids downtime

5. Service Management with Smart Restarts

Don’t just “start services”, manage them intelligently.

---
- name: Ensure nginx is running properly
  hosts: webservers
  become: yes

  tasks:
    - name: Ensure nginx is enabled and running
      service:
        name: nginx
        state: started
        enabled: yes

• services survive reboots
• consistent system state

Combine with handlers to avoid unnecessary restarts.

6. Application Config via Systemd (Better than /etc/environment)

Avoid outdated environment variable hacks.

---
- name: Configure app environment via systemd
  hosts: appservers
  become: yes

  tasks:
    - name: Create systemd override directory
      file:
        path: /etc/systemd/system/myapp.service.d
        state: directory

    - name: Set environment variables
      copy:
        dest: /etc/systemd/system/myapp.service.d/env.conf
        content: |
          [Service]
          Environment=APP_ENV=production

    - name: Reload systemd
      command: systemctl daemon-reexec

    - name: Restart app
      service:
        name: myapp
        state: restarted

• works reliably with services
• avoids hidden config bugs
• modern best practice

7. Scheduled Jobs (Cron or Systemd Timers)

Automation often depends on scheduled tasks.

---
- name: Configure backup job
  hosts: dbservers
  become: yes

  tasks:
    - name: Schedule backup
      cron:
        name: "Database Backup"
        minute: "0"
        hour: "2"
        job: "/usr/local/bin/backup.sh"

• ensures critical jobs always exist
• prevents silent failures from missing cron entries

8. Firewall Management

Avoid manual firewall edits.

---
- name: Configure firewall (UFW example)
  hosts: webservers
  become: yes

  tasks:
    - name: Allow HTTP
      ufw:
        rule: allow
        port: "80"
        proto: tcp

    - name: Allow HTTPS
      ufw:
        rule: allow
        port: "443"
        proto: tcp

• consistent security rules
• prevents accidental exposure

Adapt this for:

• cloud security groups
• iptables/nftables

9. File Permissions & Ownership

Permissions issues cause production outages.

---
- name: Fix app directory permissions
  hosts: webservers
  become: yes

  tasks:
    - name: Set ownership recursively
      file:
        path: /var/www/app
        owner: www-data
        group: www-data
        recurse: yes

• prevents permission errors
• ensures apps can read/write correctly

10. Time Synchronization

Time drift breaks distributed systems.

---
- name: Configure time sync (chrony)
  hosts: all
  become: yes

  tasks:
    - name: Install chrony
      apt:
        name: chrony
        state: present

    - name: Ensure chrony is running
      service:
        name: chrony
        state: started
        enabled: yes

• keeps logs accurate
• prevents authentication issues
• critical for distributed systems

11. Log Rotation with Validation

Logs can fill disks and crash systems.

---
- name: Configure log rotation safely
  hosts: webservers
  become: yes

  tasks:
    - name: Deploy logrotate config
      copy:
        src: logrotate.conf
        dest: /etc/logrotate.d/app

    - name: Validate logrotate config
      command: logrotate -d /etc/logrotate.d/app
      changed_when: false

• prevents disk exhaustion
• ensures logs are retained properly

12. Continuous Drift Enforcement (Automation Loop)

Automation isn’t one-time, it’s continuous.

For example, run it regularly via:

• CI/CD pipelines
• scheduled jobs
• deployment hooks

ansible-playbook baseline.yml

• fixes drift automatically
• keeps systems compliant
• reduces manual firefighting

Recommended Repository Structure

ansible/
├── inventories/
├── playbooks/
├── roles/
└── group_vars/

• keeps code organized
• makes playbooks reusable
• scales with your infrastructure

[embed]11 Ansible Playbooks to Provision Production Servers Safely not just automating things but automating them safely.medium.com

[embed]9 CI/CD Scripts DevOps Engineers Actually Use don’t lose hours every week to problems that automation could easily preventmedium.com

A collection of fully functional CI/CD Pipeline Templates for GitHub Actions, GitLab CI, Jenkins, and CircleCI, designed for DevOps engineers who want speed, reliability, consistency, and best practices without starting from scratch.