Ansible tracking

Record Ansible playbook runs on the controller with a callback plugin - plays, tasks, per-host status and output, stored encrypted.

Ghost Shell records Ansible playbook runs on the controller host — the machine running ansible-playbook. Each task's name, module, host, status (ok/changed/failed/unreachable/skipped), output, and rc is captured and stored encrypted in the central store.

Enable the callback plugin

The plugin is installed at /usr/share/ghostshell/ansible/ghostshell.py by the deb/rpm packages.

Per-run, via environment variables:

bash

export ANSIBLE_CALLBACK_PLUGINS=/usr/share/ghostshell/ansible
export ANSIBLE_CALLBACKS_ENABLED=ghostshell
ansible-playbook site.yml

Or persistently, via ansible.cfg:

ini

[defaults]
callback_plugins  = /usr/share/ghostshell/ansible
callbacks_enabled = ghostshell

Browse runs

console

$ sudo ghostshell ansible list RUN PLAYBOOK CONTROLLER OK CHG FAIL STARTED HOSTS 20260527T140300-12345 deploy.yml ctrl.host 8 3 1 2026-05-27 14:03:00 web1,web2 $ sudo ghostshell ansible show 20260527T140300-12345 Playbook : deploy.yml Run ID : 20260527T140300-12345 PLAY [Install web server] ✓ web1 install nginx (ansible.builtin.dnf) @14:03:01 ✗ web2 fail intentionally (ansible.builtin.command) @14:03:03 stderr: command not found rc: 1 PLAY RECAP web1 ok=8 changed=3 failed=1 unreachable=0 skipped=0

Per-task output is capped at ansible_output_cap bytes (default 8192) — see configuration.

Fail-open

If ghostshell-daemon is unreachable, the run is saved to ~/.local/share/ghostshell/ansible/<runid>.ajsonl and ingested later. The playbook run is never aborted due to Ghost Shell failures.

Limitation

Only controllers with ghostshell installed produce Ansible records. Managed hosts still receive raw Ansible SSH execs — captured by the sshd ForceCommand wrapper if configured, but those carry no task name or status.

Source of truth: README on GitHub