# Separation of config data and logic

**URL:** <https://forum.ansible.com/t/separation-of-config-data-and-logic/17411>\
**Category:** Ansible Project\
**Created:** [February 1, 2015, 9:03pm UTC](https://forum.ansible.com/t/separation-of-config-data-and-logic/17411 "2015-02-01T21:03:32Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Giovanni\_Tirloni](https://avatars.discourse-cdn.com/v4/letter/g/71c47a/32.png) [@Giovanni\_Tirloni](https://forum.ansible.com/u/Giovanni_Tirloni)\
**Post date:** [February 1, 2015, 9:03pm UTC](https://forum.ansible.com/t/separation-of-config-data-and-logic/17411/1 "2015-02-01T21:03:32Z")

</div>

Hi,

As I build more complex playbooks that will be used by other teams that  
have zero knowledge of Ansible (read: big corporation), I started to  
migrate much of the configuration data to variable files. The idea was  
to enforce certain things in the playbooks (thing that won't ever  
change and are standards -- famous last words) and let these users  
change the moving parts through variables.

Initially it was nice because I was asking them to fill in a variable  
named "oracle\_sid" and I would use it throughout the plays in all sorts  
of ways. The "users" didn't have to mess with Jinja filters, get the  
chance to break the logic, etc.

Then it got weird when I was creating lists of dictionaries for users  
that should exist for a given role, like this:

oracle\_users:  
&nbsp;&nbsp;- name: userX  
&nbsp;&nbsp;&nbsp;&nbsp;group: groupX  
&nbsp;&nbsp;&nbsp;&nbsp;groups: groupY,groupZ  
&nbsp;&nbsp;&nbsp;&nbsp;home: /home/userX  
- name: userY  
&nbsp;&nbsp;&nbsp;group: ....  
&nbsp;&nbsp;  
The YAML file with these variables is \_almost\_ like the playbook file  
itself and I'm just looping over the list creating users with \_almost\_  
all parameters defined by the end-user through that vars file.

So I got stuck thinking if I should be radical and not allow any  
configuration data in the playbooks, only get it from variables. Or if I  
should let these other operation teams mess directly with the playbooks.

I'm really divided about this and really appreciate any feedback.

Giovanni

---

<div class="post-metadata">

**Author:** ![michael1](https://avatars.discourse-cdn.com/v4/letter/m/eada6e/32.png) [@michael1](https://forum.ansible.com/u/michael1)\
**Post date:** [February 2, 2015, 12:54am UTC](https://forum.ansible.com/t/separation-of-config-data-and-logic/17411/2 "2015-02-02T00:54:38Z")

</div>

Hey Giovanni,

It’s good that you want to separate your data from your logic. It’s a design pattern you won’t regret, now and going forward. Here’s how I see your problem resolved.

A simple Playbook for looping over the data, adding groups (first) and users:

`

---

<div class="post-metadata">

**Author:** ![Giovanni\_Tirloni](https://avatars.discourse-cdn.com/v4/letter/g/71c47a/32.png) [@Giovanni\_Tirloni](https://forum.ansible.com/u/Giovanni_Tirloni)\
**Post date:** [February 2, 2015, 10:03am UTC](https://forum.ansible.com/t/separation-of-config-data-and-logic/17411/3 "2015-02-02T10:03:15Z")

</div>

Hi Michael,

Thanks for the insights, certainly helpful! I will review my playbooks  
and incorporate more of these ideas.

Giovanni