2nd Ansible for Network Automation Project
This project treats the network as code. Every device configuration, every IP assignment, every VLAN, and every monitoring target is defined in a source of truth and enforced by Ansible. Changes go through Git approval, which validated everything before deployment, and are monitored for configuration drift. When drift is detected, the platform remediates it automatically (with human approval).
I broke it down into 38 parts, with each part building onto the previous one. This is my 2nd iteration of my 1st Ansible for Network Automation Project.
Each service runs on its own dedicated VM since I tried to mirror enterprise isolation practices. Every service integrates with NetBox for device data and FreeIPA for authentication.
| Service | Purpose | Integration |
|---|---|---|
| NetBox | Source of truth (IPAM, DCIM) | Dynamic inventory for Ansible, service discovery for monitoring |
| Gitea | Self-hosted Git with branch protection | PR pipeline, Oxidized config backend, AWX project source |
| AWX | Automation controller | Job scheduling, RBAC, webhook-triggered deployments |
| Zabbix | Networking monitoring (SNMP) | Auto-discovers devices from Netbox |
| Prometheus + Grafana | Metrics and dashboards | Node exporter on all VMs, NetBox service discovery |
| Graylog + OpenSearch | Centralized log management | Syslog over TLS, NetBox enrichment, alerting |
| Oxidized | Config backup and versioning | Gitea backend, diff-on-change alerts |
| FreeIPA | Centralized identity and SSO | LDAP backend for TACACS+, SSO for all web UIs |
| step-ca | Internal PKI | TLS for syslog, HTTPS endpoints, ACME renewal |
| Batfish | Offline config analysis | Pre-change validation in the CI/CD pipeline |
| pyATS / Genie | Live network validation | Post-change verification, health snapshots |
| Ansible EDA | Event-driven automation | Closed-loop remediation triggered by Graylog |
Intent-based configuration
Dynamic inventory
Structured IPAM
10.33.0.0/16 supernet where the third octet encodes function (0 = loopbacks, 1 = P2P links, 10+ = VLAN ID). All addressing managed in NetBox IPAM and populated via Ansible.Multi-vault secrets
GitOps change pipeline
Self-healing loop
ssh-agentstep-ca) with ACME certificate automation
Grafana: Fabric health
Unified dashboard with device availability, interface utilization, and BGP session states.
NetBox: Device inventory
All 8 devices with sites, roles, platforms, and primary IPs populated.
AWX: Workflow execution
Multi-step workflow with validation, deployment, and approval gates.
Gitea: PR with CI checks
Pull request showing lint, syntax, and pre-change analysis passing.
Foundation
Control node, Gitea, Ansible Vault, Containerlab with first devices, playbook fundamentals, Jinja2 deep dive, reusable roles.
The Network Fabric
NetBox as source of truth, IPAM plan, multi-vendor automation (IOS-XE, NX-OS, PAN-OS), BGP fabric, VM provisioning, monitoring, config backup.
Network Services
BGP/OSPF production patterns, FreeIPA, TACACS+, security hardening, internal PKI, DNS/NTP, centralized logging, traffic flow visibility, unified observability.
Automation Platform
AWX controller, GitOps pipeline, Batfish pre-change analysis, pyATS live validation, Molecule role testing, CI/CD hardening, drift detection, NetBox reconciliation.
Advanced Automation
AWX workflows with approval gates, Event-Driven Ansible, closed-loop self-healing, full-stack rebuild from scratch.
AUTOMATION
NETWORK PLATFORMS
INFRASTRUCTURE
OBSERVABILITY
DEVOPS
LANGUAGES