ansible all -m apt -a 'name=nginx state=latest' -b

Uses the apt module to make sure nginx is installed and current on every host, with -b (become) elevating to root for package operations. The module is idempotent, so repeated runs change nothing once the package is up to date. Related: ansible all -m service.