ansible-roles

roles/
├── nginx/
│   ├── tasks/main.yml        # what to do
│   ├── handlers/main.yml     # restart/reload triggers
│   ├── templates/nginx.conf.j2  # config templates
│   ├── defaults/main.yml     # default variables
│   └── vars/main.yml         # role-specific variables
├── postgresql/
│   ├── tasks/main.yml
│   ├── templates/pg_hba.conf.j2
│   └── defaults/main.yml
└── app-deploy/
    ├── tasks/main.yml
    └── templates/app.service.j2

# roles/nginx/tasks/main.yml — Install and configure Nginx
- name: Install Nginx
  apt:
    name: nginx
    state: present
    update_cache: yes

- name: Deploy Nginx config
  template:
    src: nginx.conf.j2
    dest: /etc/nginx/sites-available/{{ app_name }}
  notify: Reload Nginx

- name: Enable site
  file:
    src: /etc/nginx/sites-available/{{ app_name }}
    dest: /etc/nginx/sites-enabled/{{ app_name }}
    state: link
  notify: Reload Nginx

# roles/nginx/handlers/main.yml
- name: Reload Nginx
  service:
    name: nginx
    state: reloaded

# roles/nginx/templates/nginx.conf.j2 — Templated config
server {
    listen 80;
    server_name {{ domain }};

    location / {
        proxy_pass http://127.0.0.1:{{ app_port }};
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

# playbook.yml — Combine roles to provision a server
- hosts: web_servers
  become: yes
  vars:
    app_name: myapp
    domain: app.example.com
    app_port: 3000
    db_name: myapp_production

  roles:
    - role: security-hardening
    - role: nginx
    - role: postgresql
    - role: nodejs
    - role: app-deploy

# Install community roles
ansible-galaxy install geerlingguy.docker
ansible-galaxy install geerlingguy.postgresql
ansible-galaxy install geerlingguy.nginx

# Requirements file
# requirements.yml
roles:
  - name: geerlingguy.docker
    version: "6.1.0"
  - name: geerlingguy.certbot

# Install all
ansible-galaxy install -r requirements.yml