glunty

Ansible Cheat Sheet

A searchable reference of Ansible commands, playbook keywords, modules, and what each one does.

Command or key What it does
ansible all -m ping Check connectivity to every host in the inventory using the ping module.
ansible-playbook play.yml Run the plays and tasks defined in a playbook file.
ansible-playbook -i inventory play.yml Run a playbook against a specific inventory file or directory.
ansible-playbook --check play.yml Do a dry run that reports what would change without changing anything.
ansible-playbook --limit web1 play.yml Restrict a run to one host or group instead of the whole inventory.
ansible-playbook --tags deploy play.yml Run only the tasks marked with the given tags.
ansible-playbook -e "key=value" play.yml Pass extra variables on the command line, which take the highest precedence.
ansible-playbook --become play.yml Run tasks with privilege escalation, typically as root through sudo.
ansible-galaxy install geerlingguy.nginx Download and install a role from Ansible Galaxy into your roles path.
ansible-vault encrypt secrets.yml Encrypt a file so its secrets stay unreadable at rest until decrypted.
ansible-playbook --list-hosts play.yml Show which hosts a playbook would target without running any tasks.
hosts Play level key naming the group or pattern of hosts the play runs against.
tasks Ordered list of actions a play runs on each targeted host.
name Human readable label for a play or task shown in the run output.
become Turn on privilege escalation for a play, block, or single task.
vars Define variables inline for a play, block, or task.
handlers Tasks that run only when notified, usually to restart or reload a service.
roles Include reusable role directories that bundle tasks, files, and defaults.
when Run a task only if the given condition evaluates to true.
loop Repeat a task once for each item in a list.
register Save the result of a task into a variable for later tasks to use.
notify Trigger a named handler when a task reports that it changed something.
copy Copy a local file to the managed host with owner and permission control.
file Manage a path as a file, directory, or symlink and set its permissions.
template Render a Jinja template on the control node and place the result on the host.
service Start, stop, restart, or enable a system service.
apt Install, remove, or update packages on Debian and Ubuntu systems.
yum Manage packages on older Red Hat and CentOS systems.
package Install a package using whichever package manager the host provides.
command Run a program on the host without a shell, so pipes and redirects do not work.
shell Run a command through the shell so pipes, redirects, and variables work.
git Clone or update a git repository on the managed host.
user Create, modify, or remove a user account on the host.
lineinfile Ensure a single line is present or absent in a text file.
debug Print a message or the value of a variable during a run.
[webservers] INI style header that defines a host group named webservers in an inventory.
group_vars/ Directory holding variable files applied to every host in a matching group.
host_vars/ Directory holding variable files applied to a single named host.
ansible_host Connection variable that sets the real address Ansible connects to for a host.
ansible_user Connection variable that sets the remote user Ansible logs in as.
[prod:children] INI section that nests other groups so prod contains several child groups.
web[01:05].example.com Host range pattern that expands to web01 through web05 in the inventory.
{{ my_var }} Insert the value of a variable named my_var inside a template or string.
{{ my_var | default("prod") }} Use the default filter to supply a fallback value when a variable is undefined.
{{ data | to_json }} Use the to_json filter to turn a value into a JSON formatted string.
ansible_facts Dictionary of details Ansible gathers about each host, such as OS and addresses.
gather_facts: true Play setting that controls whether Ansible collects facts before running tasks.
set_fact Module that defines new variables during a run for later tasks to use.
!vault Tag that marks a single variable value as encrypted with Ansible Vault.

Runs entirely in your browser. Nothing you type is sent anywhere; open DevTools and watch the Network tab to verify zero requests.

What this tool does

This is a searchable quick reference for Ansible, from the command line tools you run to the playbook keywords, modules, inventory pieces, and Jinja variables you write. Each row pairs the exact command or key with a plain-English note on what it does. Type in the filter box to search across both columns, or tap a category button to focus on one area. The whole list is built into the page, so it works offline and sends nothing anywhere.

How to use it

Start typing in the Filter box. Entering ping surfaces the connectivity check; entering become shows the privilege escalation options; entering template jumps to the templating module. The category buttons (CLI, Playbook, Modules, Inventory, and Vars and Jinja) narrow the table to one area and combine with the text filter, so you can pick Modules and type package to compare the package related modules. Clear the box to see the full sheet again.

Common use cases

  • Recalling the exact flag for a run, like --check for a dry run or --limit for a single host.
  • Remembering which module fits the job, such as copy versus template or command versus shell.
  • Looking up how a playbook keyword behaves, like the difference between handlers and ordinary tasks.
  • Checking how inventory groups and connection variables such as ansible_host are declared.
  • Reviewing the core Ansible workflow before an interview or a new job.

Common pitfalls

  • Reaching for shell when command would do. The command module runs without a shell and is safer, while shell allows pipes and redirects but also shell injection. Use command unless you truly need shell features.
  • Expecting handlers to run mid play. A handler only fires after all tasks in the play finish, and only if a task notified it. If you need an action to happen immediately, make it a normal task instead.
  • Assuming tasks are always idempotent. Most modules report changed only when they change something, but command and shell report changed every run unless you add a creates or when guard.
  • Forgetting variable precedence. Extra variables passed with -e override almost everything else, so a value set in group_vars can be silently replaced. Check where a variable is defined before you debug a surprising value.

Frequently asked questions

What is an Ansible playbook?
A playbook is a YAML file that describes the desired state of your hosts. It contains one or more plays, and each play targets a group of hosts and lists an ordered set of tasks to run on them. Because Ansible tasks aim to be idempotent, running the same playbook twice leaves the hosts in the same state rather than repeating changes. Playbooks are how you capture configuration and deployment steps as code that anyone can review and rerun.
What is the difference between a task and a handler?
A task runs in order every time the play reaches it, subject to any when condition. A handler is a special task that only runs when another task notifies it, and only once at the end of the play even if several tasks notify it. Handlers are the standard way to restart or reload a service after a change, so the service is bounced only when something it depends on actually changed.
What does become do in Ansible?
become turns on privilege escalation, so a task or play runs as a different and more privileged user on the managed host. By default it escalates to root using sudo, which is what you need for installing packages, editing system files, or managing services. You can set it at the play, block, or task level, and pair it with become_user to escalate to a user other than root.
What is an Ansible inventory?
An inventory is the list of hosts Ansible manages, along with the groups they belong to and any connection settings. It can be a simple INI or YAML file, a directory of files, or a dynamic script that queries a cloud provider. Groups let you target many hosts at once, and variables set through group_vars and host_vars attach configuration to those groups and hosts.
How do Jinja variables work in Ansible?
Ansible uses Jinja2 templating for variables. To insert the value of a variable you wrap its name in double curly braces, and Ansible replaces that expression with the value when the play runs. You can transform values with filters written after a pipe character, for example a default filter to supply a fallback or a to_json filter to format data. Facts that Ansible gathers about each host are exposed as variables too, so you can branch on the operating system or IP address of a machine.
Does this cheat sheet send anything anywhere?
No. The entire reference is baked into the page and every search and filter runs in your browser with JavaScript, so nothing you type leaves your device. Open your browser DevTools and watch the Network tab while you search to confirm there are zero requests.

Embed this tool

Free for any use; attribution appreciated. Paste this on your site:

The embed runs the same tool that lives at this URL. No tracking; no ads inside the embed. Resize height as needed for your layout.

Cite this tool

For academic, journalistic, or technical references. Pick a format:

Citations use 2026 as the publication year. Access date is left as a fillable placeholder where the citation style expects one.

Embedded tool from glunty.com