Ansible: Conditional Tasks Pattern & Site Layout - ansible

Question

I've been playing around with ansible (I'm very new to configuration management in general, it's not what I do for my
dayjob), and I'm trying to figure out the best way to pattern my conditional tasks.
I've structured my setup (git repository with the following layout:
├── dotfiles (...)
├── bin (...)
└── playbooks
├── bootstrap.yml
├── firewall.yml
├── ids.yml
├── logserver.yml
├── pvr.yml
├── site.yml
├── log
└── roles
└── bootstrap
|  ├── defaults
|  │   └── main.yml
|  └── tasks
|  ├── apt-update.yml
|  ├── apt-upgrade.yml
|  ├── homebrew-user.yml
|  ├── homebrew-install.yml
|  ├── homebrew-update.yml
|  ├── homebrew-upgrade.yml
|     ├── main.yml
|  ├── tmux-install.yml
|  └── vim-install.yml
├── elk (...)
├── snort (...)
├── tor (...)
└── zentyal (...)
For most scenarios, I've got a playbook for each system that I'm using to buildout my roles. I run the playbook locally
on each host (on my firewall system, i log in, update the git repository, and run ansible-playbook bootstrap.yml and
ansible-playbook firewall.yml. My intent is to setup a real inventory in the future so that I can run specific roles
against specific hosts, but for now while I'm learning, this works well.
Most of the roles are platform specific and require sudo, and that's fine and works well.
However my bootstrap.yml playbook needs to run in variable environments:
sometimes install homebrew on an osx system using sudo (multi-user environment)
sometimes install homebrew on an osx system without sudo (single-user environment)
sometimes install additional homebrew applications in a specific location (single-user desktop system)
sometimes install additional homebrew applications in a specific location (multiuser desktop system)
sometimes install specific applications system-wide using package control on Ubuntu/BSD systems
sometimes install specific applications using local build scripts on Ubuntu/BSD systems in $HOME
Depending on the environment, there's up to 100 applications or so that I'd like to bootstrap - all the various
utilities that I use for daily things - copying over my dotfiles, installing/updating bash/zsh, git,
git-flow, hub, vim, tmux, mosh, weechat, base16, source-highlight, netcat, nmap, setting up pip, virtualenv,
virtualenvwrapper, and about 100 other things.
As a single example, a task for installing tmux in multiple environments (in python-like psuedocode):
if ansible_distribution=='MacOSX':
if sudo_user is not None:
homebrew: name=tmux state=present sudo_user='homebrew'
else:
homebrew: name=tmux state=present
elif os=='Ubuntu':
if sudo_user is not None:
apt_repository: name='ppa:pi-rho' state: present)
apt: name=tmux state=present sudo_user='root')
else:
shell: tmux-ubuntu-build-local.sh
elif os=='BSD':
shell: tmux-bsd-build-local.sh
But ansible doesn't seem to have basic if/else constructs available - just the when construct. So , I started using
when to write conditional tasks (included by ./playbooks/roles/bootstrap/main.yml):
---
# ./playbooks/roles/bootstrap/tmux.yml
# this always installs without sudo, which works on my laptop
# but fails on shared systems that use a 'homebrew' user
- name: install
when: ansible_distribution == 'MacOSX'
sudo: no
homebrew: name=tmux
# i only want to run this when I *want* to install tmux globally
# on some systems I just want to run a build script
# if i don't have root and visudo isn't properly configured, this fails
- name: add pi-rho/dev ppa
when: ansible_distribution == 'Ubuntu'
sudo: yes
apt_repository:
repo: 'ppa:pi-rho/dev'
state: present
# again, i don't always want to do this
- name: update cache
when: ansible_distribution == 'Ubuntu'
sudo: yes
apt: update_cache=yes
# this always attempts to install using sudo, which I don't want.
# on some systems I want to run a build script that installs tmux
# to the user's home directory instead
- name: install
when: ansible_distribution == 'Ubuntu'
sudo: yes
apt: name=tmux
# this installs a set of tmux plugins without sudo to my $HOME
# directory, i do always want this
- name: install plugins
sudo: no
git:
repo: '{{ item.repo }}'
dest: '{{ tmux_plugins_path }}/plugins/{{ item.name }}'
with_items: tmux_plugins
This approach works on a couple of my systems, but fails (as the comments note) in all but the most basic cases. It also
scales very poorly - as I don't see a way to "reuse" any of the tasks or to use multiple/chained when expressions
with a single task.
I've started playing with several other solutions I've read about:
Pass in a flag using -e, for example: use_sudo, but again, without "task reuse" I'm going to have to write
individual tasks for each application/library to account for the flag. And if I also did this with the operating
system (-e os=macosx), this scales even worse.
Tag all my tasks at the role level - this required me to split out tasks into separate roles by OS rather than
"topic", which was counter-interuitive, and difficult to work with.
Tag all my tasks at the task level - again, without task reuse, this seems to scale very badly.
I've considered looking plugins/modules to see if I can write something up in Python to make enable if/else constructs
in a single task or "nested" tasks, and if I can't figure something more simple out, that's probably what I'll look into
next.
So, am I doing it wrong? Any suggestions?

Answer 1

You can use Conditional Imports
or Applying ‘when’ to roles and includes described in
http://docs.ansible.com/ansible/latest/playbooks_conditionals.html