Ansible Galaxy — Installing, Pinning and Vendoring Community Roles — Infrastructure as Code

Ansible Galaxy is the public hub for sharing and consuming community roles and collections, accessible at galaxy.ansible.com. It hosts over 30,000 roles covering every major infrastructure component: geerlingguy.nginx, geerlingguy.postgresql, geerlingguy.docker, nginxinc.nginx, elastic.elasticsearch, and thousands of others maintained by the community and vendors. Using Galaxy roles for standard components (Nginx, PostgreSQL, Redis, Docker) eliminates the need to write and maintain well-trodden automation that the community has already solved, tested, and documented. A well-maintained Galaxy role is typically more complete than a quickly written internal role — it handles edge cases across multiple OS families, provides comprehensive default variable documentation, and has been tested by thousands of users.

The 'requirements.yml' file is the Ansible equivalent of Terraform's required_providers block or Python's requirements.txt — it declares the exact roles and collections that a project depends on, with version constraints that prevent unexpected behaviour from upstream changes. Running 'ansible-galaxy install -r requirements.yml' installs all declared dependencies. In CI/CD pipelines, requirements.yml is installed before every playbook run, ensuring that the versions used in production match exactly what was tested. Vendoring (committing the downloaded roles directly to the repository) is an alternative to downloading at runtime — it eliminates network dependencies during deployment and provides an auditable record of the exact role code being used, at the cost of a larger repository.

Analogy🏏Cricket

🏏 Think of it like cricket: Terraform Cloud is the ICC's centralised match management platform — instead of each national board (team) maintaining its own scoring system, umpire assignment software and results database (self-managed CI/CD + S3 backend), the ICC platform handles all of this centrally. When a board member proposes a rule change (pull request), the platform automatically simulates the match under the new rules (speculative plan on PR), shows the referees the impact (plan output in PR comment), and requires the match committee to approve (policy gates) before the rule takes effect. The audit log records every change, every approval, and who made each decision — providing the governance and traceability that serious tournament operations require.

yaml

# requirements.yml — Ansible Galaxy dependencies file
# Install all dependencies: ansible-galaxy install -r requirements.yml

---
# ── Roles ──────────────────────────────────────────────────────────────────────
roles:
  # Nginx configuration (Jeff Geerling's widely-used role)
  - name: geerlingguy.nginx
    version: '3.2.0'  # Pin to exact version — never omit version in production

  # PostgreSQL client tools
  - name: geerlingguy.postgresql
    version: '3.4.0'

  # Docker installation and configuration
  - name: geerlingguy.docker
    version: '7.1.0'

  # Git repository from GitHub (for roles not on Galaxy)
  - name: cricket_hardening
    src: git+https://github.com/SriHayavadhana/ansible-role-hardening.git
    version: v2.0.1  # Use git tags, not branch names

  # Private GitLab repository
  - name: internal_monitoring
    src: git+https://gitlab.example.com/devops/ansible-monitoring.git
    version: main  # Branch reference — less stable than tags
    scm: git

# ── Collections ────────────────────────────────────────────────────────────────
collections:
  - name: amazon.aws
    version: '>=7.0.0,<8.0.0'  # Semantic version range

  - name: community.aws
    version: '7.0.0'

  - name: community.general
    version: '8.0.0'

  - name: community.postgresql
    version: '3.3.0'

  - name: ansible.posix
    version: '1.5.4'

bash

#!/bin/bash
# Galaxy role management commands

# Install all requirements
ansible-galaxy install -r requirements.yml

# Install to specific directory (vendoring)
ansible-galaxy install -r requirements.yml \
  --roles-path ./vendor/roles    # Commit this directory to Git

# Install collections
ansible-galaxy collection install -r requirements.yml

# Search for roles on Galaxy
ansible-galaxy search nginx --author geerlingguy

# View role information
ansible-galaxy info geerlingguy.nginx

# List installed roles and versions
ansible-galaxy list

# ansible.cfg — configure roles path for vendored dependencies
cat >> ansible.cfg << 'CFG'
[defaults]
roles_path = vendor/roles:~/.ansible/roles  # Check vendor first, then default
CFG

# Using Galaxy roles in a playbook
cat > site.yml << 'PLAY'
---
- name: Configure Cricket API servers
  hosts: api_servers
  become: true
  roles:
    - role: geerlingguy.nginx
      vars:
        nginx_worker_processes: auto
        nginx_keepalive_timeout: 65
    - role: cricket_hardening
      vars:
        hardening_sshd_port: 22
        hardening_umask: '022'
PLAY