Ansible engineering services
Ansible configures what already exists. Where Terraform creates servers, Ansible decides what runs on them — which is exactly the tool you want for estates that are not fully containerised.
Where we use Ansible
Ansible is part of the stack on this service. Each page covers how we work, what you get and what it costs to start.
Ansible in practice
Ansible configures machines that already exist. It works over SSH with no agent to install, and playbooks are idempotent by design — running one twice changes nothing the second time, which is what makes it safe to re-run during an incident rather than frightening.
In a containerised world it remains useful for everything that is not a container: the hosts themselves, network appliances, and the legacy servers that are not going to be rewritten. YAML playbooks are also readable by operations people who do not write application code, which matters for who can review a change.
What we build with Ansible
Packages, users, services and certificates defined in playbooks rather than in someone’s shell history.
Repeatable releases onto virtual machines, including the rollback path.
Baseline security configuration applied consistently across a fleet and re-checked on a schedule.
Is Ansible right for you?
Ask usA good fit when
- Configuring servers and virtual machines consistently
- Estates that are not fully containerised
- Security baselines applied across a fleet and re-checked
- Deployments onto virtual machines with a rollback path
Probably not when
- Provisioning cloud infrastructure — Terraform is the right tool
- Fully containerised platforms where hosts are disposable
- Configuration that changes constantly, where the playbook is always behind
What we run alongside Ansible
The rest of the setup, and why each piece is there. We keep this list short on purpose — every dependency is something someone has to maintain.
- Ansible Vault
- Encrypted secrets inside the repository, so playbooks are shareable.
- Roles and collections
- Reusable structure instead of one enormous playbook.
- Molecule
- Testing roles against containers before they touch a real server.
- Dynamic inventory
- Hosts read from the cloud provider rather than a file that goes stale.
- Terraform
- The other half: it creates the machines, Ansible configures them.
Why Ansible
Let’s talkNothing to install on the targets
It works over SSH, so there is no agent to deploy, secure and keep updated on every machine.
Idempotent by design
Running a playbook twice changes nothing the second time, which makes it safe to re-run during an incident.
Readable by operations people
YAML playbooks are reviewable by people who do not write application code.
What we get called in to fix
Get a second opinionShell commands instead of modules
Playbooks that are just shell scripts in YAML, losing idempotency entirely.
Secrets in plain text
Credentials committed in inventory or vars files.
Playbooks that drifted from reality
Servers changed by hand until the playbook no longer describes them.
No testing
Roles first executed against production, which is a bad place to find a typo.
Ansible or the alternative
The comparisons we are actually asked to make, answered the way we would answer them on a call.
Terraform provisions, Ansible configures. Most estates use both, at different layers.
Containers remove much of the configuration problem. Ansible remains for the hosts and everything outside containers.
Ansible for its agentless model and lower barrier. The others where an existing investment already exists.
ArgoCD
AWS
Azure
CircleCI
Datadog
Docker
GitHub
GitLab
Go
Google Cloud
GrafanaGot an idea? Let’s make it real.
Tell us the short version
This could be the first step towards a new and successful collaboration. A one-line idea and a finished spec are both fine — tell us the problem, the deadline you’re working to and what’s in your way.
Keep looking
Frequently asked questions
Both, for different jobs. Terraform provisions infrastructure; Ansible configures what runs inside it.
Yes, for the hosts, the network appliances and the legacy servers that are not going to be containerised.
Yes. We usually document the current state first, then encode it, then remove what turns out to be unnecessary.
Yes, for hosts, network devices and legacy servers. Containers reduced its scope; they did not remove the machines underneath.
Yes. We document the current state first, encode it, then remove the steps that turn out to be unnecessary — usually a surprising number.