Example playbooks

Runnable sample playbooks ship in the repository's examples/ directory, one per persona. Each page here describes the use case and embeds the playbook itself — the YAML shown is included from the repository at build time, so it is always the exact file you can run.

They run from the control node against the GitLab API (the default api backend needs no connection to the GitLab host); the Rails-only examples reach the instance over SSH or a Kubernetes toolbox pod. Every example references secrets as vault_* variables — supply them through Ansible Vault or an inventory, never in plaintext — and points gitlab_settings_target.url at your instance:

ansible-playbook -i localhost, examples/<playbook>.yml
# Preview any of them without writing:
ansible-playbook -i localhost, examples/<playbook>.yml --check --diff

Example	Persona / use case
SRE / instance administrator	Instance-level settings with an admin token
Group owner with a bounded token	Group settings under a group access token whose authority boundary the role enforces
Project team	A team's own project settings with a project-scoped token
Ephemeral lab instance	Maximum surface including Rails-only settings, in compatible mode
GitOps converge	Version-controlled desired state converged on every merge
Discover and restore	Snapshot the settings you manage; restore them after a risky change
Managed OAuth session	An OAuth automation identity with durable, rotating refresh
Discovery and the task interface	Dynamic discovery composed with ordinary loops over the public tasks

The live feature probes under tests/live/ are a second source of complete, working declarations — each exercises a full feature surface (groups, projects, users, runners, production converge, bounded team tokens) against a real instance and doubles as executable documentation.