Ansible AWX Team Automation

AWX is the open-source upstream project for Ansible Tower, providing a web-based UI, REST API, and task engine for Ansible automation. It enables teams to share playbooks, manage credentials securely, schedule jobs, and track execution history. This guide covers deploying AWX on a VPS for team automation.

Installation with Docker Compose

# Prerequisites
sudo apt install docker.io docker-compose git

# Clone AWX operator (recommended installation method for AWX 23+)
git clone https://github.com/ansible/awx-operator.git
cd awx-operator

# For Docker Compose deployment (simpler for VPS)
git clone https://github.com/ansible/awx.git
cd awx/tools/docker-compose

# Create inventory file
cat > inventory  Add
#    Name: My Infrastructure
#    Source Control Type: Git
#    Source Control URL: https://github.com/myorg/ansible-playbooks.git
#    Source Control Branch: main
#    Update Revision on Launch: Yes

# 2. Resources > Inventories > Add
#    Name: Production Servers
#    Add hosts manually or use dynamic inventory scripts

# 3. Resources > Credentials > Add
#    Machine credentials (SSH keys)
#    Source Control credentials (Git access)
#    Vault credentials (ansible-vault password)

Job Templates

# Create Job Template:
# Resources > Templates > Add > Job Template
#   Name: Deploy Application
#   Job Type: Run
#   Inventory: Production Servers
#   Project: My Infrastructure
#   Playbook: deploy.yml
#   Credentials: SSH Key, Vault Password
#   Extra Variables:
#     app_version: "latest"
#     environment: "production"

# Survey (interactive variables):
# Add survey questions that users fill in before running
# e.g., "Which version to deploy?" with dropdown options

Workflow Templates

# Workflows chain multiple job templates:
# 1. Run Tests → (on success) → 2. Deploy Staging
# 2. Deploy Staging → (on success) → 3. Run Integration Tests
# 3. Integration Tests → (on success) → 4. Deploy Production
# Any failure → 5. Send Notification

# Create in: Resources > Templates > Add > Workflow Template
# Use visual workflow editor to define flow

Role-Based Access Control

# AWX provides granular RBAC:
# Organizations → Teams → Users → Roles

# Roles per resource:
# - Admin: Full access
# - Execute: Can run job templates
# - Read: Can view but not modify
# - Use: Can use in other resources (credentials, inventories)

# Example:
# DevOps Team: Admin on all resources
# Developers: Execute on deployment templates, Read on inventories
# QA Team: Execute on test templates only

API Usage

# Launch a job template via API
curl -X POST https://awx.example.com/api/v2/job_templates/7/launch/ \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"extra_vars": {"app_version": "1.2.3"}}'

# Check job status
curl https://awx.example.com/api/v2/jobs/42/ \
  -H "Authorization: Bearer YOUR_TOKEN"

# List inventories
curl https://awx.example.com/api/v2/inventories/ \
  -H "Authorization: Bearer YOUR_TOKEN"

Scheduling

# Schedule recurring jobs:
# Job Template > Schedules > Add
#   Name: Nightly Security Scan
#   Start Date/Time: Today 02:00
#   Repeat Frequency: Every day
#   
# Cron-like scheduling available for complex patterns

Nginx Reverse Proxy

server {
    listen 443 ssl http2;
    server_name awx.example.com;

    ssl_certificate /etc/letsencrypt/live/awx.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/awx.example.com/privkey.pem;

    location / {
        proxy_pass http://127.0.0.1:30080;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Summary

AWX transforms Ansible from a CLI tool into a team-ready automation platform. The web UI provides visibility into job execution, RBAC controls who can run what, and the API enables integration with CI/CD pipelines and ChatOps. For teams managing infrastructure with Ansible, AWX running on a VPS provides the collaboration, scheduling, and audit capabilities that manual playbook execution lacks.