Infrastructure as Code — จัดการ Server ด้วย Terraform & AnsibleInfrastructure as Code — Managing Servers with Terraform & Ansible

# กำหนด provider (Cloud ที่จะใช้)
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

provider "aws" {
  region = "ap-southeast-1"    # Singapore
}

# สร้าง EC2 Instance
resource "aws_instance" "web_server" {
  ami           = "ami-0c55b159cbfafe1f0"   # Ubuntu 22.04
  instance_type = "t3.medium"

  tags = {
    Name        = "web-server-01"
    Environment = "production"
    ManagedBy   = "terraform"
  }

  # Security Group
  vpc_security_group_ids = [aws_security_group.web_sg.id]
}

# สร้าง Security Group
resource "aws_security_group" "web_sg" {
  name        = "web-sg"
  description = "Allow HTTP and SSH"

  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]     # HTTP จากทุกที่
  }

  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"]    # SSH จาก private network เท่านั้น
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

# Output — แสดง IP ที่ได้
output "server_ip" {
  value = aws_instance.web_server.public_ip
}

# Terraform commands
terraform init      # ดาวน์โหลด provider plugins
terraform plan      # ดู preview ว่าจะสร้างอะไร
terraform apply     # สร้างจริง! (ถาม yes/no)
terraform destroy   # ลบทั้งหมด (ระวัง!)

# ตัวอย่าง output ของ terraform plan:
# + aws_instance.web_server
#     ami:           "ami-0c55b159cbfafe1f0"
#     instance_type: "t3.medium"
#
# Plan: 2 to add, 0 to change, 0 to destroy.

# ใช้ count สร้าง 5 เครื่องรวด!
resource "aws_instance" "web_cluster" {
  count         = 5
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t3.medium"

  tags = {
    Name = "web-server-${count.index + 1}"
  }
}

# Output ทุก IP
output "server_ips" {
  value = aws_instance.web_cluster[*].public_ip
}
# → ["10.0.1.1", "10.0.1.2", "10.0.1.3", "10.0.1.4", "10.0.1.5"]

all:
  children:
    webservers:
      hosts:
        web1:
          ansible_host: 10.0.1.1
        web2:
          ansible_host: 10.0.1.2
        web3:
          ansible_host: 10.0.1.3
    databases:
      hosts:
        db1:
          ansible_host: 10.0.2.1
  vars:
    ansible_user: deploy
    ansible_ssh_private_key_file: ~/.ssh/id_ed25519

---
- name: Setup Web Servers
  hosts: webservers
  become: yes          # ใช้ sudo

  tasks:
    # อัพเดท system
    - name: Update apt cache
      apt:
        update_cache: yes
        cache_valid_time: 3600

    # ติดตั้ง Nginx
    - name: Install Nginx
      apt:
        name: nginx
        state: present

    # ติดตั้ง Node.js 20
    - name: Add NodeSource repository
      shell: curl -fsSL https://deb.nodesource.com/setup_20.x | bash -

    - name: Install Node.js
      apt:
        name: nodejs
        state: present

    # Copy config file
    - name: Deploy Nginx config
      template:
        src: templates/nginx.conf.j2
        dest: /etc/nginx/sites-available/myapp
      notify: Restart Nginx

    # เปิด firewall
    - name: Allow HTTP through firewall
      ufw:
        rule: allow
        port: "80"
        proto: tcp

    # ตรวจสอบว่า Nginx ทำงาน
    - name: Ensure Nginx is running
      service:
        name: nginx
        state: started
        enabled: yes

  handlers:
    - name: Restart Nginx
      service:
        name: nginx
        state: restarted

# รัน playbook
ansible-playbook -i inventory.yml setup-webserver.yml

# ดูผลลัพธ์:
# PLAY [Setup Web Servers] *************************************
# TASK [Install Nginx] *****************************************
# changed: [web1]
# changed: [web2]
# changed: [web3]
#
# PLAY RECAP ***************************************************
# web1: ok=7  changed=5  unreachable=0  failed=0
# web2: ok=7  changed=5  unreachable=0  failed=0
# web3: ok=7  changed=5  unreachable=0  failed=0

# Ping ทุกเครื่อง
ansible all -i inventory.yml -m ping

# ดู disk space ทุก webserver
ansible webservers -i inventory.yml -a "df -h"

# ติดตั้ง package ด่วน
ansible webservers -i inventory.yml -m apt -a "name=htop state=present" --become

# Restart service
ansible webservers -i inventory.yml -m service -a "name=nginx state=restarted" --become

# 1. Terraform สร้าง infrastructure
cd terraform/
terraform apply -auto-approve

# 2. Export IP ที่ได้ เป็น Ansible inventory
terraform output -json server_ips | \
  jq -r '.[] | "  " + . ' > ../ansible/hosts.txt

# 3. Ansible ตั้งค่าทุกเครื่อง
cd ../ansible/
ansible-playbook -i inventory.yml setup-all.yml

# Terraform remote state (best practice)
terraform {
  backend "s3" {
    bucket         = "my-terraform-state"
    key            = "prod/terraform.tfstate"
    region         = "ap-southeast-1"
    dynamodb_table = "terraform-locks"
    encrypt        = true
  }
}

In the previous post we covered the networking fundamentals — DNS, firewalls, load balancers, SSH.

But picture having to set up 50 servers... are you really going to SSH into each one and configure it by hand? 😰

This is where Infrastructure as Code (IaC) comes in — writing code to create and manage your entire infrastructure instead of doing it by hand. Like writing the recipe down instead of keeping it in your head 📝🐕

---

What is IaC?

Infrastructure as Code is the idea that infrastructure — servers, networks, databases, firewalls — should be defined in code, not clicked together in a console or typed one command at a time.

The benefits of IaC: repeatable (the same result every time), version controlled (kept in Git, with a history you can read), reviewable (infrastructure changes go through review, just like code), testable (you can test before you apply) — compare life before and after IaC:

Before IaC (Manual) 😩

1. Log in to the AWS Console
2. Click "Create EC2 Instance"
3. Pick Ubuntu, t3.medium, 50GB disk...
4. SSH in and install Nginx, Node.js, PostgreSQL...
5. Do it 50 times ❌

After IaC (Automated) 🚀

1. Write Terraform → 50 servers created
2. Write Ansible → software installed on all 50
3. Run one command ✅

💡 The core principles:
✅ Repeatable — the same result on every run
✅ Version-controlled — kept in Git, with a readable history
✅ Reviewable — the team reviews before you apply
✅ Testable — test it before you deploy

---

Terraform vs Ansible — which one?

The answer is both! Because they do different jobs — Terraform "builds" infrastructure (VMs, networks, databases, load balancers) while Ansible "configures" what was built (install software, configure services, deploy apps). Terraform is declarative (you state "what you want"); Ansible is procedural (you state "what to do, step by step"):

Feature	Terraform	Ansible
Primary job	Create/manage infrastructure	Configure/install software
Category	Provisioning tool	Configuration Management tool
Language	HCL (HashiCorp Config Language)	YAML (Playbooks)
How it works	Declarative — you state "what you want"	Procedural + Declarative
State	✅ Tracks a state file	❌ Agentless, no state
Examples	Create EC2, VPC, RDS, S3	Install Nginx, deploy an app
Cloud Support	AWS, GCP, Azure, DigitalOcean, +100 providers	Any machine you can SSH into

💡 An easy way to remember it: Terraform = build the machine | Ansible = configure the machine

---

Terraform — building infrastructure with code

Terraform, by HashiCorp, is the most widely adopted IaC tool — it supports every cloud provider (AWS, Azure, GCP, DigitalOcean, etc.) through provider plugins, uses the readable HCL (HashiCorp Configuration Language), and manages your infrastructure's state for you.

How does Terraform work?

The Terraform workflow has three main steps: Write (author your .tf files), Plan (see what will change — a dry run), Apply (actually create or modify the infrastructure). The important part is that terraform plan always shows you the diff before you apply — no surprises!

Example: creating an AWS EC2 instance

The main.tf below creates an EC2 instance on AWS — notice how readable HCL is: you declare the provider (AWS, region), the resource (instance type, AMI, security group), and an output (the IP address). Everything is declarative:

# Declare the provider (the cloud you will use)
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

provider "aws" {
  region = "ap-southeast-1"    # Singapore
}

# Create an EC2 instance
resource "aws_instance" "web_server" {
  ami           = "ami-0c55b159cbfafe1f0"   # Ubuntu 22.04
  instance_type = "t3.medium"

  tags = {
    Name        = "web-server-01"
    Environment = "production"
    ManagedBy   = "terraform"
  }

  # Security Group
  vpc_security_group_ids = [aws_security_group.web_sg.id]
}

# Create the Security Group
resource "aws_security_group" "web_sg" {
  name        = "web-sg"
  description = "Allow HTTP and SSH"

  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]     # HTTP from anywhere
  }

  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"]    # SSH from the private network only
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

# Output — show the IP we got
output "server_ip" {
  value = aws_instance.web_server.public_ip
}

# Terraform commands
terraform init      # download the provider plugins
terraform plan      # preview what will be created
terraform apply     # build it for real! (asks yes/no)
terraform destroy   # tear it all down (careful!)

# Sample terraform plan output:
# + aws_instance.web_server
#     ami:           "ami-0c55b159cbfafe1f0"
#     instance_type: "t3.medium"
#
# Plan: 2 to add, 0 to change, 0 to destroy.

Terraform builds many machines at once

The power of IaC becomes obvious the moment you need more than one machine — count or for_each will build 10, 50 or 100 servers from a single command. Try that by hand!

# Use count to build 5 machines in one go!
resource "aws_instance" "web_cluster" {
  count         = 5
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t3.medium"

  tags = {
    Name = "web-server-${count.index + 1}"
  }
}

# Output every IP
output "server_ips" {
  value = aws_instance.web_cluster[*].public_ip
}
# → ["10.0.1.1", "10.0.1.2", "10.0.1.3", "10.0.1.4", "10.0.1.5"]

---

Ansible — configuring servers automatically

Ansible, by Red Hat, is the easiest configuration management tool to pick up — you write playbooks in ordinary YAML, with no new language to learn. It is a good fit for installing packages, configuring services, deploying applications, and managing users and permissions.

How does Ansible work?

Ansible is agentless — nothing has to be installed on the target machine; it simply SSHes in and runs the commands. That is unlike Chef or Puppet, which need an agent on every host, and it makes setup easier and maintenance lighter. There are two main pieces: the Inventory (the list of servers) and the Playbook (what to do):

Step 1: Inventory — tell it which servers exist

The Inventory is the file that tells Ansible "these are the servers, and these are the groups they fall into". You can group them as webservers, databases, monitoring — then run a playbook against one group only:

all:
  children:
    webservers:
      hosts:
        web1:
          ansible_host: 10.0.1.1
        web2:
          ansible_host: 10.0.1.2
        web3:
          ansible_host: 10.0.1.3
    databases:
      hosts:
        db1:
          ansible_host: 10.0.2.1
  vars:
    ansible_user: deploy
    ansible_ssh_private_key_file: ~/.ssh/id_ed25519

Step 2: Playbook — tell it what to do

A Playbook is a YAML file describing what has to happen, one task at a time — Ansible runs them in order. Each task uses a module (apt, copy, service, template, and so on) that is idempotent: run it any number of times and the result is the same. Here is a web server setup:

---
- name: Setup Web Servers
  hosts: webservers
  become: yes          # use sudo

  tasks:
    # Update the system
    - name: Update apt cache
      apt:
        update_cache: yes
        cache_valid_time: 3600

    # Install Nginx
    - name: Install Nginx
      apt:
        name: nginx
        state: present

    # Install Node.js 20
    - name: Add NodeSource repository
      shell: curl -fsSL https://deb.nodesource.com/setup_20.x | bash -

    - name: Install Node.js
      apt:
        name: nodejs
        state: present

    # Copy config file
    - name: Deploy Nginx config
      template:
        src: templates/nginx.conf.j2
        dest: /etc/nginx/sites-available/myapp
      notify: Restart Nginx

    # Open the firewall
    - name: Allow HTTP through firewall
      ufw:
        rule: allow
        port: "80"
        proto: tcp

    # Check that Nginx is running
    - name: Ensure Nginx is running
      service:
        name: nginx
        state: started
        enabled: yes

  handlers:
    - name: Restart Nginx
      service:
        name: nginx
        state: restarted

# Run the playbook
ansible-playbook -i inventory.yml setup-webserver.yml

# The output:
# PLAY [Setup Web Servers] *************************************
# TASK [Install Nginx] *****************************************
# changed: [web1]
# changed: [web2]
# changed: [web3]
#
# PLAY RECAP ***************************************************
# web1: ok=7  changed=5  unreachable=0  failed=0
# web2: ok=7  changed=5  unreachable=0  failed=0
# web3: ok=7  changed=5  unreachable=0  failed=0

Ansible ad-hoc commands — no playbook required

For quick jobs that do not deserve a playbook, use ad-hoc commands to run a single command across many machines at once — check uptime everywhere, restart a service, copy a file:

# Ping every machine
ansible all -i inventory.yml -m ping

# Check disk space on every webserver
ansible webservers -i inventory.yml -a "df -h"

# Install a package in a hurry
ansible webservers -i inventory.yml -m apt -a "name=htop state=present" --become

# Restart a service
ansible webservers -i inventory.yml -m service -a "name=nginx state=restarted" --become

---

Terraform + Ansible working together

The best workflow uses both together — Terraform creates the infrastructure (VMs, VPC, load balancer), then hands its output (the IP addresses) to Ansible, which configures it (install Docker, deploy the app, set up monitoring). Terraform "builds the house"; Ansible "furnishes the rooms":

# 1. Terraform builds the infrastructure
cd terraform/
terraform apply -auto-approve

# 2. Export the IPs it returned as an Ansible inventory
terraform output -json server_ips | \
  jq -r '.[] | "  " + . ' > ../ansible/hosts.txt

# 3. Ansible configures every machine
cd ../ansible/
ansible-playbook -i inventory.yml setup-all.yml

---

Other IaC tools worth knowing

Beyond Terraform + Ansible there are other IaC tools worth a look — each has a different strength, so pick the one that suits your team and your use case:

Tool	Category	Strength
Terraform	Provisioning	HCL, multi-cloud, state management
Ansible	Config Management	YAML, agentless, simple
Pulumi	Provisioning	Written in Python/TypeScript/Go instead of HCL
CloudFormation	Provisioning	AWS native, JSON/YAML
Chef / Puppet	Config Management	Enterprise-grade, agent-based
OpenTofu	Provisioning	Terraform fork (open-source)

---

Best Practices

IaC turns infrastructure into code, so you have to treat it like real code — version control, code review, testing, modularization. The principles that matter:

1. Keep your IaC in Git — every infrastructure change goes through PR review
2. Use modules — split the code into reusable modules
3. Separate your environments — dev / staging / production each get their own config
4. Never keep secrets in code — use Vault, AWS Secrets Manager, or environment variables
5. Use remote state — keep Terraform state in S3 with a DynamoDB lock, not locally
6. Always plan before you apply — read the plan carefully before pressing yes!
7. Idempotent — run it any number of times, get the same result

# Terraform remote state (best practice)
terraform {
  backend "s3" {
    bucket         = "my-terraform-state"
    key            = "prod/terraform.tfstate"
    region         = "ap-southeast-1"
    dynamodb_table = "terraform-locks"
    encrypt        = true
  }
}

🐕 The golden rule: if the infrastructure is not in code, it does not really exist. Everything has to be reproducible!

---

Summary

Infrastructure as Code changes how you manage infrastructure — from "remember it and do it by hand" to "write the code and automate all of it". The results: a new environment in minutes, disaster recovery 100 times faster, and an audit trail in Git for every change:

• IaC = manage infrastructure with code instead of by hand
• Terraform = build the infrastructure (EC2, VPC, RDS) in HCL → plan → apply
• Ansible = configure the software (Nginx, Docker, the app) with YAML playbooks over SSH
• Use both = Terraform builds the machine → Ansible configures it → production ready!
• Best Practices = Git, modules, remote state, separate environments, no secrets in code
• An easy place to start: terraform init → plan → apply plus ansible-playbook 📝🐕