# Different initial remote\_user per host - how best to arrange inventory? **URL:** \ **Category:** Ansible Project\ **Created:** [March 20, 2014, 5:24pm UTC](https://forum.ansible.com/t/different-initial-remote-user-per-host-how-best-to-arrange-inventory/14815 "2014-03-20T17:24:06Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Adrian\_Simmons](https://avatars.discourse-cdn.com/v4/letter/a/8e8cbc/32.png) [@Adrian\_Simmons](https://forum.ansible.com/u/Adrian_Simmons)\ **Post date:** [March 20, 2014, 5:24pm UTC](https://forum.ansible.com/t/different-initial-remote-user-per-host-how-best-to-arrange-inventory/14815/1 "2014-03-20T17:24:06Z")
Hi, My current ‘hosts’ inventory file has sections for a dev/stage/production workflow, and I don’t imagine it will ever have more than one or two servers in each section. eg ```auto [devel] 192.0.2.10 hostname=devel fqdn=devel.example.com [stage] 192.0.2.10 hostname=stage fqdn=stage.example.com [production] 203.0.113.10 hostname=production fqdn=production.example.com [testing] 192.0.2.24 hostname=testing fqdn=testing.example.com 203.0.113.11 hostname=remotest fqdn=remotest.example.com ``` I have a playbook at the moment that does most of the work - main.yml - and it uses an ansible specific user I called ‘ansa’ that’s set in group\_vars/all: ```auto # A user just for ansible ansible_ssh_user: ansa ansible_ssh_private_key_file: /path/to/the/ssh/id_rsa ``` To set up this ‘ansa’ user I have a separate setup.yml. All of this is working fine. What I want to do now is run the setup.yml play on different hosts, with different initial login requirements. Namely some servers will be created using vagrant, so I want to use vagrant as remote\_user: ```auto - hosts: all accelerate: false remote_user: vagrant sudo: yes vars: ansible_ssh_user: vagrant ansible_ssh_private_key_file: "~/.vagrant.d/insecure_private_key" tasks: etc... ``` and others without vagrant using a standard root login: ```auto - hosts: all accelerate: false remote_user: root vars: ansible_ssh_user: root ansible_ssh_private_key_file: "~/.ssh/id_rsa" tasks: etc... ``` So, two interelated problems: One, I’m duplicating code with two different versions of this setup.yml, I’d like to have a single setup.yml with logic to decide which remote\_user and ansible\_ssh\_user to use. I’m not sure how to achieve that. Two, if I have an inventory section as show above with a [testing] section and two hosts in it, one of which is vagrant based and one not, how can I specify the right version of setup to use? (assuming problem One is unanswered) ‘ansible-playbook --limit testing vagrant-setup\_do.yml’ will throw an error for the other host. So far I’ve not managed to find a better way to address this than simply commenting out hosts in the inventory file before running the setup play. Once the setup play has run the main.yml play will work fine with this inventory layout, its just the inital setup run that is clunky. Suggestions for making the initial setup less clunky are welcome. Right now the only thing I can think of is to work outside of ansible, setting up the root account with vagrant to match that on the non-vagrant hosts, so I can have a single setup play. Or given that setup only has to be run once per host, maybe I’m trying to hard and just need to accept a little manual work getting things set up… ---
**Author:** ![Adrian\_Simmons](https://avatars.discourse-cdn.com/v4/letter/a/8e8cbc/32.png) [@Adrian\_Simmons](https://forum.ansible.com/u/Adrian_Simmons)\ **Post date:** [March 24, 2014, 10:25am UTC](https://forum.ansible.com/t/different-initial-remote-user-per-host-how-best-to-arrange-inventory/14815/2 "2014-03-24T10:25:50Z")
> Right now the only thing I can think of is to work outside of ansible, setting up the root account with vagrant to match that on the non-vagrant hosts, so I can have a single setup play. Looks like that question was to long and rambling to get answers 😛 At least writing it all down sometimes makes you think of the best answer. I took my own advice and did the work in vagrant instead, to set the root account up with ssh key access so my setup play can work just as it can on non-vagrant nodes. I’ll have my main ansible play remove that key as a part of securing ssh access. ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [March 24, 2014, 12:32pm UTC](https://forum.ansible.com/t/different-initial-remote-user-per-host-how-best-to-arrange-inventory/14815/3 "2014-03-24T12:32:10Z")
I highly recommend arranging variables in group\_vars/ and host\_vars/ directories versus trying to fit them into the INI file – IMHO, it’s a lot easier to read. In this case, group\_vars/production: ansible\_ssh\_user: production\_username Don’t define ansible\_ssh\_user in “vars” as this will override that setting, which seems to be not what you want to do. ---
**Author:** ![Adrian\_Simmons](https://avatars.discourse-cdn.com/v4/letter/a/8e8cbc/32.png) [@Adrian\_Simmons](https://forum.ansible.com/u/Adrian_Simmons)\ **Post date:** [March 25, 2014, 11:39am UTC](https://forum.ansible.com/t/different-initial-remote-user-per-host-how-best-to-arrange-inventory/14815/4 "2014-03-25T11:39:12Z")
Thanks Michael, > I highly recommend arranging variables in group\_vars/ and host\_vars/ directories versus trying to fit them into the INI file – IMHO, it’s a lot easier to read. I do have the ansa user in host\_vars/all – this is a user setup just for ansible to use and I do want _all_ hosts to use it. I need to run a setup play once to get the ansa user into place on each host and that setup play has ansible\_ssh\_user in “vars”… > ansible\_ssh\_user in “vars” as this will override that setting, which seems to be not what you want to do. …because overriding that setting just for the setup play is _exactly_ what I want to do. My question was regarding two different types of base boxes. Vagrant and non-vagrant – for the vagrant boxes the setup play needs to set the var ansible\_ssh\_user to ‘vagrant’ and for the non-vagrant it needs set to ‘root’. There’s no neat and tidy separation between groups, [production], [testing] etc may each have vagrant or non-vagrant hosts, so I cant just use group\_vars. What I’ve done as a workaround is to have my vagrantfile setup the root user for ssh access – so that the vagrant based boxes and non-vagrant behave exactly the same as far as my setup play is concerned. Reading the documentation again today I’m thinking I should probably have my setup play look for an ansible fact specific to a vagrant box and then a conditional in the setup play based on that, so that I can have one setup play that deals with both types of box. ---
**Author:** ![Callum\_Macdonald](https://avatars.discourse-cdn.com/v4/letter/c/3e96dc/32.png) [@Callum\_Macdonald](https://forum.ansible.com/u/Callum_Macdonald)\ **Post date:** [May 11, 2015, 3:58pm UTC](https://forum.ansible.com/t/different-initial-remote-user-per-host-how-best-to-arrange-inventory/14815/5 "2015-05-11T15:58:13Z")
@Adrian: Did you ever find a better solution? I tried adding a custom value per host, like `bootstrap_user=root`, so I could manually configure that this user should be used for the bootstrap playbook. It seems like `remote_user: "{{ bootstrap_user }}"` is not interpreted, but passed directly to the ssh command as the literal username. So this approach doesn’t really work. In the end, I did like you, and wrote the user into the playbook. I’ll manually edit it when bootstrapping new hosts. ☹ Cheers - Callum. ---
**Author:** ![Callum\_Macdonald](https://avatars.discourse-cdn.com/v4/letter/c/3e96dc/32.png) [@Callum\_Macdonald](https://forum.ansible.com/u/Callum_Macdonald)\ **Post date:** [May 11, 2015, 4:04pm UTC](https://forum.ansible.com/t/different-initial-remote-user-per-host-how-best-to-arrange-inventory/14815/6 "2015-05-11T16:04:03Z")
I did find another workaround, but it’s not very elegant either. In my bootstrap.yml file I created two identical blocks, one with `remote_user: root` and one without. Then I can conditionally run the playbook against one host like so: ansible-playbook bootstrap.yml -l host -t root or ansible-playbook bootstrap.yml -l host -t current It’s also ugly, but at least doesn’t require code changes when I want to init a new host. Cheers - Callum. ---
**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\ **Post date:** [May 11, 2015, 4:18pm UTC](https://forum.ansible.com/t/different-initial-remote-user-per-host-how-best-to-arrange-inventory/14815/7 "2015-05-11T16:18:41Z")
disable fact gathering, have the first task be setup: as root (ignore\_errors), condition the rest of the tasks on it's success or failure ---
**Author:** ![Shawn\_Ferry](https://avatars.discourse-cdn.com/v4/letter/s/f0a364/32.png) [@Shawn\_Ferry](https://forum.ansible.com/u/Shawn_Ferry)\ **Post date:** [May 12, 2015, 1:15am UTC](https://forum.ansible.com/t/different-initial-remote-user-per-host-how-best-to-arrange-inventory/14815/8 "2015-05-12T01:15:59Z")
If the list of hosts is fixed or follows a recognizable pattern by IP or by name you could define the User parameter in .ssh/config Shawn