# Blacklist specific hosts or groups in a role or playbook? **URL:** \ **Category:** Ansible Project\ **Created:** [December 6, 2013, 6:16pm UTC](https://forum.ansible.com/t/blacklist-specific-hosts-or-groups-in-a-role-or-playbook/14090 "2013-12-06T18:16:54Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Andrew\_Martin](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@Andrew\_Martin](https://forum.ansible.com/u/Andrew_Martin)\ **Post date:** [December 6, 2013, 6:16pm UTC](https://forum.ansible.com/t/blacklist-specific-hosts-or-groups-in-a-role-or-playbook/14090/1 "2013-12-06T18:16:54Z")
Hello, Is it possible to prevent a playbook, role, or even specific task from being run on a certain list of hostnames (or group)? I have a generic playbook for configuring postfix for sending emails, however I don’t want this playbook to ever be run against a mail server (which has a different postfix configuration). The idea behind blacklisting it in the playbook itself is so that if someone accidentally runs “ansible-playbook all postfix.yml” it won’t override the configuration on the mail servers. Can this be done? Thanks, Andrew ---
**Author:** ![Serge\_van\_Ginderacht](https://avatars.discourse-cdn.com/v4/letter/s/b782af/32.png) [@Serge\_van\_Ginderacht](https://forum.ansible.com/u/Serge_van_Ginderacht)\ **Post date:** [December 6, 2013, 6:41pm UTC](https://forum.ansible.com/t/blacklist-specific-hosts-or-groups-in-a-role-or-playbook/14090/2 "2013-12-06T18:41:08Z")
Is it possible to prevent a playbook, role, or even specific task from > being run on a certain list of hostnames (or group)? I have a generic > playbook for configuring postfix for sending emails, however I don't want > this playbook to ever be run against a mail server (which has a different > postfix configuration). The idea behind blacklisting it in the playbook > itself is so that if someone accidentally runs "ansible-playbook all > postfix.yml" it won't override the configuration on the mail servers. Can > this be done? Yes, see [http://www.ansibleworks.com/docs/intro\_patterns.html](http://www.ansibleworks.com/docs/intro_patterns.html) : You can exclude groups as well, for instance, all machines must be in the group webservers but not in the group phoenix: webservers:!phoenix ---
**Author:** ![Andrew\_Martin](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@Andrew\_Martin](https://forum.ansible.com/u/Andrew_Martin)\ **Post date:** [December 6, 2013, 7:40pm UTC](https://forum.ansible.com/t/blacklist-specific-hosts-or-groups-in-a-role-or-playbook/14090/3 "2013-12-06T19:40:41Z")
Serge, Thanks for the information. In order to exclude a hostname called “mailserver”, would I simply add a hosts line like this to the top of the postfix role’s tasks/main.yml? - hosts:!mailserver - name: task1 … - name: task2 … Will this override the list of hosts that I provide to the playbooks that include this role? Thanks, Andrew ---
**Author:** ![Serge\_van\_Ginderacht](https://avatars.discourse-cdn.com/v4/letter/s/b782af/32.png) [@Serge\_van\_Ginderacht](https://forum.ansible.com/u/Serge_van_Ginderacht)\ **Post date:** [December 6, 2013, 7:48pm UTC](https://forum.ansible.com/t/blacklist-specific-hosts-or-groups-in-a-role-or-playbook/14090/4 "2013-12-06T19:48:03Z")
> Thanks for the information. In order to exclude a hostname called > "mailserver", would I simply add a hosts line like this to the top of the > postfix role's tasks/main.yml? >   - hosts:!mailserver >   - name: task1 >   ... >   - name: task2 >   ... > Will this override the list of hosts that I provide to the playbooks that > include this role? ​No. the hosts: keyword is ​to be set at play level, not at task level: ​- name: mailserver play​ ---
**Author:** ![Andrew\_Martin](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@Andrew\_Martin](https://forum.ansible.com/u/Andrew_Martin)\ **Post date:** [December 6, 2013, 7:56pm UTC](https://forum.ansible.com/t/blacklist-specific-hosts-or-groups-in-a-role-or-playbook/14090/5 "2013-12-06T19:56:21Z")
Okay, so the only way to exclude a host is at the play level, not the role level? It would be more ideal for my setup to exclude at the role level, that way I can ensure that any new play that is written that includes a particular role won’t run it against blacklisted hosts. Moreover, having hosts excluded at the play level means that entire play will be skipped on blacklisted hosts, but perhaps only 1 of the roles in the play is blacklisted, and so if the blacklist/exclusion happened at the role level then the play would run on the blacklisted host and just complete all of the roles that were allowed. For example, say I have a play called common.yml which sets up several common features on hosts. It is defined as follows: roles: - ntp - postfix - smartmontools It would be nice to be able to just run the common.yml play against all hosts, and have it configure ntp and smartmontools on all hosts but only postfix on the hosts which aren’t mailservers. Is this possible? If I add “- hosts: !mailserver” to common.yml, then the complete play will be skipped on “mailserver”. ---
**Author:** ![Serge\_van\_Ginderacht](https://avatars.discourse-cdn.com/v4/letter/s/b782af/32.png) [@Serge\_van\_Ginderacht](https://forum.ansible.com/u/Serge_van_Ginderacht)\ **Post date:** [December 6, 2013, 8:12pm UTC](https://forum.ansible.com/t/blacklist-specific-hosts-or-groups-in-a-role-or-playbook/14090/6 "2013-12-06T20:12:51Z")
> Okay, so the only way to exclude a host is at the play level, not the role > level? Yes. Roles are basically just some automation around a set of tasks​​. It would be more ideal for my setup to exclude at the role level, that way > I can ensure that any new play that is written that includes a particular > role won't run it against blacklisted hosts. If you really want to be sure, add a conditional to the role tasks:    when: inventory\_hostname != mailserver Moreover, having hosts excluded at the play level means that entire play > will be skipped on blacklisted hosts, but perhaps only 1 of the roles in > the play is blacklisted, Yes, that is by design. You need to model playbooks to include roles and target a particular set of hosts. ​​ > and so if the blacklist/exclusion happened at the role level then the play > would run on the blacklisted host and just complete all of the roles that > were allowed. > > For example, say I have a play called common.yml which sets up several > common features on hosts. It is defined as follows: >   roles: >     - ntp >     - postfix >     - smartmontools > > It would be nice to be able to just run the common.yml play against all > hosts, and have it configure ntp and smartmontools on all hosts but only > postfix on the hosts which aren't mailservers. Then you need to split this up in multiple plays. Take the postfix role out of 'common', as it is not common to all your hosts. ​​ > Is this possible? If I add "- hosts: !mailserver" to common.yml, then the > complete play will be skipped on "mailserver". should be hosts: all:!mailserver​​ but yes Serge ---
**Author:** ![kahlil.hodgson](https://avatars.discourse-cdn.com/v4/letter/k/b9bd4f/32.png) [@kahlil.hodgson](https://forum.ansible.com/u/kahlil.hodgson)\ **Post date:** [December 6, 2013, 8:41pm UTC](https://forum.ansible.com/t/blacklist-specific-hosts-or-groups-in-a-role-or-playbook/14090/7 "2013-12-06T20:41:36Z")
Serge's suggestion is more elegant, but if you are paranoid, you can also add an early check to a task list: ---
**Author:** ![Andrew\_Martin](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@Andrew\_Martin](https://forum.ansible.com/u/Andrew_Martin)\ **Post date:** [December 6, 2013, 9:41pm UTC](https://forum.ansible.com/t/blacklist-specific-hosts-or-groups-in-a-role-or-playbook/14090/8 "2013-12-06T21:41:02Z")
Thanks, both of these responses are very helpful. I’ve restructured my playbooks a bit as per Serge’s suggestions and also added this extra fail check for extra protection. Note that you can do some limited wildcard matching using the Jinja2 “in” expression: - fail: msg=“Don’t accidentally run this on any of my mailservers” when: “‘mail’ in inventory\_hostname” This should match hostnames “mail”, “emailserver”, “mail0”, etc.