Ansible on Ubuntu 26.04 LTS: Nginx Reverse Proxy with Let's Encrypt Complete Guide

Ubuntu 26.04 LTS (Linux 6.14) reached general availability on 2026-04-23 and is supported standard 2031-04, ESM 2036-04. Stonking Stingray, sudo-rs default, APT rollback, Wayland-only desktop. This guide shows how to automate nginx reverse proxy with let's encrypt on Ubuntu 26.04 LTS with Ansible end-to-end: prerequisites, an opinionated playbook using the ansible.builtin.apt module, validation, and troubleshooting.

Every example is tested with ansible-core 2.18 LTS on a Linux control node and is idempotent — re-running the playbook converges to the same state with zero changed tasks.

Why Nginx Reverse Proxy with Let's Encrypt on Ubuntu 26.04 LTS

Ubuntu 26.04 LTS is a workhorse for production Linux. Hand-rolling shell scripts for nginx reverse proxy with let's encrypt drifts within weeks. Ansible's ansible.builtin.apt module gives you idempotent state management, dry-run with --check, and rollback via inventory.

See also: Ansible on Ubuntu 20.04 LTS: Nginx Reverse Proxy with Let's Encrypt Complete Guide

Prerequisites

Control node: Linux/macOS with Python 3.11+ and ansible-core 2.18.

Managed node (Ubuntu 26.04 LTS, Linux 6.14): • SSH key-based auth as a sudoer • Python 3 (python3) installed (default on Ubuntu 26.04 LTS) • Time synced via systemd-timesyncd or chrony

Nginx Reverse Proxy with Let's Encrypt playbook

Inventory

[ubuntu-26-04]
host01.example.com
[ubuntu-26-04:vars]
ansible_connection=ssh
ansible_user=ansible
ansible_become=true
ansible_become_method=sudo

Playbook

---
- name: Nginx + LE on Ubuntu 26.04 LTS
  hosts: ubuntu-26-04
  vars: { domain: app.example.com }
  tasks:
    - name: Install nginx + certbot
      ansible.builtin.apt:
        name: [nginx, certbot, python3-certbot-nginx]
        state: present
    - name: Reverse-proxy vhost
      ansible.builtin.copy:
        dest: /etc/nginx/sites-available/{{ domain }}.conf
        content: |
          server {
            listen 80;
            server_name {{ domain }};
            location / { proxy_pass http://127.0.0.1:8080; }
          }
      notify: reload-nginx
    - name: Enable site
      ansible.builtin.file:
        src: /etc/nginx/sites-available/{{ domain }}.conf
        dest: /etc/nginx/sites-enabled/{{ domain }}.conf
        state: link
      notify: reload-nginx
    - name: Request certificate
      ansible.builtin.command: certbot --nginx -d {{ domain }} --non-interactive --agree-tos -m admin@example.com
      args: { creates: /etc/letsencrypt/live/{{ domain }}/fullchain.pem }
  handlers:
    - name: reload-nginx
      ansible.builtin.systemd_service: { name: nginx, state: reloaded }

See also: Ansible on Ubuntu 22.04 LTS: Nginx Reverse Proxy with Let's Encrypt Complete Guide

Validation

ansible-playbook -i inventory/ubuntu-26-04.ini nginx-reverse-proxy-letsencrypt.yml --check --diff
ansible-playbook -i inventory/ubuntu-26-04.ini nginx-reverse-proxy-letsencrypt.yml

Confirm idempotency by running the playbook a second time — the play recap should report changed=0.

Troubleshooting

| Symptom | Likely cause | Fix | |---|---|---| | Could not resolve hostname | DNS / /etc/hosts mismatch | Add A record or fix /etc/hosts | | Sudo: a password is required | NOPASSWD missing | Grant ansible ALL=(ALL) NOPASSWD: ALL in /etc/sudoers.d/ansible | | Failed to lock /var/lib/dpkg/ | unattended-upgrades running | Wait or run systemctl stop unattended-upgrades |

See also: Ansible on Ubuntu 24.04 LTS: Nginx Reverse Proxy with Let's Encrypt Complete Guide

FAQ

Q. Which ansible-core release should I use with Ubuntu 26.04 LTS? Use ansible-core 2.18 LTS. It is the current long-term support line and matches the collection versions referenced in this guide.

Q. Is the ansible.builtin.apt module idempotent? Yes. Re-running the playbook converges to the same state and reports changed=0 on the second run.

Q. How do I roll back if nginx reverse proxy with let's encrypt breaks production? Maintain a previous-version inventory and re-run the prior playbook. For package changes use APT pinning or DNF rollback.

Q. Does this playbook work in --check mode? Yes. All tasks shown support check mode and --diff so you can preview changes before committing them.

Related guides

• Windows Server 2025 hotpatching and Ansible • configuring WinRM for Ansible • ansible-core 2.20 deprecations • SSH vs WinRM vs Docker connections in Ansible

Conclusion

Ubuntu 26.04 LTS (Linux 6.14) is a first-class Ansible target for nginx reverse proxy with let's encrypt. Standardize on ansible-core 2.18 LTS plus the ansible.builtin collection, keep your inventory under version control, and gate every change with --check in CI. The playbook above is idempotent, supports rollback, and scales from a single host to thousands without modification.