Chapter 25. Installing an Identity Management server using an Ansible playbook
Chapter 25. Installing an Identity Management server using an Ansible playbook The following sections describe how to configure a system as an IdM server by using Ansible . Configuring a system as an IdM server establishes an IdM domain and enables the system to offer IdM services to IdM clients. The deployment is managed by the ipaserver Ansible role. Prerequisites You understand Ansible and IdM concepts: Ansible roles Ansible nodes Ansible inventory Ansible tasks Ansible modules Ansible plays and playbooks 25.1. Ansible and its advantages for installing IdM Ansible is an automation tool used to configure systems, deploy software, and perform rolling updates. Ansible includes support for Identity Management (IdM), and you can use Ansible modules to automate installation tasks such as the setup of an IdM server, replica, client, or an entire IdM topology. Advantages of using Ansible to install IdM The following list presents advantages of installing Identity Management using Ansible in contrast to manual installation. You do not need to log into the managed node. You do not need to configure settings on each host to be deployed individually. Instead, you can have one inventory file to deploy a complete cluster. You can reuse an inventory file later for management tasks, for example to add users and hosts. You can reuse an inventory file even for such tasks as are not related to IdM. Additional resources Automating Red Hat Enterprise Linux Identity Management installation Planning Identity Management Preparing the system for IdM server installation 25.2. Installing the ansible-freeipa package The following procedure describes how to install the the ansible-freeipa roles. Prerequisites Ensure that the controller is a Red Hat Enterprise Linux system with a valid subscription. If this is not the case, see the official Ansible documentation Installation guide for alternative installation instructions. Ensure that you can reach the managed node over the SSH protocol from the controller. Check that the managed node is listed in the /root/.ssh/known_hosts file of the controller. Procedure Run the following procedure on the Ansible controller. Enable the required repository: Install the IdM Ansible roles: The roles are installed to the /usr/share/ansible/roles/ directory. 25.3. Ansible roles location in the file system By default, the ansible-freeipa roles are installed to the /usr/share/ansible/roles/ directory. The structure of the ansible-freeipa package is as follows: The /usr/share/ansible/roles/ directory stores the ipaserver , ipareplica , and ipaclient roles on the Ansible controller. Each role directory stores examples, a basic overview, the license and documentation about the role in a README.md Markdown file. The /usr/share/doc/ansible-freeipa/ directory stores the documentation about individual roles and the topology in README.md Markdown files. It also stores the playbooks/ subdirectory. The /usr/share/doc/ansible-freeipa/playbooks/ directory stores the example playbooks: 25.4. Setting the parameters for a deployment with an integrated DNS and an integrated CA as the root CA Complete this procedure to configure the inventory file for installing an IdM server with an integrated CA as the root CA in an environment that uses the IdM integrated DNS solution. Note The inventory in this procedure uses the INI format. You can, alternatively, use the YAML or JSON formats. Procedure Create a ~/MyPlaybooks/ directory: Create a ~/MyPlaybooks/inventory file. Open the inventory file for editing. Specify the fully-qualified domain names ( FQDN ) of the host you want to use as an IdM server. Ensure that the FQDN meets the following criteria: Only alphanumeric characters and hyphens (-) are allowed. For example, underscores are not allowed and can cause DNS failures. The host name must be all lower-case. Specify the IdM domain and realm information. Specify that you want to use integrated DNS by adding the following option: Specify the DNS forwarding settings. Choose one of the following options: Use the ipaserver_auto_forwarders=true option if you want the installer to use forwarders from the /etc/resolv.conf file. Do not use this option if the nameserver specified in the /etc/resolv.conf file is the localhost 127.0.0.1 address or if you are on a virtual private network and the DNS servers you are using are normally unreachable from the public internet. Use the ipaserver_forwarders option to specify your forwarders manually. The installation process adds the forwarder IP addresses to the /etc/named.conf file on the installed IdM server. Use the ipaserver_no_forwarders=true option to configure root DNS servers to be used instead. Note With no DNS forwarders, your environment is isolated, and names from other DNS domains in your infrastructure are not resolved. Specify the DNS reverse record and zone settings. Choose from the following options: Use the ipaserver_allow_zone_overlap=true option to allow the creation of a (reverse) zone even if the zone is already resolvable. Use the ipaserver_reverse_zones option to specify your reverse zones manually. Use the ipaserver_no_reverse=true option if you do not want the installer to create a reverse DNS zone. Note Using IdM to manage reverse zones is optional. You can use an external DNS service for this purpose instead. Specify the passwords for admin and for the Directory Manager . Use the Ansible Vault to store the password, and reference the Vault file from the playbook file. Alternatively and less securely, specify the passwords directly in the inventory file. Optional: Specify a custom firewalld zone to be used by the IdM server. If you do not set a custom zone, IdM will add its services to the default firewalld zone. The predefined default zone is public . Important The specified firewalld zone must exist and be permanent. Example of an inventory file with the required server information (excluding the passwords) Example of an inventory file with the required server information (including the passwords) Example of an inventory file with a custom firewalld zone Example playbook to set up an IdM server using admin and Directory Manager passwords stored in an Ansible Vault file Example playbook to set up an IdM server using admin and Directory Manager passwords from an inventory file Additional resources man ipa-server-install(1) /usr/share/doc/ansible-freeipa/README-server.md 25.5. Setting the parameters for a deployment with external DNS and an integrated CA as the root CA Complete this procedure to configure the inventory file for installing an IdM server with an integrated CA as the root CA in an environment that uses an external DNS solution. Note The inventory file in this procedure uses the INI format. You can, alternatively, use the YAML or JSON formats. Procedure Create a ~/MyPlaybooks/ directory: Create a ~/MyPlaybooks/inventory file. Open the inventory file for editing. Specify the fully-qualified domain names ( FQDN ) of the host you want to use as an IdM server. Ensure that the FQDN meets the following criteria: Only alphanumeric characters and hyphens (-) are allowed. For example, underscores are not allowed and can cause DNS failures. The host name must be all lower-case. Specify the IdM domain and realm information. Make sure that the ipaserver_setup_dns option is set to no or that it is absent. Specify the passwords for admin and for the Directory Manager . Use the Ansible Vault to store the password, and reference the Vault file from the playbook file. Alternatively and less securely, specify the passwords directly in the inventory file. Optional: Specify a custom firewalld zone to be used by the IdM server. If you do not set a custom zone, IdM will add its services to the default firewalld zone. The predefined default zone is public . Important The specified firewalld zone must exist and be permanent. Example of an inventory file with the required server information (excluding the passwords) Example of an inventory file with the required server information (including the passwords) Example of an inventory file with a custom firewalld zone Example playbook to set up an IdM server using admin and Directory Manager passwords stored in an Ansible Vault file Example playbook to set up an IdM server using admin and Directory Manager passwords from an inventory file Additional resources man ipa-server-install(1) /usr/share/doc/ansible-freeipa/README-server.md 25.6. Deploying an IdM server with an integrated CA as the root CA using an Ansible playbook Complete this procedure to deploy an IdM server with an integrated certificate authority (CA) as the root CA using an Ansible playbook. Prerequisites The managed node is a Red Hat Enterprise Linux 9 system with a static IP address and a working package manager. You have set the parameters that correspond to your scenario by choosing one of the following procedures: Procedure with integrated DNS Procedure with external DNS Procedure Run the Ansible playbook: Choose one of the following options: If your IdM deployment uses external DNS: add the DNS resource records contained in the /tmp/ipa.system.records.UFRPto.db file to the existing external DNS servers. The process of updating the DNS records varies depending on the particular DNS solution. Important The server installation is not complete until you add the DNS records to the existing DNS servers. If your IdM deployment uses integrated DNS: Add DNS delegation from the parent domain to the IdM DNS domain. For example, if the IdM DNS domain is idm.example.com , add a name server (NS) record to the example.com parent domain. Important Repeat this step each time after an IdM DNS server is installed. Add an _ntp._udp service (SRV) record for your time server to your IdM DNS. The presence of the SRV record for the time server of the newly-installed IdM server in IdM DNS ensures that future replica and client installations are automatically configured to synchronize with the time server used by this primary IdM server. 25.7. Setting the parameters for a deployment with an integrated DNS and an external CA as the root CA Complete this procedure to configure the inventory file for installing an IdM server with an external CA as the root CA in an environment that uses the IdM integrated DNS solution. Note The inventory file in this procedure uses the INI format. You can, alternatively, use the YAML or JSON formats. Procedure Create a ~/MyPlaybooks/ directory: Create a ~/MyPlaybooks/inventory file. Open the inventory file for editing. Specify the fully-qualified domain names ( FQDN ) of the host you want to use as an IdM server. Ensure that the FQDN meets the following criteria: Only alphanumeric characters and hyphens (-) are allowed. For example, underscores are not allowed and can cause DNS failures. The host name must be all lower-case. Specify the IdM domain and realm information. Specify that you want to use integrated DNS by adding the following option: Specify the DNS forwarding settings. Choose one of the following options: Use the ipaserver_auto_forwarders=true option if you want the installation process to use forwarders from the /etc/resolv.conf file. This option is not recommended if the nameserver specified in the /etc/resolv.conf file is the localhost 127.0.0.1 address or if you are on a virtual private network and the DNS servers you are using are normally unreachable from the public internet. Use the ipaserver_forwarders option to specify your forwarders manually. The installation process adds the forwarder IP addresses to the /etc/named.conf file on the installed IdM server. Use the ipaserver_no_forwarders=true option to configure root DNS servers to be used instead. Note With no DNS forwarders, your environment is isolated, and names from other DNS domains in your infrastructure are not resolved. Specify the DNS reverse record and zone settings. Choose from the following options: Use the ipaserver_allow_zone_overlap=true option to allow the creation of a (reverse) zone even if the zone is already resolvable. Use the ipaserver_reverse_zones option to specify your reverse zones manually. Use the ipaserver_no_reverse=true option if you do not want the installation process to create a reverse DNS zone. Note Using IdM to manage reverse zones is optional. You can use an external DNS service for this purpose instead. Specify the passwords for admin and for the Directory Manager . Use the Ansible Vault to store the password, and reference the Vault file from the playbook file. Alternatively and less securely, specify the passwords directly in the inventory file. Optional: Specify a custom firewalld zone to be used by the IdM server. If you do not set a custom zone, IdM adds its services to the default firewalld zone. The predefined default zone is public . Important The specified firewalld zone must exist and be permanent. Example of an inventory file with the required server information (excluding the passwords) Example of an inventory file with the required server information (including the passwords) Example of an inventory file with a custom firewalld zone Create a playbook for the first step of the installation. Enter instructions for generating the certificate signing request (CSR) and copying it from the controller to the managed node. Create another playbook for the final step of the installation. Additional resources man ipa-server-install(1) /usr/share/doc/ansible-freeipa/README-server.md 25.8. Setting the parameters for a deployment with external DNS and an external CA as the root CA Complete this procedure to configure the inventory file for installing an IdM server with an external CA as the root CA in an environment that uses an external DNS solution. Note The inventory file in this procedure uses the INI format. You can, alternatively, use the YAML or JSON formats. Procedure Create a ~/MyPlaybooks/ directory: Create a ~/MyPlaybooks/inventory file. Open the inventory file for editing. Specify the fully-qualified domain names ( FQDN ) of the host you want to use as an IdM server. Ensure that the FQDN meets the following criteria: Only alphanumeric characters and hyphens (-) are allowed. For example, underscores are not allowed and can cause DNS failures. The host name must be all lower-case. Specify the IdM domain and realm information. Make sure that the ipaserver_setup_dns option is set to no or that it is absent. Specify the passwords for admin and for the Directory Manager . Use the Ansible Vault to store the password, and reference the Vault file from the playbook file. Alternatively and less securely, specify the passwords directly in the inventory file. Optional: Specify a custom firewalld zone to be used by the IdM server. If you do not set a custom zone, IdM will add its services to the default firewalld zone. The predefined default zone is public . Important The specified firewalld zone must exist and be permanent. Example of an inventory file with the required server information (excluding the passwords) Example of an inventory file with the required server information (including the passwords) Example of an inventory file with a custom firewalld zone Create a playbook for the first step of the installation. Enter instructions for generating the certificate signing request (CSR) and copying it from the controller to the managed node. Create another playbook for the final step of the installation. Additional resources Installing an IdM server: Without integrated DNS, with an external CA as the root CA man ipa-server-install(1) /usr/share/doc/ansible-freeipa/README-server.md 25.9. Deploying an IdM server with an external CA as the root CA using an Ansible playbook Complete this procedure to deploy an IdM server with an external certificate authority (CA) as the root CA using an Ansible playbook. Prerequisites The managed node is a Red Hat Enterprise Linux 9 system with a static IP address and a working package manager. You have set the parameters that correspond to your scenario by choosing one of the following procedures: Procedure with integrated DNS Procedure with external DNS Procedure Run the Ansible playbook with the instructions for the first step of the installation, for example install-server-step1.yml : Locate the ipa.csr certificate signing request file on the controller and submit it to the external CA. Place the IdM CA certificate signed by the external CA in the controller file system so that the playbook in the step can find it. Run the Ansible playbook with the instructions for the final step of the installation, for example install-server-step2.yml : Choose one of the following options: If your IdM deployment uses external DNS: add the DNS resource records contained in the /tmp/ipa.system.records.UFRPto.db file to the existing external DNS servers. The process of updating the DNS records varies depending on the particular DNS solution. Important The server installation is not complete until you add the DNS records to the existing DNS servers. If your IdM deployment uses integrated DNS: Add DNS delegation from the parent domain to the IdM DNS domain. For example, if the IdM DNS domain is idm.example.com , add a name server (NS) record to the example.com parent domain. Important Repeat this step each time after an IdM DNS server is installed. Add an _ntp._udp service (SRV) record for your time server to your IdM DNS. The presence of the SRV record for the time server of the newly-installed IdM server in IdM DNS ensures that future replica and client installations are automatically configured to synchronize with the time server used by this primary IdM server. 25.10. Uninstalling an IdM server using an Ansible playbook Note In an existing Identity Management (IdM) deployment, replica and server are interchangeable terms. Complete this procedure to uninstall an IdM replica using an Ansible playbook. In this example: IdM configuration is uninstalled from server123.idm.example.com . server123.idm.example.com and the associated host entry are removed from the IdM topology. Prerequisites On the control node: You are using Ansible version 2.15 or later. You have installed the ansible-freeipa package. You have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server in the ~/ MyPlaybooks / directory. You have stored your ipaadmin_password in the secret.yml Ansible vault. For the ipaserver_remove_from_topology option to work, the system must be running on RHEL 9.3 or later. On the managed node: The system is running on RHEL 9. Procedure Create your Ansible playbook file uninstall-server.yml with the following content: The ipaserver_remove_from_domain option unenrolls the host from the IdM topology. Note If the removal of server123.idm.example.com should lead to a disconnected topology, the removal will be aborted. For more information, see Using an Ansible playbook to uninstall an IdM server even if this leads to a disconnected topology . Uninstall the replica: Ensure that all name server (NS) DNS records pointing to server123.idm.example.com are deleted from your DNS zones. This applies regardless of whether you use integrated DNS managed by IdM or external DNS. For more information on how to delete DNS records from IdM, see Deleting DNS records in the IdM CLI . 25.11. Using an Ansible playbook to uninstall an IdM server even if this leads to a disconnected topology Note In an existing Identity Management (IdM) deployment, replica and server are interchangeable terms. Complete this procedure to uninstall an IdM replica using an Ansible playbook even if this results in a disconnected IdM topology. In the example, server456.idm.example.com is used to remove the replica and the associated host entry with the FQDN of server123.idm.example.com from the topology, leaving certain replicas disconnected from server456.idm.example.com and the rest of the topology. Note If removing a replica from the topology using only the remove_server_from_domain does not result in a disconnected topology, no other options are required. If the result is a disconnected topology, you must specify which part of the domain you want to preserve. In that case, you must do the following: Specify the ipaserver_remove_on_server value. Set ipaserver_ignore_topology_disconnect to True. Prerequisites On the control node: You are using Ansible version 2.15 or later. The system is running on RHEL 9.3 or later. You have installed the ansible-freeipa package. You have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server in the ~/ MyPlaybooks / directory. You have stored your ipaadmin_password in the secret.yml Ansible vault. On the managed node: The system is running on 9 or later. Procedure Create your Ansible playbook file uninstall-server.yml with the following content: Note Under normal circumstances, if the removal of server123 does not result in a disconnected topology: if the value for ipaserver_remove_on_server is not set, the replica on which server123 is removed is automatically determined using the replication agreements of server123. Uninstall the replica: Ensure that all name server (NS) DNS records pointing to server123.idm.example.com are deleted from your DNS zones. This applies regardless of whether you use integrated DNS managed by IdM or external DNS. For more information on how to delete DNS records from IdM, see Deleting DNS records in the IdM CLI . Additional resources Inventory basics: formats, hosts, and groups You can see sample Ansible playbooks for installing an IdM server and a list of possible variables in the ansible-freeipa upstream documentation .
subscription-manager repos --enable rhel-9-for-x86_64-appstream-rpms dnf install ansible-freeipa ls -1 /usr/share/ansible/roles/ ipaclient ipareplica ipaserver ls -1 /usr/share/doc/ansible-freeipa/ playbooks README-client.md README.md README-replica.md README-server.md README-topology.md ls -1 /usr/share/doc/ansible-freeipa/playbooks/ install-client.yml install-cluster.yml install-replica.yml install-server.yml uninstall-client.yml uninstall-cluster.yml uninstall-replica.yml uninstall-server.yml mkdir MyPlaybooks ipaserver_setup_dns=true [ipaserver] server.idm.example.com [ipaserver:vars] ipaserver_domain=idm.example.com ipaserver_realm=IDM.EXAMPLE.COM ipaserver_setup_dns=true ipaserver_auto_forwarders=true [...] [ipaserver] server.idm.example.com [ipaserver:vars] ipaserver_domain=idm.example.com ipaserver_realm=IDM.EXAMPLE.COM ipaserver_setup_dns=true ipaserver_auto_forwarders=true ipaadmin_password=MySecretPassword123 ipadm_password=MySecretPassword234 [...] [ipaserver] server.idm.example.com [ipaserver:vars] ipaserver_domain=idm.example.com ipaserver_realm=IDM.EXAMPLE.COM ipaserver_setup_dns=true ipaserver_auto_forwarders=true ipaadmin_password=MySecretPassword123 ipadm_password=MySecretPassword234 ipaserver_firewalld_zone= custom zone --- - name: Playbook to configure IPA server hosts: ipaserver become: true vars_files: - playbook_sensitive_data.yml roles: - role: ipaserver state: present --- - name: Playbook to configure IPA server hosts: ipaserver become: true roles: - role: ipaserver state: present mkdir MyPlaybooks [ipaserver] server.idm.example.com [ipaserver:vars] ipaserver_domain=idm.example.com ipaserver_realm=IDM.EXAMPLE.COM ipaserver_setup_dns=no [...] [ipaserver] server.idm.example.com [ipaserver:vars] ipaserver_domain=idm.example.com ipaserver_realm=IDM.EXAMPLE.COM ipaserver_setup_dns=no ipaadmin_password=MySecretPassword123 ipadm_password=MySecretPassword234 [...] [ipaserver] server.idm.example.com [ipaserver:vars] ipaserver_domain=idm.example.com ipaserver_realm=IDM.EXAMPLE.COM ipaserver_setup_dns=no ipaadmin_password=MySecretPassword123 ipadm_password=MySecretPassword234 ipaserver_firewalld_zone= custom zone --- - name: Playbook to configure IPA server hosts: ipaserver become: true vars_files: - playbook_sensitive_data.yml roles: - role: ipaserver state: present --- - name: Playbook to configure IPA server hosts: ipaserver become: true roles: - role: ipaserver state: present ansible-playbook -i ~/MyPlaybooks/inventory ~/MyPlaybooks/install-server.yml Restarting the KDC Please add records in this file to your DNS system: /tmp/ipa.system.records.UFRBto.db Restarting the web server mkdir MyPlaybooks ipaserver_setup_dns=true [ipaserver] server.idm.example.com [ipaserver:vars] ipaserver_domain=idm.example.com ipaserver_realm=IDM.EXAMPLE.COM ipaserver_setup_dns=true ipaserver_auto_forwarders=true [...] [ipaserver] server.idm.example.com [ipaserver:vars] ipaserver_domain=idm.example.com ipaserver_realm=IDM.EXAMPLE.COM ipaserver_setup_dns=true ipaserver_auto_forwarders=true ipaadmin_password=MySecretPassword123 ipadm_password=MySecretPassword234 [...] [ipaserver] server.idm.example.com [ipaserver:vars] ipaserver_domain=idm.example.com ipaserver_realm=IDM.EXAMPLE.COM ipaserver_setup_dns=true ipaserver_auto_forwarders=true ipaadmin_password=MySecretPassword123 ipadm_password=MySecretPassword234 ipaserver_firewalld_zone= custom zone [...] --- - name: Playbook to configure IPA server Step 1 hosts: ipaserver become: true vars_files: - playbook_sensitive_data.yml vars: ipaserver_external_ca: true roles: - role: ipaserver state: present post_tasks: - name: Copy CSR /root/ipa.csr from node to "{{ groups.ipaserver[0] + '-ipa.csr' }}" fetch: src: /root/ipa.csr dest: "{{ groups.ipaserver[0] + '-ipa.csr' }}" flat: true --- - name: Playbook to configure IPA server Step 2 hosts: ipaserver become: true vars_files: - playbook_sensitive_data.yml vars: ipaserver_external_cert_files: - "/root/servercert20240601.pem" - "/root/cacert.pem" pre_tasks: - name: Copy "{{ groups.ipaserver[0] }}-{{ item }}" to "/root/{{ item }}" on node ansible.builtin.copy: src: "{{ groups.ipaserver[0] }}-{{ item }}" dest: "/root/{{ item }}" force: true with_items: - servercert20240601.pem - cacert.pem roles: - role: ipaserver state: present mkdir MyPlaybooks [ipaserver] server.idm.example.com [ipaserver:vars] ipaserver_domain=idm.example.com ipaserver_realm=IDM.EXAMPLE.COM ipaserver_setup_dns=no [...] [ipaserver] server.idm.example.com [ipaserver:vars] ipaserver_domain=idm.example.com ipaserver_realm=IDM.EXAMPLE.COM ipaserver_setup_dns=no ipaadmin_password=MySecretPassword123 ipadm_password=MySecretPassword234 [...] [ipaserver] server.idm.example.com [ipaserver:vars] ipaserver_domain=idm.example.com ipaserver_realm=IDM.EXAMPLE.COM ipaserver_setup_dns=no ipaadmin_password=MySecretPassword123 ipadm_password=MySecretPassword234 ipaserver_firewalld_zone= custom zone [...] --- - name: Playbook to configure IPA server Step 1 hosts: ipaserver become: true vars_files: - playbook_sensitive_data.yml vars: ipaserver_external_ca: true roles: - role: ipaserver state: present post_tasks: - name: Copy CSR /root/ipa.csr from node to "{{ groups.ipaserver[0] + '-ipa.csr' }}" fetch: src: /root/ipa.csr dest: "{{ groups.ipaserver[0] + '-ipa.csr' }}" flat: true --- - name: Playbook to configure IPA server Step 2 hosts: ipaserver become: true vars_files: - playbook_sensitive_data.yml vars: ipaserver_external_cert_files: - "/root/servercert20240601.pem" - "/root/cacert.pem" pre_tasks: - name: Copy "{{ groups.ipaserver[0] }}-{{ item }}" to "/root/{{ item }}" on node ansible.builtin.copy: src: "{{ groups.ipaserver[0] }}-{{ item }}" dest: "/root/{{ item }}" force: true with_items: - servercert20240601.pem - cacert.pem roles: - role: ipaserver state: present ansible-playbook --vault-password-file=password_file -v -i ~/MyPlaybooks/inventory ~/MyPlaybooks/install-server-step1.yml ansible-playbook -v -i ~/MyPlaybooks/inventory ~/MyPlaybooks/install-server-step2.yml Restarting the KDC Please add records in this file to your DNS system: /tmp/ipa.system.records.UFRBto.db Restarting the web server --- - name: Playbook to uninstall an IdM replica hosts: ipaserver become: true roles: - role: ipaserver ipaserver_remove_from_domain: true state: absent ansible-playbook --vault-password-file=password_file -v -i <path_to_inventory_directory>/inventory <path_to_playbooks_directory>/uninstall-server.yml --- - name: Playbook to uninstall an IdM replica hosts: ipaserver become: true roles: - role: ipaserver ipaserver_remove_from_domain: true ipaserver_remove_on_server: server456.idm.example.com ipaserver_ignore_topology_disconnect: true state: absent ansible-playbook --vault-password-file=password_file -v -i <path_to_inventory_directory>/hosts <path_to_playbooks_directory>/uninstall-server.yml