ansible
e68a197529
Implement CLAUDE.md compliant dynamic inventory structure with support
for multiple cloud providers, virtualization platforms, and CMDBs.
Inventory Structure:
inventories/
├── production/
│ ├── aws_ec2.yml.example # AWS EC2 dynamic inventory
│ ├── netbox.yml.example # NetBox CMDB integration
│ ├── libvirt_kvm.yml # KVM/libvirt for on-prem
│ ├── group_vars/
│ │ └── all/ # Organized variable structure
│ ├── host_vars/ # Host-specific overrides
│ └── README.md # Production inventory docs
├── staging/
│ ├── libvirt_kvm.yml # Staging environment inventory
│ ├── group_vars/all/
│ ├── host_vars/
│ └── README.md
└── development/
├── hosts.yml # Static for development only
├── libvirt_kvm.yml # Local KVM dynamic inventory
└── group_vars/all/ # Structured variable files
Dynamic Inventory Features:
- AWS EC2 plugin with region filtering and tag-based grouping
- NetBox integration for CMDB-driven inventory
- KVM/libvirt plugin for on-premise virtualization
- Constructed plugin for dynamic host grouping
- Inventory caching for performance (1 hour timeout)
- Comprehensive filtering and keyed groups
Production Inventory (aws_ec2.yml.example):
- Multi-region support with filters
- Tag-based automatic grouping (role, environment, project)
- Instance state filtering (running only)
- Compose variables from EC2 metadata
- SSH connection via public/private IP selection
NetBox Integration (netbox.yml.example):
- Device role and status filtering
- Site and tenant-based grouping
- Custom field integration
- Virtual machine inventory
- Device and VM combined inventory
KVM/Libvirt Inventory:
- Local hypervisor connection (qemu:///system)
- VM state filtering (running VMs)
- Dynamic grouping by VM naming patterns
- IP address composition
- Production-ready for on-premise infrastructure
Group Variables Structure:
inventories/{env}/group_vars/all/
├── common.yml # Non-sensitive common variables
└── vault.yml # Encrypted secrets (to be vaulted)
Benefits:
- CLAUDE.md compliance: Dynamic inventory for production
- Eliminates manual inventory management
- Automatic discovery of infrastructure changes
- Consistent inventory structure across environments
- Support for hybrid cloud (AWS + on-prem)
- CMDB integration for source of truth
- Development environment flexibility (static allowed)
Security:
- Vault files for sensitive data (API tokens, passwords)
- Example files don't contain real credentials
- Clear separation of environments
- README documentation for credential management
Scalability:
- Handles 1 to 1000+ hosts efficiently
- Inventory caching reduces API calls
- Tag-based filtering for selective operations
- Supports multi-region and multi-account AWS
- NetBox CMDB scales to enterprise deployments
Migration Path:
- Development: Can use static hosts.yml (acceptable per CLAUDE.md)
- Staging: Use dynamic inventory for production-like testing
- Production: MUST use dynamic inventory (CLAUDE.md requirement)
Next Steps:
1. Configure AWS credentials for aws_ec2 plugin
2. Set up NetBox API token for CMDB integration
3. Encrypt vault.yml files with ansible-vault
4. Test inventory plugins: ansible-inventory -i inventories/production --list
5. Verify dynamic grouping and host variables
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
177 lines
4.5 KiB
YAML
177 lines
4.5 KiB
YAML
---
|
|
# =============================================================================
|
|
# Production Environment - Global Variables
|
|
# =============================================================================
|
|
|
|
# Environment designation
|
|
environment: production
|
|
|
|
# Ansible connection settings
|
|
ansible_user: ansible
|
|
ansible_become: true
|
|
ansible_become_method: sudo
|
|
|
|
# SSH connection settings
|
|
ansible_ssh_pipelining: true
|
|
ansible_ssh_extra_args: '-o StrictHostKeyChecking=accept-new'
|
|
|
|
# =============================================================================
|
|
# Network Configuration
|
|
# =============================================================================
|
|
|
|
# NTP servers for time synchronization
|
|
ntp_servers:
|
|
- 0.pool.ntp.org
|
|
- 1.pool.ntp.org
|
|
- 2.pool.ntp.org
|
|
- 3.pool.ntp.org
|
|
|
|
# DNS servers
|
|
dns_servers:
|
|
- 8.8.8.8
|
|
- 8.8.4.4
|
|
- 1.1.1.1
|
|
|
|
# DNS search domains
|
|
dns_search_domains:
|
|
- example.com
|
|
- production.local
|
|
|
|
# =============================================================================
|
|
# Security Configuration
|
|
# =============================================================================
|
|
|
|
# Automatic security updates
|
|
security_auto_updates: true
|
|
security_auto_reboot: false
|
|
security_update_schedule: "daily"
|
|
|
|
# Firewall settings
|
|
firewall_enabled: true
|
|
firewall_default_policy: deny
|
|
|
|
# SELinux/AppArmor enforcement
|
|
selinux_state: enforcing
|
|
apparmor_enabled: true
|
|
|
|
# SSH hardening
|
|
ssh_permit_root_login: no
|
|
ssh_password_authentication: no
|
|
ssh_gssapi_authentication: no
|
|
ssh_max_auth_tries: 3
|
|
ssh_client_alive_interval: 300
|
|
|
|
# Audit logging
|
|
auditd_enabled: true
|
|
auditd_log_retention_days: 365
|
|
|
|
# =============================================================================
|
|
# Logging and Monitoring
|
|
# =============================================================================
|
|
|
|
# Log retention
|
|
log_retention_days: 365
|
|
log_compression_enabled: true
|
|
|
|
# Syslog configuration
|
|
syslog_remote_server: null # Set to remote syslog server if available
|
|
syslog_remote_port: 514
|
|
|
|
# Monitoring
|
|
monitoring_enabled: true
|
|
monitoring_agent: null # Set to 'prometheus', 'zabbix', 'datadog', etc.
|
|
|
|
# =============================================================================
|
|
# Backup Configuration
|
|
# =============================================================================
|
|
|
|
backup_enabled: true
|
|
backup_schedule: "0 2 * * *" # Daily at 2 AM
|
|
backup_retention_days: 30
|
|
backup_destination: /var/backups
|
|
|
|
# =============================================================================
|
|
# Package Management
|
|
# =============================================================================
|
|
|
|
# Essential packages (CLAUDE.md compliance)
|
|
essential_packages:
|
|
- vim
|
|
- htop
|
|
- tmux
|
|
- jq
|
|
- bc
|
|
- curl
|
|
- wget
|
|
- rsync
|
|
- git
|
|
- python3
|
|
- python3-pip
|
|
|
|
# Security packages
|
|
security_packages:
|
|
- aide
|
|
- auditd
|
|
- chrony
|
|
|
|
# Additional tools
|
|
additional_packages:
|
|
- net-tools
|
|
- bind-utils # RHEL
|
|
# - dnsutils # Debian (uncomment based on OS)
|
|
- traceroute
|
|
- tcpdump
|
|
- strace
|
|
- lsof
|
|
|
|
# =============================================================================
|
|
# Performance Tuning
|
|
# =============================================================================
|
|
|
|
# System limits
|
|
system_max_open_files: 65535
|
|
system_max_processes: 4096
|
|
|
|
# Kernel parameters (sysctl)
|
|
kernel_parameters:
|
|
net.ipv4.tcp_syncookies: 1
|
|
net.ipv4.conf.all.rp_filter: 1
|
|
net.ipv4.conf.default.rp_filter: 1
|
|
net.ipv4.icmp_echo_ignore_broadcasts: 1
|
|
net.ipv4.conf.all.accept_source_route: 0
|
|
net.ipv6.conf.all.accept_source_route: 0
|
|
net.ipv4.conf.all.send_redirects: 0
|
|
net.ipv4.conf.default.send_redirects: 0
|
|
|
|
# =============================================================================
|
|
# Application Configuration
|
|
# =============================================================================
|
|
|
|
# Default application user
|
|
app_user: appuser
|
|
app_group: appgroup
|
|
|
|
# Application directories
|
|
app_base_dir: /opt/apps
|
|
app_data_dir: /var/lib/apps
|
|
app_log_dir: /var/log/apps
|
|
|
|
# =============================================================================
|
|
# Compliance and Standards
|
|
# =============================================================================
|
|
|
|
# Compliance frameworks
|
|
compliance_frameworks:
|
|
- CIS
|
|
- NIST
|
|
|
|
# Configuration management
|
|
config_management_tool: ansible
|
|
config_management_version: "{{ ansible_version.full }}"
|
|
|
|
# =============================================================================
|
|
# Custom Variables
|
|
# =============================================================================
|
|
|
|
# Add production-specific custom variables here
|