Automating Your Dedicated Infrastructure: A Complete Ansible Playbook Guide

There are many Infrastructure as Code (IaC) tools out there, but Ansible is uniquely suited for configuring dedicated servers because of three core philosophies:

• Agentless: You do not need to install any special "Ansible agent" software on your new dedicated server. As long as the server has Python installed and an open SSH port, Ansible can control it.

• Idempotency: You can run an Ansible playbook 100 times, and it will only make changes if the server's current state doesn't match the playbook. It prevents accidental duplicate configurations.

• YAML Syntax: Playbooks are written in YAML (Yet Another Markup Language), which reads almost like plain English. You don't need to learn a complex programming language to automate your infrastructure.

Ansible needs to know which servers it is supposed to talk to. This is done via an inventory file.

On your local machine (or your Ansible control node), create a simple file named inventory.ini and add your new dedicated server's IP address. We will assume you only have root access to begin with.

[dedicated_servers]
203.0.113.50 ansible_user=root
                                

(Replace 203.0.113.50 with your actual server IP).

Now, let's write the actual automation logic. Create a file named provision.yml.

This playbook will perform a complete initial server setup: it will update all software, create a new non-root user with sudo privileges, inject your local SSH key for passwordless login, lock down the SSH daemon, and configure a basic UFW firewall. Copy and paste the following YAML code:

---
- name: Automate Dedicated Server Provisioning and Security
  hosts: dedicated_servers
  become: yes # Run tasks with root privileges
  vars:
    new_user: "sysadmin"
    # Replace the string below with your actual public SSH key (cat ~/.ssh/id_rsa.pub)
    ssh_pub_key: "ssh-rsa AAAAB3NzaC1yc... user@local"

  tasks:
    - name: Update apt cache and upgrade all packages
      apt:
        update_cache: yes
        upgrade: dist
      when: ansible_os_family == "Debian"

    - name: Create a new sudo user
      user:
        name: "{{ new_user }}"
        state: present
        groups: sudo
        append: yes
        shell: /bin/bash

    - name: Set authorized SSH key for the new user
      ansible.posix.authorized_key:
        user: "{{ new_user }}"
        state: present
        key: "{{ ssh_pub_key }}"

    - name: Secure SSH - Disable Root Login and Password Auth
      lineinfile:
        dest: /etc/ssh/sshd_config
        regexp: "{{ item.regexp }}"
        line: "{{ item.line }}"
        state: present
      loop:
        - { regexp: '^#?PermitRootLogin', line: 'PermitRootLogin no' }
        - { regexp: '^#?PasswordAuthentication', line: 'PasswordAuthentication no' }
      notify: Restart SSH

    - name: Install UFW firewall
      apt:
        name: ufw
        state: present

    - name: Configure UFW to allow standard web and SSH traffic
      ufw:
        rule: allow
        port: "{{ item }}"
        proto: tcp
      loop:
        - '22'   # SSH
        - '80'   # HTTP
        - '443'  # HTTPS

    - name: Enable UFW Firewall
      ufw:
        state: enabled
        policy: deny # Default deny incoming traffic

  handlers:
    - name: Restart SSH
      service:
        name: sshd
        state: restarted
                                

What this Playbook is Doing:

• vars: We define variables at the top so you can easily change the username or SSH key without hunting through the code.

• loop: Instead of writing three separate tasks to open ports 22, 80, and 443, we use a loop to iterate through them cleanly.

• handlers: Notice the notify: Restart SSH line. If (and only if) Ansible changes the SSH configuration file, it triggers the handler at the bottom to restart the SSH service. If the file is already secure, the service is left alone.

With your inventory.ini and provision.yml files saved in the same directory, you are ready to automate your setup. Run the following command in your terminal:

ansible-playbook -i inventory.ini provision.yml
                                

You will see Ansible connect to the server, run through each task sequentially, and output a status (ok, changed, or failed).

Once the playbook finishes, your dedicated server is fully updated, secured behind a firewall, and accessible only via SSH keys using your new sysadmin user. The root password is now obsolete.