Chapter 79: DevOps Projects Part 9: Ansible Nginx Roles Vault Patch Inventory Agents

79.2 Project 62: Ansible roles for a LAMP stack

By Ravindra Bagale Last updated: 28 October 2026

Friends, a LAMP stack spreads across packages. Today we scaffold apache, php and mysql roles, wire site.yml, add a PHP template, and dry-run with check mode.

What you will build in this project

Scaffold three roles.
Write tasks and handlers.
Call roles from site.yml.
Check mode before apply.

1. Start from a real company story

At Zomato in Pune, Apache and PHP versions drifted across eight boxes and a coupon API failed on two nodes.

Rough cost: about ₹18 lakh in free coupons and support that weekend.

Neha packed LAMP into roles and banned hand edits on those hosts.

Today we build that role layout.

Picture 1: site.yml → roles/apache + php + mysql → lamp host

Ravindra Bagale's Tip

Students put root DB passwords in role defaults as plain text. Defaults are not secret storage. Use Vault next. Keep that habit.

2. Start and prepare

Step 1: Why roles

Why: Playbooks grow; roles split concerns. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: echo roles. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 1: a1

Type this:

echo 'Role = tasks handlers defaults templates files'

You will see:

Role = tasks handlers defaults templates files

What it means: What.

Example 2: a2

Type this:

mkdir -p /tmp/ans62 && echo 'LAMP = Linux Apache MySQL PHP'

You will see:

LAMP = Linux Apache MySQL PHP

What it means: LAMP.

Example 3: a3

Type this:

echo 'Today: apache php mysql roles called from site.yml'

You will see:

Today: apache php mysql roles called from site.yml

What it means: Scope.

Step 2: galaxy init tip

Why: Scaffold a role. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: ansible-galaxy. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 4: b1

Type this:

echo 'cd /tmp/ans62 && ansible-galaxy init roles/apache'

You will see:

cd /tmp/ans62 && ansible-galaxy init roles/apache

What it means: Init apache.

Example 5: b2

Type this:

echo 'ansible-galaxy init roles/php && ansible-galaxy init roles/mysql'

You will see:

ansible-galaxy init roles/php && ansible-galaxy init roles/mysql

What it means: Init others.

Example 6: b3

Type this:

mkdir -p /tmp/ans62/roles/{apache,php,mysql}/{tasks,handlers,defaults,templates,files,meta} && find /tmp/ans62/roles -type d | wc -l

You will see:

What it means: Dirs.

Step 3: Apache tasks

Why: Install and enable. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: tasks/main.yml. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 7: c1

Type this:

printf '%s\n' '---' '- name: Install apache2' '  apt: { name: apache2, state: present, update_cache: true }' '- name: Start apache2' '  service: { name: apache2, state: started, enabled: true }' > /tmp/ans62/roles/apache/tasks/main.yml && cat /tmp/ans62/roles/apache/tasks/main.yml

You will see:

- name: Install apache2

What it means: Apache tasks.

Example 8: c2

Type this:

printf '%s\n' '---' '- name: Reload apache2' '  service: { name: apache2, state: reloaded }' > /tmp/ans62/roles/apache/handlers/main.yml && cat /tmp/ans62/roles/apache/handlers/main.yml

You will see:

- name: Reload apache2

What it means: Handler.

Example 9: c3

Type this:

echo 'Debian family uses apache2; RHEL uses httpd — pick one OS family'

You will see:

Debian family uses apache2; RHEL uses httpd — pick one OS family

What it means: Family tip.

3. Build the main pieces

Step 4: PHP role

Why: Modules for the app. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: php tasks. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 10: d1

Type this:

printf '%s\n' '---' '- name: Install PHP and modules' '  apt:' '    name: [ php, libapache2-mod-php, php-mysql ]' '    state: present' > /tmp/ans62/roles/php/tasks/main.yml && cat /tmp/ans62/roles/php/tasks/main.yml

You will see:

php-mysql

What it means: PHP modules.

Example 11: d2

Type this:

printf '%s\n' '---' 'php_memory_limit: 256M' > /tmp/ans62/roles/php/defaults/main.yml && cat /tmp/ans62/roles/php/defaults/main.yml

You will see:

php_memory_limit: 256M

What it means: Default.

Example 12: d3

Type this:

echo 'Notify apache reload after php.ini template changes'

You will see:

Notify apache reload after php.ini template changes

What it means: Notify tip.

Step 5: MySQL role

Why: DB server notes. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: mysql tasks. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 13: e1

Type this:

printf '%s\n' '---' '- name: Install mysql-server' '  apt: { name: mysql-server, state: present }' '- name: Ensure mysql running' '  service: { name: mysql, state: started, enabled: true }' > /tmp/ans62/roles/mysql/tasks/main.yml && cat /tmp/ans62/roles/mysql/tasks/main.yml

You will see:

- name: Install mysql-server

What it means: MySQL tasks.

Example 14: e2

Type this:

echo 'Put DB passwords in Ansible Vault — never plain defaults'

You will see:

Put DB passwords in Ansible Vault — never plain defaults

What it means: Secret tip.

Example 15: e3

Type this:

echo 'Bind MySQL to private IP only in group_vars'

You will see:

Bind MySQL to private IP only in group_vars

What it means: Bind tip.

Step 6: site.yml

Why: Call the roles. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: playbook. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 16: f1

Type this:

printf '%s\n' '---' '- name: LAMP stack' '  hosts: lamp' '  become: true' '  roles:' '    - apache' '    - php' '    - mysql' > /tmp/ans62/site.yml && cat /tmp/ans62/site.yml

You will see:

- mysql

What it means: site.yml.

Example 17: f2

Type this:

printf '%s\n' '[lamp]' 'lamp01 ansible_host=10.0.2.11' > /tmp/ans62/hosts.ini && cat /tmp/ans62/hosts.ini

You will see:

lamp01 ansible_host=10.0.2.11

What it means: Inventory.

Example 18: f3

Type this:

echo 'ansible-playbook -i hosts.ini site.yml'

You will see:

ansible-playbook -i hosts.ini site.yml

What it means: Run tip.

4. Automate and verify

Step 7: Template page

Why: index.php. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: template. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 19: g1

Type this:

printf '%s\n' '<?php echo "shop lamp " . gethostname(); phpinfo(INFO_GENERAL);' > /tmp/ans62/roles/apache/templates/index.php.j2 && cat /tmp/ans62/roles/apache/templates/index.php.j2

You will see:

<?php echo "shop lamp " . gethostname(); phpinfo(INFO_GENERAL);

What it means: Template.

Example 20: g2

Type this:

printf '%s\n' '- name: Deploy index.php' '  template:' '    src: index.php.j2' '    dest: /var/www/html/index.php' '    mode: "0644"' '  notify: Reload apache2' >> /tmp/ans62/roles/apache/tasks/main.yml && tail -6 /tmp/ans62/roles/apache/tasks/main.yml

You will see:

src: index.php.j2

What it means: Deploy task.

Example 21: g3

Type this:

echo 'Remove default index.html so PHP page is served'

You will see:

Remove default index.html so PHP page is served

What it means: Cleanup tip.

Step 8: meta deps

Why: Role dependencies. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: meta/main.yml. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 22: h1

Type this:

printf '%s\n' '---' 'dependencies: []' 'galaxy_info:' '  author: shop-team' '  description: apache for lamp lab' > /tmp/ans62/roles/apache/meta/main.yml && cat /tmp/ans62/roles/apache/meta/main.yml

You will see:

dependencies: []

What it means: Meta.

Example 23: h2

Type this:

echo 'PHP role can list apache under dependencies if needed'

You will see:

PHP role can list apache under dependencies if needed

What it means: Dep tip.

Example 24: h3

Type this:

echo 'Keep roles reusable — no hard-coded shop secrets inside'

You will see:

Keep roles reusable — no hard-coded shop secrets inside

What it means: Reuse.

Step 9: Check mode

Why: Dry run. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: --check --diff. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 25: i1

Type this:

echo 'ansible-playbook -i hosts.ini site.yml --check --diff'

You will see:

ansible-playbook -i hosts.ini site.yml --check --diff

What it means: Check.

Example 26: i2

Type this:

echo 'Read the diff before removing --check'

You will see:

Read the diff before removing --check

What it means: Habit.

Example 27: i3

Type this:

echo 'Some modules report incomplete check mode — still read them'

You will see:

Some modules report incomplete check mode — still read them

What it means: Limit.

5. Harden and accept

Step 10: Story Zomato

Why: Pune LAMP drift. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: story. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 28: j1

Type this:

printf '%s\n' 'At Zomato in Pune, Apache and PHP versions drifted across 8 boxes. A coupon API failed on 2 nodes.' 'Neha packed LAMP into roles and banned hand edits on those hosts.' > /tmp/ans62/STORY.txt && cat /tmp/ans62/STORY.txt

You will see:

Neha packed LAMP into roles and banned hand edits on those hosts.

What it means: Story.

Example 29: j2

Type this:

echo 'Rough cost: about ₹18 lakh in free coupons and support that weekend'

You will see:

Rough cost: about ₹18 lakh in free coupons and support that weekend

What it means: Cost.

Example 30: j3

Type this:

echo 'Neha: PASS'

You will see:

Neha: PASS

What it means: Sign-off.

Step 11: Tree proof

Why: Roles exist. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: find. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 31: k1

Type this:

find /tmp/ans62/roles -name main.yml | sort

You will see:

/tmp/ans62/roles/apache/handlers/main.yml\n/tmp/ans62/roles/apache/meta/main.yml\n/tmp/ans62/roles/apache/tasks/main.yml\n/tmp/ans62/roles/mysql/tasks/main.yml\n/tmp/ans62/roles/php/defaults/main.yml\n/tmp/ans62/roles/php/tasks/main.yml

What it means: Files.

Example 32: k2

Type this:

test -f /tmp/ans62/site.yml && echo 'site ok'

You will see:

site ok

What it means: site.

Example 33: k3

Type this:

echo 'Next: Ansible Vault project 63'

You will see:

Next: Ansible Vault project 63

What it means: Bridge.

Step 12: Acceptance

Why: Role layout clear. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: final. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 34: z1

Type this:

echo 'Three roles + site.yml ready'

You will see:

Three roles + site.yml ready

What it means: Ready.

Example 35: z2

Type this:

echo 'Secrets wait for Vault in project 63'

You will see:

Secrets wait for Vault in project 63

What it means: Vault bridge.

Example 36: z3

Type this:

echo 'Check mode before first real apply'

You will see:

Check mode before first real apply

What it means: Habit.

Check yourself

Q1. Who fixed Zomato LAMP drift?

Neha

Q2. Three roles?

apache php mysql

Q3. Composer file?

site.yml

Q4. Dry run flags?

--check --diff

Q5. PHP template ext?

Q6. Secrets in defaults?

Friends, you built LAMP as Ansible roles. Did you understand? Let us try it once more. Add a mysql role task that creates an application database name from a variable.

Lab: try at home

Init role trees.
Write apache php mysql tasks.
Wire site.yml.
Practice check mode.

Recap

Roles split concerns.
Handlers reload once.
site.yml composes roles.
Check before apply.
No secrets in defaults.