Ansible Automation Playbook Creator

Generates production-ready, idempotent Ansible playbooks and roles for any infrastructure automation or configuration task.

IT & Administration chatgpt claude gemini grok
// prompt
You are a **senior DevOps / infrastructure automation engineer** with deep expertise in Ansible, configuration management, and Linux administration. Write production-grade, idempotent automation that I can run as-is. ## Task Build an Ansible solution to automate: **{{infrastructure_task}}**. ## Context - Target hosts / inventory group: **{{inventory_group}}** - Operating system & version: **{{target_os}}** - Environment: **{{environment}}** (e.g. dev, staging, production) - Constraints or existing tooling: **{{constraints}}** ## What to Deliver 1. **Plan** — a brief outline of the steps the automation will perform and the end state it guarantees. 2. **Playbook / Role** — complete, copy-pasteable YAML with: - Clear `name:` on every play and task - Native modules over `shell`/`command` wherever possible (and `changed_when`/`creates` when not) - Variables surfaced in `defaults/main.yml` or a `vars:` block, never hardcoded - `handlers` for service restarts and `notify` wiring - Tags for selective runs 3. **Inventory & variables** — a sample `inventory.ini` (or YAML) and a `group_vars` example, with any secrets referenced via **Ansible Vault** placeholders (never plaintext). 4. **Run instructions** — the exact `ansible-playbook` command, including `--check` (dry-run) and `--diff`. ## Requirements - **Idempotent** — safe to run repeatedly with no unintended changes. - Follow current Ansible best practices: FQCN module names (e.g. `ansible.builtin.apt`), proper privilege escalation with `become`, and least-privilege defaults. - Include conditional logic, error handling, and a rollback or recovery note where state-changing. - Harden defaults (firewall, SSH, file permissions) when relevant to the task. ## Output Format Use fenced ```yaml blocks for all code, with short explanatory text between them. End with a **Validation** section listing how to test the result (e.g. `ansible-playbook --syntax-check`, `ansible-lint`, and what to verify on the target host). If any detail above is missing or ambiguous, ask me before generating the playbook.
Fill in the variables

Example run

Generated by Claude Opus 5.5 on September 23, 2026

Inputs used

Infrastructure task
Deploy and harden an NGINX reverse proxy (fronting a Node.js app on port 3000) with automatic Let's Encrypt TLS certificate issuance and renewal via certbot
Inventory group
webservers_prod
Target os
Ubuntu 22.04 LTS (Jammy), kernel 5.15
Environment
production
Constraints
Servers are direct internet-facing VPS instances (no load balancer in front). Must use UFW for firewall management, allowing only 22/tcp (restricted to office VPN CIDR 203.0.113.0/24), 80/tcp and 443/tcp. TLS certs must be issued via Let's Encrypt using the DNS-01 challenge against Cloudflare (API token stored in Ansible Vault). fail2ban is already installed and must remain untouched. Prometheus node_exporter runs on port 9100 and must stay reachable only from the internal monitoring subnet 10.0.5.0/24. All package installs must go through the internal APT mirror at http://apt-mirror.internal.example.com (repo already configured in /etc/apt/sources.list.d/internal.list). Company policy forbids raw shell/command modules unless no native module exists, and every state-changing task must log to /var/log/ansible-deployments.log via a handler.

Most gaps can become variables in defaults/main.yml. However, a few decisions affect safety or correctness on internet-facing production hosts. Please confirm or correct these before I generate the playbook. Proposed defaults are in bold, so you can just reply "defaults are fine" or change any of them.

Blocking (no safe default)

  1. Domains and ACME contact. Which FQDN(s) does each host serve, and should any host have SAN or wildcard certs? Which email address should Let's Encrypt use? My plan is a per-host nginx_server_names list in host_vars, with the email in group_vars.
  2. Cloudflare token scope. Can you confirm the Vault token is a scoped API token with Zone:DNS:Edit on the relevant zones? It should not be a Global API Key. This affects the credentials file format certbot needs.

Safety-critical (lockout or disruption risk)

  1. SSH hardening scope. You asked for hardened defaults, but changing sshd_config on a VPS risks locking you out. Should I apply the following?

    • PermitRootLogin no
    • PasswordAuthentication no
    • KbdInteractiveAuthentication no
    • MaxAuthTries 3
    • X11Forwarding no
    • An AllowGroups list, or leave it unset

    The change would be validated with sshd -t and delivered as a drop-in (/etc/ssh/sshd_config.d/10-hardening.conf) rather than by editing the main file. Or should SSH be left out of scope entirely?

  2. Existing UFW rules. Is UFW currently active with rules that aren't in your list, for example rules added by fail2ban or other tooling?

    • Option A (default): leave existing rules alone, add the required ones, and set default deny incoming / allow outgoing.
    • Option B: reset UFW and enforce exactly the declared ruleset. This is stricter but can drop sessions and remove rules you forgot about.

    Also, should the Ansible control node's own SSH path always come from 203.0.113.0/24? Otherwise the run will cut itself off.

  3. ACME environment. I'd issue against the Let's Encrypt staging endpoint first (toggle variable), then flip to production. This avoids rate limits if DNS propagation or the token misbehaves. Is that acceptable?

Design choices

  1. Certbot source. Snap is off the table because of the mirror requirement, so I'd install certbot and python3-certbot-dns-cloudflare from the Jammy APT repos via your mirror. Can you confirm the mirror carries universe? Renewal would use the packaged certbot.timer, plus a deploy hook that reloads nginx.

  2. Node.js app. Is the app already deployed and managed (systemd/pm2) outside this playbook, with the playbook only proxying to 127.0.0.1:3000? Should I also block port 3000 from outside? UFW default-deny already covers that. Do you need WebSocket upgrade headers? I'd include them by default.

  3. TLS and header policy. My defaults would be:

    • TLS 1.2 + 1.3 with the Mozilla "intermediate" ciphers
    • OCSP stapling off, since Let's Encrypt ended OCSP support in 2025
    • HSTS max-age=63072000 without preload
    • X-Content-Type-Options, X-Frame-Options DENY, Referrer-Policy, server_tokens off
    • Basic rate limiting (limit_req)

    Should anything change, for example HSTS includeSubDomains/preload or a CSP?

  4. Deployment log format. For /var/log/ansible-deployments.log, I'd use a handler that appends a line via ansible.builtin.lineinfile (no shell): ISO-8601 timestamp, host, playbook, and changed task/role, with the file at 0640 root:adm and logrotate config included. Is that okay, or do you need a specific format, such as JSON for log shipping?

  5. node_exporter. Should the playbook only manage the UFW rule (9100/tcp from 10.0.5.0/24) and never touch the node_exporter service itself? Should I also add an explicit deny for 9100 from elsewhere, or rely on default deny?

Once you answer, I'll deliver the full role and the rest of what you asked for:

  • Role layout: defaults, tasks split by tag (packages, firewall, ssh, nginx, tls, logging), handlers, and templates.
  • Inventory: inventory.ini, plus group_vars with Vault placeholders.
  • Run and validation: run commands with --check --diff, rollback notes, and the Validation section.

Related prompts

IT & Administration

Cybersecurity Audit Specialist

Run a structured cybersecurity audit of an organization, prioritizing risks and producing an actionable remediation roadmap.

IT & Administration

DevOps Automation Specialist

Acts as a DevOps engineer to design, optimize, and troubleshoot CI/CD pipelines, infrastructure as code, and cloud automation.

IT & Administration

Docker Container Builder

Generates production-ready, optimized Dockerfiles with multi-stage builds, caching, and tagging for any application.

IT & Administration

Cloud Infrastructure Architect

Design a scalable, secure, cost-optimized cloud architecture with IaC, diagrams, and a phased rollout plan.