Inventory, Connection and the First Honest Run

Why this matters

A playbook runs against all hosts because nobody set a limit, and a test task restarts the web server on the machine that serves the demo to visitors. The blast radius was the default, not a decision. Every configuration incident of this class shares one missing line: the run was never scoped. Inventory groups plus an explicit target pattern make the scope visible before execution, and the habit of limiting first turns accidents into no-ops.

Concepts

Inventory is a list with structure: hosts, groups of hosts, and variables attached at each level. Groups express roles (web, db, lab) so playbooks address intent instead of IP addresses; group variables hold the differences, host variables the exceptions. Static files suit fixed labs; dynamic sources suit clouds, but this module's labs stay static and local on purpose.

Connection is SSH with key authentication, and the private key never enters the repo, the chat or the screenshots. The control machine holds the key with tight file permissions; targets carry the public half. Test the connection with a read-only ad-hoc command before writing any playbook: ping the group, gather facts, read the output states. Green means reachable, and reachable is the precondition for everything else.

Ad-hoc output teaches the vocabulary the whole module uses: ok means already correct, changed means the task acted, failed means it did not. A run of many oks and zero changes is success, not silence; it proves the machines already match intent. Scope with explicit patterns and limits, and confirm the target list the tool prints before it acts.

Targets are machines you own: local VMs, lab containers, throwaway instances you created. The rule is absolute and repeated in every lab: never point these runs at machines you do not own, never borrow shared infrastructure for experiments, never embed real credentials to reach a target.

Worked example

A two-container lab stands in for web and db. The learner writes a static inventory with both groups, runs a read-only facts command limited to the lab group, and reads the ok output. Then a deliberately unlimited pattern is shown in check mode against an empty group first, demonstrating that scope is verified before execution, not after.

Common wrong move

Sharing one inventory file with production hosts and lab hosts in the same groups. A lab experiment with a broad pattern becomes a production incident. Separate inventories per trust domain; the lab inventory knows only lab machines.