What do the ansible.builtin.copy options src, dest, owner, group and mode do, and why write the mode as 0644 (or "0644") rather than 644?

src is a file on the control node (relative paths resolve against the playbook's files/ directory), dest the target path on the managed host, owner/group the ownership, and mode the permissions. The leading zero makes YAML read the number as octal, which is how permissions work; 644 without it is the decimal number 644, which gives completely wrong permissions.

* Each octal digit is read 4 + write 2 + execute 1, for owner, group and others. *

- name: Configure web service
  ansible.builtin.copy:
    src: "{{ httpdconf_src }}"     # files/000-default.conf on the control node
    dest: "{{ httpdconf_dest }}"   # path on the managed host
    owner: root
    group: root
    mode: "0644"

How the permission digits work: each octal digit is one set of rights, owner / group / others, each the sum of read 4, write 2, execute 1. So:

Unquoted 0644 works because YAML 1.1 reads a leading zero as octal. Quoting it ("0644", or even "644") is the safest form, since Ansible then parses the string as octal itself and nothing depends on YAML's number rules. Writing an unquoted 644 gives decimal 644, which is octal 1204: odd, wrong permissions.

Go deeper:

• ansible.builtin.copy module: mode (official docs) — the warning about octal numbers and quoting.
• ansible.builtin.file module (official docs) — state: directory for creating directories.
• File-system permissions: notation of traditional Unix permissions (Wikipedia) — symbolic and octal notation side by side.