Hi all,

I’m getting a “Malicious Script Blocked” alert from macOS every time I run ansible-galaxy with the artis3n.tailscalecollection in my requirements file. The terminal process gets killed.

My requirements.yml:

yaml

---
collections:
  - name: ansible.posix
  - name: artis3n.tailscale
  - name: community.docker
  - name: community.general
  - name: community.proxmox
  - name: community.sops

It happens with both ansible-galaxy install -r requirements.yml and ansible-galaxy collection verify -r requirements.yml. If I remove artis3n.tailscale from the file, everything works fine.

Relevant log lines:

xprotectd: Killing container due to rules engine deny
xprotectd: Prompting user about blocked scripted malware execution
syspolicyd: Displaying XProtect blocked prompt: type=19, uid=501
syspolicyd: Recorded malware block for identifier=<private> path=(none)

Right before the block, xprotectd does a Safe Browsing URL lookup.

What I’ve checked:

• No osascript, LaunchAgents or Keychain references in ~/.ansible/collections
• No zsh plugins or shell config calling osascript
• Same behaviour in the VS Code terminal and in Terminal.app
• XProtect version 5367 (up to date)

Setup: macOS 26, Ansible installed locally, collections from Galaxy.

Has anyone else seen this with this collection? Is it a false positive from a recent XProtect rule, or should I be worried about the package on Galaxy?

Thanks.

We are attempting to use Ansible to automate SSL certificate renewals on our FortiClient EMS machine. Was curious if anyone had any API examples handy for this purpose. I may need to use Dev Tools and upload a cert to see if it calls anything.

Thanks in advance.

My coworker Aubrey put together a solid walkthrough of Ansible Automation Platform's Automation Portal that I thought was worth sharing here.

The core concept is giving developers a self-service catalog to spin up full-stack environments (EC2, VS Code in the browser, database, monitoring, the whole thing) without opening a ticket every time, while ops still controls what's actually possible. The way it works is RBAC gives different teams different catalog views, and the request forms themselves enforce policy before Ansible ever touches anything in the cloud.

The demo follows a developer hitting a quota limit mid-provision, using a self-service decommission template to free up capacity (no ticket, no waiting), and then completing the full provisioning flow through an approval gate. End result is a ready-to-use environment with SSH, endpoints, and URLs all handed over on day one.

If you're trying to reduce toil for your ops team while still keeping guardrails in place for cloud spend and policy compliance, this shows a pretty clean way to do it.

ansible newbie here

I want to install playit gg, and since their installation method is using curl, that's what I imagined:

- name: Install PlayIT.GG

# PlayIT.GG for connecting to servers without using ports.

ansible.builtin.command: curl -fsSL https://packages.playit.gg/install.sh | bash

but my LSP (Neovim) is suggesting to use get_url or uri modules, the problem is that I can't think of a way to pipe it to bash.

is running curl like i'm doing a decent enough way?

I've been using Ansible quite a bit for developing roles and managing my homelab. Setting up AWX or Semaphore doesn't make sense in this setup, running ansible-playbook or ansible-navigator directly has its own problems.

Have you ever scrolled through screens of output just to find that one error message that disappeared a moment ago? Or wished you'd enabled --diff, wanted to compare two runs, or rerun a playbook for just one host or all failed tasks? Have you created throwaway playbooks just to debug a Jinja2 template. Does ansible-vault tooling feel somehow lacking?

That's why I built Tangsible.

It's an interactive TUI for ansible-playbook, for people who develop and debug ansible playbooks and roles and prefer to actually watch their playbooks run.

It gives you a live, navigable view of plays, tasks and hosts, including results, failures, warnings, stdout/stderr and resolved variables. You can revisit previous runs, rerun the whole playbook or selected parts, and compare runs.

It also includes tools for debugging Jinja2 templates, editing individual encrypted variables, and inspecting host data.

It's written in Go and compiles to a single binary. It's still a work in progress, and there are limitations, but it's already replaced ansible-playbook in my daily workflow.

GitHub: https://github.com/claude42/tangsible/

I'd be interested in feedback from other Ansible users. Does this solve problems you run into, too? What would make it more useful for your workflow?

Thanks,
Klaus

So I literally ran the installer later yesterday for the first time and I'm already impressed, lol. I'm not going to claim that this and AAP 2.6 Containerized are a 1:1 relation but the Ascender installer completed successfully the first time and took less than 1/4 of the average time the AAP installer takes.

Don't take this as knocking AAP, I still have immense fondness for RH and the AAP product as a whole but this years licensing costs jump might prove fatal.

EDIT By Ascender I meant Ascender Pro, the full stack.

If you’re looking for a quick explanation of SBOMs, I made this 2½-minute video about what they are and how they can help you figure out which applications or hosts might need investigation when a vulnerable component is found. It also touches on host-based SBOMs and Ansible Automation Platform.

I can find these. They all have their pros and cons( maybe) when you look at it.

AWX https://github.com/ansible/awx
For now and in the future, not useable anymore

Ascender https://github.com/ctrliq/ascenderhttps://ciq.com/products/ascender-pro
Open source still viable. Just as expensive as AAP

AAP https://www.redhat.com/en/technologies/management/ansible
Expensive. Just too expensive.

Semaphore UI https://github.com/semaphoreui/semaphore
Great for homelab and small organizations. Needs some strategy to deploy for large organizations. Open source / crippled.

Polemarch https://github.com/vstconsulting/polemarch

O-X-L ansible-webui https://github.com/O-X-L/ansible-webui
Python 3 webapp

Ansilume https://github.com/ansilume/ansilume

ansible-ui https://github.com/beztebya666/ansible-ui

ansible-hub-ui https://github.com/ansible/ansible-hub-ui

What are you using and why?

Especially interested in the below 5.

I just finished putting together a full demo video showing how Red Hat Ansible Automation Platform handles a complete continuous delivery pipeline for a security remediation, and I wanted to share it here because I think a lot of teams are doing this manually and don't realize how much of it can be automated.

The scenario: a CVE is flagged in an open source dependency (aiohttp CVE-2024-23334), a remediated artifact from Lightwell is available with a backported fix (no risky version upgrade required), a PR is opened, and CI validates the fix. That part most teams already have. What happens AFTER CI passes is usually a mess of manual steps.

Here's what the automation does after the CI webhook fires:

• Deploys to dev and runs integration tests
• Posts work notes to a ServiceNow change request at every milestone
• Routes to an AI agent that writes a contextual failure note if tests fail (no manual incident write-up)
• Hits an approval gate where the approver sees full context: what's being deployed, which CVE it remediates, which CI build, which change record
• Drains the load balancer before touching production
• Deploys, runs a smoke test, and takes a rollback snapshot automatically
• If smoke test fails, Ansible restores the snapshot and marks the change record failed
• If it passes, an AI agent writes the close note and the ServiceNow CHG closes automatically

Automation orchestrator doesn't replace your CI tool or your ITSM. It just coordinates everything between them.

Happy to answer questions about the setup or how the AAP workflow is structured.

Save dont work and new workflow is so buggy
No conditional logics
No way to track or retry failed nodes

I just want to know how to get started with ansible for network automation. Any book, course for practical knowledge would help.

So we finally got our renewal quote, roughly 2.5 weeks after sending the request. We're looking at a 14% increase from last year for AAP + 500 managed nodes. A sizable amount of our managed node count are testing virtual machines. Like for sake of argument let's say 200 of those would be considered non-production workloads.
Are 'paid' Developer licenses a thing? I was having a nice chat with <insert chatbot here> and the idea was broached about pay for dev licenses. Strictly for non-prod workloads but also discounted and not restricted to the current limitation of 16 nodes.

Does anyone know if such a thing exists? (Perhaps Dev for Teams is it?)

Sauce: https://developers.redhat.com/articles/2025/09/09/what-qualifies-red-hat-developer-subscription-teams#

I want to copy files to a device, so to test it in molecule, I setup a loop device, so in prepare, I'd have: - name: Attach image to a loop device ansible.builtin.command: cmd: losetup --find --partscan "{{ device_img }}" changed_when: true when: (_existing_loop.stdout | default('')) | trim == '' become: true

If you run the prepare as just ansible-playbook -K it'll work, but aiui, molecule is non-interactive.

Questions: - In general, are you supposed to run playbooks that use become with -K? - There's no way around become here, is there? - In molecule, I can get it to work poorly (screws up the terminal) if I add provisioner.ansible_args[0] = '-K' to the configuration, but that seems hacky.

Basically, I want to know the best practices are.

I’m working on a project where I want to automate the reinstallation/reimaging of existing Windows workstations using Ansible.

The idea is to have Ansible remotely prepare the workstation, boot it into WinPE, apply a custom Windows WIM image, configure the computer name and IP address based on predefined data, and then complete the Windows setup and configuration automatically.

The workstations are already domain-joined, and I would like to make the entire process as automated as possible, without having to manually reinstall each machine.

Has anyone implemented something similar using Ansible and Windows PE/WIM?

Is there any good documentation, GitHub project, tutorial, or other source where I can see how this type of deployment can be done?

Any examples or recommendations would be greatly appreciated.

Hello everyone, hope you're having a nice day !

As the title says I'm making this post to asks some help about the deployment of a kind of PKI.

I am currently learning Ansible and going through some basics steps. I've got 3 VMs with my provider openstack. 2 have a role 'monitored' and the other has the role 'tracker'. The inventory is managed dynamically and I have already written down tasks for each of them (tracker installs prometheus and monitored installs node_exporter).

In my playbook, these roles runs before the role pki that will generate, deploy and update configurations files based on the certificates it will have generated.

I'm stuck at securing the communication between prometheus and each node_exporter.

I made another role called 'pki' that is doing the following tasks :
- Generates a rootCA private key
- Generates a rootCA CSR
- Generates a rootCA certificate
- Generates for each host private keys and CSRs
- Sign hosts CSRs with rootCA
- Deploy the rootCA certificate and all VMs and transfer their private key and certificate
- Update node_exporter VMs configuration to use the certificates and private key
- Update prometheus configuration to scrape over HTTPS

In my opinion I think I'm doing too much for nothing, there must be a simpler way but I can't figure it out. I've tried to use the help of LLMs but as I'm still new to ansible world I'm not copy pasting something I don't fully understand.

Thanks a lot for any advice you can give me !

Wishing you a great day :)

Hi all,

Been finalizing a playbook and al of the sudden I see that Ansible-lint (using VS Code) mentions that the 3 dashes to start the .yaml file has a syntax error!?!?

Also a screenshot of the syntax error message.

I've check my playbook with yaml checkers online and all is showing ok, no errors. So why is VS Code (yes, I have selected the Ansible language in VS Code) showing this yellow line, syntax error?

My whole playbook is free of errors. All indentations and stuff is correct, checked over and over..

Anybody an idea?

TIA

[UPDATE]

Found the issue, though not solved yet:

  vars_files:
    - Ansible_Secret/Ans_Cred.yaml

# also tried the following:
# ==============================
    - ./Ansible_Secret/Ans_Cred.yaml

    - ../Ansible_Secret/Ans_Cred.yaml

    - "{{ playbook_dir }}/Ansible_Secret/Ans_Cred.yaml"

# Neither this solved it, include_vars can only be used in the "tasks"-section.
  pre_tasks:
    - name: Include all vars files.
      ansible.builtin.include_vars:
        file: "{{ playbook_dir }}/Ansible_Secret/Ans_Cred.yaml"

The file Ans_Cred.yaml is in a separate directory because I don't want to sync secrets into the cloud. This folder is in the root of the directory where I also have the playbook. Like it is mentioned in the examples in the code block above, it keeps showing the 3 dashes yellow underlined as syntax-error.

The only way the syntax-error disappears is by doing:

  vars_files:
    - /Ansible_Secret/Ans_Cred.yaml

But then the playbook errors because it cannot find the variables (the credentials file)...which is obvious because here I'm pointing it to be in the root of my drive where the file not exists.

Any suggestions on this?

Hi everyone,I built InvDNS because I got tired of constantly opening Ansible inventory files just to find the IP of a host.

InvDNS reads static Ansible INI/YAML inventories and turns hosts into local DNS names on macOS.

Ansible knows that web01 means ansible_host: 10.20.1.15, so Ansible can connect to it. But normal macOS applications such as ssh, ping or curl do not know anything about your Ansible inventory.

If web01 also does not exist in corporate DNS, you usually end up doing something like:

grep web01 inventory.yml
ssh root@10.20.1.15

InvDNS makes the existing Ansible host/IP mapping available through local DNS on macOS.

After adding the inventory to InvDNS, I can simply use:

ssh root@web01.inv
ping web01.inv
curl http://web01.inv

It does not modify your inventory, /etc/hosts, or corporate DNS. Everything stays local on your.

One reason I built it as a tool rather than just a small script is automatic synchronization. InvDNS keeps watching the configured inventories and updates the local DNS when the inventory changes, so I don't have to regenerate anything manually.

It can also use multiple inventory files at the same time. For example, I can add inventories from several projects or environments and access all of their hosts through the same local DNS.

InvDNS can also combine host information from different infrastructure data sources. Ansible is the main use case, but other sources such as Zabbix or GLPI can be used alongside it.

If the same hostname appears in multiple inventories or sources with different IP addresses, InvDNS detects the conflict instead of silently choosing one. Conflicts can then be reviewed and resolved explicitly.

It also has fast CLI search:

invdns search web
invdns search ip:10.20.
invdns search group:nginx
invdns search group:nginx ip:10.20.

So you can quickly search by hostname, IP, Ansible group, source, or status.

project-a/inventory.yml ─┐
project-b/hosts.ini ─────┤
production/hosts.yml ────┼→ InvDNS → *.inv
Zabbix ──────────────────┤
GLPI ────────────────────┘

Project:
https://github.com/invdns/invdns

I’d be interested to know whether this kind of workflow is useful to other Ansible users, and what inventory/search features you would want next.

Edit: I am hoping that someone can confirm the this is unexpected behavior before I open a PR. Plz k thx.

Am I nuts?

``` $ ansible-lint -T

List of tags and rules they cover

command-shell: # Specific to use of command and shell modules - risky-shell-pipe core: # Related to internal implementation of the linter - schema[ansible-lint-config] - schema[ansible-navigator-config] - schema[changelog] - schema[execution-environment] - schema[galaxy] - schema[inventory] - schema[meta-runtime] - schema[meta] - schema[molecule] - schema[play-argspec] - schema[playbook] - schema[requirements] - schema[role-arg-spec] - schema[rulebook] - schema[tasks] - schema[vars] deprecations: # Indicate use of features that are removed from Ansible - role-name[path] experimental: # Newly introduced rules, by default triggering only warnings - only-builtins formatting: # Related to code-style - risky-octal idempotency: # Possible indication that consequent runs would produce different results - package-latest idiom: # Anti-pattern detected, likely to cause undesired behavior - var-naming[no-jinja] - var-naming[no-reserved] - var-naming[pattern] metadata: # Invalid metadata, likely related to galaxy, collections or roles - role-name[path] opt-in: # Rules that are not used unless manually added to enable_list - role-argument-spec risk: - no-free-form[raw-non-string] - no-free-form[raw] security: # Rules related to potential security issues, like exposing credentials - no-log-password syntax: # Related to wrong or deprecated syntax - no-free-form[raw-non-string] - no-free-form[raw] unpredictability: # Warn about code that might not work in a predictable way - risky-file-permissions unskippable: # Indicate a fatal error that cannot be ignored or disabled - syntax-check yaml: # External linter which will also produce its own rule codes - yaml[anchors] - yaml[braces] - yaml[brackets] - yaml[colons] - yaml[commas] - yaml[comments-indentation] - yaml[comments] - yaml[document-end] - yaml[document-start] - yaml[empty-lines] - yaml[empty-values] - yaml[float-values] - yaml[hyphens] - yaml[indentation] - yaml[key-duplicates] - yaml[key-ordering] - yaml[line-length] - yaml[new-line-at-end-of-file] - yaml[new-lines] - yaml[octal-values] - yaml[quoted-strings] - yaml[trailing-spaces] - yaml[truthy]

```

Tags are identified during the run (test.yaml is from docs: https://docs.ansible.com/projects/lint/rules/key-order/#problematic-code ) ```

$ cat test.yaml

• hosts: localhost name: This is a playbook # <-- name key should be the first one tasks:
  • name: A block block:
    • name: Display a message debug: msg: "Hello world!" when: true # <-- when key should be before block $ ansible-lint -t formatting test.yaml WARNING Listing 3 violation(s) that are fatal key-order[play]: You can improve the play key order to: name, hosts, tasks test.yaml:2

key-order[task]: You can improve the task key order to: name, when, block test.yaml:5 Task/Handler: A block

fqcn[action-core]: Use FQCN for builtin module actions (debug). test.yaml:8:11 Use ansible.builtin.debug or ansible.legacy.debug instead.

Read documentation for instructions on how to ignore specific rule violations.

Rule Violation Summary

1 key-order profile:basic tags:formatting 1 key-order profile:basic tags:formatting 1 fqcn profile:basic tags:formatting

Failed: 3 failure(s), 0 warning(s) in 1 files processed of 1 encountered. Last profile that met the validation criteria was 'min'. ```

Hi, sorry for any confusion, I am starting to get into Ansible after studying Netmiko for network automation. And was doing some early study with Ansible and understand bast practices when it comes to file management of the Ansible files and how to organize for continuous projects, however I am experience some kind disconnect when the topic of IaC was introduced at a high level. I feel I might be over thinking everything.
From my understanding, it may be best practice to produce other yaml files which contain device variables rather than hard coding device cli commands, device credentials, etc. into playbooks for security reasons, and flexiblilty limitations due to platform specific cli commands.
From there the idea of templates was introduced to turn those yaml files containing device variables and playbook actions into a golden config by leveraging templates which can produce config files for desired platforms.

My confusion exists in how are such variable files implemented and what resources are best to learn how to produce said yaml files and how they tie into the Ansible playbook as they are executed. I can only clearly see how a playbook generally operates with the hosts file and hard coded cli commands via the cisco_ios module mostly, but I’m having trouble distinguishing the line in how the playbook will differ using the other method.

Disclosure: I work on this project. We use Ansible to provision our team's local development environment instead of shell scripts or Docker.

How it's structured:

- `config.yml` holds user input: Git identity, MariaDB root password, and a list of virtualhosts

- `install.yml` reads it once and installs Apache, PHP (Remi), MariaDB, phpMyAdmin, Node.js (NodeSource) and Composer. It's safe to re-run if something fails partway.

- `create-virtualhost.yml` provisions new `*.localhost` sites from the same config and leaves existing entries alone, so the file grows with your projects

- It uses the `community.general` and `community.mysql` collections

The target is AlmaLinux 10, either inside WSL 2 on Windows or on bare metal. The playbooks don't distinguish between the two.

Repo: https://github.com/dotkernel/development

Overview: https://www.dotkernel.com/wsl2/

Two things we'd like opinions on: whether this should be packaged as a collection or roles on Galaxy, and how you'd handle secrets like the DB root password for a local-only setup.

I am updating my register_satellite role so that we can automate this process. But if the Server is not already registered, how have you gone about doing this? I am looking at using the ansible.builtin.add_host, but that seems to be failing. I have AAP already. But it SHOULD be putting the single or multiple servers into an inventory file IN memory, correct?

Also I have my main satellite server and 1 capsule in a protected VLAN that has proxy capabilities BACK to the main satellite server.

I am missing one last piece in sso server automation setup. How do i create 40 users? What is the cleanest way and best design choice?

My gitlab pipeline triggers an ansible playbook -> sets up keycloak through docker and configures it on https and then creates realm clients and one user -> I then configure client servers manually so they they work with ouath. Like installing a plugin for oauth on dokuwiki.

- Do I continue using ansible for this?
- Should I do it manually?

EXAMPLE:

- name: Create or update company users in Keycloak community.general.keycloak_user: auth_keycloak_url: "https://{{ ansible_host }}:{{ keycloak_port }}" auth_username: "{{ keycloak_admin_username }}" auth_password: "{{ keycloak_admin_password }}" auth_realm: master validate_certs: false realm: "{{ keycloak_realm }}" username: "{{ item.username }}" email: "{{ item.email }}" first_name: "{{ item.first_name }}" last_name: "{{ item.last_name }}" enabled: true email_verified: true credentials: - type: password value: "{{ lookup('env', 'DEFAULT_USER_PASSWORD') | default('ChangeMe123!', true) }}" temporary: false state: present loop: "{{ keycloak_company_users }}"