Ansible on Arch Linux Automation Complete Guide

By Luca Berton · Published 2024-01-01 · Category: installation

Automate Arch Linux (rolling) with Ansible: pacman, AUR via paru, systemd, nftables, snapshot-based safety, Wayland, developer environments.

Arch Linux is a rolling-release distribution favored by developers, enthusiasts, and lab operators. It always ships the latest stable kernel (typically 6.16+), Python 3.13/3.14, OpenSSH 10.0, Podman 5, and a minimal base install. Ansible's job on Arch is to make the otherwise hands-on system reproducible — pinning packages, dropping config, and keeping AUR builds idempotent. This guide is the master Ansible reference for Arch Linux workstations and lab servers.

Arch Linux release facts

Item	Value
Type	Rolling release
Default kernel	latest mainline / LTS
Default Python	3.13/3.14
Package manager	pacman
AUR helpers	paru, yay
Init	systemd

Ansible-core compatibility

Use ansible-core 2.20.

Baseline playbook

- name: Arch Linux baseline
  hosts: arch
  become: true
  tasks:
    - name: Sync and upgrade
      community.general.pacman:
        update_cache: true
        upgrade: true

    - name: Install baseline tools
      community.general.pacman:
        name:
          - vim
          - htop
          - curl
          - chrony
          - nftables
          - openssh
          - podman
          - cockpit
          - reflector
        state: present

    - name: Best mirrors via reflector
      ansible.builtin.command: |
        reflector --latest 20 --protocol https --country DE,FR,US --sort rate --save /etc/pacman.d/mirrorlist
      changed_when: true

    - name: Enable services
      ansible.builtin.service:
        name: "{{ item }}"
        enabled: true
        state: started
      loop: [chronyd, nftables, sshd, cockpit.socket]

AUR packages via `paru` (run as non-root)

- name: Install AUR packages idempotently
  hosts: arch
  become: true
  tasks:
    - name: Ensure paru is installed
      community.general.pacman:
        name: paru
        state: present

    - name: Install AUR packages
      become: true
      become_user: builder
      ansible.builtin.command: paru -S --noconfirm --needed {{ item }}
      register: paru_out
      changed_when: "'reinstalling' not in paru_out.stdout and 'is up to date' not in paru_out.stdout"
      loop:
        - visual-studio-code-bin
        - 1password

nftables firewall

- name: Configure nftables on Arch
  hosts: arch
  become: true
  handlers:
    - name: reload nftables
      ansible.builtin.service: { name: nftables, state: reloaded }
  tasks:
    - name: Drop ruleset
      ansible.builtin.copy:
        dest: /etc/nftables.conf
        owner: root
        mode: "0644"
        content: |
          flush ruleset
          table inet filter {
            chain input {
              type filter hook input priority 0; policy drop;
              ct state established,related accept
              iif "lo" accept
              tcp dport 22 accept
              icmp type echo-request accept
            }
          }
      notify: reload nftables

Pre-upgrade snapshots (Btrfs/Snapper)

- name: Snapshot before pacman -Syu
  hosts: arch
  become: true
  tasks:
    - name: Create pre snapshot
      ansible.builtin.command: snapper create --type pre --description "ansible pre-syu" --print-number
      register: pre

    - name: Sync and upgrade
      community.general.pacman: { update_cache: true, upgrade: true }

    - name: Post snapshot
      ansible.builtin.command: snapper create --type post --pre-number {{ pre.stdout }} --description "ansible post-syu"

Best practices

Never run paru as root — use a dedicated builder user.
Pin critical packages with IgnorePkg in /etc/pacman.conf and lift the pin only via Ansible.
Couple Arch with Btrfs + Snapper for deterministic rollback.

Conclusion

Ansible turns Arch Linux from a hand-tuned developer system into a reproducible, snapshot-safe workstation. Combine community.general.pacman, paru for AUR, and Snapper to ship a fleet of identical Arch boxes from a single playbook.

Installing Ansible on Arch Linux

# Install via pacman
sudo pacman -S ansible

# Or install via pip
pip install ansible --user

# Verify
ansible --version

Pacman Package Management

- name: Configure Arch Linux
  hosts: archlinux
  become: true
  tasks:
    - name: Update system
      community.general.pacman:
        update_cache: true
        upgrade: true

    - name: Install packages
      community.general.pacman:
        name:
          - vim
          - git
          - htop
          - tmux
          - openssh
          - firewalld
          - base-devel
        state: present

    - name: Install AUR helper (yay)
      ansible.builtin.command: |
        git clone https://aur.archlinux.org/yay-bin.git /tmp/yay-bin
        cd /tmp/yay-bin && makepkg -si --noconfirm
      args:
        creates: /usr/bin/yay
      become: false

Service Management

    - name: Enable and start services
      ansible.builtin.systemd:
        name: "{{ item }}"
        state: started
        enabled: true
      loop:
        - sshd
        - firewalld
        - NetworkManager

    - name: Configure firewalld
      ansible.posix.firewalld:
        service: ssh
        permanent: true
        immediate: true
        state: enabled

FAQ

Is Ansible well-supported on Arch Linux?

Yes. Ansible is in the official Arch repositories and stays current with upstream releases. Arch's rolling release model means you always have the latest version.

Which package module should I use?

Use community.general.pacman for official repository packages. For AUR packages, use shell commands with yay or paru.

Category: installation

Browse all Ansible tutorials · AnsiblePilot Home

AnsiblePilot — Master Ansible Automation

Popular Topics

About Luca Berton