* fix: add explicit bool filters for Ansible 12 jinja2_native compatibility
Ansible 12 enables jinja2_native by default, which means string values
like "true"/"false" are no longer automatically coerced to booleans in
when: conditions and Jinja2 if statements. Add | bool filters to all
boolean variable references in tasks, templates, and handlers.
Also reformats long single-line Jinja2 conditionals into multi-line for
readability, fixes GCE default() calls for native mode, adds help
command to the algo script, and updates test fixtures to register the
bool filter.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* ci: add j2lint for Jinja2 template linting
Add j2lint (aristanetworks/j2lint) to catch syntax errors, spacing
issues, and operator formatting in Jinja2 templates. Integrated into
pre-commit hooks, lint.yml CI, and smart-tests.yml.
Rules S3/S5/S6/S7/V1 are ignored — they enforce conventions
incompatible with Ansible's config-file-embedded templates.
Also fixes int+1 → int + 1 operator spacing in server.conf.j2.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: resolve all ansible-lint warnings and enforce zero-tolerance policy
Fix 18 jinja[spacing] errors across 12 files by moving Jinja2 block
delimiters to prevent YAML >- folding from introducing trailing spaces.
Fix 27 key-order[task] warnings across 17 files by reordering task keys
to canonical order (name → when → tags → environment → become → block).
Promote key-order[task] and yaml[line-length] from warn_list to hard
errors by removing warn_list entirely from .ansible-lint.
Add zero-tolerance warning policy to CLAUDE.md explaining why warnings
are unacceptable in a security tool and documenting resolution order.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
This commit addresses two issues affecting AWS deployments in Ansible 12:
1. **EC2 credentials not being passed correctly**
- The `default()` filter chain wasn't handling empty strings properly
- In Ansible 12 with mandatory jinja2_native, `lookup('env', 'VAR')` returns
an empty string (not undefined) when the env var is not set
- Empty strings are "defined" values, so `default()` doesn't trigger
- Fix: Add `true` as second parameter to `default()` to also handle falsy values
2. **CloudFormation deprecated template parameter**
- The `template` parameter is deprecated (removal after 2026-05-01)
- Migrate to `template_body` with file lookup as recommended
- Applied to both EC2 and Lightsail cloudformation tasks
These changes ensure AWS deployments work correctly with Ansible 12's
stricter type handling while also addressing deprecation warnings.
Fixes#14842🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude <noreply@anthropic.com>
* fix: Add no_log to tasks handling sensitive information
- Add no_log: true to OpenSSL commands that contain passwords/passphrases
- Add no_log: true to WireGuard key generation commands
- Add no_log: true to password/CA password generation tasks
- Add no_log: true to AWS credential handling tasks
- Add no_log: true to QR code generation that contains full configs
This prevents sensitive information like passwords, private keys, and
WireGuard configurations from being logged to syslog/journald.
Fixes#1617
* feat: Comprehensive privacy enhancements
- Add no_log directives to all cloud provider credential handling
- Set privacy-focused defaults (StrongSwan logging disabled, DNSCrypt syslog off)
- Implement privacy role with log rotation, history clearing, and log filtering
- Add Privacy Considerations section to README
- Make all privacy features configurable and enabled by default
This update significantly reduces Algo's logging footprint to enhance user privacy
while maintaining the ability to enable logging for debugging when needed.
* docs: Move privacy documentation from README to FAQ
- Remove Privacy Considerations section from README
- Add expanded 'Does Algo support zero logging?' question to FAQ
- Better placement alongside existing logging/monitoring questions
- More detailed explanation of privacy features and limitations
* fix: Remove invalid 'bool' filter from Jinja2 template
The privacy-monitor.sh.j2 template was using '| bool' which is not a valid
Jinja2 filter. The 'bool' is a built-in Python function, not a Jinja2 filter.
Fixed by removing the '| bool' filter and directly outputting the boolean
variables as they will be rendered correctly by Jinja2.
This resolves the template syntax error that was causing CI tests to fail:
"No filter named 'bool'" error in privacy monitoring script template.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* Fix YAML linting issues in privacy role
* Fix linting warnings: shellcheck and ansible-lint issues
- Fixed all shellcheck warnings in test scripts:
- Quoted variables to prevent word splitting
- Replaced A && B || C constructs with proper if-then-else
- Changed unused loop variable to _
- Added shellcheck directives for FreeBSD rc.d script
- Fixed ansible-lint risky-file-permissions warnings:
- Added explicit file permissions for sensitive files (mode 0600)
- Added permissions for config files and certificates (mode 0644)
- Set proper permissions for directories (mode 0755)
- Fixed yamllint compatibility with ansible-lint:
- Added required octal-values configuration
- Quoted all octal mode values to prevent YAML misinterpretation
- Added comments-indentation: false as required
All tests pass and functionality remains unchanged.
* Remove algo.egg-info from version control
This directory is generated by Python package tools (pip/setuptools) and
should not be tracked in git. It's already listed in .gitignore but was
accidentally committed. The directory contains build metadata that is
regenerated when the package is installed.
* Restructure privacy documentation for clarity
- Simplified FAQ entry to be concise with link to README for details
- Added comprehensive Privacy and Logging section to README
- Clarified what IS logged by default vs what is not
- Explained two separate privacy settings (strongswan_log_level and privacy_enhancements_enabled)
- Added clear debugging instructions (need to change both settings)
- Removed confusing language about "enabling additional features"
- Made documentation more natural and less AI-generated sounding
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* Fix Ubuntu 22.04 iptables deployment issues and simplify config.cfg
Issues fixed:
1. Added base 'iptables' package to batch installation list (was missing, only iptables-persistent was included)
2. Fixed alternatives configuration for Ubuntu 22.04+ - only configure main iptables/ip6tables alternatives, not save/restore (they're handled as slaves)
Config.cfg improvements:
- Reduced from 308 to 198 lines (35% reduction)
- Moved privacy settings above "Advanced users only" line for better accessibility
- Clarified algo_no_log is for Ansible output, not server privacy
- Simplified verbose comments throughout
- Moved experimental performance options to commented section at end
- Better organized into logical sections
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* Add privacy features to README and improve feature descriptions
- Added privacy-focused feature bullet highlighting minimal logging and privacy enhancements
- Simplified IKEv2 bullet (removed redundant platform list)
- Updated helper scripts description to be more comprehensive
- Specified Ubuntu 22.04 LTS and automatic security updates
- Made feature list more concise and accurate
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* Fix logrotate duplicate entries error in privacy role
The privacy role was creating logrotate configs that duplicated the default
Ubuntu rsyslog logrotate rules, causing deployment failures with errors like
'duplicate log entry for /var/log/syslog'.
Changes:
- Disable default rsyslog logrotate config before applying privacy configs
- Consolidate system log rotation into single config file
- Add missingok flag to handle logs that may not exist on all systems
- Remove forced immediate rotation that was triggering the error
This ensures privacy-enhanced log rotation works without conflicts.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* Fix 'history: not found' error in privacy role
The 'history -c' command was failing because history is a bash built-in
that doesn't exist in /bin/sh (Ubuntu's default shell for scripts).
Changes:
- Removed the 'Clear current session history' task since it's ineffective
in Ansible context (each task runs in a new shell)
- History files are already cleared by the existing file removal tasks
- Added explanatory comment about why session history clearing is omitted
This fixes the deployment failure while maintaining all effective history
clearing functionality.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* Fix BPF JIT sysctl error in privacy role
The net.core.bpf_jit_enable sysctl parameter was failing on some systems
because BPF JIT support is not available in all kernel configurations.
Changes:
- Separated BPF JIT setting into its own task with ignore_errors
- Made BPF JIT disabling optional since it's not critical for privacy
- Added explanatory comments about kernel support variability
- Both runtime sysctl and persistent config now handle missing parameter
This allows deployments to succeed on systems without BPF JIT support
while still applying the setting where available.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* Fix AWS Lightsail deployment error by removing deprecated boto3 parameter
Remove the deprecated boto3 parameter from get_aws_connection_info() call
in the lightsail_region_facts module. This parameter has been non-functional
since amazon.aws collection 4.0.0 and was removed in recent versions bundled
with Ansible 11.x, causing deployment failures.
The function works correctly without this parameter as the module already
properly imports and validates boto3 availability.
Closes#14822🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* Update uv.lock to fix Docker build failure
The lockfile was out of sync after the Ansible 11.8.0 to 11.9.0 upgrade.
This regenerates the lockfile to include:
- ansible 11.9.0 (was 11.8.0)
- ansible-core 2.18.8 (was 2.18.7)
This fixes the Docker build CI failure where uv sync --locked was failing
due to lockfile mismatch.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* Fix Jinja spacing linter issues correctly
- Add spacing in lookup('env', 'VAR') calls
- Fix spacing around pipe operators within Jinja expressions only
- Preserve YAML block scalar syntax (prompt: |)
- Fix array indexing spacing within Jinja expressions
- All changes pass yamllint and ansible-lint tests
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* Add algo.egg-info to .gitignore
* Add unit test for AWS Lightsail boto3 parameter fix
- Tests that get_aws_connection_info() is called without boto3 parameter
- Verifies the module can be imported successfully
- Checks source code doesn't contain boto3=True
- Regression test specifically for issue #14822
- All 4 test cases pass
This ensures the fix remains in place and prevents regression.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* Fix Python linting issues in test file
- Sort imports according to ruff standards
- Remove trailing whitespace from blank lines
- Remove unnecessary 'r' mode argument from open()
- Add trailing newline at end of file
All tests still pass after linting fixes.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* feat: Add AWS credentials file support
- Automatically reads AWS credentials from ~/.aws/credentials
- Supports AWS_PROFILE and AWS_SHARED_CREDENTIALS_FILE environment variables
- Adds support for temporary credentials with session tokens
- Maintains backward compatibility with existing credential methods
- Follows standard AWS credential precedence order
Based on PR #14460 by @lefth with the following improvements:
- Fixed variable naming to match existing code (access_key vs aws_access_key)
- Added session token support for temporary credentials
- Integrated credential discovery directly into prompts.yml
- Added comprehensive tests
- Added documentation
Closes#14382
* fix ansible lint
---------
Co-authored-by: Jack Ivanov <17044561+jackivanov@users.noreply.github.com>
* Support for associating to existing AWS Elastic IP
Signed-off-by: Elliot Murphy <statik@users.noreply.github.com>
* Backport ec2_eip_facts module for EIP support
This means that EIP support no longer requires Ansible 2.6
The local fact module has been named ec2_elasticip_facts
to avoid conflict with the ec2_eip_facts module whenever
the Ansible 2.6 upgrade takes place.
Signed-off-by: Elliot Murphy <statik@users.noreply.github.com>
* Update from review feedback.
Signed-off-by: Elliot Murphy <statik@users.noreply.github.com>
* Move to the native module. Add additional condition for existing Elastic IP
* Refactoring, booleans declaration and update users fix
* Make server_name more FQDN compatible
* Rename variables
* Define the default value for store_cakey
* Skip a prompt about the SSH user if deploying to localhost
* Disable reboot for non-cloud deployments
* Enable EC2 volume encryption by default
* Add default server value (localhost) for the local installation
Delete empty files
* Add default region to aws_region_facts
* Update docs
* EC2 credentials fix
* Warnings fix
* Update deploy-from-ansible.md
* Fix a typo
* Remove lightsail from the docs
* Disable EC2 encryption by default
* rename droplet to server
* Disable dependencies
* Disable tls_cipher_suite
* Convert wifi-exclude to a string. Update-users fix
* SSH access congrats fix
* 16.04 > 18.04
* Dont ask for the credentials if specified in the environment vars
* GCE server name fix
