# roles configuring other roles?

**URL:** <https://forum.ansible.com/t/roles-configuring-other-roles/22903>\
**Category:** Ansible Project\
**Created:** [October 27, 2016, 3:37pm UTC](https://forum.ansible.com/t/roles-configuring-other-roles/22903 "2016-10-27T15:37:13Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![lesh](https://avatars.discourse-cdn.com/v4/letter/l/6f9a4e/32.png) [@lesh](https://forum.ansible.com/u/lesh)\
**Post date:** [October 27, 2016, 3:37pm UTC](https://forum.ansible.com/t/roles-configuring-other-roles/22903/1 "2016-10-27T15:37:13Z")

</div>

Hi,  
I’d like for roles I assign to a host to append some data to this hosts configuration, facts, or something else, readable by other roles.

To be concrete, a web server role should specify config for local\_firewall, router\_firewall and nagios\_server roles  
Right now if I add a web server role to a machine, I have to edit its host\_vars by hand, and add something like (simplified):

firewall:  
tcp:  
http: 80  
https: 443

nagios:  
groups:

- http
- ssh

checks:

- ping

(nagios dict is read by nagios\_server role running on a separate machine, and firewall config is read by a local iptables role but also by a router/firewall/NAT role also running on a separate machine)

Central repetitive config I need to update per-role is inconvenient by itself, but with more roles it gets very messy, I’m supposing I’m not the only one dealing with this, so I’d like to ask about the best practices?

I know about role dependencies but these don’t work remotely (router/nagios) and I don’t want to append to some state from 5000 roles, I think I should be able to generate this state on demand.

and I know about set\_fact in roles, but using it would again mean that I have to run all the roles on all machines because “These variables will be available to subsequent plays during an ansible-playbook run, but will not be saved across executions” and also, I’d like to append to the config (a let’s say firewall dict?), and not rewrite it entirely with each set\_fact

Am I missing something? How should I approach this?  
Thanks!

---

<div class="post-metadata">

**Author:** ![Dick\_Davies](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@Dick\_Davies](https://forum.ansible.com/u/Dick_Davies)\
**Post date:** [October 28, 2016, 1:20pm UTC](https://forum.ansible.com/t/roles-configuring-other-roles/22903/2 "2016-10-28T13:20:03Z")

</div>

I have the exact same issue with my nagios generation experiment

(

here if anyones interested -  
[https://github.com/rasputnik/ansible-autonagios/issues/2](https://github.com/rasputnik/ansible-autonagios/issues/2)

I use a sub-template per group to assemble a single .cfg per host, see  
the bottom of  
[https://github.com/rasputnik/ansible-autonagios/blob/master/roles/autonagios/templates/host-template.cfg.j2](https://github.com/rasputnik/ansible-autonagios/blob/master/roles/autonagios/templates/host-template.cfg.j2)

)

set\_fact within other roles sounds a bit intrusive, but there has to be some  
binding between the roles and their service check templates anyway. At least  
this way it's clear to see which role vars are used by the templates.

Big downside to this approach is the requirement to stick your nagios  
role at the end  
of the play. Not just from a speed perspective; I've had issues in the  
past with hostvars  
where a downed machine will break the play and it will be even harder  
to workaround  
with all this inter-host dependency.

I'm probably going to go with group\_vars/ to solve this; my checks are  
group-based,  
the other roles can use the same vars which prevents drift, and since  
all vars used by  
Nagios are now inventory based I don't need to touch any other hosts  
during the play.