# Assignment

Developers are looking for dependencies to be installed and run on Nautilus app servers in Stratos DC. They have shared some requirements with the DevOps team. Because we are now managing packages installation and services management using Ansible, some playbooks need to be created and tested. As per details mentioned below please complete the task:

a. On jump host create an Ansible playbook /home/thor/ansible/playbook.yml and configure it to install httpd on all app servers.
b. After installation make sure to start and enable httpd service on all app servers.
c. The inventory /home/thor/ansible/inventory is already there on jump host.
d. Make sure user thor should be able to run the playbook on jump host.

Note: Validation will try to run playbook using command ansible-playbook -i inventory playbook.yml so please make sure playbook works this way, without passing any extra arguments.

# Solution

# Ansible Playbook — install and enable httpd on all App Servers

Create `/home/thor/ansible/playbook.yml` so `ansible-playbook -i inventory playbook.yml` installs
httpd and brings the service up on all app servers — with **no extra arguments**.

> Note: this is an Ansible task, not Kubernetes — no manifests to pipe into `kubectl`. The heredoc
> below writes the playbook.

## Step 0 — The inventory already exists; leave it alone

Requirement (c) confirms the inventory is already in place. **Don't recreate or overwrite it** —
just verify its contents:

```bash
cat /home/thor/ansible/inventory
```

Confirm it lists the app servers with their connection variables. If it lacks
`ansible_become_pass` and the app-server users need a sudo password, add that per host — the
playbook requires privilege escalation and you can't pass `-K` at runtime.

## Step 1 — Playbook

```bash
cat > /home/thor/ansible/playbook.yml <<'EOF'
---
- name: Install and enable httpd on all app servers
  hosts: all
  become: yes
  tasks:
    - name: Install httpd package
      ansible.builtin.yum:
        name: httpd
        state: present

    - name: Start and enable httpd service
      ansible.builtin.service:
        name: httpd
        state: started
        enabled: yes
EOF
```

## Step 2 — Ensure `thor` can run it (requirement d)

```bash
ls -l /home/thor/ansible/
```

Creating the playbook with the heredoc above (as `thor`) already gives correct ownership. If the
directory was pre-created by another user and `thor` can't read the files, fix it:

```bash
sudo chown -R thor:thor /home/thor/ansible
chmod 644 /home/thor/ansible/playbook.yml
```

## How it works

### Why `become: yes`

Both tasks are privileged: installing a package writes to system directories and the RPM database,
and managing a systemd service requires root. The SSH users on the app servers are unprivileged, so
the play escalates once at the **play level** rather than repeating `become` on each task.

Because validation runs the bare command with no `-K`, the sudo password must come from
`ansible_become_pass` in the existing inventory. "Missing sudo password" at runtime means that
variable is absent or wrong — and it's the most common failure on this task, since there's no way to
supply it on the command line.

### Task 1 — install httpd

`ansible.builtin.yum` with **`state: present`** installs the package if it's missing and does nothing
if it's already there. That makes the task **idempotent**: the first run reports `changed`,
subsequent runs report `ok`. `state: latest` would instead upgrade on every run, which isn't what
"install" asks for.

These app servers are RHEL/CentOS-family, so `yum` is the correct package module. (On modern
RHEL 8+ the `dnf` module is its successor, and Ansible's `yum` module delegates to dnf where
appropriate — so `yum` works regardless.)

### Task 2 — start *and* enable

Requirement (b) has two distinct halves, and `ansible.builtin.service` covers both:

| Option | Effect |
|--------|--------|
| `state: started` | httpd is running **right now**. |
| `enabled: yes` | httpd starts automatically **on boot**. |

These are independent — a service can be running but not enabled (dies on reboot), or enabled but
not currently started. "Start and enable" requires both, so both are set.

### Ordering matters

The install task must precede the service task: you can't start a service whose unit file doesn't
exist yet. Ansible executes tasks top to bottom, so this ordering is a correctness requirement, not
just style. Reversing them would fail with "Could not find the requested service httpd."

### `hosts: all`

The inventory contains the app servers, so `all` targets exactly them — and it can't break if the
inventory's group name and the playbook's `hosts:` value ever drift apart.

### Requirement (d) — "thor should be able to run the playbook"

Validation runs as `thor`, so `thor` must be able to **read** the playbook and inventory. Writing the
file via heredoc as `thor` satisfies this automatically; Step 2 is a safety check for the case where
the directory was pre-created with root ownership, which would fail validation before Ansible even
starts.

### Host key checking

If a first-time SSH connection trips on host-key verification, add an `ansible.cfg` beside the
playbook — safest because it needs no extra command-line arguments:

```bash
cat > /home/thor/ansible/ansible.cfg <<'EOF'
[defaults]
host_key_checking = False
EOF
```

## Verify

```bash
cd /home/thor/ansible

# Connectivity first
ansible -i inventory all -m ping

# The actual validation command
ansible-playbook -i inventory playbook.yml

# httpd installed
ansible -i inventory all -b -m command -a "rpm -q httpd"

# Running AND enabled
ansible -i inventory all -b -m command -a "systemctl is-active httpd"
ansible -i inventory all -b -m command -a "systemctl is-enabled httpd"
```

Expected — `ping` returning `SUCCESS` on every server; the playbook finishing with `failed=0`;
`rpm -q httpd` printing an installed version; `is-active` returning `active`; and `is-enabled`
returning `enabled`.

> Check **both** `is-active` and `is-enabled` — passing only one means half the requirement was met.
> "Could not find the requested service httpd" ⇒ task order is wrong. "Missing sudo password" ⇒ the
> inventory needs `ansible_become_pass`.